Create Interactive Tour

Windows Analysis Report HttpToUsbBridge.exe

Overview

General Information

Sample Name:	HttpToUsbBridge.exe
Analysis ID:	469620
MD5:	d6a42f123db5c2b8ea1953eb96081170
SHA1:	a829727881d0f2f93efb4c93fb62738f807ff70e
SHA256:	8342f66eca7a1cd23723d964b34f4bb96be5415196cc87b89848cad77da27278
Infos:
Most interesting Screenshot:

Detection

Score:	8
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Creates a DirectInput object (often for capturing keystrokes)

Uses 32bit PE files

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

Found large amount of non-executed APIs

PE file contains executable resources (Code or Archives)

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

HttpToUsbBridge.exe (PID: 6440 cmdline: 'C:\Users\user\Desktop\HttpToUsbBridge.exe' MD5: D6A42F123DB5C2B8EA1953EB96081170)

conhost.exe (PID: 6448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

• Compliance
• Spreading
• Networking
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• System Summary
• Data Obfuscation
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: HttpToUsbBridge.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: HttpToUsbBridge.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Jenkins\workspace\Release\HttpToUsbBridge\HttpToUsbBridge\Release\HttpToUsbBridge.pdbn source: HttpToUsbBridge.exe
Source:	Binary string: C:\Jenkins\workspace\Release\HttpToUsbBridge\HttpToUsbBridge\Release\HttpToUsbBridge.pdb source: HttpToUsbBridge.exe

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe

Code function: 0_2_00E26780 FindFirstFileA,FindNextFileA,FindClose,

0_2_00E26780

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe

Code function: 0_2_00E25900 GetCurrentThreadId,select,GetCurrentThreadId,GetCurrentThreadId,recv,GetCurrentThreadId,GetCurrentThreadId,

0_2_00E25900

Source: HttpToUsbBridge.exe, 00000000.00000002.475703872.0000000000C6A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: HttpToUsbBridge.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E1B1B0	0_2_00E1B1B0
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E35101	0_2_00E35101
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E14380	0_2_00E14380
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E27340	0_2_00E27340
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E5A4A5	0_2_00E5A4A5
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E3055D	0_2_00E3055D
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E24700	0_2_00E24700
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E47A1D	0_2_00E47A1D
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E1ABA0	0_2_00E1ABA0
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E5CB4C	0_2_00E5CB4C
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E5CC70	0_2_00E5CC70
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E4ADA0	0_2_00E4ADA0
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E2FD77	0_2_00E2FD77
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E43D7E	0_2_00E43D7E
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E51D2F	0_2_00E51D2F
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E44D30	0_2_00E44D30
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E32D01	0_2_00E32D01

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: String function: 00E14C40 appears 37 times
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: String function: 00E2C6ED appears 66 times
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: String function: 00E2CED0 appears 50 times

Source: HttpToUsbBridge.exe

Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79

Source: HttpToUsbBridge.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\HttpToUsbBridge.exe 'C:\Users\user\Desktop\HttpToUsbBridge.exe'
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\HttpToUsbBridge
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6448:120:WilError_01

Source: classification engine

Classification label: clean8.winEXE@2/0@0/0

Source: HttpToUsbBridge.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: HttpToUsbBridge.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: HttpToUsbBridge.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: HttpToUsbBridge.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: HttpToUsbBridge.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: HttpToUsbBridge.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: HttpToUsbBridge.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: HttpToUsbBridge.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Jenkins\workspace\Release\HttpToUsbBridge\HttpToUsbBridge\Release\HttpToUsbBridge.pdbn source: HttpToUsbBridge.exe
Source:	Binary string: C:\Jenkins\workspace\Release\HttpToUsbBridge\HttpToUsbBridge\Release\HttpToUsbBridge.pdb source: HttpToUsbBridge.exe

Source: HttpToUsbBridge.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: HttpToUsbBridge.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: HttpToUsbBridge.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: HttpToUsbBridge.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: HttpToUsbBridge.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E2C6C7 push ecx; ret		0_2_00E2C6DA
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E2CF16 push ecx; ret		0_2_00E2CF29

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe

Code function: 0_2_00E3B3A0 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00E3B3A0

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-32120

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe

API coverage: 7.9 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe

Code function: 0_2_00E26780 FindFirstFileA,FindNextFileA,FindClose,

0_2_00E26780

Source: HttpToUsbBridge.exe, 00000000.00000002.475703872.0000000000C6A000.00000004.00000020.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe

Code function: 0_2_00E493BE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00E493BE

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E54396 mov eax, dword ptr fs:[00000030h]	0_2_00E54396
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E54350 mov eax, dword ptr fs:[00000030h]	0_2_00E54350
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E4BE9F mov eax, dword ptr fs:[00000030h]	0_2_00E4BE9F

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe

Code function: 0_2_00E3B3A0 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00E3B3A0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E493BE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E493BE
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E2C918 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00E2C918
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E2CD0F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E2CD0F

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: GetLocaleInfoW,	0_2_00E5104D
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00E592BC
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00E59497
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: EnumSystemLocalesW,	0_2_00E50AF1
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_00E58B28
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: EnumSystemLocalesW,	0_2_00E58DCE
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: EnumSystemLocalesW,	0_2_00E58EB4
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: EnumSystemLocalesW,	0_2_00E58E19

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe

Code function: 0_2_00E2CB68 cpuid

0_2_00E2CB68

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe

Code function: 0_2_00E32A3C GetVersionExW,Concurrency::details::platform::InitializeSystemFunctionPointers,Concurrency::details::WinRT::Initialize,__CxxThrowException@8,

0_2_00E32A3C

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe

Code function: 0_2_00E2B74B GetSystemTimeAsFileTime,

0_2_00E2B74B

Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E25450 GetCurrentThreadId,htons,htonl,bind,GetCurrentThreadId,	0_2_00E25450
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E255E0 GetCurrentThreadId,listen,GetCurrentThreadId,	0_2_00E255E0
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E3E00E Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,	0_2_00E3E00E
Source: C:\Users\user\Desktop\HttpToUsbBridge.exe	Code function: 0_2_00E3D338 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	0_2_00E3D338

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API2	Path Interception	Process Injection1	Virtualization/Sandbox Evasion1	Input Capture1	System Time Discovery1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Security Software Discovery11	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Deobfuscate/Decode Files or Information1	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	File and Directory Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	System Information Discovery23	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
HttpToUsbBridge.exe	3%	Virustotal	Browse
HttpToUsbBridge.exe	0%	Metadefender	Browse
HttpToUsbBridge.exe	0%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	469620
Start date:	23.08.2021
Start time:	02:33:02
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	HttpToUsbBridge.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean8.winEXE@2/0@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 5.9% (good quality ratio 5.8%) Quality average: 69.4% Quality standard deviation: 21.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, UpdateNotificationMgr.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.5482422873366435
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	HttpToUsbBridge.exe
File size:	463360
MD5:	d6a42f123db5c2b8ea1953eb96081170
SHA1:	a829727881d0f2f93efb4c93fb62738f807ff70e
SHA256:	8342f66eca7a1cd23723d964b34f4bb96be5415196cc87b89848cad77da27278
SHA512:	6f62d259d56f1ca6a90cfdc0ffa1dcfc89e30ccbf6bb8ede7d21f5759204e46a792dc6e17cefefb6303125be0cc242785eddf4dd86b113a8b537a27ecdae8b4f
SSDEEP:	12288:uSeAZFMhOmrGhgwxgBPwSkS+pJI3fbX6lD+75z:uSlAOmqh/gBepJIb6x+7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$...`..K`..K`..K...Jq..K...J...K...Jw..K2..Ju..K2..J...K2..JD..K...Je..K`..K...K...Jo..K..\|Ka..K`..Ka..K...Ja..KRich`..K.......

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x41c6bd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5F102D71 [Thu Jul 16 10:35:29 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	7d45f0949fd45c2e495eb7d278887d51

Entrypoint Preview

Instruction
call 00007F8DE4D80EEBh
jmp 00007F8DE4D804A9h
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F8DE4D7FFB6h
jmp 00007F8DE4D80610h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0046B068h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0046B068h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0046B068h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x69f3c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6f000	0x360	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x70000	0x4a7c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x62bd0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x62c40	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x53000	0x210	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x517d0	0x51800	False	0.551434288727	data	6.62657610164	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x53000	0x17a54	0x17c00	False	0.434333881579	data	5.14401908293	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x6b000	0x3aec	0x2a00	False	0.196707589286	DOS executable (block device driverpyright)	4.23167531562	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x6f000	0x360	0x400	False	0.447265625	data	3.94230190228	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x70000	0x4a7c	0x4c00	False	0.693667763158	data	6.5567636479	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x6f0a0	0x140	MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79	Japanese	Japan
RT_MANIFEST	0x6f1e0	0x17d	XML 1.0 document text	English	United States

Imports

DLL

Import

KERNEL32.dll

CreateMutexA, ReleaseMutex, GetLastError, CloseHandle, FindFirstFileA, FindNextFileA, FindClose, LoadLibraryA, GetProcAddress, FreeLibrary, SetEndOfFile, WriteConsoleW, HeapSize, CreateFileW, SetStdHandle, GetProcessHeap, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, DeleteCriticalSection, GetCurrentThreadId, DuplicateHandle, WaitForSingleObjectEx, Sleep, GetCurrentProcess, SwitchToThread, GetCurrentThread, QueryPerformanceCounter, SetLastError, InitializeCriticalSectionAndSpinCount, CreateEventW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, GetModuleHandleW, EncodePointer, DecodePointer, MultiByteToWideChar, GetCPInfo, CompareStringW, LCMapStringW, GetLocaleInfoW, GetStringTypeW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, GetCurrentProcessId, InitializeSListHead, CreateTimerQueue, SetEvent, SignalObjectAndWait, CreateThread, SetThreadPriority, GetThreadPriority, GetLogicalProcessorInformation, CreateTimerQueueTimer, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, GetProcessAffinityMask, SetThreadAffinityMask, RegisterWaitForSingleObject, UnregisterWait, GetThreadTimes, FreeLibraryAndExitThread, GetModuleFileNameW, GetModuleHandleA, LoadLibraryExW, GetVersionExW, VirtualAlloc, VirtualProtect, VirtualFree, ReleaseSemaphore, InterlockedPopEntrySList, InterlockedPushEntrySList, InterlockedFlushSList, QueryDepthSList, UnregisterWaitEx, LoadLibraryW, RtlUnwind, RaiseException, ExitThread, GetModuleHandleExW, ExitProcess, GetStdHandle, WriteFile, GetCommandLineA, GetCommandLineW, GetFileSizeEx, SetFilePointerEx, GetFileType, HeapAlloc, FlushFileBuffers, GetConsoleCP, GetConsoleMode, HeapFree, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, ReadFile, ReadConsoleW, HeapReAlloc

WS2_32.dll

accept, bind, closesocket, select, listen, WSACleanup, send, socket, recv, htonl, htons, setsockopt, WSAStartup

Version Infos

Description	Data
FileVersion	1.0.9.1
ProductVersion	1.0.9.1
Translation	0x0411 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
Japanese	Japan
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

• HttpToUsbBridge.exe
• conhost.exe

Click to jump to process

Memory Usage

• HttpToUsbBridge.exe
• conhost.exe

Click to jump to process

High Level Behavior Distribution

• File
• Network

Click to dive into process behavior distribution

Behavior

• HttpToUsbBridge.exe
• conhost.exe

Click to jump to process

System Behavior

Analysis Process: HttpToUsbBridge.exe PID: 6440 Parent PID: 1124

Function Logs

General

Start time:	02:33:52
Start date:	23/08/2021
Path:	C:\Users\user\Desktop\HttpToUsbBridge.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\HttpToUsbBridge.exe'
Imagebase:	0xe10000
File size:	463360 bytes
MD5 hash:	D6A42F123DB5C2B8EA1953EB96081170
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

File Activities

Device IO

Show Windows behavior

Section Activities

Sections loaded by Windows

Show Windows behavior

Registry Activities

Show Windows behavior

Mutex Activities

Memory Activities

Memory Usage Statistics

Show Windows behavior

System Activities

Show Windows behavior

Network Activities

Socket bound

Chronological Activities

Analysis Process: conhost.exe PID: 6448 Parent PID: 6440

Function Logs

General

Start time:	02:33:53
Start date:	23/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

File Activities

Volume Information Queried

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

Show Windows behavior

Mutex Activities

Mutex Created

Show Windows behavior

Process Activities

Show Windows behavior

Thread Activities

Thread Created

Thread Delayed

Thread Information Set

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

System Activities

Show Windows behavior

Timing Activities

Show Windows behavior

Windows UI Activities

Window Created

Window UI Enumerated

Message Posted to Windows UI

Window UIs Event Hook Set

Show Windows behavior

LPC Port Activities

Chronological Activities

Disassembly

Code Analysis

Analysis Process: HttpToUsbBridge.exe PID: 6440 Parent PID: 1124 HttpToUsbBridge.exeCOMMON

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.5%
Total number of Nodes:	722
Total number of Limit Nodes:	47

Executed Functions

Function 00E25450, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 107
threadnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E00E25450(void* __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				short _v32;
				short _v34;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				void* __ebp;
				signed int _t28;
				signed int _t29;
				char* _t53;
				char* _t56;
				char* _t57;
				signed int _t71;
				signed int _t73;
				void* _t74;
				char* _t76;
				void* _t77;
				char* _t78;

				_t69 = __edi;
				_t66 = __edx;
				_t51 = __ebx;
				_push(0xffffffff);
				_push(0xe60c58);
				_push( *[fs:0x0]);
				_t28 =  *0xe7b068; // 0x1b9618b6
				_t29 = _t28 ^ _t73;
				_v20 = _t29;
				_push(_t29);
				 *[fs:0x0] =  &_v16;
				_t71 = __ecx;
				E00E20EA0(__ebx, __ecx, __edx, __edi);
				_t76 = _t74 - 8;
				_t53 = _t76;
				 *((intOrPtr*)(_t53 + 0x10)) = 0;
				 *((intOrPtr*)(_t53 + 0x14)) = 0xf;
				 *_t53 = 0;
				E00E14C40(__ebx, _t53, __edx, "Socket::BindSocket", 0x12);
				_push(GetCurrentThreadId());
				E00E12260(__ebx, 0x84, _t66, __edi);
				_t77 = _t76 + 0x1c;
				_t55 = _t71;
				_v40 = 0;
				if( *((intOrPtr*)( *((intOrPtr*)( *_t71 + 0xc))))() != 0 &&  *((intOrPtr*)(_t71 + 8)) != 0xffffffff) {
					asm("xorps xmm0, xmm0");
					asm("movups [ebp-0x20], xmm0");
					_v36 = 2;
					__imp__#9(_a4);
					_v34 = 2;
					__imp__#8(0x7f000001);
					_v32 = 2;
					__imp__#2( *((intOrPtr*)(_t71 + 8)),  &_v36, 0x10); // executed
					_t66 = 1;
					_t55 =  ==  ? 1 : _v40 & 0x000000ff;
					_v40 =  ==  ? 1 : _v40 & 0x000000ff;
				}
				E00E20EA0(_t51, _t55, _t66, _t69);
				_t78 = _t77 - 0x18;
				_t56 = _t78;
				_v44 = _t78;
				 *((intOrPtr*)(_t56 + 0x10)) = 0;
				 *((intOrPtr*)(_t56 + 0x14)) = 0xf;
				 *_t56 = 0;
				E00E14C40(_t51, _t56, _t66, "-Result: ", 9);
				_v8 = 0;
				_t57 = _t78 - 0x18;
				 *((intOrPtr*)(_t57 + 0x10)) = 0;
				 *((intOrPtr*)(_t57 + 0x14)) = 0xf;
				 *_t57 = 0;
				E00E14C40(_t51, _t57, _t66, "Socket::BindSocket", 0x12);
				_push(GetCurrentThreadId());
				_v8 = 0xffffffff;
				E00E12110(_t51, 0x9a, _t66, _t69);
				E00E20EA0(_t51, 0x9a, _t66, _t69);
				if( *0xe7ea10 != 0) {
					_t68 =  ==  ? "FALSE" : "TRUE";
					E00E167A0(_t51,  ==  ? "FALSE" : "TRUE", _t69, _v40, E00E164F0(0xe7d8f8,  ==  ? "FALSE" : "TRUE"));
				}
				 *[fs:0x0] = _v16;
				return E00E2C067(_v20 ^ _t73);
			}

0x00e25450
0x00e25450
0x00e25450
0x00e25453
0x00e25455
0x00e25460
0x00e25464
0x00e25469
0x00e2546b
0x00e2546f
0x00e25473
0x00e25479
0x00e2547b
0x00e25480
0x00e25483
0x00e25487
0x00e2548e
0x00e2549a
0x00e2549d
0x00e254a7
0x00e254ad
0x00e254b4
0x00e254b7
0x00e254b9
0x00e254c4
0x00e254cf
0x00e254d7
0x00e254db
0x00e254df
0x00e254ea
0x00e254ee
0x00e254f4
0x00e25500
0x00e2550e
0x00e25513
0x00e25516
0x00e25516
0x00e25519
0x00e2551e
0x00e25521
0x00e25523
0x00e25528
0x00e2552f
0x00e2553b
0x00e2553e
0x00e25546
0x00e2554d
0x00e25551
0x00e25558
0x00e25564
0x00e25567
0x00e25571
0x00e25577
0x00e2557e
0x00e25586
0x00e25592
0x00e255a7
0x00e255b0
0x00e255b5
0x00e255be
0x00e255d4

APIs

Part of subcall function 00E20EA0: __Mtx_unlock.LIBCPMT ref: 00E20F3F

GetCurrentThreadId.KERNEL32 ref: 00E254A2
htons.WS2_32(000000FF), ref: 00E254DF
htonl.WS2_32(7F000001), ref: 00E254EE
bind.WS2_32(000000FF,?,00000010), ref: 00E25500
GetCurrentThreadId.KERNEL32 ref: 00E2556C

Strings

Socket::BindSocket, xrefs: 00E25495, 00E2555F
TRUE, xrefs: 00E2559D
-Result: , xrefs: 00E25536
FALSE, xrefs: 00E25598

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: CurrentThread$Mtx_unlockbindhtonlhtons
String ID: -Result: $FALSE$Socket::BindSocket$TRUE
API String ID: 2969249176-4022731657
Opcode ID: 2ee31a61595644e380688814fc18cfbcbc24ba1c504f45b11b671a9fd393dc13
Instruction ID: 79ba1e893bac3b735f6e0d52201c62259836be60c2c3ed6d957a3f9d5de8f167
Opcode Fuzzy Hash: 2ee31a61595644e380688814fc18cfbcbc24ba1c504f45b11b671a9fd393dc13
Instruction Fuzzy Hash: 214113B0A003489BEB14EFB4D8067AE7BF0AF45308F14565DE8557B3C2CBBA89448791

Uniqueness

Uniqueness Score: -1.00%

Function 00E255E0, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 92
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00E255E0(intOrPtr* __ecx, void* __edx, void* __edi, void* __eflags) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __ebp;
				signed int _t15;
				intOrPtr _t35;
				void* _t36;
				void* _t37;
				char* _t41;
				intOrPtr* _t43;
				char* _t44;
				char* _t45;
				void* _t54;
				intOrPtr* _t55;
				signed int _t57;
				void* _t58;
				char* _t60;
				void* _t61;
				char* _t62;

				_t53 = __edi;
				_t50 = __edx;
				_t15 =  *0xe7b068; // 0x1b9618b6
				 *[fs:0x0] =  &_v16;
				_t55 = __ecx;
				E00E20EA0(_t36, __ecx, __edx, __edi);
				_t60 = _t58 - 0xfffffffffffffff0;
				_t41 = _t60;
				 *((intOrPtr*)(_t41 + 0x10)) = 0;
				 *((intOrPtr*)(_t41 + 0x14)) = 0xf;
				 *_t41 = 0;
				E00E14C40(_t36, _t41, __edx, "Socket::ListenSocket", 0x14);
				E00E12260(_t36, 0xa2, _t50, __edi, GetCurrentThreadId(), _t15 ^ _t57, _t54, _t36,  *[fs:0x0], 0xe60bf8, 0xffffffff);
				_t61 = _t60 + 0x1c;
				_t43 = _t55;
				_t37 = 0;
				if( *((intOrPtr*)( *((intOrPtr*)( *_t55 + 0xc))))() != 0) {
					_t35 =  *((intOrPtr*)(_t55 + 8));
					if(_t35 != 0xffffffff) {
						__imp__#13(_t35, 5); // executed
						_t43 = 1;
						_t37 =  ==  ? 1 : 0;
					}
				}
				E00E20EA0(_t37, _t43, _t50, _t53);
				_t62 = _t61 - 0x18;
				_t44 = _t62;
				_v20 = _t62;
				 *((intOrPtr*)(_t44 + 0x10)) = 0;
				 *((intOrPtr*)(_t44 + 0x14)) = 0xf;
				 *_t44 = 0;
				E00E14C40(_t37, _t44, _t50, "-Result: ", 9);
				_v8 = 0;
				_t45 = _t62 - 0x18;
				 *((intOrPtr*)(_t45 + 0x10)) = 0;
				 *((intOrPtr*)(_t45 + 0x14)) = 0xf;
				 *_t45 = 0;
				E00E14C40(_t37, _t45, _t50, "Socket::ListenSocket", 0x14);
				_push(GetCurrentThreadId());
				_v8 = 0xffffffff;
				E00E12110(_t37, 0xb1, _t50, _t53);
				E00E20EA0(_t37, 0xb1, _t50, _t53);
				if( *0xe7ea10 != 0) {
					_t52 =  ==  ? "FALSE" : "TRUE";
					E00E167A0(_t37,  ==  ? "FALSE" : "TRUE", _t53, _t37, E00E164F0(0xe7d8f8,  ==  ? "FALSE" : "TRUE"));
				}
				 *[fs:0x0] = _v16;
				return _t37;
			}

0x00e255e0
0x00e255e0
0x00e255f6
0x00e25601
0x00e25607
0x00e25609
0x00e2560e
0x00e25611
0x00e25615
0x00e2561c
0x00e25628
0x00e2562b
0x00e2563b
0x00e25642
0x00e25645
0x00e25647
0x00e25650
0x00e25652
0x00e25658
0x00e2565d
0x00e25668
0x00e2566d
0x00e2566d
0x00e25658
0x00e25670
0x00e25675
0x00e25678
0x00e2567a
0x00e2567f
0x00e25686
0x00e25692
0x00e25695
0x00e2569d
0x00e256a4
0x00e256a8
0x00e256af
0x00e256bb
0x00e256be
0x00e256c8
0x00e256ce
0x00e256d5
0x00e256dd
0x00e256e9
0x00e256fc
0x00e25705
0x00e2570a
0x00e25712
0x00e2571f

APIs

Part of subcall function 00E20EA0: __Mtx_unlock.LIBCPMT ref: 00E20F3F

GetCurrentThreadId.KERNEL32 ref: 00E25630
listen.WS2_32(?,00000005), ref: 00E2565D
GetCurrentThreadId.KERNEL32 ref: 00E256C3

Strings

TRUE, xrefs: 00E256F2
-Result: , xrefs: 00E2568D
Socket::ListenSocket, xrefs: 00E25623, 00E256B6
FALSE, xrefs: 00E256EB

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: CurrentThread$Mtx_unlocklisten
String ID: -Result: $FALSE$Socket::ListenSocket$TRUE
API String ID: 2692890861-2512374212
Opcode ID: 7bddb6f0aadd48325a3aa51c775efad6159947b55486af9ac0643ab74b168158
Instruction ID: 87be472d787b403d8005fcd5016c97236c9b8d8b968d2623346df98a22f38fc1
Opcode Fuzzy Hash: 7bddb6f0aadd48325a3aa51c775efad6159947b55486af9ac0643ab74b168158
Instruction Fuzzy Hash: 78310AB16403409BEB14AF78DC0779A37E4DB01318F54556DE914BB3C3D7BA894587E2

Uniqueness

Uniqueness Score: -1.00%

Function 00E1EDB0, Relevance: 31.8, APIs: 1, Strings: 17, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E00E1EDB0(void* __ebx, signed int __ecx, signed int _a8, signed int _a12, signed int _a16, signed int _a20, intOrPtr _a36, intOrPtr _a40) {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				char _v47;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v61;
				char _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				char _v88;
				signed int _v92;
				char _v95;
				signed int _v96;
				signed int _v100;
				char _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				void* _v117;
				char _v120;
				signed int* _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				char _v156;
				char _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				char _v180;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v216;
				char _v220;
				signed int _v232;
				char _v240;
				char _v244;
				char _v268;
				signed int _v272;
				signed int _v284;
				char _v292;
				signed int _v296;
				signed int _v388;
				signed int _v400;
				signed int _v404;
				signed int _v412;
				char _v452;
				intOrPtr* _v460;
				signed int _v472;
				char _v480;
				signed int _v484;
				signed int _v516;
				signed int _v628;
				char* _v632;
				char _v652;
				signed int _v656;
				char* _v732;
				signed int _v844;
				signed int _v856;
				char _v864;
				signed int _v868;
				signed int _v896;
				signed int _v912;
				char _v940;
				signed int __edi;
				signed int __esi;
				signed int __ebp;
				signed int _t800;
				signed int _t801;
				signed int _t805;
				intOrPtr _t806;
				signed int _t809;
				intOrPtr _t817;
				signed int _t823;
				signed int _t824;
				signed int _t828;
				signed int _t834;
				signed int _t838;
				signed int _t841;
				void* _t845;
				intOrPtr _t846;
				signed int _t851;
				char* _t854;
				void* _t863;
				signed int _t864;
				signed int _t870;
				signed int _t871;
				void* _t878;
				signed int _t883;
				signed int _t894;
				signed int _t896;
				signed int _t899;
				signed int _t904;
				signed int _t905;
				signed int _t909;
				signed int _t913;
				signed int _t919;
				signed int _t920;
				signed int _t922;
				signed int _t926;
				signed int _t940;
				signed int _t943;
				signed int _t950;
				intOrPtr* _t955;
				signed int _t957;
				signed int _t960;
				signed int _t961;
				signed int _t966;
				void* _t979;
				signed int _t980;
				signed int _t981;
				signed int _t982;
				signed int _t984;
				signed int _t985;
				signed int _t988;
				void* _t1002;
				void* _t1012;
				void* _t1019;
				signed int _t1024;
				signed int _t1026;
				signed int _t1028;
				void* _t1039;
				signed int _t1040;
				signed int _t1043;
				signed int _t1051;
				signed int _t1053;
				signed int _t1064;
				signed int _t1066;
				intOrPtr* _t1068;
				intOrPtr* _t1070;
				signed int _t1073;
				signed int _t1082;
				intOrPtr* _t1084;
				signed int _t1087;
				signed int _t1088;
				signed int _t1101;
				signed int _t1105;
				signed int _t1114;
				intOrPtr* _t1119;
				signed int _t1130;
				signed int _t1131;
				signed int _t1132;
				signed int _t1148;
				intOrPtr* _t1154;
				signed int _t1167;
				signed int _t1171;
				signed int _t1175;
				intOrPtr _t1186;
				signed int _t1192;
				signed int _t1193;
				signed int _t1202;
				intOrPtr _t1204;
				signed int _t1209;
				signed int _t1213;
				signed int _t1226;
				signed int* _t1228;
				signed int _t1229;
				void* _t1230;
				void* _t1231;
				signed int _t1232;
				signed int* _t1233;
				signed int _t1239;
				intOrPtr _t1260;
				signed int _t1264;
				intOrPtr* _t1268;
				intOrPtr _t1269;
				signed int _t1274;
				intOrPtr* _t1278;
				intOrPtr* _t1279;
				intOrPtr* _t1291;
				signed int _t1293;
				signed int _t1296;
				signed int _t1298;
				intOrPtr* _t1300;
				signed int _t1304;
				signed int _t1305;
				intOrPtr* _t1306;
				intOrPtr* _t1308;
				signed int _t1316;
				intOrPtr* _t1319;
				signed int _t1320;
				signed int _t1321;
				intOrPtr* _t1322;
				char* _t1325;
				signed int _t1332;
				signed int _t1336;
				signed int _t1342;
				signed int _t1343;
				signed int _t1344;
				signed int _t1349;
				signed int _t1362;
				signed int* _t1369;
				signed int _t1379;
				char* _t1380;
				char* _t1384;
				char* _t1385;
				char* _t1388;
				char* _t1389;
				void* _t1393;
				signed int _t1394;
				intOrPtr* _t1395;
				signed int _t1413;
				signed int _t1419;
				signed int _t1420;
				signed int _t1425;
				signed int _t1434;
				void* _t1452;
				signed int _t1460;
				signed int _t1461;
				intOrPtr* _t1469;
				signed int* _t1476;
				void* _t1490;
				void* _t1491;
				intOrPtr* _t1492;
				signed int _t1498;
				intOrPtr* _t1500;
				signed int _t1505;
				intOrPtr _t1507;
				signed int _t1508;
				signed int _t1510;
				intOrPtr _t1511;
				signed int* _t1512;
				signed int _t1514;
				intOrPtr _t1515;
				void* _t1516;
				void* _t1517;
				void* _t1521;
				signed int _t1522;
				intOrPtr _t1523;
				void* _t1524;
				void* _t1525;
				signed int _t1527;
				signed int _t1530;
				void* _t1532;
				void* _t1533;
				void* _t1534;
				signed int _t1535;
				intOrPtr _t1536;
				intOrPtr* _t1540;
				intOrPtr* _t1541;
				signed int _t1543;
				signed int _t1545;
				signed int _t1548;
				signed int _t1550;
				char* _t1552;
				signed int _t1554;
				intOrPtr* _t1558;
				intOrPtr* _t1559;
				signed int _t1561;
				intOrPtr* _t1562;
				intOrPtr* _t1564;
				signed int _t1565;
				signed int _t1568;
				signed int _t1569;
				intOrPtr* _t1573;
				signed int _t1574;
				signed int _t1575;
				signed int* _t1577;
				signed int _t1578;
				intOrPtr* _t1580;
				signed int _t1581;
				signed int _t1582;
				void* _t1583;
				intOrPtr _t1584;
				intOrPtr* _t1585;
				intOrPtr _t1587;
				signed int _t1589;
				signed int _t1590;
				signed int _t1592;
				signed int _t1594;
				signed int _t1596;
				signed int _t1598;
				signed int _t1600;
				signed int _t1603;
				signed int _t1604;
				void* _t1605;
				signed int* _t1606;
				signed int _t1608;
				void* _t1610;
				signed int _t1612;
				signed int _t1613;
				signed int _t1617;
				signed int _t1618;
				signed int _t1623;
				signed int* _t1628;
				signed int _t1629;
				signed int _t1630;
				signed int _t1631;
				signed int _t1633;
				char* _t1634;
				char* _t1636;
				char* _t1637;
				char* _t1638;
				char* _t1639;
				void* _t1640;
				signed int _t1641;
				void* _t1642;
				void* _t1646;
				void* _t1647;
				signed int* _t1648;
				intOrPtr* _t1655;

				_t1589 = _t1603;
				_push(0xffffffff);
				_push(0xe603e0);
				_push( *[fs:0x0]);
				_t1604 = _t1603 - 0x10;
				_t800 =  *0xe7b068; // 0x1b9618b6
				_t801 = _t800 ^ _t1589;
				_v20 = _t801;
				_push(__ebx);
				_push(_t1540);
				_push(_t801);
				 *[fs:0x0] =  &_v16;
				_t1290 = __ecx;
				_v28 = __ecx;
				 *((intOrPtr*)( *((intOrPtr*)( *__ecx)) + 8))();
				_t1558 =  *((intOrPtr*)(__ecx + 8));
				_t805 =  *_t1558;
				_v24 = _t805;
				if(_t805 != _t1558) {
					goto L2;
					L4:
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t805 + 0x14)))) + 8))();
					_v8 = 0;
					_t1655 = _t1540;
					if(_t1655 != 0) {
						asm("lock xadd [edi+0x4], eax");
						if(_t1655 == 0) {
							 *((intOrPtr*)( *_t1540))();
							asm("lock xadd [edi+0x8], eax");
							if(_t1655 == 0) {
								 *((intOrPtr*)( *_t1540 + 4))();
							}
						}
					}
					_v8 = 0xffffffff;
					E00E21050( &_v24);
					_t805 = _v24;
					if(_t805 != _t1558) {
						L2:
						_t1540 =  *((intOrPtr*)(_t805 + 0x18));
						if(_t1540 != 0) {
							asm("lock inc dword [edi+0x4]");
							_t1540 =  *((intOrPtr*)(_t805 + 0x18));
						}
						goto L4;
					} else {
						_t1290 = _v28;
					}
				}
				_t806 =  *0xe7ea24; // 0x1
				if(_t806 == 0) {
					L25:
					_t1304 =  *(_t1290 + 0x88);
					if(_t1304 < 0x10) {
						L30:
						 *(_t1290 + 0x84) = 0;
						 *(_t1290 + 0x88) = 0xf;
						 *((char*)(_t1290 + 0x74)) = 0;
						_t1305 =  *(_t1290 + 0x70);
						if(_t1305 < 0x10) {
							L35:
							 *(_t1290 + 0x6c) = 0;
							 *(_t1290 + 0x70) = 0xf;
							 *((char*)(_t1290 + 0x5c)) = 0;
							E00E2ADBB(_t1290 + 0x28);
							_t1505 =  *((intOrPtr*)(_t1290 + 0x20));
							_t1306 = _t1290 + 0x20;
							_t1605 = _t1604 + 4;
							_v24 = _t1306;
							_v32 = _t1505;
							_v8 = 2;
							_t809 = _t1505;
							_t1540 =  *((intOrPtr*)(_t1505 + 4));
							_t1559 = _t1540;
							if( *((char*)(_t1540 + 0xd)) == 0) {
								_t1300 = _t1306;
								goto L37;
								L37:
								E00E213E0(_t1300,  *((intOrPtr*)(_t1559 + 8)));
								_t1559 =  *_t1559;
								L102();
								_push(0x44);
								E00E2C347(_t1540);
								_t1605 = _t1605 + 8;
								_t1540 = _t1559;
								if( *((char*)(_t1559 + 0xd)) == 0) {
									goto L37;
								} else {
									_t809 =  *_t1300;
									_t1290 = _v28;
									_t1306 = _v24;
									_t1505 = _v32;
								}
							}
							 *((intOrPtr*)(_t809 + 4)) = _t1505;
							_push(0x44);
							 *((intOrPtr*)( *_t1306)) = _t1505;
							 *((intOrPtr*)( *_t1306 + 8)) = _t1505;
							 *(_t1306 + 4) = 0;
							E00E2C347( *_t1306);
							_t1558 =  *((intOrPtr*)(_t1290 + 0x14));
							_t1604 = _t1605 + 8;
							_v8 = 3;
							E00E21500(_t1290 + 0x14, _t1505,  *((intOrPtr*)(_t1558 + 4)));
							 *((intOrPtr*)( *((intOrPtr*)(_t1290 + 0x14)) + 4)) = _t1558;
							 *((intOrPtr*)( *((intOrPtr*)(_t1290 + 0x14)))) = _t1558;
							_v8 = 0xffffffff;
							 *((intOrPtr*)( *((intOrPtr*)(_t1290 + 0x14)) + 8)) = _t1558;
							 *(_t1290 + 0x18) = 0;
							_t817 =  *((intOrPtr*)(_t1290 + 0x14));
							_t1308 =  *((intOrPtr*)(_t817 - 4));
							if(_t817 - _t1308 + 0xfffffffc > 0x1f) {
								goto L45;
							} else {
								_push(0x13bf);
								E00E2C347(_t1308);
								_t1584 =  *((intOrPtr*)(_t1290 + 8));
								_v8 = 4;
								E00E21450( *((intOrPtr*)(_t1584 + 4)));
								_push(0x1c);
								 *((intOrPtr*)( *((intOrPtr*)(_t1290 + 8)) + 4)) = _t1584;
								 *((intOrPtr*)( *((intOrPtr*)(_t1290 + 8)))) = _t1584;
								 *((intOrPtr*)( *((intOrPtr*)(_t1290 + 8)) + 8)) = _t1584;
								 *(_t1290 + 0xc) = 0;
								E00E2C347( *((intOrPtr*)(_t1290 + 8)));
								_v8 = 6;
								_t1585 =  *((intOrPtr*)(_t1290 + 4));
								if(_t1585 != 0) {
									_t1298 = _t1290 | 0xffffffff;
									asm("lock xadd [esi+0x4], eax");
									if(_t1298 == 0) {
										 *((intOrPtr*)( *_t1585))();
										asm("lock xadd [esi+0x8], ebx");
										if(_t1298 == 1) {
											 *((intOrPtr*)( *_t1585 + 4))();
										}
									}
								}
								 *[fs:0x0] = _v16;
								return E00E2C067(_v20 ^ _t1589);
							}
						} else {
							_t1260 =  *((intOrPtr*)(_t1290 + 0x5c));
							_t1490 = _t1305 + 1;
							if(_t1490 < 0x1000) {
								L34:
								_push(_t1490);
								E00E2C347(_t1260);
								_t1604 = _t1604 + 8;
								goto L35;
							} else {
								_t1505 =  *((intOrPtr*)(_t1260 - 4));
								_t1308 = _t1490 + 0x23;
								if(_t1260 - _t1505 + 0xfffffffc > 0x1f) {
									goto L45;
								} else {
									_t1260 = _t1505;
									goto L34;
								}
							}
						}
					} else {
						_t1264 =  *((intOrPtr*)(_t1290 + 0x74));
						_t1491 = _t1304 + 1;
						if(_t1491 < 0x1000) {
							L29:
							_push(_t1491);
							E00E2C347(_t1264);
							_t1604 = _t1604 + 8;
							goto L30;
						} else {
							_t1505 =  *((intOrPtr*)(_t1264 - 4));
							_t1308 = _t1491 + 0x23;
							if(_t1264 - _t1505 + 0xfffffffc > 0x1f) {
								L45:
								E00E4957C(_t1290, _t1308, _t1505, _t1540, __eflags);
								goto L46;
							} else {
								_t1264 = _t1505;
								goto L29;
							}
						}
					}
				} else {
					_t1558 =  *0xe7ea20; // 0x0
					goto L12;
					L15:
					_t1535 = _t1534 + _t1558;
					if(_t1268 == 0) {
						L19:
						_t1269 = 0;
						__eflags = 0;
					} else {
						_t1278 =  *_t1268;
						if(_t1278 == 0) {
							goto L19;
						} else {
							_t1279 =  *_t1278;
							if(_t1279 == 0) {
								goto L19;
							} else {
								_t1269 =  *_t1279;
							}
						}
					}
					_t1308 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1269 + 4)) + ( *((intOrPtr*)(_t1269 + 8)) - 0x00000001 & _t1535) * 4)) + 0x24));
					if(_t1308 == 0) {
						L46:
						E00E29FA8(__eflags);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_t1590 = _t1604;
						_t1606 = _t1604 - 0x90;
						_t823 =  *0xe7b068; // 0x1b9618b6
						_t824 = _t823 ^ _t1590;
						_v68 = _t824;
						 *[fs:0x0] =  &_v64;
						_t1541 = _t1308;
						_t828 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1541)) + 4))))(_t824, _t1540, _t1558,  *[fs:0x0], 0xe6043e, 0xffffffff, _t1589); // executed
						__eflags = _t828;
						if(_t828 == 0) {
							L99:
							 *((intOrPtr*)( *((intOrPtr*)( *_t1541)) + 0x34))();
							 *[fs:0x0] = _v20;
							__eflags = _v24 ^ _t1590;
							return E00E2C067(_v24 ^ _t1590);
						} else {
							_t834 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1541)) + 0x10))))(); // executed
							__eflags = _t834;
							if(_t834 == 0) {
								goto L99;
							} else {
								_t1316 = 0;
								__eflags = 0;
								while(1) {
									_t1506 =  *(_t1541 + 0x10);
									__eflags = _t1506;
									if(_t1506 != 0) {
										__eflags = _t1506 - 0xc350;
										if(_t1506 >= 0xc350) {
											_t1506 = _t1506 + 0xa;
											__eflags = _t1506;
											 *(_t1541 + 0x10) = _t1506;
										}
									} else {
										 *(_t1541 + 0x10) = 0xc350;
										_t1506 = 0xc350;
									}
									_t101 = _t1506 - 0xc350; // 0x0
									__eflags = _t101 - 0x3de;
									if(_t101 > 0x3de) {
										break;
									}
									_t1316 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1541)) + 0x18))))(_t1506);
									__eflags = _t1316;
									if(_t1316 == 0) {
										continue;
									} else {
										L58:
										_t838 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1541)) + 0x1c))))(); // executed
										__eflags = _t838;
										if(_t838 == 0) {
											goto L99;
										} else {
											while(1) {
												L60:
												_t841 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1541)) + 0x24))))(); // executed
												__eflags = _t841;
												if(_t841 == 0) {
													continue;
												}
												L61:
												asm("xorps xmm0, xmm0");
												asm("movups [ebp-0x24], xmm0");
												_push(0x7800);
												_v40 = 0;
												_v36 = 0;
												_v32 = 0;
												_t1561 = E00E495D8();
												_t1608 = _t1606 + 4;
												_v44 = _t1561;
												__eflags = _t1561;
												if(_t1561 != 0) {
													E00E43C10(_t1541, _t1561, 0, 0x7800);
													_t1606 = _t1608 + 0xc;
													_v36 = 0x7800;
													_v12 = 0;
													_v28 = 0;
													_v117 = 0;
													_t1192 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1541)) + 0x28))))();
													__eflags = _t1192;
													if(_t1192 <= 0) {
														_t1193 = _v117;
													} else {
														_t1506 =  &_v28;
														_t1193 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1541)) + 0x2c))))(_t1561, 0x7800,  &_v28);
													}
													_v100 = 0;
													_v96 = 0xf;
													_v116 = 0;
													_v76 = 0;
													_v72 = 0xf;
													_v92 = 0;
													_t1582 = 0;
													_v12 = 1;
													__eflags = _t1193;
													if(_t1193 == 0) {
														L75:
														_v52 = 0;
														_v48 = 0xf;
														_v68 = 0;
														_v12 = 3;
														_t1561 = _t1582;
														__eflags = _t1561;
														if(_t1561 == 0) {
															_v132 = 0;
															_v128 = 0xf;
															_v148 = 0;
															E00E14C40(_t1290,  &_v148, _t1506, "HTTP/1.1 400 BadRequest\r\nContent-Length: 0\r\nContent-Type: application/json\r\n\r\n", 0x4e);
															E00E160E0(_t1290,  &_v68,  &_v148);
															_t1527 = _v128;
															__eflags = _t1527 - 0x10;
															if(_t1527 < 0x10) {
																goto L89;
															} else {
																_t1461 = _v148;
																_t1533 = _t1527 + 1;
																_t1213 = _t1461;
																__eflags = _t1533 - 0x1000;
																if(_t1533 < 0x1000) {
																	L88:
																	_push(_t1533);
																	E00E2C347(_t1461);
																	_t1606 = _t1606 + 8;
																	goto L89;
																} else {
																	_t1459 =  *((intOrPtr*)(_t1461 - 4));
																	_t1506 = _t1533 + 0x23;
																	__eflags = _t1213 -  *((intOrPtr*)(_t1461 - 4)) + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L100;
																	} else {
																		goto L88;
																	}
																}
															}
														} else {
															_t1561 = _t1561 - 1;
															__eflags = _t1561;
															if(_t1561 == 0) {
																_push(0x46);
																_push("HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: application/json\r\n\r\n");
																goto L83;
															} else {
																_t1561 = _t1561 - 1;
																__eflags = _t1561;
																if(_t1561 == 0) {
																	_t1648 = _t1606 - 0x18;
																	_v152 = _t1648;
																	_v124 = _t1648;
																	E00E12D00(_t1506,  &_v92);
																	_t1606 = _t1648 - 0x18;
																	_v12 = 0x18;
																	_v124 = _t1606;
																	E00E12D00(_t1506,  &_v116);
																	_t1218 =  &_v148;
																	_v12 = 3;
																	_push( &_v148);
																	L126();
																} else {
																	_push(0x4e);
																	_push("HTTP/1.1 400 BadRequest\r\nContent-Length: 0\r\nContent-Type: application/json\r\n\r\n");
																	L83:
																	_v148 = 0;
																	_v128 = 0xf;
																	_v132 = 0;
																	E00E14C40(_t1290,  &_v148, _t1506);
																	_t1218 =  &_v148;
																}
															}
															E00E160E0(_t1290,  &_v68, _t1218);
															E00E12C70(_t1290,  &_v148, _t1541, _t1561);
															L89:
															__eflags = _v48 - 0x10;
															_t1529 =  >=  ? _v68 :  &_v68;
															 *((intOrPtr*)( *((intOrPtr*)( *_t1541)) + 0x30))(_v52);
															 *((intOrPtr*)( *((intOrPtr*)( *_t1541)) + 0x38))();
															E00E12C70(_t1290,  &_v68, _t1541, _t1561,  >=  ? _v68 :  &_v68);
															_v12 = 0;
															_t1530 = _v72;
															__eflags = _t1530 - 0x10;
															if(_t1530 < 0x10) {
																L93:
																_t1506 = _v96;
																__eflags = _t1506 - 0x10;
																if(_t1506 < 0x10) {
																	L97:
																	_v12 = 0xffffffff;
																	_t1202 = _v44;
																	__eflags = _t1202;
																	if(_t1202 != 0) {
																		E00E48B06(_t1202);
																		_t1606 = _t1606 + 4;
																	}
																	do {
																		goto L60;
																	} while (_t841 == 0);
																	goto L61;
																} else {
																	_t1459 = _v116;
																	_t1506 = _t1506 + 1;
																	_t1204 = _t1459;
																	__eflags = _t1506 - 0x1000;
																	if(_t1506 < 0x1000) {
																		L96:
																		_push(_t1506);
																		E00E2C347(_t1459);
																		_t1606 = _t1606 + 8;
																		goto L97;
																	} else {
																		_t1459 =  *((intOrPtr*)(_t1459 - 4));
																		_t1506 = _t1506 + 0x23;
																		__eflags = _t1204 - _t1459 + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L100;
																		} else {
																			goto L96;
																		}
																	}
																}
															} else {
																_t1460 = _v92;
																_t1532 = _t1530 + 1;
																_t1209 = _t1460;
																__eflags = _t1532 - 0x1000;
																if(_t1532 < 0x1000) {
																	L92:
																	_push(_t1532);
																	E00E2C347(_t1460);
																	_t1606 = _t1606 + 8;
																	goto L93;
																} else {
																	_t1459 =  *((intOrPtr*)(_t1460 - 4));
																	_t1506 = _t1532 + 0x23;
																	__eflags = _t1209 -  *((intOrPtr*)(_t1460 - 4)) + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L100;
																	} else {
																		goto L92;
																	}
																}
															}
														}
													} else {
														E00E17D10(_t1290,  &_v44, _t1541, _v28);
														_t1531 = _v44;
														_t1469 = _v44;
														_v132 = 0;
														_v128 = 0xf;
														_v148 = 0;
														_t1583 = _t1469 + 1;
														do {
															_t1226 =  *_t1469;
															_t1469 = _t1469 + 1;
															__eflags = _t1226;
														} while (_t1226 != 0);
														E00E14C40(_t1290,  &_v148, _t1531, _t1531, _t1469 - _t1583);
														_v12 = 2;
														_t1228 = _v148;
														_t1582 = 0;
														__eflags = _v128 - 0x10;
														_t1506 = _v132;
														_t1473 =  >=  ? _t1228 :  &_v148;
														_v124 = _t1228;
														_t1229 = E00E190E0( >=  ? _t1228 :  &_v148, _v132, 0, "\r\n", 2);
														_t1606 = _t1606 + 0xc;
														_v152 = _t1229;
														_push(_t1229);
														_push("CheckConnection");
														_t1230 = E00E23240( &_v148);
														__eflags = _t1230 - 0xffffffff;
														if(_t1230 == 0xffffffff) {
															_push(_v152);
															_push("GetDeviceUrl");
															_t1231 = E00E23240( &_v148);
															__eflags = _t1231 - 0xffffffff;
															if(_t1231 == 0xffffffff) {
																goto L70;
															} else {
																_t1606 = _t1606 - 0x18;
																E00E12D00(_t1506,  &_v148);
																_t1239 = E00E23040( &_v116);
																_t1476 = _v148;
																__eflags = _t1239;
																_t1582 =  !=  ? 2 : 0;
																goto L71;
															}
															goto L370;
														} else {
															_t1582 = 1;
															L70:
															_t1476 = _v124;
														}
														L71:
														_v12 = 1;
														_t1232 = _v128;
														__eflags = _t1232 - 0x10;
														if(_t1232 < 0x10) {
															goto L75;
														} else {
															_t1506 = _t1232 + 1;
															_t1233 = _t1476;
															__eflags = _t1506 - 0x1000;
															if(_t1506 < 0x1000) {
																L74:
																_push(_t1506);
																E00E2C347(_t1476);
																_t1606 = _t1606 + 8;
																goto L75;
															} else {
																_t1459 =  *((intOrPtr*)(_t1476 - 4));
																_t1506 = _t1506 + 0x23;
																__eflags = _t1233 -  *((intOrPtr*)(_t1476 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	L100:
																	E00E4957C(_t1290, _t1459, _t1506, _t1541, __eflags);
																} else {
																	goto L74;
																}
															}
														}
													}
												}
												_t1319 =  &_v164;
												E00E11560(_t1319, _t1561, "malloc failed.");
												_t845 = E00E4309B( &_v164, 0xe79e34);
												asm("int3");
												asm("int3");
												_push(_t1561);
												_t1562 = _t1319;
												_t1320 =  *(_t1562 + 0x2c);
												__eflags = _t1320 - 0x10;
												if(_t1320 < 0x10) {
													L107:
													 *(_t1562 + 0x28) = 0;
													 *(_t1562 + 0x2c) = 0xf;
													 *((char*)(_t1562 + 0x18)) = 0;
													_t1321 =  *(_t1562 + 0x14);
													__eflags = _t1321 - 0x10;
													if(_t1321 < 0x10) {
														L112:
														 *(_t1562 + 0x10) = 0;
														 *(_t1562 + 0x14) = 0xf;
														 *_t1562 = 0;
														return _t845;
													} else {
														_t846 =  *_t1562;
														_t1322 = _t1321 + 1;
														__eflags = _t1322 - 0x1000;
														if(_t1322 < 0x1000) {
															L111:
															_push(_t1322);
															_t845 = E00E2C347(_t846);
															goto L112;
														} else {
															_t1507 =  *((intOrPtr*)(_t846 - 4));
															_t1322 = _t1322 + 0x23;
															__eflags = _t846 - _t1507 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L113;
															} else {
																_t846 = _t1507;
																goto L111;
															}
														}
													}
												} else {
													_t1186 =  *((intOrPtr*)(_t1562 + 0x18));
													_t1452 = _t1320 + 1;
													__eflags = _t1452 - 0x1000;
													if(_t1452 < 0x1000) {
														L106:
														_push(_t1452);
														_t845 = E00E2C347(_t1186);
														_t1608 = _t1608 + 8;
														goto L107;
													} else {
														_t1507 =  *((intOrPtr*)(_t1186 - 4));
														_t1322 = _t1452 + 0x23;
														__eflags = _t1186 - _t1507 + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															L113:
															E00E4957C(_t1290, _t1322, _t1507, _t1541, __eflags);
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															_push(_t1590);
															_t1592 = _t1608;
															_push(0xffffffff);
															_push(0xe6049f);
															_push( *[fs:0x0]);
															_t1610 = _t1608 - 0x18;
															_push(_t1290);
															_push(_t1562);
															_push(_t1541);
															_t851 =  *0xe7b068; // 0x1b9618b6
															_push(_t851 ^ _t1592);
															 *[fs:0x0] =  &_v240;
															_t1291 = _t1322;
															_t1323 = _t1291 + 0x74;
															_v232 = 1;
															_t854 =  &_v220;
															__eflags = _t1291 + 0x74 - _t854;
															if(__eflags != 0) {
																__eflags = _a16 - 0x10;
																_t1184 =  >=  ? _v4 : _t854;
																__eflags =  >=  ? _v4 : _t854;
																E00E14C40(_t1291, _t1323, _t1507,  >=  ? _v4 : _t854, _a12);
															}
															_push(0x4c);
															_t1543 = E00E2C07D(_t1507, __eflags);
															_v28 = _t1543;
															_v16 = 2;
															 *(_t1543 + 4) = 1;
															 *(_t1543 + 8) = 1;
															_t222 = _t1543 + 0xc; // 0xc
															_t1564 = _t222;
															 *_t1543 = 0xe72794;
															E00E22230(_t1291,  &_v48, _t1543, _t1564,  &_a20);
															_t1612 = _t1610 + 4 - 0x18;
															_v16 = 3;
															_t1325 = _t1612;
															_v32 = _t1612;
															 *(_t1325 + 0x10) = 0;
															 *(_t1325 + 0x14) = 0xf;
															 *_t1325 = 0;
															E00E14C40(_t1291, _t1325, _t1507, 0xe71f6b, 0);
															_t1613 = _t1612 - 0xc;
															_v16 = 4;
															E00E22230(_t1291, _t1613, _t1543, _t1564,  &_v48);
															_v16 = 3;
															E00E260A0(_t1291, _t1564, _t1507, _t1543, __eflags);
															 *_t1564 = 0xe72a94;
															E00E210B0(_t1291,  &_v48, _t1543, _t1564, 0);
															 *_t1291 = _t1564;
															_t1565 =  *(_t1291 + 4);
															 *(_t1291 + 4) = _t1543;
															_v16 = 5;
															__eflags = _t1565;
															if(_t1565 != 0) {
																_t1543 = _t1543 | 0xffffffff;
																__eflags = _t1543;
																asm("lock xadd [esi+0x4], eax");
																if(_t1543 == 0) {
																	 *((intOrPtr*)( *_t1565))();
																	asm("lock xadd [esi+0x8], edi");
																	_t1543 = _t1543 - 1;
																	__eflags = _t1543;
																	if(_t1543 == 0) {
																		 *((intOrPtr*)( *_t1565 + 4))();
																	}
																}
															}
															_t1508 = _a16;
															__eflags = _t1508 - 0x10;
															if(_t1508 < 0x10) {
																L124:
																_a12 = 0;
																_a16 = 0xf;
																_v4 = 0;
																_t863 = E00E210B0(_t1291,  &_a20, _t1543, _t1565);
																 *[fs:0x0] = _v24;
																return _t863;
															} else {
																_t1332 = _v4;
																_t1509 = _t1508 + 1;
																_t864 = _t1332;
																__eflags = _t1509 - 0x1000;
																if(_t1509 < 0x1000) {
																	L123:
																	_push(_t1509);
																	E00E2C347(_t1332);
																	goto L124;
																} else {
																	_t237 = _t1332 - 4; // 0xe5f2ac
																	_t1332 =  *_t237;
																	_t1509 = _t1509 + 0x23;
																	__eflags = _t864 - _t1332 + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		E00E4957C(_t1291, _t1332, _t1509, _t1543, __eflags);
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		_push(_t1592);
																		_t1594 = _t1613;
																		_push(0xffffffff);
																		_push(0xe6055a);
																		_push( *[fs:0x0]);
																		_t870 =  *0xe7b068; // 0x1b9618b6
																		_t871 = _t870 ^ _t1594;
																		_v296 = _t871;
																		_push(_t1291);
																		_push(_t1565);
																		_push(_t1543);
																		_push(_t871);
																		 *[fs:0x0] =  &_v292;
																		_t1545 = _t1332;
																		_v404 = _t1545;
																		_t1293 = _v272;
																		_v400 = _t1293;
																		_v412 = _t1293;
																		_v284 = 1;
																		_push( *(_t1545 + 0x1c) & 0x000000ff);
																		_t1617 = _t1613 - 0x64;
																		_v412 = _t1617;
																		E00E12D00(_t1509,  &_v244);
																		_t1618 = _t1617 - 0x18;
																		_v284 = 2;
																		_v388 = _t1618;
																		E00E12D00(_t1509,  &_v268);
																		_v284 = 3;
																		_t878 = E00E20D50(_t1293, _t1618, _t1509);
																		_v284 = 1;
																		_t1336 = E00E27940(_t1293, _t878, _t1545, _t1565);
																		__eflags = _t1336;
																		if(_t1336 == 0) {
																			 *(_t1293 + 0x10) = 0;
																			 *(_t1293 + 0x14) = 0xf;
																			 *_t1293 = 0;
																			E00E14C40(_t1293, _t1293, _t1509, "HTTP/1.1 503 ServiceUnavailable\r\nContent-Length: 0\r\nContent-Type: application/json\r\n\r\n", 0x56);
																			goto L138;
																		} else {
																			__eflags =  *(_t1545 + 0x6c);
																			if( *(_t1545 + 0x6c) != 0) {
																				L130:
																				_t1395 = _t1545 + 0x58;
																				_v148 = _t1395;
																				 *_t1395 = 0;
																				_t1565 =  *(_t1545 + 0x20);
																				_v116 = 0;
																				_v144 = _t1545 + 0x20;
																				_v117 = 0;
																				_t1051 =  *_t1565;
																				_v36 = _t1051;
																				__eflags = _t1051 - _t1565;
																				if(_t1051 == _t1565) {
																					L147:
																					_v152 = _t1545 + 0x10;
																					_t1574 = _t1545 + 8;
																					_t1053 = _t1545 + 0x74;
																					_t1545 = _t1545 | 0xffffffff;
																					__eflags = _t1545;
																					_v36 = _t1053;
																					while(1) {
																						_t1641 = _t1618 - 0x18;
																						_v108 = _t1641;
																						_t1293 = _t1574;
																						E00E12D00(_t1509,  &_a20);
																						_t1642 = _t1641 - 0x18;
																						_v20 = 5;
																						E00E12D00(_t1509,  &_v4);
																						_v20 = 1;
																						_v116 = E00E243B0(_v152, __eflags);
																						__eflags =  *(_v36 + 0x10);
																						if(__eflags != 0) {
																							goto L154;
																						}
																						_push(0x1c);
																						_t1554 = E00E2C07D(_t1509, __eflags);
																						asm("xorps xmm0, xmm0");
																						_v128 = _t1554;
																						_t1580 = _t1554 + 0xc;
																						asm("movlpd [ebp-0x74], xmm0");
																						_t1618 = _t1642 + 4;
																						_v132 = _t1580;
																						 *(_t1554 + 4) = 1;
																						 *(_t1554 + 8) = 1;
																						 *_t1554 = 0xe72778;
																						 *_t1580 = 0xe729e8;
																						 *((char*)(_t1580 + 4)) = 0;
																						 *(_t1580 + 8) = 0xffffffff;
																						 *(_t1580 + 0xc) = 0xffffffff;
																						_v128 = _t1554;
																						_v20 = 6;
																						_t1154 = E00E20F70(_t1293,  &_v116);
																						_v132 = 0;
																						_v128 = 0;
																						 *_t1154 = _t1580;
																						_t1581 =  *(_t1154 + 4);
																						 *(_t1154 + 4) = _t1554;
																						_t1545 = _t1554 | 0xffffffff;
																						_v20 = 7;
																						__eflags = _t1581;
																						if(__eflags != 0) {
																							asm("lock xadd [esi+0x4], eax");
																							if(__eflags == 0) {
																								 *((intOrPtr*)( *_t1581))();
																								asm("lock xadd [esi+0x8], eax");
																								if(__eflags == 0) {
																									 *((intOrPtr*)( *_t1581 + 4))();
																								}
																							}
																						}
																						L162:
																						_v20 = 1;
																						_t1070 = E00E20F70(_t1293,  &_v116);
																						_t1574 = _t1293;
																						_t1073 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1070)) + 4))))();
																						__eflags = _t1073;
																						if(_t1073 == 0) {
																							L165:
																							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(E00E20F70(_t1293,  &_v116))))) + 0x34))();
																							continue;
																						} else {
																							_t1082 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(E00E20F70(_t1293,  &_v116))))) + 0x10))))();
																							__eflags = _t1082;
																							if(_t1082 == 0) {
																								goto L165;
																							} else {
																								_t1084 = E00E20F70(_t1293,  &_v116);
																								_t1087 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1084)) + 0x18))))(_v116);
																								__eflags = _t1087;
																								if(_t1087 != 0) {
																									asm("xorps xmm0, xmm0");
																									_t1512 = _v116;
																									asm("movlpd [ebp-0x60], xmm0");
																									_t1565 =  *(_v140 + 8);
																									_t1342 = _t1565;
																									_t1088 =  *(_t1342 + 4);
																									__eflags =  *((char*)(_t1088 + 0xd));
																									while( *((char*)(_t1088 + 0xd)) == 0) {
																										__eflags =  *((intOrPtr*)(_t1088 + 0x10)) - _t1512;
																										if( *((intOrPtr*)(_t1088 + 0x10)) >= _t1512) {
																											_t1342 = _t1088;
																											_t1088 =  *_t1088;
																										} else {
																											_t1088 =  *(_t1088 + 8);
																										}
																										__eflags =  *((char*)(_t1088 + 0xd));
																									}
																									__eflags = _t1342 - _t1565;
																									if(_t1342 == _t1565) {
																										goto L224;
																									} else {
																										__eflags = _t1512 -  *((intOrPtr*)(_t1342 + 0x10));
																										if(_t1512 <  *((intOrPtr*)(_t1342 + 0x10))) {
																											goto L224;
																										} else {
																											_t1293 =  *(_t1342 + 0x18);
																											__eflags = _t1293;
																											if(_t1293 != 0) {
																												asm("lock inc dword [ebx+0x4]");
																												_t1293 =  *(_t1342 + 0x18);
																											}
																											_t1413 =  *((intOrPtr*)(_t1342 + 0x14));
																											_v112 = _t1413;
																											_v108 = _t1293;
																											_v104 = _v140;
																											__eflags = _t1293;
																											if(_t1293 != 0) {
																												asm("lock inc dword [ebx+0x4]");
																											}
																											_v100 = _t1413;
																											_v96 = _t1293;
																											_v20 = 0xf;
																											E00E12D00(_t1512,  &_v4);
																											_v20 = 0x10;
																											E00E12D00(_t1512,  &_a20);
																											_v20 = 0x11;
																											E00E21A70(_t1293,  &_v44, _t1512, _t1545, _t1565, __eflags,  &_v104);
																											_v20 = 0x13;
																											L225();
																											__eflags = _v44;
																											if(_v44 == 0) {
																												 *_v148 = 1;
																												_t1565 = _v136;
																												_t1342 = _t1565;
																												 *(_t1565 + 0x10) = 0;
																												 *(_t1565 + 0x14) = 0xf;
																												 *_t1565 = 0;
																												E00E14C40(_t1293, _t1342, _t1512, "HTTP/1.1 600 ResetSession\r\nContent-Length: 0\r\nContent-Type: application/json\r\n\r\n", 0x50);
																												_v20 = 0xe;
																												__eflags = _v40;
																												if(__eflags != 0) {
																													goto L223;
																												} else {
																													_v20 = 0x23;
																													__eflags = _t1293;
																													if(__eflags != 0) {
																														asm("lock xadd [ecx+0x4], eax");
																														if(__eflags == 0) {
																															 *((intOrPtr*)( *_t1293))();
																															asm("lock xadd [ebx+0x8], edi");
																															_t1545 = _t1545 - 1;
																															__eflags = _t1545;
																															if(_t1545 == 0) {
																																 *((intOrPtr*)( *_t1293 + 4))();
																															}
																														}
																													}
																													goto L200;
																												}
																											} else {
																												_t1545 = _v140 + 0x28;
																												_v128 = _t1545;
																												_t1114 = E00E2AE38(_t1545);
																												_t1646 = _t1618 + 4;
																												__eflags = _t1114;
																												if(_t1114 != 0) {
																													E00E2AA76(_t1293, _t1512, _t1545, _t1114);
																													_t1646 = _t1646 + 4;
																												}
																												_v20 = 0x14;
																												E00E12D00(_t1512,  &_v4);
																												_v20 = 0x15;
																												E00E12D00(_t1512,  &_a20);
																												_v20 = 0x16;
																												_t1425 = _v116;
																												_t1512 =  *_v144;
																												_t1577 = _t1512;
																												_t1119 =  *((intOrPtr*)(_t1577 + 4));
																												__eflags =  *((char*)(_t1119 + 0xd));
																												while( *((char*)(_t1119 + 0xd)) == 0) {
																													__eflags =  *((intOrPtr*)(_t1119 + 0x10)) - _t1425;
																													if( *((intOrPtr*)(_t1119 + 0x10)) >= _t1425) {
																														_t1577 = _t1119;
																														_t1119 =  *_t1119;
																													} else {
																														_t1119 =  *((intOrPtr*)(_t1119 + 8));
																													}
																													__eflags =  *((char*)(_t1119 + 0xd));
																												}
																												__eflags = _t1577 - _t1512;
																												if(_t1577 == _t1512) {
																													L187:
																													_push(_t1425);
																													_v124 =  &_v116;
																													__eflags = E00E223B0(_v144, _t1425,  &_v124) + 0x10;
																													E00E223F0(_t1293, _v144, _t1545, _t1577,  &_v124, _t1577, E00E223B0(_v144, _t1425,  &_v124) + 0x10, _t1122);
																													_t1577 = _v124;
																												} else {
																													__eflags = _t1425 -  *((intOrPtr*)(_t1577 + 0x10));
																													if(_t1425 <  *((intOrPtr*)(_t1577 + 0x10))) {
																														goto L187;
																													}
																												}
																												E00E160E0(_t1293, _t1577 + 0x14,  &_v92);
																												E00E160E0(_t1293, _t1577 + 0x2c,  &_v68);
																												_t1342 =  &_v92;
																												_v20 = 0x14;
																												L102();
																												_t1130 = _v40;
																												__eflags = _t1130;
																												if(_t1130 == 0) {
																													E00E2AAA3(_t1293, _t1545, 1);
																													_t1130 = _v40;
																													_t1646 = _t1646 + 4;
																												}
																												_push(_t1130);
																												_t1131 = E00E2AF7C(_v44);
																												_t1647 = _t1646 + 8;
																												__eflags = _t1131;
																												if(_t1131 != 0) {
																													E00E2AA76(_t1293, _t1512, _t1545, _t1131);
																													_t1647 = _t1647 + 4;
																												}
																												_push(_v116);
																												_t1565 = _v136;
																												_push(1);
																												_push(_t1565);
																												_v44 = 0;
																												_v40 = 0;
																												L302();
																												_v20 = 0x17;
																												_t1132 = E00E2AE5D(_t1545);
																												_t1618 = _t1647 + 4;
																												__eflags = _t1132;
																												if(_t1132 != 0) {
																													E00E2AA76(_t1293, _t1512, _t1545, _t1132);
																													_t1618 = _t1618 + 4;
																												}
																												_v20 = 0xe;
																												__eflags = _v40;
																												if(__eflags != 0) {
																													goto L220;
																												} else {
																													_v20 = 0x18;
																													__eflags = _t1293;
																													if(_t1293 != 0) {
																														_t1578 = _t1565 | 0xffffffff;
																														__eflags = _t1578;
																														asm("lock xadd [ebx+0x4], eax");
																														if(_t1578 == 0) {
																															 *((intOrPtr*)( *_t1293))();
																															asm("lock xadd [ebx+0x8], esi");
																															__eflags = _t1578 == 1;
																															if(_t1578 == 1) {
																																 *((intOrPtr*)( *_t1293 + 4))();
																															}
																														}
																														_t1565 = _v136;
																													}
																													L200:
																													_t1522 = _a16;
																													__eflags = _t1522 - 0x10;
																													if(_t1522 < 0x10) {
																														L204:
																														_t1523 = _a40;
																														_a12 = 0;
																														_a16 = 0xf;
																														_v4 = 0;
																														__eflags = _t1523 - 0x10;
																														if(_t1523 < 0x10) {
																															L208:
																															goto L217;
																														} else {
																															_t1419 = _a20;
																															_t1524 = _t1523 + 1;
																															_t1101 = _t1419;
																															__eflags = _t1524 - 0x1000;
																															if(_t1524 < 0x1000) {
																																L207:
																																_push(_t1524);
																																E00E2C347(_t1419);
																																goto L208;
																															} else {
																																_t1342 =  *(_t1419 - 4);
																																_t1512 = _t1524 + 0x23;
																																__eflags = _t1101 - _t1342 + 0xfffffffc - 0x1f;
																																if(__eflags > 0) {
																																	goto L222;
																																} else {
																																	goto L207;
																																}
																															}
																														}
																													} else {
																														_t1420 = _v4;
																														_t1525 = _t1522 + 1;
																														_t1105 = _t1420;
																														__eflags = _t1525 - 0x1000;
																														if(_t1525 < 0x1000) {
																															L203:
																															_push(_t1525);
																															E00E2C347(_t1420);
																															_t1618 = _t1618 + 8;
																															goto L204;
																														} else {
																															_t1342 =  *(_t1420 - 4);
																															_t1512 = _t1525 + 0x23;
																															__eflags = _t1105 - _t1342 + 0xfffffffc - 0x1f;
																															if(__eflags > 0) {
																																goto L221;
																															} else {
																																goto L203;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								} else {
																									goto L165;
																								}
																							}
																						}
																						goto L370;
																						L154:
																						_push(0x4c);
																						_t1565 = E00E2C07D(_t1509, __eflags);
																						_v124 = _t1565;
																						_v20 = 9;
																						 *(_t1565 + 4) = 1;
																						 *(_t1565 + 8) = 1;
																						 *_t1565 = 0xe72794;
																						E00E12D00(_t1509, _v36);
																						_push(1);
																						_v20 = 0xa;
																						E00E12D00(_t1509,  &_v68);
																						_t1618 = _t1642 + 4 - 0xc;
																						_t355 = _t1565 + 0xc; // 0xc
																						_t1064 = _t1618;
																						 *_t1064 = 0;
																						 *(_t1064 + 4) = 0;
																						 *(_t1064 + 8) = 0;
																						E00E260A0(_t1293, _t355, _t1509, _t1545, __eflags);
																						_v20 = 9;
																						_t359 = _t1565 + 0xc; // 0xc
																						_t1066 = _t359;
																						_t1509 = _v48;
																						 *_t1066 = 0xe72a94;
																						__eflags = _t1509 - 0x10;
																						if(_t1509 < 0x10) {
																							L158:
																							asm("xorps xmm0, xmm0");
																							_v52 = 0;
																							asm("movlpd [ebp-0x74], xmm0");
																							_v48 = 0xf;
																							_v68 = 0;
																							_v132 = _t1066;
																							_v128 = _t1565;
																							_v20 = 0xb;
																							_t1068 = E00E20F70(_t1293,  &_v116);
																							_t371 = _t1565 + 0xc; // 0xc
																							_v132 = 0;
																							_v128 = 0;
																							 *_t1068 = _t371;
																							_t1575 =  *(_t1068 + 4);
																							 *(_t1068 + 4) = _v124;
																							_v20 = 0xc;
																							__eflags = _t1575;
																							if(__eflags != 0) {
																								asm("lock xadd [esi+0x4], eax");
																								if(__eflags == 0) {
																									 *((intOrPtr*)( *_t1575))();
																									asm("lock xadd [esi+0x8], eax");
																									if(__eflags == 0) {
																										 *((intOrPtr*)( *_t1575 + 4))();
																									}
																								}
																							}
																							goto L162;
																						} else {
																							_t1434 = _v68;
																							_t1509 = _t1509 + 1;
																							_t1148 = _t1434;
																							__eflags = _t1509 - 0x1000;
																							if(_t1509 < 0x1000) {
																								L157:
																								_push(_t1509);
																								E00E2C347(_t1434);
																								_t1618 = _t1618 + 8;
																								_t1066 = _t1565 + 0xc;
																								goto L158;
																							} else {
																								_t1342 =  *(_t1434 - 4);
																								_t1512 = _t1509 + 0x23;
																								__eflags = _t1148 - _t1342 + 0xfffffffc - 0x1f;
																								if(__eflags > 0) {
																									goto L218;
																								} else {
																									goto L157;
																								}
																							}
																						}
																						goto L370;
																					}
																				} else {
																					_t1296 = _v117;
																					do {
																						_t1545 = _t1051 + 0x14;
																						_v96 =  *((intOrPtr*)(_t1051 + 0x10));
																						_v124 =  &_v92;
																						E00E12D00(_t1509, _t1545);
																						_v20 = 4;
																						E00E12D00(_t1509, _t1545 + 0x18);
																						_v20 = 1;
																						__eflags = _a16 - 0x10;
																						_t1166 =  >=  ? _v4 :  &_v4;
																						__eflags = _v72 - 0x10;
																						_t1509 = _v76;
																						_t1442 =  >=  ? _v92 :  &_v92;
																						_t1167 = E00E1D7E0( >=  ? _v92 :  &_v92, _v76,  >=  ? _v4 :  &_v4, _a12);
																						_t1618 = _t1618 + 8;
																						__eflags = _t1167;
																						if(_t1167 != 0) {
																							__eflags = _a40 - 0x10;
																							_t1170 =  >=  ? _a20 :  &_a20;
																							__eflags = _v48 - 0x10;
																							_t1509 = _v52;
																							_t1446 =  >=  ? _v68 :  &_v68;
																							_t1171 = E00E1D7E0( >=  ? _v68 :  &_v68, _v52,  >=  ? _a20 :  &_a20, _a36);
																							_t1618 = _t1618 + 8;
																							__eflags = _t1171;
																							if(_t1171 != 0) {
																								_t1296 = 1;
																								_v116 = _v96;
																							}
																						}
																						L102();
																						E00E21050( &_v36);
																						_t1051 = _v36;
																						__eflags = _t1051 - _t1565;
																					} while (_t1051 != _t1565);
																					__eflags = _t1296;
																					_t1293 = _v136;
																					if(_t1296 == 0) {
																						_t1545 = _v140;
																						goto L147;
																					} else {
																						_push(_v116);
																						_push(1);
																						_push(_t1293);
																						L302();
																						L138:
																						_t1510 = _a16;
																						__eflags = _t1510 - 0x10;
																						if(_t1510 < 0x10) {
																							L142:
																							_t1511 = _a40;
																							_a12 = 0;
																							_a16 = 0xf;
																							_v4 = 0;
																							__eflags = _t1511 - 0x10;
																							if(_t1511 < 0x10) {
																								goto L216;
																							} else {
																								_t1342 = _a20;
																								_t1512 = _t1511 + 1;
																								_t883 = _t1342;
																								__eflags = _t1512 - 0x1000;
																								if(_t1512 < 0x1000) {
																									L215:
																									_push(_t1512);
																									E00E2C347(_t1342);
																									goto L216;
																								} else {
																									_t1342 =  *(_t1342 - 4);
																									_t1512 = _t1512 + 0x23;
																									__eflags = _t883 - _t1342 + 0xfffffffc - 0x1f;
																									if(__eflags > 0) {
																										goto L219;
																									} else {
																										goto L215;
																									}
																								}
																							}
																						} else {
																							_t1394 = _v4;
																							_t1521 = _t1510 + 1;
																							_t1043 = _t1394;
																							__eflags = _t1521 - 0x1000;
																							if(_t1521 < 0x1000) {
																								L141:
																								_push(_t1521);
																								E00E2C347(_t1394);
																								_t1618 = _t1618 + 8;
																								goto L142;
																							} else {
																								_t1342 =  *(_t1394 - 4);
																								_t1512 = _t1521 + 0x23;
																								__eflags = _t1043 - _t1342 + 0xfffffffc - 0x1f;
																								if(__eflags > 0) {
																									L218:
																									E00E4957C(_t1293, _t1342, _t1512, _t1545, __eflags);
																									L219:
																									E00E4957C(_t1293, _t1342, _t1512, _t1545, __eflags);
																									L220:
																									E00E48493(_t1293, _t1342, _t1512, _t1545, __eflags);
																									L221:
																									E00E4957C(_t1293, _t1342, _t1512, _t1545, __eflags);
																									L222:
																									E00E4957C(_t1293, _t1342, _t1512, _t1545, __eflags);
																									L223:
																									E00E48493(_t1293, _t1342, _t1512, _t1545, __eflags);
																									L224:
																									_push("invalid map<K, T> key");
																									E00E2A005();
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									_push(_t1594);
																									_t1596 = _t1618;
																									_push(0xffffffff);
																									_push(0xe5f9a0);
																									_push( *[fs:0x0]);
																									_push(_t1565);
																									_push(_t1545);
																									_t894 =  *0xe7b068; // 0x1b9618b6
																									_push(_t894 ^ _t1596);
																									_t896 =  &_v452;
																									 *[fs:0x0] = _t896;
																									_t1568 = _t1342;
																									_t1343 =  *(_t1568 + 0x38);
																									__eflags = _t1343 - 0x10;
																									if(_t1343 < 0x10) {
																										L230:
																										 *(_t1568 + 0x34) = 0;
																										 *(_t1568 + 0x38) = 0xf;
																										 *(_t1568 + 0x24) = 0;
																										_t1344 =  *(_t1568 + 0x20);
																										__eflags = _t1344 - 0x10;
																										if(_t1344 < 0x10) {
																											L235:
																											 *(_t1568 + 0x1c) = 0;
																											 *(_t1568 + 0x20) = 0xf;
																											 *(_t1568 + 0xc) = 0;
																											_v24 = 0;
																											_t1569 =  *(_t1568 + 8);
																											__eflags = _t1569;
																											if(_t1569 != 0) {
																												_t1548 = _t1545 | 0xffffffff;
																												__eflags = _t1548;
																												_t896 = _t1548;
																												asm("lock xadd [esi+0x4], eax");
																												if(_t1548 == 0) {
																													_t896 =  *((intOrPtr*)( *_t1569))();
																													asm("lock xadd [esi+0x8], edi");
																													__eflags = _t1548 == 1;
																													if(_t1548 == 1) {
																														_t896 =  *((intOrPtr*)( *_t1569 + 4))();
																													}
																												}
																											}
																											 *[fs:0x0] = _v32;
																											return _t896;
																										} else {
																											_t899 =  *(_t1568 + 0xc);
																											_t1349 = _t1344 + 1;
																											__eflags = _t1349 - 0x1000;
																											if(_t1349 < 0x1000) {
																												L234:
																												_push(_t1349);
																												_t896 = E00E2C347(_t899);
																												goto L235;
																											} else {
																												_t1513 =  *(_t899 - 4);
																												_t1349 = _t1349 + 0x23;
																												__eflags = _t899 - _t1513 + 0xfffffffc - 0x1f;
																												if(__eflags > 0) {
																													goto L240;
																												} else {
																													_t899 = _t1513;
																													goto L234;
																												}
																											}
																										}
																									} else {
																										_t1040 =  *(_t1568 + 0x24);
																										_t1393 = _t1343 + 1;
																										__eflags = _t1393 - 0x1000;
																										if(_t1393 < 0x1000) {
																											L229:
																											_push(_t1393);
																											_t896 = E00E2C347(_t1040);
																											_t1618 = _t1618 + 8;
																											goto L230;
																										} else {
																											_t1513 =  *(_t1040 - 4);
																											_t1349 = _t1393 + 0x23;
																											__eflags = _t1040 - _t1513 + 0xfffffffc - 0x1f;
																											if(__eflags > 0) {
																												L240:
																												E00E4957C(_t1293, _t1349, _t1513, _t1545, __eflags);
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												_t1598 = _t1618;
																												_t1623 = _t1618 - 0x90;
																												_t904 =  *0xe7b068; // 0x1b9618b6
																												_t905 = _t904 ^ _t1598;
																												_v484 = _t905;
																												 *[fs:0x0] =  &_v480;
																												_t1550 = _t1349;
																												_v516 = _t1550;
																												_v472 = 2;
																												_t909 =  *((intOrPtr*)( *((intOrPtr*)( *_v460 + 0x1c))))(_t905, _t1545, _t1568,  *[fs:0x0], 0xe60600, 0xffffffff, _t1596);
																												__eflags = _t909;
																												if(_t909 == 0) {
																													L283:
																													 *((intOrPtr*)( *_v16 + 0x34))();
																													_v28 = 0xf;
																													_t1568 = _v12;
																													__eflags = _t1568;
																													if(_t1568 != 0) {
																														_t1550 = _t1550 | 0xffffffff;
																														__eflags = _t1550;
																														asm("lock xadd [esi+0x4], eax");
																														if(_t1550 == 0) {
																															 *( *_t1568)();
																															asm("lock xadd [esi+0x8], edi");
																															_t1550 = _t1550 - 1;
																															__eflags = _t1550;
																															if(_t1550 == 0) {
																																 *((intOrPtr*)( *_t1568 + 4))();
																															}
																														}
																													}
																													_t1514 = _a12;
																													__eflags = _t1514 - 0x10;
																													if(_t1514 < 0x10) {
																														L291:
																														_t1515 = _a36;
																														_a8 = 0;
																														_a12 = 0xf;
																														_v8 = 0;
																														__eflags = _t1515 - 0x10;
																														if(_t1515 < 0x10) {
																															L295:
																															 *[fs:0x0] = _v36;
																															__eflags = _v40 ^ _t1598;
																															return E00E2C067(_v40 ^ _t1598);
																														} else {
																															_t1356 = _a16;
																															_t1516 = _t1515 + 1;
																															_t913 = _t1356;
																															__eflags = _t1516 - 0x1000;
																															if(_t1516 < 0x1000) {
																																L294:
																																_push(_t1516);
																																E00E2C347(_t1356);
																																goto L295;
																															} else {
																																_t1356 =  *(_t1356 - 4);
																																_t1516 = _t1516 + 0x23;
																																__eflags = _t913 - _t1356 + 0xfffffffc - 0x1f;
																																if(__eflags > 0) {
																																	goto L301;
																																} else {
																																	goto L294;
																																}
																															}
																														}
																													} else {
																														_t1362 = _v8;
																														_t1517 = _t1514 + 1;
																														_t926 = _t1362;
																														__eflags = _t1517 - 0x1000;
																														if(_t1517 < 0x1000) {
																															L290:
																															_push(_t1517);
																															E00E2C347(_t1362);
																															_t1623 = _t1623 + 8;
																															goto L291;
																														} else {
																															_t1356 =  *(_t1362 - 4);
																															_t1516 = _t1517 + 0x23;
																															__eflags = _t926 -  *(_t1362 - 4) + 0xfffffffc - 0x1f;
																															if(__eflags > 0) {
																																goto L300;
																															} else {
																																goto L290;
																															}
																														}
																													}
																												} else {
																													while(1) {
																														__eflags =  *(_t1550 + 0x58);
																														if( *(_t1550 + 0x58) != 0) {
																															goto L245;
																														}
																														L244:
																														_t1039 =  *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x20))))();
																														__eflags = _t1039 - 1;
																														if(_t1039 < 1) {
																															continue;
																															do {
																																while(1) {
																																	__eflags =  *(_t1550 + 0x58);
																																	if( *(_t1550 + 0x58) != 0) {
																																		goto L245;
																																	}
																																	goto L244;
																																}
																																goto L245;
																																L246:
																																_t940 =  *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x24))))();
																																__eflags = _t940;
																															} while (_t940 == 0);
																															_t943 =  *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x28))))();
																															__eflags = _t943;
																															if(_t943 <= 0) {
																																L282:
																																 *((intOrPtr*)( *_v16 + 0x38))();
																																continue;
																															} else {
																																_t1628 = _t1623 - 8;
																																_v60 = 0;
																																_t1369 = _t1628;
																																 *_t1369 = 0;
																																_t1369[1] = 0;
																																__eflags = _v12;
																																if(__eflags != 0) {
																																	asm("lock inc dword [eax+0x4]");
																																}
																																 *_t1369 = _v16;
																																_t1369[1] = _v12;
																																E00E23330(_t1293,  &_v60, _t1513, __eflags);
																																asm("xorps xmm0, xmm0");
																																_v28 = 3;
																																asm("movups [ebp-0x20], xmm0");
																																_push(0x7800);
																																_v56 = 0;
																																_v52 = 0;
																																_v48 = 0;
																																_v44 = 0;
																																_t950 = E00E495D8();
																																_t1623 =  &(_t1628[3]);
																																_v56 = _t950;
																																__eflags = _t950;
																																if(_t950 == 0) {
																																	L299:
																																	_t1356 =  &_v180;
																																	E00E11560( &_v180, _t1568, "malloc failed.");
																																	E00E4309B( &_v180, 0xe79e34);
																																	L300:
																																	E00E4957C(_t1293, _t1356, _t1516, _t1550, __eflags);
																																	L301:
																																	E00E4957C(_t1293, _t1356, _t1516, _t1550, __eflags);
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	_push(_t1598);
																																	_t1600 = _t1623;
																																	_push(0xffffffff);
																																	_push(0xe60669);
																																	_push( *[fs:0x0]);
																																	_t919 =  *0xe7b068; // 0x1b9618b6
																																	_t920 = _t919 ^ _t1600;
																																	_v656 = _t920;
																																	_push(_t1293);
																																	_push(_t1568);
																																	_push(_t1550);
																																	_push(_t920);
																																	 *[fs:0x0] =  &_v652;
																																	_t922 = _v628;
																																	_t1552 = _v632;
																																	_v732 = _t1552;
																																	__eflags = _t922 - 5;
																																	if(_t922 > 5) {
																																		L343:
																																		_push(0x4e);
																																		_push("HTTP/1.1 400 BadRequest\r\nContent-Length: 0\r\nContent-Type: application/json\r\n\r\n");
																																		goto L344;
																																	} else {
																																		switch( *((intOrPtr*)(_t922 * 4 +  &M00E20B44))) {
																																			case 0:
																																				_push(0x46);
																																				_push("HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: application/json\r\n\r\n");
																																				goto L344;
																																			case 1:
																																				__ebx = _v12;
																																				__esi =  &_v95;
																																				do {
																																					__eax = 0xcccccccd;
																																					__esi = __esi - 1;
																																					__edx = 0xcccccccd * __ebx >> 0x20;
																																					__eax = 0xcccccccd * __ebx;
																																					__edx = 0xcccccccd * __ebx >> 0x20 >> 3;
																																					__ecx = 0xcccccccd * __ebx + __edx;
																																					__cl = __cl + __cl;
																																					__bl = __bl - __cl;
																																					__bl = __bl + 0x30;
																																					 *__esi = __bl;
																																					__ebx = __edx;
																																					__eflags = __ebx;
																																				} while (__ebx != 0);
																																				__eax =  &_v95;
																																				_v128 = __edx;
																																				_v124 = 0xf;
																																				_v144 = __dl;
																																				__eflags = __esi - __eax;
																																				if(__esi != __eax) {
																																					__eflags = __eax;
																																					__ecx =  &_v144;
																																					__eax = E00E14C40(__ebx,  &_v144, __edx, __esi, __eax);
																																				}
																																				__eax =  &_v144;
																																				_v32 = 0;
																																				__edx = "{\"URL\":\"http://localhost:";
																																				__ecx =  &_v192;
																																				__edx = E00E21C70( &_v192, "{\"URL\":\"http://localhost:",  &_v144);
																																				_v32 = 1;
																																				__ecx =  &_v116;
																																				__eax = E00E21D60( &_v116, __eax, "\"}");
																																				_v32 = 3;
																																				__edx = _v172;
																																				__eflags = __edx - 0x10;
																																				if(__edx < 0x10) {
																																					L313:
																																					_v176 = 0;
																																					_v172 = 0xf;
																																					_v192 = 0;
																																					_v32 = 4;
																																					__edx = _v124;
																																					__eflags = __edx - 0x10;
																																					if(__edx < 0x10) {
																																						L317:
																																						__ebx = _v100;
																																						__esi =  &_v47;
																																						_v128 = 0;
																																						_v124 = 0xf;
																																						_v144 = 0;
																																						do {
																																							__eax = 0xcccccccd;
																																							__esi = __esi - 1;
																																							__edx = 0xcccccccd * __ebx >> 0x20;
																																							__eax = 0xcccccccd * __ebx;
																																							__edx = 0xcccccccd * __ebx >> 0x20 >> 3;
																																							__ecx = 0xcccccccd * __ebx + __edx;
																																							__cl = __cl + __cl;
																																							__bl = __bl - __cl;
																																							__bl = __bl + 0x30;
																																							 *__esi = __bl;
																																							__ebx = __edx;
																																							__eflags = __ebx;
																																						} while (__ebx != 0);
																																						__eax =  &_v47;
																																						_v152 = __edx;
																																						_v148 = 0xf;
																																						_v168 = __dl;
																																						__eflags = __esi - __eax;
																																						if(__esi != __eax) {
																																							__eflags = __eax;
																																							__ecx =  &_v168;
																																							__eax = E00E14C40(__ebx,  &_v168, __edx, __esi, __eax);
																																						}
																																						__eax =  &_v168;
																																						_v32 = 5;
																																						__edx = "HTTP/1.1 200 OK\r\nContent-Length: ";
																																						__ecx =  &_v216;
																																						__edx = E00E21C70( &_v216, "HTTP/1.1 200 OK\r\nContent-Length: ",  &_v168);
																																						_v32 = 6;
																																						__ecx =  &_v92;
																																						__eax = E00E21D60( &_v92, __eax, "\r\nContent-Type: application/json\r\n\r\n");
																																						_v32 = 8;
																																						__edx = _v196;
																																						__eflags = __edx - 0x10;
																																						if(__edx < 0x10) {
																																							L325:
																																							_v200 = 0;
																																							_v196 = 0xf;
																																							_v216 = 0;
																																							_v32 = 9;
																																							__edx = _v148;
																																							__eflags = __edx - 0x10;
																																							if(__edx < 0x10) {
																																								L329:
																																								__eflags = _v96 - 0x10;
																																								__edx =  &_v116;
																																								__ebx = _v116;
																																								__eax = _v72;
																																								__edx =  >=  ? __ebx :  &_v116;
																																								__esi = _v76;
																																								__eax = _v72 - __esi;
																																								__ecx = _v100;
																																								_v152 = 0;
																																								_v148 = 0xf;
																																								_v168 = 0;
																																								_push(__ecx);
																																								_push( >=  ? __ebx :  &_v116);
																																								__eflags = __ecx - _v72 - __esi;
																																								if(__ecx > _v72 - __esi) {
																																									_v120 = 0;
																																									__ecx =  &_v92;
																																									__eax = E00E170B0(__ebx,  &_v92, __edi,  &_v92, _v120);
																																									__ebx = _v116;
																																								} else {
																																									__eflags = _v72 - 0x10;
																																									__eax = __esi + __ecx;
																																									_v76 = __esi + __ecx;
																																									 &_v92 =  >=  ? _v92 :  &_v92;
																																									__esi = ( >=  ? _v92 :  &_v92) + __esi;
																																									_push(__esi);
																																									E00E43690() = _v100;
																																									__esp = __esp + 0xc;
																																									 *((char*)(__esi + _v100)) = 0;
																																								}
																																								__eax =  &_v92;
																																								__ecx = __edi;
																																								__eax = E00E12CC0(__ecx,  &_v92);
																																								__edx = _v72;
																																								__eflags = __edx - 0x10;
																																								if(__edx < 0x10) {
																																									L336:
																																									__eax = _v96;
																																									_v76 = 0;
																																									_v72 = 0xf;
																																									_v92 = 0;
																																									__eflags = __eax - 0x10;
																																									if(__eax < 0x10) {
																																										goto L345;
																																									} else {
																																										__ecx = __eax + 1;
																																										__eax = __ebx;
																																										__eflags = __ecx - 0x1000;
																																										if(__ecx < 0x1000) {
																																											L339:
																																											_push(__ecx);
																																											__eax = E00E2C347(__ebx);
																																											goto L345;
																																										} else {
																																											__ebx =  *(__ebx - 4);
																																											__ecx = __ecx + 0x23;
																																											__eax = __eax - __ebx;
																																											__eflags = __eax - 0x1f;
																																											if(__eflags > 0) {
																																												goto L351;
																																											} else {
																																												goto L339;
																																											}
																																										}
																																									}
																																								} else {
																																									__ecx = _v92;
																																									__edx = __edx + 1;
																																									__eax = __ecx;
																																									__eflags = __edx - 0x1000;
																																									if(__edx < 0x1000) {
																																										L335:
																																										_push(__edx);
																																										__eax = E00E2C347(__ecx);
																																										goto L336;
																																									} else {
																																										__ecx =  *(__ecx - 4);
																																										__edx = __edx + 0x23;
																																										__eax = __eax - __ecx;
																																										__eflags = __eax - 0x1f;
																																										if(__eflags > 0) {
																																											goto L350;
																																										} else {
																																											goto L335;
																																										}
																																									}
																																								}
																																							} else {
																																								__ecx = _v168;
																																								__edx = __edx + 1;
																																								__eax = __ecx;
																																								__eflags = __edx - 0x1000;
																																								if(__edx < 0x1000) {
																																									L328:
																																									_push(__edx);
																																									__eax = E00E2C347(__ecx);
																																									goto L329;
																																								} else {
																																									__ecx =  *(__ecx - 4);
																																									__edx = __edx + 0x23;
																																									__eax = __eax - __ecx;
																																									__eflags = __eax - 0x1f;
																																									if(__eflags > 0) {
																																										goto L349;
																																									} else {
																																										goto L328;
																																									}
																																								}
																																							}
																																						} else {
																																							__ecx = _v216;
																																							__edx = __edx + 1;
																																							__eax = __ecx;
																																							__eflags = __edx - 0x1000;
																																							if(__edx < 0x1000) {
																																								L324:
																																								_push(__edx);
																																								__eax = E00E2C347(__ecx);
																																								goto L325;
																																							} else {
																																								__ecx =  *(__ecx - 4);
																																								__edx = __edx + 0x23;
																																								__eax = __eax - __ecx;
																																								__eflags = __eax - 0x1f;
																																								if(__eflags > 0) {
																																									goto L348;
																																								} else {
																																									goto L324;
																																								}
																																							}
																																						}
																																					} else {
																																						__ecx = _v144;
																																						__edx = __edx + 1;
																																						__eax = __ecx;
																																						__eflags = __edx - 0x1000;
																																						if(__edx < 0x1000) {
																																							L316:
																																							_push(__edx);
																																							__eax = E00E2C347(__ecx);
																																							goto L317;
																																						} else {
																																							__ecx =  *(__ecx - 4);
																																							__edx = __edx + 0x23;
																																							__eax = __eax - __ecx;
																																							__eflags = __eax - 0x1f;
																																							if(__eflags > 0) {
																																								goto L347;
																																							} else {
																																								goto L316;
																																							}
																																						}
																																					}
																																				} else {
																																					__ecx = _v192;
																																					__edx = __edx + 1;
																																					__eax = __ecx;
																																					__eflags = __edx - 0x1000;
																																					if(__edx < 0x1000) {
																																						L312:
																																						_push(__edx);
																																						__eax = E00E2C347(__ecx);
																																						goto L313;
																																					} else {
																																						__ecx =  *(__ecx - 4);
																																						__edx = __edx + 0x23;
																																						__eax = __eax - __ecx;
																																						__eflags = __eax - 0x1f;
																																						if(__eflags > 0) {
																																							__eax = E00E4957C(__ebx, __ecx, __edx, __edi, __eflags);
																																							L347:
																																							__eax = E00E4957C(__ebx, __ecx, __edx, __edi, __eflags);
																																							L348:
																																							__eax = E00E4957C(__ebx, __ecx, __edx, __edi, __eflags);
																																							L349:
																																							__eax = E00E4957C(__ebx, __ecx, __edx, __edi, __eflags);
																																							L350:
																																							__eax = E00E4957C(__ebx, __ecx, __edx, __edi, __eflags);
																																							L351:
																																							_t761 = E00E4957C(__ebx, __ecx, __edx, __edi, __eflags);
																																							__eax = __edi;
																																							__edi = _t761;
																																							_pop(es);
																																							asm("loop 0x2");
																																							 *0xca00e207 = __eax;
																																							__ah = __ah | __dl;
																																							__bl = __bl + __dl;
																																							__ah = __ah | __dl;
																																							__ch = __ch + __ah;
																																							__ah = __ah | __dl;
																																							__ah = __ah + __bl;
																																							__ah = __ah + __cl;
																																							asm("int3");
																																							asm("int3");
																																							asm("int3");
																																							_push(__ebp);
																																							__ebp = __esp;
																																							_push(0xffffffff);
																																							_push(0xe606c1);
																																							__eax =  *[fs:0x0];
																																							_push( *[fs:0x0]);
																																							__esp = __esp - 0x30;
																																							__eax =  *0xe7b068; // 0x1b9618b6
																																							__eax = __eax ^ __ebp;
																																							_v868 = __eax;
																																							_push(__esi);
																																							_push(__edi);
																																							_push(__eax);
																																							__eax =  &_v864;
																																							 *[fs:0x0] =  &_v864;
																																							__esi = _v844;
																																							asm("xorps xmm0, xmm0");
																																							_v856 = 0;
																																							_v912 = __esi;
																																							_v896 = 0;
																																							asm("movups [esi], xmm0");
																																							_push(0x7800);
																																							 *__esi = 0;
																																							 *(__esi + 4) = 0;
																																							 *(__esi + 8) = 0;
																																							 *(__esi + 0xc) = 0;
																																							__eax = E00E495D8();
																																							__esp = __esp + 4;
																																							 *__esi = __eax;
																																							__eflags = __eax;
																																							if(__eax == 0) {
																																								_push("malloc failed.");
																																								goto L364;
																																							} else {
																																								__eax = E00E43C10(__edi, __eax, 0, 0x7800);
																																								 *(__esi + 8) = 0x7800;
																																								_push(0);
																																								_push(_v20);
																																								__eax =  &_v72;
																																								_v36 = 0;
																																								_push( &_v72);
																																								_v76 = 1;
																																								L302();
																																								_v36 = 1;
																																								__edi = _v56;
																																								__eflags =  *(__esi + 8) - __edi;
																																								if( *(__esi + 8) >= __edi) {
																																									L356:
																																									__eflags = _v52 - 0x10;
																																									__eax =  &_v72;
																																									__edi = _v72;
																																									 >=  ? __edi :  &_v72 =  *(__esi + 4);
																																									 *(__esi + 4) +  *__esi = E00E43110( *(__esi + 4) +  *__esi,  >=  ? __edi :  &_v72, _v56);
																																									__ecx = __esi;
																																									__eax = E00E17D10(__ebx, __esi, __edi, _v56);
																																									__eax = _v52;
																																									__eflags = __eax - 0x10;
																																									if(__eax < 0x10) {
																																										L362:
																																										__eax = __esi;
																																										__ecx = _v44;
																																										 *[fs:0x0] = _v44;
																																										_pop(__ecx);
																																										_pop(__edi);
																																										_pop(__esi);
																																										__ecx = _v48;
																																										__ecx = _v48 ^ __ebp;
																																										__eflags = __ecx;
																																										__eax = E00E2C067(__ecx);
																																										__esp = __ebp;
																																										_pop(__ebp);
																																										return __eax;
																																									} else {
																																										_t789 = __eax + 1; // 0x11
																																										__ecx = _t789;
																																										__eax = __edi;
																																										__eflags = __ecx - 0x1000;
																																										if(__ecx < 0x1000) {
																																											L361:
																																											_push(__ecx);
																																											__eax = E00E2C347(__edi);
																																											goto L362;
																																										} else {
																																											__edi =  *(__edi - 4);
																																											__ecx = __ecx + 0x23;
																																											__eax = __eax - __edi;
																																											__eflags = __eax - 0x1f;
																																											if(__eflags > 0) {
																																												goto L365;
																																											} else {
																																												goto L361;
																																											}
																																										}
																																									}
																																								} else {
																																									_push(__edi);
																																									_push( *__esi);
																																									__edx = E00E495CD();
																																									__esp = __esp + 8;
																																									__eflags = __edx;
																																									if(__edx == 0) {
																																										_push("reaclloc failed.");
																																										L364:
																																										__ecx =  &_v88;
																																										E00E11560( &_v88, __esi) =  &_v88;
																																										__eax = E00E4309B( &_v88, 0xe79e34);
																																										L365:
																																										__eax = E00E4957C(__ebx, __ecx, __edx, __edi, __eflags);
																																										asm("int3");
																																										asm("int3");
																																										asm("int3");
																																										asm("int3");
																																										asm("int3");
																																										asm("int3");
																																										asm("int3");
																																										asm("int3");
																																										asm("int3");
																																										asm("int3");
																																										asm("int3");
																																										asm("int3");
																																										_push(__ebp);
																																										__ebp = __esp;
																																										_push(0xffffffff);
																																										_push(0xe606f0);
																																										__eax =  *[fs:0x0];
																																										_push( *[fs:0x0]);
																																										_push(__esi);
																																										_push(__edi);
																																										__eax =  *0xe7b068; // 0x1b9618b6
																																										_push(__eax);
																																										__eax =  &_v940;
																																										 *[fs:0x0] = __eax;
																																										__esi =  *(__ecx + 4);
																																										__eflags = __esi;
																																										if(__esi != 0) {
																																											__edi = __edi | 0xffffffff;
																																											__eflags = __edi;
																																											__eax = __edi;
																																											asm("lock xadd [esi+0x4], eax");
																																											if(__edi == 0) {
																																												__eax =  *__esi;
																																												__ecx = __esi;
																																												__eax =  *( *__esi)();
																																												asm("lock xadd [esi+0x8], edi");
																																												__edi = __edi - 1;
																																												__eflags = __edi;
																																												if(__edi == 0) {
																																													__eax =  *__esi;
																																													__ecx = __esi;
																																													__eax =  *((intOrPtr*)( *__esi + 4))();
																																												}
																																											}
																																										}
																																										__ecx = _v48;
																																										 *[fs:0x0] = _v48;
																																										_pop(__ecx);
																																										_pop(__edi);
																																										_pop(__esi);
																																										__esp = __ebp;
																																										_pop(__ebp);
																																										return __eax;
																																									} else {
																																										__ecx =  *(__esi + 4);
																																										__edi = __edi - __ecx;
																																										__eflags = __edi - __ecx;
																																										 *__esi = __edx;
																																										__ecx + __edx = E00E43C10(__edi, __ecx + __edx, 0, __ecx + __edx);
																																										 *(__esi + 8) = __edi;
																																										goto L356;
																																									}
																																								}
																																							}
																																						} else {
																																							goto L312;
																																						}
																																					}
																																				}
																																				goto L370;
																																			case 2:
																																				_push(0x4c);
																																				_push("HTTP/1.1 404 NotFound\r\nContent-Length: 0\r\nContent-Type: application/json\r\n\r\n");
																																				goto L344;
																																			case 3:
																																				_push(0x56);
																																				_push("HTTP/1.1 503 ServiceUnavailable\r\nContent-Length: 0\r\nContent-Type: application/json\r\n\r\n");
																																				goto L344;
																																			case 4:
																																				goto L343;
																																			case 5:
																																				_push(0x50);
																																				_push("HTTP/1.1 600 ResetSession\r\nContent-Length: 0\r\nContent-Type: application/json\r\n\r\n");
																																				L344:
																																				 *(_t1552 + 0x10) = 0;
																																				 *(_t1552 + 0x14) = 0xf;
																																				 *_t1552 = 0;
																																				E00E14C40(_t1293, _t1552, _t1516);
																																				L345:
																																				 *[fs:0x0] = _v40;
																																				__eflags = _v44 ^ _t1600;
																																				return E00E2C067(_v44 ^ _t1600);
																																				goto L370;
																																		}
																																	}
																																} else {
																																	E00E43C10(_t1550, _t950, 0, 0x7800);
																																	_t1623 = _t1623 + 0xc;
																																	_v48 = 0x7800;
																																	_v28 = 4;
																																	__eflags = _v60;
																																	if(_v60 == 0) {
																																		_push(4);
																																		_t955 =  &_v132;
																																		_push(_t955);
																																		L352();
																																		_t1573 = _t955;
																																		_v28 = 0xe;
																																		__eflags =  &_v56 - _t1573;
																																		if( &_v56 == _t1573) {
																																			L274:
																																			_v28 = 4;
																																			_t957 = _v132;
																																			__eflags = _t957;
																																			if(_t957 != 0) {
																																				E00E48B06(_t957);
																																				_t1623 = _t1623 + 4;
																																				_v132 = 0;
																																			}
																																			goto L276;
																																		} else {
																																			_push( *((intOrPtr*)(_t1573 + 4)));
																																			_t966 = E00E495D8();
																																			_t1623 = _t1623 + 4;
																																			_v56 = _t966;
																																			__eflags = _t966;
																																			if(_t966 == 0) {
																																				goto L298;
																																			} else {
																																				E00E43110(_t966,  *_t1573,  *((intOrPtr*)(_t1573 + 4)));
																																				_t1623 = _t1623 + 0xc;
																																				_v48 =  *((intOrPtr*)(_t1573 + 8));
																																				_v52 =  *((intOrPtr*)(_t1573 + 4));
																																				_v44 =  *((intOrPtr*)(_t1573 + 0xc));
																																				goto L274;
																																			}
																																		}
																																	} else {
																																		_push( *(_t1550 + 0x1c) & 0x000000ff);
																																		_t1629 = _t1623 - 0x18;
																																		_v68 = _t1629;
																																		E00E12D00(_t1513,  &_a16);
																																		_t1630 = _t1629 - 0x18;
																																		_v28 = 5;
																																		_v84 = _t1630;
																																		E00E12D00(_t1513,  &_v8);
																																		_v28 = 6;
																																		_t979 = E00E20D50(_t1293, _t1630, _t1513);
																																		_v28 = 4;
																																		_t980 = E00E27940(_t1293, _t979, _t1550, _t1568);
																																		_t1568 = _t1550 + 0x28;
																																		_v68 = _t980;
																																		_v84 = _t1568;
																																		_t981 = E00E2AE38(_t1568);
																																		_t1631 = _t1630 + 4;
																																		__eflags = _t981;
																																		if(_t981 != 0) {
																																			E00E2AA76(_t1293, _t1513, _t1550, _t981);
																																			_t1631 = _t1631 + 4;
																																		}
																																		_v28 = 7;
																																		__eflags = _v68;
																																		if(_v68 == 0) {
																																			_push(3);
																																			_t982 =  &_v116;
																																			_push(_t982);
																																			L352();
																																			_t1550 = _t982;
																																			_v28 = 0xc;
																																			__eflags =  &_v56 - _t1550;
																																			if( &_v56 == _t1550) {
																																				L264:
																																				_t984 = _v116;
																																				__eflags = _t984;
																																				if(_t984 != 0) {
																																					E00E48B06(_t984);
																																					_v116 = 0;
																																					goto L266;
																																				}
																																				goto L267;
																																			} else {
																																				_push( *(_t1550 + 4));
																																				_t988 = E00E495D8();
																																				_t1623 = _t1631 + 4;
																																				_v56 = _t988;
																																				__eflags = _t988;
																																				if(_t988 == 0) {
																																					goto L297;
																																				} else {
																																					E00E43110(_t988,  *_t1550,  *(_t1550 + 4));
																																					_t1631 = _t1623 + 0xc;
																																					_v48 =  *(_t1550 + 8);
																																					_v52 =  *(_t1550 + 4);
																																					_v44 =  *(_t1550 + 0xc);
																																					goto L264;
																																				}
																																			}
																																		} else {
																																			E00E12D00(_t1513, _t1550 + 0x5c);
																																			 *((intOrPtr*)( *_v68 + 0xc))();
																																			E00E20EA0(_t1293, _v68, _t1513, _t1550);
																																			_t1633 = _t1631;
																																			_t1379 = _t1633;
																																			_v76 = _t1633;
																																			 *(_t1379 + 0x10) = 0;
																																			 *(_t1379 + 0x14) = 0xf;
																																			 *_t1379 = 0;
																																			E00E14C40(_t1293, _t1379, _t1513, "-USBRequestBuf: ", 0x10);
																																			_t1634 = _t1633 - 0x18;
																																			_v28 = 8;
																																			_t1380 = _t1634;
																																			 *(_t1380 + 0x10) = 0;
																																			 *(_t1380 + 0x14) = 0xf;
																																			 *_t1380 = 0;
																																			_t1002 = E00E14C40(_t1293, _t1380, _t1513, "HTTPMediator::ConnectBrowser", 0x1c);
																																			L00E2AFA4();
																																			_v28 = 7;
																																			E00E12110(_t1293, 0xcd, _t1513, _t1550);
																																			E00E20EA0(_t1293, 0xcd, _t1513, _t1550);
																																			E00E123F0(_t1293,  *_v60,  *((intOrPtr*)(_v60 + 4)), _t1550);
																																			_t1519 =  &_v56;
																																			_v61 =  *((intOrPtr*)( *((intOrPtr*)( *_v68 + 8))))(_v60,  &_v56, _t1002);
																																			E00E20EA0(_t1293, _v68,  &_v56, _t1550);
																																			_t1636 = _t1634 + 0x34 - 0x18;
																																			_t1384 = _t1636;
																																			_v80 = _t1636;
																																			 *(_t1384 + 0x10) = 0;
																																			 *(_t1384 + 0x14) = 0xf;
																																			 *_t1384 = 0;
																																			E00E14C40(_t1293, _t1384,  &_v56, "-USBResponseBuf: ", 0x11);
																																			_t1637 = _t1636 - 0x18;
																																			_v28 = 9;
																																			_t1385 = _t1637;
																																			 *(_t1385 + 0x10) = 0;
																																			 *(_t1385 + 0x14) = 0xf;
																																			 *_t1385 = 0;
																																			_t1012 = E00E14C40(_t1293, _t1385,  &_v56, "HTTPMediator::ConnectBrowser", 0x1c);
																																			L00E2AFA4();
																																			_push(_t1012);
																																			_v28 = 7;
																																			E00E12110(_t1293, 0xd2,  &_v56, _t1550);
																																			E00E20EA0(_t1293, 0xd2, _t1519, _t1550);
																																			_t1520 =  *((intOrPtr*)(_v60 + 4));
																																			E00E127F0(_t1293,  *_v60,  *((intOrPtr*)(_v60 + 4)), _t1550, _v56, _v52);
																																			E00E20EA0(_t1293,  *_v60,  *((intOrPtr*)(_v60 + 4)), _t1550);
																																			_t1638 = _t1637 + 0x24;
																																			_t1388 = _t1638;
																																			_v80 = _t1638;
																																			 *(_t1388 + 0x10) = 0;
																																			 *(_t1388 + 0x14) = 0xf;
																																			 *_t1388 = 0;
																																			E00E14C40(_t1293, _t1388,  *((intOrPtr*)(_v60 + 4)), "-USBResult: ", 0xc);
																																			_t1639 = _t1638 - 0x18;
																																			_v28 = 0xa;
																																			_t1389 = _t1639;
																																			 *(_t1389 + 0x10) = 0;
																																			 *(_t1389 + 0x14) = 0xf;
																																			 *_t1389 = 0;
																																			_t1019 = E00E14C40(_t1293, _t1389,  *((intOrPtr*)(_v60 + 4)), "HTTPMediator::ConnectBrowser", 0x1c);
																																			L00E2AFA4();
																																			_push(_t1019);
																																			_v28 = 7;
																																			E00E12110(_t1293, 0xd4,  *((intOrPtr*)(_v60 + 4)), _t1550);
																																			E00E20EA0(_t1293, 0xd4, _t1520, _t1550);
																																			_t1513 = _v61 & 0x000000ff;
																																			_t1640 = _t1639 + 0x1c;
																																			E00E1EA80(_t1293, _t1640, _v61 & 0x000000ff, _t1550, _t1568);
																																			E00E12350(_t1293, _t1550);
																																			_t1631 = _t1640 + 0x18;
																																			__eflags = _v61;
																																			if(_v61 != 0) {
																																				L268:
																																				_v28 = 0xd;
																																				_t985 = E00E2AE5D(_t1568);
																																				_t1623 = _t1631 + 4;
																																				__eflags = _t985;
																																				if(_t985 != 0) {
																																					E00E2AA76(_t1293, _t1513, _t1550, _t985);
																																					_t1623 = _t1623 + 4;
																																				}
																																				_v28 = 4;
																																				L276:
																																				 *((intOrPtr*)( *_v16 + 0x30))(_v56, _v52);
																																				_t960 = _v56;
																																				__eflags = _t960;
																																				if(_t960 != 0) {
																																					E00E48B06(_t960);
																																					_t1623 = _t1623 + 4;
																																					_v56 = 0;
																																				}
																																				_v28 = 2;
																																				_t1568 = _v60;
																																				__eflags = _t1568;
																																				if(_t1568 != 0) {
																																					_t961 =  *_t1568;
																																					__eflags = _t961;
																																					if(_t961 != 0) {
																																						E00E48B06(_t961);
																																						_t1623 = _t1623 + 4;
																																						 *_t1568 = 0;
																																					}
																																					_push(0x10);
																																					E00E2C347(_t1568);
																																					_t1623 = _t1623 + 8;
																																				}
																																				goto L282;
																																			} else {
																																				_push(3);
																																				_t1024 =  &_v100;
																																				_push(_t1024);
																																				L352();
																																				_t1550 = _t1024;
																																				_v28 = 0xb;
																																				__eflags =  &_v56 - _t1550;
																																				if( &_v56 == _t1550) {
																																					L259:
																																					_t1026 = _v100;
																																					__eflags = _t1026;
																																					if(_t1026 != 0) {
																																						E00E48B06(_t1026);
																																						_v100 = 0;
																																						L266:
																																						_t1631 = _t1631 + 4;
																																					}
																																					L267:
																																					_t1550 = _v72;
																																					goto L268;
																																				} else {
																																					_push( *(_t1550 + 4));
																																					_t1028 = E00E495D8();
																																					_t1623 = _t1631 + 4;
																																					_v56 = _t1028;
																																					__eflags = _t1028;
																																					if(_t1028 == 0) {
																																						E00E11560( &_v144, _t1568, "malloc failed.");
																																						E00E4309B( &_v144, 0xe79e34);
																																						L297:
																																						E00E11560( &_v156, _t1568, "malloc failed.");
																																						E00E4309B( &_v156, 0xe79e34);
																																						L298:
																																						E00E11560( &_v168, _t1568, "malloc failed.");
																																						E00E4309B( &_v168, 0xe79e34);
																																						goto L299;
																																					} else {
																																						E00E43110(_t1028,  *_t1550,  *(_t1550 + 4));
																																						_t1631 = _t1623 + 0xc;
																																						_v48 =  *(_t1550 + 8);
																																						_v52 =  *(_t1550 + 4);
																																						_v44 =  *(_t1550 + 0xc);
																																						goto L259;
																																					}
																																				}
																																			}
																																		}
																																	}
																																}
																															}
																															goto L370;
																														}
																														L245:
																														__eflags =  *(_t1550 + 0x58);
																														if( *(_t1550 + 0x58) != 0) {
																															goto L283;
																														} else {
																															goto L246;
																														}
																														goto L370;
																													}
																												}
																											} else {
																												_t1040 = _t1513;
																												goto L229;
																											}
																										}
																									}
																								} else {
																									goto L141;
																								}
																							}
																						}
																					}
																				}
																			} else {
																				_t1175 =  *((intOrPtr*)( *((intOrPtr*)( *_t1336 + 4))))();
																				__eflags = _t1175;
																				if(_t1175 != 0) {
																					goto L130;
																				} else {
																					 *(_t1293 + 0x10) = 0;
																					 *(_t1293 + 0x14) = 0xf;
																					 *_t1293 = _t1175;
																					E00E14C40(_t1293, _t1293, _t1509, "HTTP/1.1 404 NotFound\r\nContent-Length: 0\r\nContent-Type: application/json\r\n\r\n", 0x4c);
																					E00E12C70(_t1293,  &_v4, _t1545, _t1565);
																					E00E12C70(_t1293,  &_a20, _t1545, _t1565);
																					L216:
																					L217:
																					 *[fs:0x0] = _v28;
																					__eflags = _v32 ^ _t1594;
																					return E00E2C067(_v32 ^ _t1594);
																				}
																			}
																		}
																	} else {
																		goto L123;
																	}
																}
															}
														} else {
															_t1186 = _t1507;
															goto L106;
														}
													}
												}
												goto L370;
												L60:
												_t841 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1541)) + 0x24))))(); // executed
												__eflags = _t841;
											}
										}
									}
									goto L370;
								}
								__eflags = _t1316;
								if(_t1316 == 0) {
									goto L99;
								} else {
									goto L58;
								}
							}
						}
					} else {
						 *((intOrPtr*)( *_t1308 + 8))();
						_t1540 =  *0xe7ea24; // 0x1
						_t1536 =  *0xe7ea1c; // 0x8
						_t1587 =  *0xe7ea20; // 0x0
						_t1274 =  *0xe7ea18; // 0xc6b078
						_t24 = _t1540 - 1; // 0x0
						_t1290 =  *(_t1274 + (_t1536 - 0x00000001 & _t24 + _t1587) * 4);
						_v8 = 1;
						_t1498 =  *(_t1290 + 0x24);
						if(_t1498 != 0) {
							 *((intOrPtr*)( *_t1498 + 0x10))((_t1274 & 0xffffff00 | _t1498 != _t1290) & 0x000000ff);
							 *(_t1290 + 0x24) = 0;
							_t1540 =  *0xe7ea24; // 0x1
							_t1587 =  *0xe7ea20; // 0x0
						}
						_t33 = _t1540 - 1; // 0x0
						_t806 = _t33;
						_v8 = 0xffffffff;
						 *0xe7ea24 = _t806;
						_t1558 =  ==  ? 0 : _t1587;
						 *0xe7ea20 = _t1558;
						if(_t806 != 0) {
							L12:
							_t1492 =  *0xe7ea14; // 0xc6e508
							_t17 = _t806 - 1; // 0x0
							_t1534 = _t17;
							_t1268 = 0;
							if(_t1492 != 0) {
								_t1500 =  *_t1492;
								if(_t1500 != 0) {
									_t1268 =  *_t1500;
								}
							}
							goto L15;
						} else {
							_t1290 = _v28;
							goto L25;
						}
					}
				}
				L370:
			}

0x00e1edb1
0x00e1edb3
0x00e1edb5
0x00e1edc0
0x00e1edc1
0x00e1edc4
0x00e1edc9
0x00e1edcb
0x00e1edce
0x00e1edd0
0x00e1edd1
0x00e1edd5
0x00e1eddb
0x00e1eddd
0x00e1ede4
0x00e1ede7
0x00e1edea
0x00e1edec
0x00e1edf1
0x00e1edf3
0x00e1ee04
0x00e1ee09
0x00e1ee0c
0x00e1ee13
0x00e1ee15
0x00e1ee19
0x00e1ee1e
0x00e1ee24
0x00e1ee28
0x00e1ee2d
0x00e1ee33
0x00e1ee33
0x00e1ee2d
0x00e1ee1e
0x00e1ee39
0x00e1ee40
0x00e1ee45
0x00e1ee4a
0x00e1edf6
0x00e1edf6
0x00e1edfb
0x00e1edfd
0x00e1ee01
0x00e1ee01
0x00000000
0x00e1ee4c
0x00e1ee4c
0x00e1ee4c
0x00e1ee4a
0x00e1ee4f
0x00e1ee56
0x00e1ef23
0x00e1ef23
0x00e1ef2c
0x00e1ef5a
0x00e1ef5a
0x00e1ef64
0x00e1ef6e
0x00e1ef72
0x00e1ef78
0x00e1efa6
0x00e1efa9
0x00e1efb0
0x00e1efb8
0x00e1efbc
0x00e1efc1
0x00e1efc4
0x00e1efc7
0x00e1efca
0x00e1efcd
0x00e1efd0
0x00e1efd7
0x00e1efd9
0x00e1efdc
0x00e1efe2
0x00e1efe4
0x00e1efe4
0x00e1efe6
0x00e1efeb
0x00e1eff0
0x00e1eff5
0x00e1effa
0x00e1effd
0x00e1f002
0x00e1f005
0x00e1f00b
0x00000000
0x00e1f00d
0x00e1f00d
0x00e1f00f
0x00e1f012
0x00e1f015
0x00e1f015
0x00e1f00b
0x00e1f018
0x00e1f01d
0x00e1f01f
0x00e1f023
0x00e1f026
0x00e1f02f
0x00e1f034
0x00e1f037
0x00e1f03a
0x00e1f047
0x00e1f04f
0x00e1f055
0x00e1f05a
0x00e1f061
0x00e1f064
0x00e1f06b
0x00e1f06e
0x00e1f079
0x00000000
0x00e1f07f
0x00e1f07f
0x00e1f085
0x00e1f08a
0x00e1f090
0x00e1f09d
0x00e1f0a5
0x00e1f0a7
0x00e1f0ad
0x00e1f0b2
0x00e1f0b5
0x00e1f0bf
0x00e1f0c7
0x00e1f0ce
0x00e1f0d3
0x00e1f0d5
0x00e1f0da
0x00e1f0df
0x00e1f0e5
0x00e1f0e7
0x00e1f0ed
0x00e1f0f3
0x00e1f0f3
0x00e1f0ed
0x00e1f0df
0x00e1f0f9
0x00e1f111
0x00e1f111
0x00e1ef7a
0x00e1ef7a
0x00e1ef7d
0x00e1ef84
0x00e1ef9c
0x00e1ef9c
0x00e1ef9e
0x00e1efa3
0x00000000
0x00e1ef86
0x00e1ef86
0x00e1ef89
0x00e1ef94
0x00000000
0x00e1ef9a
0x00e1ef9a
0x00000000
0x00e1ef9a
0x00e1ef94
0x00e1ef84
0x00e1ef2e
0x00e1ef2e
0x00e1ef31
0x00e1ef38
0x00e1ef50
0x00e1ef50
0x00e1ef52
0x00e1ef57
0x00000000
0x00e1ef3a
0x00e1ef3a
0x00e1ef3d
0x00e1ef48
0x00e1f112
0x00e1f112
0x00000000
0x00e1ef4e
0x00e1ef4e
0x00000000
0x00e1ef4e
0x00e1ef48
0x00e1ef38
0x00e1ee5c
0x00e1ee5c
0x00e1ee5c
0x00e1ee79
0x00e1ee79
0x00e1ee7d
0x00e1ee8f
0x00e1ee8f
0x00e1ee8f
0x00e1ee7f
0x00e1ee7f
0x00e1ee83
0x00000000
0x00e1ee85
0x00e1ee85
0x00e1ee89
0x00000000
0x00e1ee8b
0x00e1ee8b
0x00e1ee8b
0x00e1ee89
0x00e1ee83
0x00e1ee9d
0x00e1eea2
0x00e1f117
0x00e1f117
0x00e1f11c
0x00e1f11d
0x00e1f11e
0x00e1f11f
0x00e1f121
0x00e1f131
0x00e1f137
0x00e1f13c
0x00e1f13e
0x00e1f147
0x00e1f14d
0x00e1f156
0x00e1f158
0x00e1f15a
0x00e1f576
0x00e1f57a
0x00e1f580
0x00e1f58d
0x00e1f597
0x00e1f160
0x00e1f167
0x00e1f169
0x00e1f16b
0x00000000
0x00e1f171
0x00e1f171
0x00e1f171
0x00e1f173
0x00e1f173
0x00e1f176
0x00e1f178
0x00e1f188
0x00e1f18e
0x00e1f190
0x00e1f190
0x00e1f193
0x00e1f193
0x00e1f17a
0x00e1f17a
0x00e1f181
0x00e1f181
0x00e1f196
0x00e1f19c
0x00e1f1a1
0x00000000
0x00000000
0x00e1f1ad
0x00e1f1af
0x00e1f1b1
0x00000000
0x00e1f1b3
0x00e1f1bd
0x00e1f1c4
0x00e1f1c6
0x00e1f1c8
0x00000000
0x00000000
0x00e1f1d0
0x00e1f1d0
0x00e1f1d7
0x00e1f1d9
0x00e1f1db
0x00000000
0x00000000
0x00e1f1dd
0x00e1f1dd
0x00e1f1e0
0x00e1f1e4
0x00e1f1e9
0x00e1f1f0
0x00e1f1f7
0x00e1f203
0x00e1f205
0x00e1f208
0x00e1f20b
0x00e1f20d
0x00e1f21b
0x00e1f220
0x00e1f223
0x00e1f22a
0x00e1f233
0x00e1f23a
0x00e1f243
0x00e1f245
0x00e1f247
0x00e1f25e
0x00e1f249
0x00e1f24b
0x00e1f25a
0x00e1f25a
0x00e1f261
0x00e1f268
0x00e1f26f
0x00e1f273
0x00e1f27a
0x00e1f281
0x00e1f285
0x00e1f287
0x00e1f28b
0x00e1f28d
0x00e1f357
0x00e1f357
0x00e1f35e
0x00e1f365
0x00e1f369
0x00e1f36d
0x00e1f36d
0x00e1f370
0x00e1f46d
0x00e1f474
0x00e1f47b
0x00e1f482
0x00e1f491
0x00e1f496
0x00e1f499
0x00e1f49c
0x00000000
0x00e1f49e
0x00e1f49e
0x00e1f4a4
0x00e1f4a5
0x00e1f4a7
0x00e1f4ad
0x00e1f4c3
0x00e1f4c3
0x00e1f4c5
0x00e1f4ca
0x00000000
0x00e1f4af
0x00e1f4af
0x00e1f4b2
0x00e1f4ba
0x00e1f4bd
0x00000000
0x00000000
0x00000000
0x00000000
0x00e1f4bd
0x00e1f4ad
0x00e1f376
0x00e1f376
0x00e1f376
0x00e1f379
0x00e1f41d
0x00e1f41f
0x00000000
0x00e1f37f
0x00e1f37f
0x00e1f37f
0x00e1f382
0x00e1f3dd
0x00e1f3e5
0x00e1f3eb
0x00e1f3ef
0x00e1f3f4
0x00e1f3f7
0x00e1f400
0x00e1f404
0x00e1f409
0x00e1f40f
0x00e1f413
0x00e1f416
0x00e1f384
0x00e1f384
0x00e1f386
0x00e1f424
0x00e1f42a
0x00e1f431
0x00e1f438
0x00e1f43f
0x00e1f444
0x00e1f444
0x00e1f382
0x00e1f44e
0x00e1f459
0x00e1f4cd
0x00e1f4d2
0x00e1f4d9
0x00e1f4e0
0x00e1f4e7
0x00e1f4ed
0x00e1f4f2
0x00e1f4f6
0x00e1f4f9
0x00e1f4fc
0x00e1f526
0x00e1f526
0x00e1f529
0x00e1f52c
0x00e1f556
0x00e1f556
0x00e1f55d
0x00e1f560
0x00e1f562
0x00e1f569
0x00e1f56e
0x00e1f56e
0x00e1f1d0
0x00000000
0x00000000
0x00000000
0x00e1f52e
0x00e1f52e
0x00e1f531
0x00e1f532
0x00e1f534
0x00e1f53a
0x00e1f54c
0x00e1f54c
0x00e1f54e
0x00e1f553
0x00000000
0x00e1f53c
0x00e1f53c
0x00e1f53f
0x00e1f547
0x00e1f54a
0x00000000
0x00000000
0x00000000
0x00000000
0x00e1f54a
0x00e1f53a
0x00e1f4fe
0x00e1f4fe
0x00e1f501
0x00e1f502
0x00e1f504
0x00e1f50a
0x00e1f51c
0x00e1f51c
0x00e1f51e
0x00e1f523
0x00000000
0x00e1f50c
0x00e1f50c
0x00e1f50f
0x00e1f517
0x00e1f51a
0x00000000
0x00000000
0x00000000
0x00000000
0x00e1f51a
0x00e1f50a
0x00e1f4fc
0x00e1f293
0x00e1f299
0x00e1f29e
0x00e1f2a1
0x00e1f2a3
0x00e1f2a6
0x00e1f2ad
0x00e1f2b4
0x00e1f2b7
0x00e1f2b7
0x00e1f2b9
0x00e1f2ba
0x00e1f2ba
0x00e1f2c8
0x00e1f2cd
0x00e1f2d7
0x00e1f2dd
0x00e1f2df
0x00e1f2e3
0x00e1f2ed
0x00e1f2f0
0x00e1f2f4
0x00e1f2f9
0x00e1f2fc
0x00e1f308
0x00e1f309
0x00e1f30e
0x00e1f313
0x00e1f316
0x00e1f390
0x00e1f39c
0x00e1f3a1
0x00e1f3a6
0x00e1f3a9
0x00000000
0x00e1f3af
0x00e1f3af
0x00e1f3bb
0x00e1f3c3
0x00e1f3c8
0x00e1f3ce
0x00e1f3d5
0x00000000
0x00e1f3d5
0x00000000
0x00e1f318
0x00e1f318
0x00e1f31d
0x00e1f31d
0x00e1f31d
0x00e1f320
0x00e1f320
0x00e1f324
0x00e1f327
0x00e1f32a
0x00000000
0x00e1f32c
0x00e1f32c
0x00e1f32f
0x00e1f331
0x00e1f337
0x00e1f34d
0x00e1f34d
0x00e1f34f
0x00e1f354
0x00000000
0x00e1f339
0x00e1f339
0x00e1f33c
0x00e1f344
0x00e1f347
0x00e1f598
0x00e1f598
0x00000000
0x00000000
0x00000000
0x00e1f347
0x00e1f337
0x00e1f32a
0x00e1f28d
0x00e1f5a2
0x00e1f5a8
0x00e1f5b9
0x00e1f5be
0x00e1f5bf
0x00e1f5c0
0x00e1f5c1
0x00e1f5c3
0x00e1f5c6
0x00e1f5c9
0x00e1f5f3
0x00e1f5f3
0x00e1f5fa
0x00e1f601
0x00e1f605
0x00e1f608
0x00e1f60b
0x00e1f634
0x00e1f634
0x00e1f63b
0x00e1f642
0x00e1f646
0x00e1f60d
0x00e1f60d
0x00e1f60f
0x00e1f610
0x00e1f616
0x00e1f62a
0x00e1f62a
0x00e1f62c
0x00000000
0x00e1f618
0x00e1f618
0x00e1f61b
0x00e1f623
0x00e1f626
0x00000000
0x00e1f628
0x00e1f628
0x00000000
0x00e1f628
0x00e1f626
0x00e1f616
0x00e1f5cb
0x00e1f5cb
0x00e1f5ce
0x00e1f5cf
0x00e1f5d5
0x00e1f5e9
0x00e1f5e9
0x00e1f5eb
0x00e1f5f0
0x00000000
0x00e1f5d7
0x00e1f5d7
0x00e1f5da
0x00e1f5e2
0x00e1f5e5
0x00e1f647
0x00e1f647
0x00e1f64c
0x00e1f64d
0x00e1f64e
0x00e1f64f
0x00e1f650
0x00e1f651
0x00e1f653
0x00e1f655
0x00e1f660
0x00e1f661
0x00e1f664
0x00e1f665
0x00e1f666
0x00e1f667
0x00e1f66e
0x00e1f672
0x00e1f678
0x00e1f67a
0x00e1f67d
0x00e1f684
0x00e1f687
0x00e1f689
0x00e1f68b
0x00e1f692
0x00e1f692
0x00e1f697
0x00e1f697
0x00e1f69c
0x00e1f6a3
0x00e1f6a8
0x00e1f6ab
0x00e1f6b6
0x00e1f6bd
0x00e1f6c4
0x00e1f6c4
0x00e1f6c7
0x00e1f6cd
0x00e1f6d4
0x00e1f6d7
0x00e1f6db
0x00e1f6dd
0x00e1f6e2
0x00e1f6e9
0x00e1f6f5
0x00e1f6f8
0x00e1f6fd
0x00e1f700
0x00e1f70a
0x00e1f711
0x00e1f715
0x00e1f71d
0x00e1f723
0x00e1f728
0x00e1f72a
0x00e1f72d
0x00e1f730
0x00e1f734
0x00e1f736
0x00e1f738
0x00e1f738
0x00e1f73d
0x00e1f742
0x00e1f748
0x00e1f74a
0x00e1f74f
0x00e1f74f
0x00e1f750
0x00e1f756
0x00e1f756
0x00e1f750
0x00e1f742
0x00e1f759
0x00e1f75c
0x00e1f75f
0x00e1f789
0x00e1f78c
0x00e1f793
0x00e1f79a
0x00e1f79e
0x00e1f7a6
0x00e1f7b4
0x00e1f761
0x00e1f761
0x00e1f764
0x00e1f765
0x00e1f767
0x00e1f76d
0x00e1f77f
0x00e1f77f
0x00e1f781
0x00000000
0x00e1f76f
0x00e1f76f
0x00e1f76f
0x00e1f772
0x00e1f77a
0x00e1f77d
0x00e1f7b7
0x00e1f7bc
0x00e1f7bd
0x00e1f7be
0x00e1f7bf
0x00e1f7c0
0x00e1f7c1
0x00e1f7c3
0x00e1f7c5
0x00e1f7d0
0x00e1f7d4
0x00e1f7d9
0x00e1f7db
0x00e1f7de
0x00e1f7df
0x00e1f7e0
0x00e1f7e1
0x00e1f7e5
0x00e1f7eb
0x00e1f7ed
0x00e1f7f0
0x00e1f7f3
0x00e1f7f6
0x00e1f7fc
0x00e1f807
0x00e1f808
0x00e1f810
0x00e1f817
0x00e1f81c
0x00e1f81f
0x00e1f826
0x00e1f82c
0x00e1f831
0x00e1f835
0x00e1f83c
0x00e1f845
0x00e1f847
0x00e1f849
0x00e1ff7e
0x00e1ff87
0x00e1ff93
0x00e1ff96
0x00000000
0x00e1f84f
0x00e1f84f
0x00e1f853
0x00e1f893
0x00e1f893
0x00e1f898
0x00e1f89e
0x00e1f8a0
0x00e1f8a6
0x00e1f8ad
0x00e1f8b0
0x00e1f8b4
0x00e1f8b6
0x00e1f8b9
0x00e1f8bb
0x00e1f9fa
0x00e1f9fd
0x00e1fa03
0x00e1fa06
0x00e1fa09
0x00e1fa09
0x00e1fa0c
0x00e1fa10
0x00e1fa10
0x00e1fa18
0x00e1fa1b
0x00e1fa1e
0x00e1fa23
0x00e1fa26
0x00e1fa30
0x00e1fa3b
0x00e1fa44
0x00e1fa4a
0x00e1fa4e
0x00000000
0x00000000
0x00e1fa54
0x00e1fa5b
0x00e1fa5d
0x00e1fa60
0x00e1fa63
0x00e1fa66
0x00e1fa6b
0x00e1fa6e
0x00e1fa71
0x00e1fa78
0x00e1fa7f
0x00e1fa85
0x00e1fa8b
0x00e1fa8f
0x00e1fa96
0x00e1fa9d
0x00e1faa3
0x00e1faaa
0x00e1faaf
0x00e1fab6
0x00e1fabd
0x00e1fabf
0x00e1fac2
0x00e1fac5
0x00e1fac8
0x00e1facc
0x00e1face
0x00e1fad2
0x00e1fad7
0x00e1fadd
0x00e1fae1
0x00e1fae6
0x00e1faec
0x00e1faec
0x00e1fae6
0x00e1fad7
0x00e1fc11
0x00e1fc14
0x00e1fc1b
0x00e1fc20
0x00e1fc29
0x00e1fc2b
0x00e1fc2d
0x00e1fc62
0x00e1fc71
0x00000000
0x00e1fc2f
0x00e1fc41
0x00e1fc43
0x00e1fc45
0x00000000
0x00e1fc47
0x00e1fc4d
0x00e1fc5c
0x00e1fc5e
0x00e1fc60
0x00e1fc7c
0x00e1fc7f
0x00e1fc82
0x00e1fc87
0x00e1fc8a
0x00e1fc8c
0x00e1fc8f
0x00e1fc93
0x00e1fc95
0x00e1fc98
0x00e1fc9f
0x00e1fca1
0x00e1fc9a
0x00e1fc9a
0x00e1fc9a
0x00e1fca3
0x00e1fca3
0x00e1fca9
0x00e1fcab
0x00000000
0x00e1fcb1
0x00e1fcb1
0x00e1fcb4
0x00000000
0x00e1fcba
0x00e1fcba
0x00e1fcbd
0x00e1fcbf
0x00e1fcc1
0x00e1fcc5
0x00e1fcc5
0x00e1fcc8
0x00e1fccb
0x00e1fcce
0x00e1fcd4
0x00e1fcd7
0x00e1fcd9
0x00e1fcdb
0x00e1fcdb
0x00e1fcdf
0x00e1fce2
0x00e1fce8
0x00e1fcf0
0x00e1fcf8
0x00e1fd00
0x00e1fd08
0x00e1fd10
0x00e1fd18
0x00e1fd1c
0x00e1fd21
0x00e1fd25
0x00e1ff11
0x00e1ff13
0x00e1ff16
0x00e1ff1f
0x00e1ff26
0x00e1ff2d
0x00e1ff30
0x00e1ff35
0x00e1ff39
0x00e1ff3d
0x00000000
0x00e1ff43
0x00e1ff45
0x00e1ff49
0x00e1ff4b
0x00e1ff55
0x00e1ff5a
0x00e1ff62
0x00e1ff64
0x00e1ff69
0x00e1ff69
0x00e1ff6a
0x00e1ff74
0x00e1ff74
0x00e1ff6a
0x00e1ff5a
0x00000000
0x00e1ff4b
0x00e1fd2b
0x00e1fd2e
0x00e1fd32
0x00e1fd35
0x00e1fd3a
0x00e1fd3d
0x00e1fd3f
0x00e1fd42
0x00e1fd47
0x00e1fd47
0x00e1fd4d
0x00e1fd55
0x00e1fd5d
0x00e1fd65
0x00e1fd6d
0x00e1fd71
0x00e1fd74
0x00e1fd76
0x00e1fd78
0x00e1fd7b
0x00e1fd7f
0x00e1fd81
0x00e1fd84
0x00e1fd8b
0x00e1fd8d
0x00e1fd86
0x00e1fd86
0x00e1fd86
0x00e1fd8f
0x00e1fd8f
0x00e1fd95
0x00e1fd97
0x00e1fd9e
0x00e1fda1
0x00e1fda2
0x00e1fdb6
0x00e1fdbf
0x00e1fdc4
0x00e1fd99
0x00e1fd99
0x00e1fd9c
0x00000000
0x00000000
0x00e1fd9c
0x00e1fdce
0x00e1fdda
0x00e1fddf
0x00e1fde2
0x00e1fde6
0x00e1fdeb
0x00e1fdee
0x00e1fdf0
0x00e1fdf4
0x00e1fdf9
0x00e1fdfc
0x00e1fdfc
0x00e1fdff
0x00e1fe03
0x00e1fe08
0x00e1fe0b
0x00e1fe0d
0x00e1fe10
0x00e1fe15
0x00e1fe15
0x00e1fe18
0x00e1fe1b
0x00e1fe1e
0x00e1fe20
0x00e1fe21
0x00e1fe28
0x00e1fe2f
0x00e1fe35
0x00e1fe39
0x00e1fe3e
0x00e1fe41
0x00e1fe43
0x00e1fe46
0x00e1fe4b
0x00e1fe4b
0x00e1fe4e
0x00e1fe52
0x00e1fe56
0x00000000
0x00e1fe5c
0x00e1fe5c
0x00e1fe60
0x00e1fe62
0x00e1fe64
0x00e1fe64
0x00e1fe69
0x00e1fe6e
0x00e1fe74
0x00e1fe76
0x00e1fe7b
0x00e1fe7c
0x00e1fe82
0x00e1fe82
0x00e1fe7c
0x00e1fe85
0x00e1fe85
0x00e1fe88
0x00e1fe88
0x00e1fe8b
0x00e1fe8e
0x00e1febc
0x00e1febc
0x00e1febf
0x00e1fec6
0x00e1fecd
0x00e1fed1
0x00e1fed4
0x00e1ff02
0x00000000
0x00e1fed6
0x00e1fed6
0x00e1fed9
0x00e1feda
0x00e1fedc
0x00e1fee2
0x00e1fef8
0x00e1fef8
0x00e1fefa
0x00000000
0x00e1fee4
0x00e1fee4
0x00e1fee7
0x00e1feef
0x00e1fef2
0x00000000
0x00000000
0x00000000
0x00000000
0x00e1fef2
0x00e1fee2
0x00e1fe90
0x00e1fe90
0x00e1fe93
0x00e1fe94
0x00e1fe96
0x00e1fe9c
0x00e1feb2
0x00e1feb2
0x00e1feb4
0x00e1feb9
0x00000000
0x00e1fe9e
0x00e1fe9e
0x00e1fea1
0x00e1fea9
0x00e1feac
0x00000000
0x00000000
0x00000000
0x00000000
0x00e1feac
0x00e1fe9c
0x00e1fe8e
0x00e1fe56
0x00e1fd25
0x00e1fcb4
0x00000000
0x00000000
0x00000000
0x00e1fc60
0x00e1fc45
0x00000000
0x00e1faf4
0x00e1faf4
0x00e1fafb
0x00e1fb00
0x00e1fb03
0x00e1fb0d
0x00e1fb14
0x00e1fb1b
0x00e1fb21
0x00e1fb26
0x00e1fb2b
0x00e1fb35
0x00e1fb3a
0x00e1fb3d
0x00e1fb40
0x00e1fb42
0x00e1fb48
0x00e1fb4f
0x00e1fb56
0x00e1fb5b
0x00e1fb5f
0x00e1fb5f
0x00e1fb62
0x00e1fb65
0x00e1fb6b
0x00e1fb6e
0x00e1fb9f
0x00e1fb9f
0x00e1fba2
0x00e1fba9
0x00e1fbae
0x00e1fbb5
0x00e1fbb9
0x00e1fbbc
0x00e1fbc2
0x00e1fbc9
0x00e1fbce
0x00e1fbd1
0x00e1fbd8
0x00e1fbdf
0x00e1fbe1
0x00e1fbe7
0x00e1fbea
0x00e1fbee
0x00e1fbf0
0x00e1fbf4
0x00e1fbf9
0x00e1fbff
0x00e1fc03
0x00e1fc08
0x00e1fc0e
0x00e1fc0e
0x00e1fc08
0x00e1fbf9
0x00000000
0x00e1fb70
0x00e1fb70
0x00e1fb73
0x00e1fb74
0x00e1fb76
0x00e1fb7c
0x00e1fb92
0x00e1fb92
0x00e1fb94
0x00e1fb99
0x00e1fb9c
0x00000000
0x00e1fb7e
0x00e1fb7e
0x00e1fb81
0x00e1fb89
0x00e1fb8c
0x00000000
0x00000000
0x00000000
0x00000000
0x00e1fb8c
0x00e1fb7c
0x00000000
0x00e1fb6e
0x00e1f8c1
0x00e1f8c1
0x00e1f8c4
0x00e1f8c7
0x00e1f8cd
0x00e1f8d3
0x00e1f8d6
0x00e1f8de
0x00e1f8e6
0x00e1f8eb
0x00e1f8f2
0x00e1f8fc
0x00e1f900
0x00e1f904
0x00e1f907
0x00e1f90c
0x00e1f911
0x00e1f914
0x00e1f916
0x00e1f918
0x00e1f922
0x00e1f929
0x00e1f92d
0x00e1f930
0x00e1f935
0x00e1f93a
0x00e1f93d
0x00e1f93f
0x00e1f944
0x00e1f946
0x00e1f946
0x00e1f93f
0x00e1f94c
0x00e1f954
0x00e1f959
0x00e1f95c
0x00e1f95c
0x00e1f964
0x00e1f966
0x00e1f969
0x00e1f9f7
0x00000000
0x00e1f96f
0x00e1f96f
0x00e1f972
0x00e1f974
0x00e1f975
0x00e1f97a
0x00e1f97a
0x00e1f97d
0x00e1f980
0x00e1f9ae
0x00e1f9ae
0x00e1f9b1
0x00e1f9b8
0x00e1f9bf
0x00e1f9c3
0x00e1f9c6
0x00000000
0x00e1f9cc
0x00e1f9cc
0x00e1f9cf
0x00e1f9d0
0x00e1f9d2
0x00e1f9d8
0x00e1ffa0
0x00e1ffa0
0x00e1ffa2
0x00000000
0x00e1f9de
0x00e1f9de
0x00e1f9e1
0x00e1f9e9
0x00e1f9ec
0x00000000
0x00e1f9f2
0x00000000
0x00e1f9f2
0x00e1f9ec
0x00e1f9d8
0x00e1f982
0x00e1f982
0x00e1f985
0x00e1f986
0x00e1f988
0x00e1f98e
0x00e1f9a4
0x00e1f9a4
0x00e1f9a6
0x00e1f9ab
0x00000000
0x00e1f990
0x00e1f990
0x00e1f993
0x00e1f99b
0x00e1f99e
0x00e1ffca
0x00e1ffca
0x00e1ffcf
0x00e1ffcf
0x00e1ffd4
0x00e1ffd4
0x00e1ffd9
0x00e1ffd9
0x00e1ffde
0x00e1ffde
0x00e1ffe3
0x00e1ffe3
0x00e1ffe8
0x00e1ffe8
0x00e1ffed
0x00e1fff2
0x00e1fff3
0x00e1fff4
0x00e1fff5
0x00e1fff6
0x00e1fff7
0x00e1fff8
0x00e1fff9
0x00e1fffa
0x00e1fffb
0x00e1fffc
0x00e1fffd
0x00e1fffe
0x00e1ffff
0x00e20000
0x00e20001
0x00e20003
0x00e20005
0x00e20010
0x00e20011
0x00e20012
0x00e20013
0x00e2001a
0x00e2001b
0x00e2001e
0x00e20024
0x00e20026
0x00e20029
0x00e2002c
0x00e2005a
0x00e2005a
0x00e20061
0x00e20068
0x00e2006c
0x00e2006f
0x00e20072
0x00e2009c
0x00e2009c
0x00e200a3
0x00e200aa
0x00e200ae
0x00e200b5
0x00e200b8
0x00e200ba
0x00e200bc
0x00e200bc
0x00e200bf
0x00e200c1
0x00e200c6
0x00e200cc
0x00e200ce
0x00e200d3
0x00e200d4
0x00e200da
0x00e200da
0x00e200d4
0x00e200c6
0x00e200e0
0x00e200ed
0x00e20074
0x00e20074
0x00e20077
0x00e20078
0x00e2007e
0x00e20092
0x00e20092
0x00e20094
0x00000000
0x00e20080
0x00e20080
0x00e20083
0x00e2008b
0x00e2008e
0x00000000
0x00e20090
0x00e20090
0x00000000
0x00e20090
0x00e2008e
0x00e2007e
0x00e2002e
0x00e2002e
0x00e20031
0x00e20032
0x00e20038
0x00e20050
0x00e20050
0x00e20052
0x00e20057
0x00000000
0x00e2003a
0x00e2003a
0x00e2003d
0x00e20045
0x00e20048
0x00e200ee
0x00e200ee
0x00e200f3
0x00e200f4
0x00e200f5
0x00e200f6
0x00e200f7
0x00e200f8
0x00e200f9
0x00e200fa
0x00e200fb
0x00e200fc
0x00e200fd
0x00e200fe
0x00e200ff
0x00e20101
0x00e20111
0x00e20117
0x00e2011c
0x00e2011e
0x00e20127
0x00e2012d
0x00e2012f
0x00e20132
0x00e20141
0x00e20143
0x00e20145
0x00e205f2
0x00e205f7
0x00e205fa
0x00e205fe
0x00e20601
0x00e20603
0x00e20605
0x00e20605
0x00e2060a
0x00e2060f
0x00e20615
0x00e20617
0x00e2061c
0x00e2061c
0x00e2061d
0x00e20623
0x00e20623
0x00e2061d
0x00e2060f
0x00e20626
0x00e20629
0x00e2062c
0x00e2065a
0x00e2065a
0x00e2065d
0x00e20664
0x00e2066b
0x00e2066f
0x00e20672
0x00e206a0
0x00e206a3
0x00e206b0
0x00e206ba
0x00e20674
0x00e20674
0x00e20677
0x00e20678
0x00e2067a
0x00e20680
0x00e20696
0x00e20696
0x00e20698
0x00000000
0x00e20682
0x00e20682
0x00e20685
0x00e2068d
0x00e20690
0x00000000
0x00000000
0x00000000
0x00000000
0x00e20690
0x00e20680
0x00e2062e
0x00e2062e
0x00e20631
0x00e20632
0x00e20634
0x00e2063a
0x00e20650
0x00e20650
0x00e20652
0x00e20657
0x00000000
0x00e2063c
0x00e2063c
0x00e2063f
0x00e20647
0x00e2064a
0x00000000
0x00000000
0x00000000
0x00000000
0x00e2064a
0x00e2063a
0x00000000
0x00e20150
0x00e20153
0x00e20155
0x00000000
0x00000000
0x00e20157
0x00e2015f
0x00e20161
0x00e20164
0x00000000
0x00e20150
0x00e20150
0x00e20153
0x00e20155
0x00000000
0x00000000
0x00000000
0x00e20155
0x00000000
0x00e20171
0x00e20179
0x00e2017b
0x00e2017b
0x00e20187
0x00e20189
0x00e2018b
0x00e205e5
0x00e205ea
0x00000000
0x00e20191
0x00e20191
0x00e20194
0x00e2019b
0x00e2019d
0x00e201a3
0x00e201ad
0x00e201af
0x00e201b1
0x00e201b1
0x00e201b8
0x00e201bd
0x00e201c3
0x00e201c8
0x00e201cb
0x00e201cf
0x00e201d3
0x00e201d8
0x00e201df
0x00e201e6
0x00e201ed
0x00e201f4
0x00e201f9
0x00e201fc
0x00e201ff
0x00e20201
0x00e2071a
0x00e2071f
0x00e20725
0x00e20736
0x00e2073b
0x00e2073b
0x00e20740
0x00e20740
0x00e20745
0x00e20746
0x00e20747
0x00e20748
0x00e20749
0x00e2074a
0x00e2074b
0x00e2074c
0x00e2074d
0x00e2074e
0x00e2074f
0x00e20750
0x00e20751
0x00e20753
0x00e20755
0x00e20760
0x00e20767
0x00e2076c
0x00e2076e
0x00e20771
0x00e20772
0x00e20773
0x00e20774
0x00e20778
0x00e2077e
0x00e20781
0x00e20784
0x00e20787
0x00e2078a
0x00e20ae5
0x00e20ae5
0x00e20ae7
0x00000000
0x00e20790
0x00e20790
0x00000000
0x00e20797
0x00e20799
0x00000000
0x00000000
0x00e207a3
0x00e207a6
0x00e207b0
0x00e207b0
0x00e207b5
0x00e207b6
0x00e207b6
0x00e207b8
0x00e207c0
0x00e207c3
0x00e207c5
0x00e207c7
0x00e207ca
0x00e207cc
0x00e207ce
0x00e207ce
0x00e207d2
0x00e207d5
0x00e207d8
0x00e207df
0x00e207e2
0x00e207e4
0x00e207e6
0x00e207e8
0x00e207ed
0x00e207ed
0x00e207f2
0x00e207f5
0x00e207fd
0x00e20802
0x00e20812
0x00e20814
0x00e20818
0x00e2081b
0x00e20823
0x00e20827
0x00e2082d
0x00e20830
0x00e20861
0x00e20861
0x00e2086b
0x00e20875
0x00e2087c
0x00e20880
0x00e20883
0x00e20886
0x00e208b4
0x00e208b4
0x00e208b7
0x00e208ba
0x00e208c1
0x00e208c8
0x00e208d0
0x00e208d0
0x00e208d5
0x00e208d6
0x00e208d6
0x00e208d8
0x00e208e0
0x00e208e3
0x00e208e5
0x00e208e7
0x00e208ea
0x00e208ec
0x00e208ee
0x00e208ee
0x00e208f2
0x00e208f5
0x00e208f8
0x00e208ff
0x00e20905
0x00e20907
0x00e20909
0x00e2090b
0x00e20913
0x00e20913
0x00e20918
0x00e2091e
0x00e20923
0x00e20928
0x00e20938
0x00e2093a
0x00e2093e
0x00e20941
0x00e20949
0x00e2094d
0x00e20953
0x00e20956
0x00e20987
0x00e20987
0x00e20991
0x00e2099b
0x00e209a2
0x00e209a6
0x00e209a9
0x00e209ac
0x00e209dd
0x00e209dd
0x00e209e1
0x00e209e4
0x00e209e7
0x00e209ea
0x00e209ed
0x00e209f0
0x00e209f2
0x00e209f5
0x00e209fc
0x00e20a03
0x00e20a0a
0x00e20a0b
0x00e20a0c
0x00e20a0e
0x00e20a35
0x00e20a3d
0x00e20a40
0x00e20a45
0x00e20a10
0x00e20a10
0x00e20a14
0x00e20a17
0x00e20a1d
0x00e20a21
0x00e20a23
0x00e20a29
0x00e20a2c
0x00e20a2f
0x00e20a2f
0x00e20a48
0x00e20a4b
0x00e20a4e
0x00e20a53
0x00e20a56
0x00e20a59
0x00e20a87
0x00e20a87
0x00e20a8a
0x00e20a91
0x00e20a98
0x00e20a9c
0x00e20a9f
0x00000000
0x00e20aa1
0x00e20aa1
0x00e20aa4
0x00e20aa6
0x00e20aac
0x00e20abe
0x00e20abe
0x00e20ac0
0x00000000
0x00e20aae
0x00e20aae
0x00e20ab1
0x00e20ab4
0x00e20ab9
0x00e20abc
0x00000000
0x00000000
0x00000000
0x00000000
0x00e20abc
0x00e20aac
0x00e20a5b
0x00e20a5b
0x00e20a5e
0x00e20a5f
0x00e20a61
0x00e20a67
0x00e20a7d
0x00e20a7d
0x00e20a7f
0x00000000
0x00e20a69
0x00e20a69
0x00e20a6c
0x00e20a6f
0x00e20a74
0x00e20a77
0x00000000
0x00000000
0x00000000
0x00000000
0x00e20a77
0x00e20a67
0x00e209ae
0x00e209ae
0x00e209b4
0x00e209b5
0x00e209b7
0x00e209bd
0x00e209d3
0x00e209d3
0x00e209d5
0x00000000
0x00e209bf
0x00e209bf
0x00e209c2
0x00e209c5
0x00e209ca
0x00e209cd
0x00000000
0x00000000
0x00000000
0x00000000
0x00e209cd
0x00e209bd
0x00e20958
0x00e20958
0x00e2095e
0x00e2095f
0x00e20961
0x00e20967
0x00e2097d
0x00e2097d
0x00e2097f
0x00000000
0x00e20969
0x00e20969
0x00e2096c
0x00e2096f
0x00e20974
0x00e20977
0x00000000
0x00000000
0x00000000
0x00000000
0x00e20977
0x00e20967
0x00e20888
0x00e20888
0x00e2088b
0x00e2088c
0x00e2088e
0x00e20894
0x00e208aa
0x00e208aa
0x00e208ac
0x00000000
0x00e20896
0x00e20896
0x00e20899
0x00e2089c
0x00e208a1
0x00e208a4
0x00000000
0x00000000
0x00000000
0x00000000
0x00e208a4
0x00e20894
0x00e20832
0x00e20832
0x00e20838
0x00e20839
0x00e2083b
0x00e20841
0x00e20857
0x00e20857
0x00e20859
0x00000000
0x00e20843
0x00e20843
0x00e20846
0x00e20849
0x00e2084e
0x00e20851
0x00e20b24
0x00e20b29
0x00e20b29
0x00e20b2e
0x00e20b2e
0x00e20b33
0x00e20b33
0x00e20b38
0x00e20b38
0x00e20b3d
0x00e20b44
0x00e20b44
0x00e20b44
0x00e20b45
0x00e20b46
0x00e20b48
0x00e20b4d
0x00e20b4f
0x00e20b51
0x00e20b53
0x00e20b55
0x00e20b57
0x00e20b5b
0x00e20b5d
0x00e20b5e
0x00e20b5f
0x00e20b60
0x00e20b61
0x00e20b63
0x00e20b65
0x00e20b6a
0x00e20b70
0x00e20b71
0x00e20b74
0x00e20b79
0x00e20b7b
0x00e20b7e
0x00e20b7f
0x00e20b80
0x00e20b81
0x00e20b84
0x00e20b8a
0x00e20b8d
0x00e20b90
0x00e20b97
0x00e20b9a
0x00e20ba1
0x00e20ba4
0x00e20ba9
0x00e20baf
0x00e20bb6
0x00e20bbd
0x00e20bc4
0x00e20bc9
0x00e20bcc
0x00e20bce
0x00e20bd0
0x00e20cc4
0x00000000
0x00e20bd6
0x00e20bde
0x00e20be6
0x00e20bed
0x00e20bef
0x00e20bf2
0x00e20bf5
0x00e20bfc
0x00e20bfd
0x00e20c04
0x00e20c09
0x00e20c10
0x00e20c13
0x00e20c16
0x00e20c44
0x00e20c44
0x00e20c48
0x00e20c4e
0x00e20c55
0x00e20c5b
0x00e20c63
0x00e20c68
0x00e20c6d
0x00e20c70
0x00e20c73
0x00e20ca5
0x00e20ca5
0x00e20ca7
0x00e20caa
0x00e20cb1
0x00e20cb2
0x00e20cb3
0x00e20cb4
0x00e20cb7
0x00e20cb7
0x00e20cb9
0x00e20cbe
0x00e20cc0
0x00e20cc1
0x00e20c75
0x00e20c75
0x00e20c75
0x00e20c78
0x00e20c7a
0x00e20c80
0x00e20c9b
0x00e20c9b
0x00e20c9d
0x00000000
0x00e20c82
0x00e20c82
0x00e20c85
0x00e20c88
0x00e20c8d
0x00e20c90
0x00000000
0x00e20c92
0x00000000
0x00e20c92
0x00e20c90
0x00e20c80
0x00e20c18
0x00e20c18
0x00e20c19
0x00e20c20
0x00e20c22
0x00e20c25
0x00e20c27
0x00e20c94
0x00e20cc9
0x00e20cc9
0x00e20cd6
0x00e20cda
0x00e20cdf
0x00e20cdf
0x00e20ce4
0x00e20ce5
0x00e20ce6
0x00e20ce7
0x00e20ce8
0x00e20ce9
0x00e20cea
0x00e20ceb
0x00e20cec
0x00e20ced
0x00e20cee
0x00e20cef
0x00e20cf0
0x00e20cf1
0x00e20cf3
0x00e20cf5
0x00e20cfa
0x00e20d00
0x00e20d01
0x00e20d02
0x00e20d03
0x00e20d0a
0x00e20d0b
0x00e20d0e
0x00e20d14
0x00e20d17
0x00e20d19
0x00e20d1b
0x00e20d1b
0x00e20d1e
0x00e20d20
0x00e20d25
0x00e20d27
0x00e20d29
0x00e20d2b
0x00e20d2d
0x00e20d32
0x00e20d32
0x00e20d33
0x00e20d35
0x00e20d37
0x00e20d39
0x00e20d39
0x00e20d33
0x00e20d25
0x00e20d3c
0x00e20d3f
0x00e20d46
0x00e20d47
0x00e20d48
0x00e20d49
0x00e20d4b
0x00e20d4c
0x00e20c29
0x00e20c29
0x00e20c2e
0x00e20c2e
0x00e20c30
0x00e20c39
0x00e20c41
0x00000000
0x00e20c41
0x00e20c27
0x00e20c16
0x00000000
0x00000000
0x00000000
0x00e20851
0x00e20841
0x00000000
0x00000000
0x00e20aca
0x00e20acc
0x00000000
0x00000000
0x00e20ad3
0x00e20ad5
0x00000000
0x00000000
0x00000000
0x00000000
0x00e20adc
0x00e20ade
0x00e20aec
0x00e20aec
0x00e20af5
0x00e20afc
0x00e20aff
0x00e20b04
0x00e20b09
0x00e20b17
0x00e20b21
0x00000000
0x00000000
0x00e20790
0x00e20207
0x00e2020f
0x00e20214
0x00e20217
0x00e2021e
0x00e20222
0x00e20226
0x00e2052c
0x00e2052e
0x00e20531
0x00e20532
0x00e20537
0x00e2053c
0x00e20540
0x00e20542
0x00e2057a
0x00e2057a
0x00e2057e
0x00e20581
0x00e20583
0x00e20586
0x00e2058b
0x00e2058e
0x00e2058e
0x00000000
0x00e20544
0x00e20544
0x00e20547
0x00e2054c
0x00e2054f
0x00e20552
0x00e20554
0x00000000
0x00e2055a
0x00e20560
0x00e20568
0x00e2056b
0x00e20571
0x00e20577
0x00000000
0x00e20577
0x00e20554
0x00e2022c
0x00e20230
0x00e20231
0x00e20239
0x00e2023d
0x00e20242
0x00e20245
0x00e2024c
0x00e20252
0x00e20257
0x00e2025b
0x00e20262
0x00e20266
0x00e2026b
0x00e2026e
0x00e20272
0x00e20275
0x00e2027a
0x00e2027d
0x00e2027f
0x00e20282
0x00e20287
0x00e20287
0x00e2028a
0x00e2028e
0x00e20292
0x00e204a4
0x00e204a6
0x00e204a9
0x00e204aa
0x00e204af
0x00e204b4
0x00e204b8
0x00e204ba
0x00e204f2
0x00e204f2
0x00e204f5
0x00e204f7
0x00e204fa
0x00e204ff
0x00000000
0x00e204ff
0x00000000
0x00e204bc
0x00e204bc
0x00e204bf
0x00e204c4
0x00e204c7
0x00e204ca
0x00e204cc
0x00000000
0x00e204d2
0x00e204d8
0x00e204e0
0x00e204e3
0x00e204e9
0x00e204ef
0x00000000
0x00e204ef
0x00e204cc
0x00e20298
0x00e202a1
0x00e202ab
0x00e202ae
0x00e202b3
0x00e202b6
0x00e202b8
0x00e202bd
0x00e202c4
0x00e202d0
0x00e202d3
0x00e202d8
0x00e202db
0x00e202df
0x00e202e3
0x00e202ea
0x00e202f6
0x00e202f9
0x00e202fe
0x00e20309
0x00e2030d
0x00e20315
0x00e20322
0x00e2032a
0x00e20338
0x00e2033b
0x00e20340
0x00e20343
0x00e20345
0x00e2034a
0x00e20351
0x00e2035d
0x00e20360
0x00e20365
0x00e20368
0x00e2036c
0x00e20370
0x00e20377
0x00e20383
0x00e20386
0x00e2038b
0x00e20390
0x00e20396
0x00e2039a
0x00e2039f
0x00e203ad
0x00e203b2
0x00e203b7
0x00e203bc
0x00e203bf
0x00e203c1
0x00e203cb
0x00e203d2
0x00e203d9
0x00e203dc
0x00e203e1
0x00e203e4
0x00e203e8
0x00e203ec
0x00e203f3
0x00e203ff
0x00e20402
0x00e20407
0x00e2040c
0x00e20412
0x00e20416
0x00e2041b
0x00e20420
0x00e20424
0x00e20429
0x00e2042e
0x00e20433
0x00e20436
0x00e2043a
0x00e2050c
0x00e2050d
0x00e20511
0x00e20516
0x00e20519
0x00e2051b
0x00e2051e
0x00e20523
0x00e20523
0x00e20526
0x00e20595
0x00e205a0
0x00e205a3
0x00e205a6
0x00e205a8
0x00e205ab
0x00e205b0
0x00e205b3
0x00e205b3
0x00e205ba
0x00e205be
0x00e205c1
0x00e205c3
0x00e205c5
0x00e205c7
0x00e205c9
0x00e205cc
0x00e205d1
0x00e205d4
0x00e205d4
0x00e205da
0x00e205dd
0x00e205e2
0x00e205e2
0x00000000
0x00e20440
0x00e20440
0x00e20442
0x00e20445
0x00e20446
0x00e2044b
0x00e20450
0x00e20454
0x00e20456
0x00e2048e
0x00e2048e
0x00e20491
0x00e20493
0x00e20496
0x00e2049b
0x00e20506
0x00e20506
0x00e20506
0x00e20509
0x00e20509
0x00000000
0x00e20458
0x00e20458
0x00e2045b
0x00e20460
0x00e20463
0x00e20466
0x00e20468
0x00e206c5
0x00e206d3
0x00e206d8
0x00e206e3
0x00e206f4
0x00e206f9
0x00e20704
0x00e20715
0x00000000
0x00e2046e
0x00e20474
0x00e2047c
0x00e2047f
0x00e20485
0x00e2048b
0x00000000
0x00e2048b
0x00e20468
0x00e20456
0x00e2043a
0x00e20292
0x00e20226
0x00e20201
0x00000000
0x00e2018b
0x00e20166
0x00e20169
0x00e2016b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00e2016b
0x00e20150
0x00e2004e
0x00e2004e
0x00000000
0x00e2004e
0x00e20048
0x00e20038
0x00000000
0x00000000
0x00000000
0x00e1f99e
0x00e1f98e
0x00e1f980
0x00e1f969
0x00e1f855
0x00e1f85a
0x00e1f85c
0x00e1f85e
0x00000000
0x00e1f860
0x00e1f862
0x00e1f86b
0x00e1f877
0x00e1f879
0x00e1f881
0x00e1f889
0x00e1ffaa
0x00e1ffac
0x00e1ffaf
0x00e1ffbd
0x00e1ffc7
0x00e1ffc7
0x00e1f85e
0x00e1f853
0x00000000
0x00000000
0x00000000
0x00e1f77d
0x00e1f76d
0x00e1f5e7
0x00e1f5e7
0x00000000
0x00e1f5e7
0x00e1f5e5
0x00e1f5d5
0x00000000
0x00e1f1d0
0x00e1f1d7
0x00e1f1d9
0x00e1f1d9
0x00e1f1d0
0x00e1f1c8
0x00000000
0x00e1f1b1
0x00e1f1b5
0x00e1f1b7
0x00000000
0x00000000
0x00000000
0x00000000
0x00e1f1b7
0x00e1f16b
0x00e1eea8
0x00e1eeaa
0x00e1eead
0x00e1eeb3
0x00e1eeb9
0x00e1eec0
0x00e1eec5
0x00e1eecc
0x00e1eecf
0x00e1eed6
0x00e1eedb
0x00e1eee8
0x00e1eeeb
0x00e1eef2
0x00e1eef8
0x00e1eef8
0x00e1eefe
0x00e1eefe
0x00e1ef01
0x00e1ef0a
0x00e1ef11
0x00e1ef14
0x00e1ef1a
0x00e1ee62
0x00e1ee62
0x00e1ee68
0x00e1ee68
0x00e1ee6b
0x00e1ee6f
0x00e1ee71
0x00e1ee75
0x00e1ee77
0x00e1ee77
0x00e1ee75
0x00000000
0x00e1ef20
0x00e1ef20
0x00000000
0x00e1ef20
0x00e1ef1a
0x00e1eea2
0x00000000

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00E1EFBC

Strings

-USBResult: , xrefs: 00E203C6
malloc failed., xrefs: 00E1F59D, 00E206BD, 00E206D8, 00E206F9, 00E2071A
GetDeviceUrl, xrefs: 00E1F39C
invalid map<K, T> key, xrefs: 00E1FFE8
-USBResponseBuf: , xrefs: 00E20358
HTTPMediator::ConnectBrowser, xrefs: 00E202F1, 00E2037E, 00E203FA
{"URL":"http://localhost:, xrefs: 00E207FD
HTTP/1.1 404 NotFoundContent-Length: 0Content-Type: application/json, xrefs: 00E1F872, 00E20ACC
-USBRequestBuf: , xrefs: 00E202CB
HTTP/1.1 400 BadRequestContent-Length: 0Content-Type: application/json, xrefs: 00E1F386, 00E1F462, 00E20AE7
HTTP/1.1 200 OKContent-Length: , xrefs: 00E20923
HTTP/1.1 503 ServiceUnavailableContent-Length: 0Content-Type: application/json, xrefs: 00E20AD5
Content-Type: application/json, xrefs: 00E20933
HTTP/1.1 600 ResetSessionContent-Length: 0Content-Type: application/json, xrefs: 00E1FF1A, 00E20ADE
#, xrefs: 00E1FF45
CheckConnection, xrefs: 00E1F309
HTTP/1.1 200 OKContent-Length: 0Content-Type: application/json, xrefs: 00E1F41F, 00E20799

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Mtx_destroy_in_situ
String ID: Content-Type: application/json$#$-USBRequestBuf: $-USBResponseBuf: $-USBResult: $CheckConnection$GetDeviceUrl$HTTP/1.1 200 OKContent-Length: $HTTP/1.1 200 OKContent-Length: 0Content-Type: application/json$HTTP/1.1 400 BadRequestContent-Length: 0Content-Type: application/json$HTTP/1.1 404 NotFoundContent-Length: 0Content-Type: application/json$HTTP/1.1 503 ServiceUnavailableContent-Length: 0Content-Type: application/json$HTTP/1.1 600 ResetSessionContent-Length: 0Content-Type: application/json$HTTPMediator::ConnectBrowser$invalid map<K, T> key$malloc failed.${"URL":"http://localhost:
API String ID: 3543493169-694758368
Opcode ID: 25dcdaa15f3704010cb9825cbb0dcbd13cf674314d9d6ee2884ba780f3080bf7
Instruction ID: 9d65eb5eb441652badb884bf4bf892a586eea9f01145fa6e77dd498791934ab4
Opcode Fuzzy Hash: 25dcdaa15f3704010cb9825cbb0dcbd13cf674314d9d6ee2884ba780f3080bf7
Instruction Fuzzy Hash: F3B17F70600601CFDB18CF28D984B69BBF1FF48314F1981A8E819AB7A6D731ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E235D0, Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E00E235D0(void* __ebx, struct _SECURITY_ATTRIBUTES* __ecx, signed int __edx) {
				intOrPtr _v0;
				struct _SECURITY_ATTRIBUTES* _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				struct _SECURITY_ATTRIBUTES* _v36;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				struct _SECURITY_ATTRIBUTES* _v60;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				char _v80;
				char _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				struct _SECURITY_ATTRIBUTES* _v108;
				signed int _v124;
				char _v128;
				struct _SECURITY_ATTRIBUTES* _v132;
				struct _SECURITY_ATTRIBUTES* _v136;
				struct _SECURITY_ATTRIBUTES* _v140;
				struct _SECURITY_ATTRIBUTES* _v144;
				struct _SECURITY_ATTRIBUTES* _v148;
				struct _SECURITY_ATTRIBUTES* _v152;
				struct _SECURITY_ATTRIBUTES* _v156;
				struct _SECURITY_ATTRIBUTES* _v160;
				signed int _v164;
				struct _SECURITY_ATTRIBUTES* _v168;
				struct _SECURITY_ATTRIBUTES* _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				char _v188;
				signed int _v192;
				struct _SECURITY_ATTRIBUTES* _v196;
				char _v212;
				struct _SECURITY_ATTRIBUTES* _v228;
				char _v236;
				signed int _v240;
				void* _v244;
				intOrPtr _v416;
				intOrPtr _v420;
				intOrPtr _v432;
				intOrPtr _v436;
				intOrPtr _v440;
				intOrPtr _v456;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t333;
				signed int _t334;
				DWORD* _t336;
				intOrPtr _t338;
				void* _t342;
				signed int _t345;
				signed int _t348;
				signed int _t351;
				signed int _t354;
				signed int _t355;
				signed int _t357;
				signed int _t364;
				signed int _t365;
				void* _t367;
				long _t372;
				signed int _t381;
				struct _SECURITY_ATTRIBUTES* _t391;
				intOrPtr _t405;
				void* _t410;
				signed int _t411;
				signed int _t413;
				signed int _t414;
				signed int _t426;
				void* _t427;
				signed int _t429;
				signed int _t440;
				char _t441;
				intOrPtr _t442;
				signed int _t443;
				signed int _t450;
				char _t451;
				struct _SECURITY_ATTRIBUTES** _t453;
				signed int _t455;
				signed int _t456;
				char _t457;
				struct _SECURITY_ATTRIBUTES* _t460;
				signed int _t464;
				signed int _t468;
				void* _t469;
				signed int _t481;
				signed int _t489;
				signed int _t499;
				signed int _t509;
				void* _t513;
				void* _t518;
				signed int _t519;
				intOrPtr* _t528;
				signed int _t534;
				signed int _t536;
				signed int _t538;
				signed int _t540;
				struct _SECURITY_ATTRIBUTES* _t547;
				struct _SECURITY_ATTRIBUTES* _t555;
				intOrPtr _t556;
				signed int _t558;
				signed int _t559;
				signed int _t561;
				unsigned int _t565;
				signed int _t567;
				signed int _t573;
				signed int _t574;
				signed int _t577;
				signed int _t587;
				intOrPtr _t596;
				struct _SECURITY_ATTRIBUTES* _t598;
				signed int _t599;
				signed int _t606;
				signed int _t614;
				signed int _t619;
				signed int _t624;
				signed int _t625;
				signed int _t627;
				void* _t633;
				signed int _t638;
				void* _t639;
				signed int _t643;
				signed int _t644;
				intOrPtr _t649;
				void* _t651;
				intOrPtr _t653;
				void* _t654;
				struct _SECURITY_ATTRIBUTES* _t655;
				DWORD* _t656;
				intOrPtr _t657;
				void* _t658;
				void* _t659;
				intOrPtr _t660;
				intOrPtr _t661;
				void* _t662;
				intOrPtr _t663;
				intOrPtr _t664;
				void* _t665;
				char _t666;
				intOrPtr _t667;
				void* _t668;
				void* _t671;
				signed int _t672;
				intOrPtr _t673;
				signed int _t675;
				signed int _t676;
				void* _t680;
				signed int _t682;
				void* _t684;
				signed int _t686;
				signed int _t689;
				signed int _t692;
				signed int _t693;
				signed int _t695;
				signed int _t696;
				void* _t697;
				void* _t699;
				signed int _t700;
				void* _t701;
				void* _t703;
				void* _t706;

				_t625 = __edx;
				_t513 = __ebx;
				_push(0xffffffff);
				_push(0xe60a62);
				_push( *[fs:0x0]);
				_t700 = _t699 - 0xc4;
				_t333 =  *0xe7b068; // 0x1b9618b6
				_t334 = _t333 ^ _t695;
				_v20 = _t334;
				_push(_t334);
				 *[fs:0x0] =  &_v16;
				_v164 = __edx;
				_v160 = __ecx;
				_t336 = 1;
				_t682 = 0;
				_v100 = 0;
				_v132 = 1;
				if(__ecx <= 1) {
					L66:
					 *[fs:0x0] = _v16;
					__eflags = _v20 ^ _t695;
					return E00E2C067(_v20 ^ _t695);
				} else {
					while(1) {
						_t626 =  *((intOrPtr*)(_t625 + _t336 * 4));
						_t528 =  *((intOrPtr*)(_t625 + _t336 * 4));
						_v28 = 0;
						_v24 = 0xf;
						_v44 = 0;
						_t671 = _t528 + 1;
						asm("o16 nop [eax+eax]");
						do {
							_t338 =  *_t528;
							_t528 = _t528 + 1;
						} while (_t338 != 0);
						E00E14C40(_t513,  &_v44, _t626, _t626, _t528 - _t671);
						_v8 = 0;
						_t341 =  >=  ? "-console" : "-console";
						_t627 = _v44;
						_t672 = _v28;
						_t532 =  >=  ? _t627 :  &_v44;
						_v96 = _t627;
						_t342 = E00E190E0( >=  ? _t627 :  &_v44, _t672, 0,  >=  ? "-console" : "-console",  *0xe7bb18);
						_t700 = _t700 + 0xc;
						if(_t342 != 0) {
							__eflags =  *0xe7bb7c - 0x10;
							_t344 =  >=  ? "-dumpDir=" : "-dumpDir=";
							__eflags = _v24 - 0x10;
							_t534 =  >=  ? _v96 :  &_v44;
							_t345 = E00E190E0(_t534, _t672, 0,  >=  ? "-dumpDir=" : "-dumpDir=", "\t");
							_t700 = _t700 + 0xc;
							__eflags = _t345;
							if(_t345 != 0) {
								__eflags =  *0xe7bb4c - 0x10;
								_t347 =  >=  ? "-deviceDir=" : "-deviceDir=";
								__eflags = _v24 - 0x10;
								_t536 =  >=  ? _v96 :  &_v44;
								_t348 = E00E190E0(_t536, _t672, 0,  >=  ? "-deviceDir=" : "-deviceDir=",  *0xe7bb48);
								_t700 = _t700 + 0xc;
								__eflags = _t348;
								if(_t348 != 0) {
									__eflags =  *0xe7bb34 - 0x10;
									_t350 =  >=  ? "-socketDir=" : "-socketDir=";
									__eflags = _v24 - 0x10;
									_t538 =  >=  ? _v96 :  &_v44;
									_t351 = E00E190E0(_t538, _t672, 0,  >=  ? "-socketDir=" : "-socketDir=",  *0xe7bb30);
									_t700 = _t700 + 0xc;
									__eflags = _t351;
									if(_t351 != 0) {
										__eflags =  *0xe7bb94 - 0x10;
										_t353 =  >=  ? "-testDeviceIds=" : "-testDeviceIds=";
										__eflags = _v24 - 0x10;
										_t540 =  >=  ? _v96 :  &_v44;
										_t354 = E00E190E0(_t540, _t672, 0,  >=  ? "-testDeviceIds=" : "-testDeviceIds=",  *0xe7bb90);
										_t700 = _t700 + 0xc;
										__eflags = _t354;
										if(__eflags != 0) {
											goto L6;
										} else {
											_t649 =  *0xe7bb90;
											_v52 = _t354;
											_v48 = 0xf;
											_v68 = _t354;
											__eflags = _t672 - _t649;
											if(_t672 < _t649) {
												goto L68;
											} else {
												_t680 = _t672 - _t649;
												__eflags = _t680 - 0xffffffff;
												_t583 =  <  ? _t680 : _t540 | 0xffffffff;
												__eflags = _v24 - 0x10;
												_t437 =  >=  ? _v96 :  &_v44;
												_t438 = ( >=  ? _v96 :  &_v44) + _t649;
												E00E14C40(_t513,  &_v68, _t649, ( >=  ? _v96 :  &_v44) + _t649,  <  ? _t680 : _t540 | 0xffffffff);
												_t682 = _t682 | 0x00000020;
												_v8 = 1;
												__eflags = _v48 - 0x10;
												_t440 = _v68;
												_t672 = _v52;
												_t586 =  >=  ? _t440 :  &_v68;
												_t650 = _t672;
												_v100 = _t440;
												_t441 = E00E190E0( >=  ? _t440 :  &_v68, _t672, 0, ",", 1);
												_t700 = _t700 + 0xc;
												_v128 = _t441;
												__eflags = _t672;
												if(_t672 == 0) {
													L61:
													_v8 = 0;
													_t442 = _v48;
													__eflags = _t442 - 0x10;
													if(__eflags < 0) {
														L65:
														_t541 = _v44;
														_v52 = 0;
														_v48 = 0xf;
														_v68 = 0;
														goto L7;
													} else {
														_t587 = _v100;
														_t651 = _t442 + 1;
														_t443 = _t587;
														__eflags = _t651 - 0x1000;
														if(__eflags < 0) {
															L64:
															_push(_t651);
															E00E2C347(_t587);
															_t700 = _t700 + 8;
															goto L65;
														} else {
															_t541 =  *(_t587 - 4);
															_t633 = _t651 + 0x23;
															__eflags = _t443 -  *(_t587 - 4) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L67;
															} else {
																goto L64;
															}
														}
													}
												} else {
													do {
														__eflags = _t672 - _t441;
														_v76 = 0;
														_v72 = 0xf;
														_t589 =  <  ? _t672 : _t441;
														_v92 = 0;
														__eflags = _v48 - 0x10;
														_t448 =  >=  ? _v100 :  &_v68;
														E00E14C40(_t513,  &_v92, _t650,  >=  ? _v100 :  &_v68,  <  ? _t672 : _t441);
														_t682 = _t682 | 0x00000040;
														_v100 = _t682;
														_v8 = 2;
														__eflags = _v72 - 0x10;
														_t672 = _v76;
														_t652 = _t672;
														_t541 =  >=  ? _v92 :  &_v92;
														_t450 = E00E190E0(_t541, _t672, 0, "&", 1);
														_t700 = _t700 + 0xc;
														_v96 = _t450;
														__eflags = _t450 - 0xffffffff;
														if(_t450 == 0xffffffff) {
															L42:
															_t451 = _v128;
															__eflags = _t451 - 0xffffffff;
															if(_t451 == 0xffffffff) {
																_v108 = 0;
																_v104 = 0xf;
																_v124 = 0;
																E00E14C40(_t513,  &_v124, _t652, 0xe71f6b, 0);
																_t453 =  &_v124;
																_t682 = _t682 | 0x00000002;
																__eflags = _t682;
																goto L46;
															} else {
																_t659 = _t451 + 1;
																_v140 = 0;
																_t468 = _v52;
																_v136 = 0xf;
																_v156 = 0;
																__eflags = _t468 - _t659;
																if(_t468 < _t659) {
																	goto L68;
																} else {
																	_t469 = _t468 - _t659;
																	__eflags = _t469 - 0xffffffff;
																	_t601 =  <  ? _t469 : _t541 | 0xffffffff;
																	__eflags = _v48 - 0x10;
																	_t471 =  >=  ? _v68 :  &_v68;
																	_t472 = ( >=  ? _v68 :  &_v68) + _t659;
																	E00E14C40(_t513,  &_v156, _t659, ( >=  ? _v68 :  &_v68) + _t659,  <  ? _t469 : _t541 | 0xffffffff);
																	_t453 =  &_v156;
																	_v8 = 6;
																	_t682 = _t682 | 0x00000201;
																	L46:
																	_v96 = _t682;
																	E00E160E0(_t513,  &_v68, _t453);
																	_t455 = _t682;
																	__eflags = _t455 & 0x00000002;
																	if((_t455 & 0x00000002) == 0) {
																		L51:
																		_v8 = 2;
																		__eflags = _t455 & 0x00000001;
																		if((_t455 & 0x00000001) == 0) {
																			L56:
																			_v8 = 1;
																			_t653 = _v72;
																			__eflags = _t653 - 0x10;
																			if(_t653 < 0x10) {
																				goto L60;
																			} else {
																				_t457 = _v92;
																				_t654 = _t653 + 1;
																				_t596 = _t457;
																				__eflags = _t654 - 0x1000;
																				if(_t654 < 0x1000) {
																					L59:
																					_push(_t654);
																					E00E2C347(_t457);
																					_t700 = _t700 + 8;
																					goto L60;
																				} else {
																					_t457 =  *((intOrPtr*)(_t457 - 4));
																					_t633 = _t654 + 0x23;
																					_t541 = _t596 - _t457 + 0xfffffffc;
																					__eflags = _t596 - _t457 + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						goto L67;
																					} else {
																						goto L59;
																					}
																				}
																			}
																		} else {
																			_t655 = _v136;
																			_v96 = _t455 & 0xfffffffe;
																			__eflags = _t655 - 0x10;
																			if(_t655 < 0x10) {
																				goto L56;
																			} else {
																				_t598 = _v156;
																				_t656 =  &(_t655->nLength);
																				_t460 = _t598;
																				__eflags = _t656 - 0x1000;
																				if(_t656 < 0x1000) {
																					L55:
																					_push(_t656);
																					E00E2C347(_t598);
																					_t700 = _t700 + 8;
																					goto L56;
																				} else {
																					_t541 =  *(_t598 - 4);
																					_t633 = _t656 + 0x23;
																					__eflags = _t460 -  *(_t598 - 4) + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						goto L67;
																					} else {
																						goto L55;
																					}
																				}
																			}
																		}
																	} else {
																		_t657 = _v104;
																		_t455 = _t455 & 0xfffffffd;
																		_v96 = _t455;
																		__eflags = _t657 - 0x10;
																		if(_t657 < 0x10) {
																			goto L51;
																		} else {
																			_t599 = _v124;
																			_t658 = _t657 + 1;
																			_t464 = _t599;
																			__eflags = _t658 - 0x1000;
																			if(_t658 < 0x1000) {
																				L50:
																				_push(_t658);
																				E00E2C347(_t599);
																				_t455 = _v96;
																				_t700 = _t700 + 8;
																				goto L51;
																			} else {
																				_t541 =  *(_t599 - 4);
																				_t633 = _t658 + 0x23;
																				__eflags = _t464 -  *(_t599 - 4) + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					goto L67;
																				} else {
																					goto L50;
																				}
																			}
																		}
																	}
																}
															}
														} else {
															_t652 = _t450 + 1;
															_v108 = 0;
															_v104 = 0xf;
															_v124 = 0;
															__eflags = _t672 - _t652;
															if(_t672 < _t652) {
																goto L68;
															} else {
																_t672 = _t672 - _t652;
																__eflags = _t672 - 0xffffffff;
																_t604 =  <  ? _t672 : _t541 | 0xffffffff;
																__eflags = _v72 - 0x10;
																_t475 =  >=  ? _v92 :  &_v92;
																_t476 = ( >=  ? _v92 :  &_v92) + _t652;
																E00E14C40(_t513,  &_v124, _t652, ( >=  ? _v92 :  &_v92) + _t652,  <  ? _t672 : _t541 | 0xffffffff);
																_v8 = 3;
																_t606 = _v96;
																__eflags = _v76 - _t606;
																_v140 = 0;
																_t607 =  <  ? _v76 : _t606;
																__eflags = _v72 - 0x10;
																_t479 =  >=  ? _v92 :  &_v92;
																_v136 = 0xf;
																_v156 = 0;
																E00E14C40(_t513,  &_v156, _t652,  >=  ? _v92 :  &_v92,  <  ? _v76 : _t606);
																_t682 = _t682 | 0x00000180;
																_v100 = _t682;
																asm("movups xmm0, [ebp-0x98]");
																_v156 = 0;
																asm("movups xmm2, [ebp-0x78]");
																_v124 = 0;
																asm("movq xmm1, [ebp-0x88]");
																asm("movq xmm3, [ebp-0x68]");
																asm("movups [ebp-0xd0], xmm0");
																_v140 = 0;
																asm("movq [ebp-0xc0], xmm1");
																_v136 = 0xf;
																asm("movups [ebp-0xb8], xmm2");
																_v108 = 0;
																asm("movq [ebp-0xa8], xmm3");
																_v104 = 0xf;
																_v8 = 5;
																_t481 =  *0xe7ea2c;
																__eflags =  *0xe7ea30 - _t481;
																if( *0xe7ea30 == _t481) {
																	_push( &_v212);
																	_push(_t481);
																	L87();
																} else {
																	asm("movups [eax], xmm0");
																	_v196 = 0;
																	asm("movq [eax+0x10], xmm1");
																	 *(_t481 + 0x28) = 0;
																	 *(_t481 + 0x2c) = 0;
																	asm("movups [eax+0x18], xmm2");
																	_v192 = 0xf;
																	asm("movq [eax+0x28], xmm3");
																	 *0xe7ea2c =  *0xe7ea2c + 0x30;
																	_v212 = 0;
																	_v172 = 0;
																	_v168 = 0xf;
																	_v188 = 0;
																}
																_t541 =  &_v212;
																E00E1F5C0(_t513, _t541, _t672);
																_v8 = 2;
																goto L42;
															}
														}
														goto L117;
														L60:
														__eflags = _v48 - 0x10;
														_t456 = _v68;
														_t672 = _v52;
														_t595 =  >=  ? _t456 :  &_v68;
														_t650 = _t672;
														_v100 = _t456;
														_t441 = E00E190E0( >=  ? _t456 :  &_v68, _t672, 0, ",", 1);
														_t682 = _v96;
														_t700 = _t700 + 0xc;
														_v128 = _t441;
														__eflags = _t672;
													} while (_t672 != 0);
													goto L61;
												}
											}
										}
									} else {
										_t660 =  *0xe7bb30;
										_v108 = _t351;
										_v104 = 0xf;
										_v124 = _t351;
										__eflags = _t672 - _t660;
										if(_t672 < _t660) {
											goto L68;
										} else {
											_t672 = _t672 - _t660;
											__eflags = _t672 - 0xffffffff;
											_t611 =  <  ? _t672 : _t538 | 0xffffffff;
											__eflags = _v24 - 0x10;
											_t484 =  >=  ? _v96 :  &_v44;
											_t485 = ( >=  ? _v96 :  &_v44) + _t660;
											E00E14C40(_t513,  &_v124, _t660, ( >=  ? _v96 :  &_v44) + _t660,  <  ? _t672 : _t538 | 0xffffffff);
											_t682 = _t682 | 0x00000010;
											E00E160E0(_t513, 0xe7baf0,  &_v124);
											_t661 = _v104;
											__eflags = _t661 - 0x10;
											if(__eflags < 0) {
												goto L31;
											} else {
												_t614 = _v124;
												_t662 = _t661 + 1;
												_t489 = _t614;
												__eflags = _t662 - 0x1000;
												if(__eflags < 0) {
													L30:
													_push(_t662);
													E00E2C347(_t614);
													_t700 = _t700 + 8;
													goto L31;
												} else {
													_t541 =  *(_t614 - 4);
													_t633 = _t662 + 0x23;
													__eflags = _t489 -  *(_t614 - 4) + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														goto L67;
													} else {
														goto L30;
													}
												}
											}
										}
									}
								} else {
									_t663 =  *0xe7bb48;
									_v108 = _t348;
									_v104 = 0xf;
									_v124 = _t348;
									__eflags = _t672 - _t663;
									if(_t672 < _t663) {
										goto L68;
									} else {
										_t672 = _t672 - _t663;
										__eflags = _t672 - 0xffffffff;
										_t616 =  <  ? _t672 : _t536 | 0xffffffff;
										__eflags = _v24 - 0x10;
										_t494 =  >=  ? _v96 :  &_v44;
										_t495 = ( >=  ? _v96 :  &_v44) + _t663;
										E00E14C40(_t513,  &_v124, _t663, ( >=  ? _v96 :  &_v44) + _t663,  <  ? _t672 : _t536 | 0xffffffff);
										_t682 = _t682 | 0x00000008;
										E00E160E0(_t513, 0xe7bb50,  &_v124);
										_t664 = _v104;
										__eflags = _t664 - 0x10;
										if(__eflags < 0) {
											goto L31;
										} else {
											_t619 = _v124;
											_t665 = _t664 + 1;
											_t499 = _t619;
											__eflags = _t665 - 0x1000;
											if(__eflags < 0) {
												L24:
												_push(_t665);
												E00E2C347(_t619);
												_t541 = _v44;
												_t700 = _t700 + 8;
												goto L7;
											} else {
												_t541 =  *(_t619 - 4);
												_t633 = _t665 + 0x23;
												__eflags = _t499 -  *(_t619 - 4) + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L67;
												} else {
													goto L24;
												}
											}
										}
									}
								}
							} else {
								_t666 = "\t";
								_v108 = _t345;
								_v104 = 0xf;
								_v124 = _t345;
								__eflags = _t672 - _t666;
								if(_t672 < _t666) {
									goto L68;
								} else {
									_t672 = _t672 - _t666;
									__eflags = _t672 - 0xffffffff;
									_t621 =  <  ? _t672 : _t534 | 0xffffffff;
									__eflags = _v24 - 0x10;
									_t504 =  >=  ? _v96 :  &_v44;
									_t505 = ( >=  ? _v96 :  &_v44) + _t666;
									E00E14C40(_t513,  &_v124, _t666, ( >=  ? _v96 :  &_v44) + _t666,  <  ? _t672 : _t534 | 0xffffffff);
									_t682 = _t682 | 0x00000004;
									E00E160E0(_t513, 0xe7ba90,  &_v124);
									_t667 = _v104;
									__eflags = _t667 - 0x10;
									if(__eflags < 0) {
										L31:
										_t541 = _v44;
										goto L7;
									} else {
										_t624 = _v124;
										_t668 = _t667 + 1;
										_t509 = _t624;
										__eflags = _t668 - 0x1000;
										if(__eflags < 0) {
											L18:
											_push(_t668);
											E00E2C347(_t624);
											_t541 = _v44;
											_t700 = _t700 + 8;
											goto L7;
										} else {
											_t541 =  *(_t624 - 4);
											_t633 = _t668 + 0x23;
											__eflags = _t509 -  *(_t624 - 4) + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												goto L67;
											} else {
												goto L18;
											}
										}
									}
								}
							}
						} else {
							 *0xe7ea10 = 1;
							L6:
							_t541 = _v96;
							L7:
							_v8 = 0xffffffff;
							_t355 = _v24;
							if(_t355 < 0x10) {
								L11:
								_t336 =  &(_v132->nLength);
								_v132 = _t336;
								if(_t336 >= _v160) {
									goto L66;
								} else {
									_t625 = _v164;
									continue;
								}
							} else {
								_t23 = _t355 + 1; // 0x11
								_t633 = _t23;
								_t357 = _t541;
								if(_t633 < 0x1000) {
									L10:
									_push(_t633);
									E00E2C347(_t541);
									_t700 = _t700 + 8;
									goto L11;
								} else {
									_t541 =  *(_t541 - 4);
									_t633 = _t633 + 0x23;
									if(_t357 - _t541 + 0xfffffffc > 0x1f) {
										L67:
										E00E4957C(_t513, _t541, _t633, _t672, __eflags);
										L68:
										E00E160D0(_t513, _t541);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t695);
										_t696 = _t700;
										_push(0xffffffff);
										_push(0xe60afa);
										_push( *[fs:0x0]);
										_t701 = _t700 - 0xb4;
										_t364 =  *0xe7b068; // 0x1b9618b6
										_t365 = _t364 ^ _t696;
										_v240 = _t365;
										_push(_t513);
										_push(_t682);
										_push(_t672);
										_push(_t365);
										 *[fs:0x0] =  &_v236;
										_t673 = _v212;
										_v228 = 0;
										_t367 = CreateMutexA(0, 0, "Global\\HttpToUsbBridge"); // executed
										_t514 = CloseHandle;
										_t684 = _t367;
										_v244 = _t684;
										__eflags = _t684;
										if(_t684 == 0) {
											L85:
											ReleaseMutex(_t684);
											CloseHandle(_t684);
											 *[fs:0x0] = _v20;
											__eflags = _v24 ^ _t696;
											return E00E2C067(_v24 ^ _t696);
										} else {
											_t372 = GetLastError();
											__eflags = _t372 - 0xb7;
											if(_t372 != 0xb7) {
												_t634 = _t673;
												E00E235D0(CloseHandle, _v0, _t673);
												E00E43C10(_t673,  &_v168, 0, 0x8c);
												_v168 = 0;
												_v164 = 0;
												_v12 = 1;
												_v160 = 0;
												_v156 = 0;
												_v160 = E00E21430();
												_v12 = 2;
												_v152 = 0;
												_v148 = 0;
												_v144 = 0;
												_v148 = E00E246D0(CloseHandle, _v0, _t673, _t673, __eflags);
												_v12 = 3;
												_v140 = 0;
												_v136 = 0;
												_v132 = 0;
												_v136 = E00E213C0();
												E00E2AE17(__eflags,  &_v128, 2);
												_v80 = 0;
												_v60 = 0;
												_v56 = 0xf;
												_v76 = 0;
												_v36 = 0;
												_v32 = 0xf;
												_v52 = 0;
												_push(0x1c);
												_v12 = 7;
												_t381 = E00E2C07D(_t673, __eflags);
												_v172 = _t381;
												_t703 = _t701 + 0x18;
												 *(_t381 + 4) = 1;
												_t547 = _t381 + 0xc;
												 *(_t381 + 8) = 1;
												 *_t381 = 0xe72778;
												_t547->nLength = 0xe729e8;
												_t547->lpSecurityDescriptor = 0;
												_t547->bInheritHandle = 0xffffffff;
												 *(_t547 + 0xc) = 0xffffffff;
												_t675 = _v164;
												_v168 = _t547;
												_v164 = _t381;
												_v12 = 8;
												__eflags = _t675;
												if(_t675 != 0) {
													__eflags = CloseHandle;
													asm("lock xadd [edi+0x4], eax");
													if(CloseHandle == 0) {
														 *((intOrPtr*)( *_t675))();
														asm("lock xadd [edi+0x8], ebx");
														__eflags = (CloseHandle | 0xffffffff) == 1;
														if((CloseHandle | 0xffffffff) == 1) {
															 *((intOrPtr*)( *_t675 + 4))();
														}
													}
													_t514 = CloseHandle;
												}
												_v12 = 0xa;
												__eflags =  *0xe7bb60;
												if( *0xe7bb60 == 0) {
													L82:
													__eflags =  *0xe7bb00;
													if( *0xe7bb00 != 0) {
														_v172 = _t703 - 0xc;
														E00E22230(_t514, _t703 - 0xc, _t675, _t684, 0xe7ea28);
														_v12 = 0xc;
														E00E12D00(_t634, 0xe7baf0);
														_v12 = 0xa;
														E00E1F650(_t514,  &_v168, _t634);
													}
													E00E1F120(_t514,  &_v168);
													E00E1EDB0(_t514,  &_v168);
													goto L85;
												} else {
													E00E12D00(_t634, 0xe7bb50);
													_v12 = 0xb;
													__eflags = _v176 - 0x10;
													_t389 =  >=  ? _v196 :  &_v196;
													E00E14C40(_t514,  &_v76, _t634,  >=  ? _v196 :  &_v196, _v180);
													_v12 = 0xa;
													_t634 = _v176;
													__eflags = _t634 - 0x10;
													if(_t634 < 0x10) {
														goto L82;
													} else {
														_t555 = _v196;
														_t634 = _t634 + 1;
														_t391 = _t555;
														__eflags = _t634 - 0x1000;
														if(_t634 < 0x1000) {
															L81:
															_push(_t634);
															E00E2C347(_t555);
															_t703 = _t703 + 8;
															goto L82;
														} else {
															_t555 =  *(_t555 - 4);
															_t634 = _t634 + 0x23;
															__eflags = _t391 - _t555 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																E00E4957C(_t514, _t555, _t634, _t675, __eflags);
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t696);
																_t697 = _t703;
																_t706 = _t703 - 0x14;
																_t556 = _v420;
																_push(_t514);
																_v440 = _v416;
																_push(_t684);
																_t686 =  *0xe7ea28; // 0x0
																_v436 = _t556;
																_t558 =  *0xe7ea2c; // 0x0
																_t559 = _t558 - _t686;
																_v432 = (0x2aaaaaab * (_t556 - _t686) >> 0x20 >> 3 >> 0x1f) + (0x2aaaaaab * (_t556 - _t686) >> 0x20 >> 3);
																_push(_t675);
																_t638 = 0x2aaaaaab * _t559 >> 0x20 >> 3;
																_t518 = (_t638 >> 0x1f) + _t638;
																__eflags = _t518 - 0x5555555;
																if(_t518 == 0x5555555) {
																	L112:
																	E00E19CA0(_t559);
																	asm("int3");
																	_push(_t697);
																	_t405 = _v456;
																	_push(_t686);
																	_push(_t675);
																	_t676 = _t638;
																	__eflags = _t559 - _t676;
																	if(_t559 != _t676) {
																		_t639 = _t559 + 0x2c;
																		_t689 = _t405 - _t559;
																		__eflags = _t689;
																		do {
																			 *(_t405 + 0x10) = 0;
																			_t639 = _t639 + 0x30;
																			 *(_t405 + 0x14) = 0;
																			asm("movups xmm0, [edx-0x5c]");
																			asm("movups [eax], xmm0");
																			asm("movq xmm0, [edx-0x4c]");
																			asm("movq [eax+0x10], xmm0");
																			 *(_t639 - 0x4c) = 0;
																			 *((intOrPtr*)(_t639 - 0x48)) = 0xf;
																			 *((char*)(_t639 - 0x5c)) = 0;
																			 *(_t405 + 0x28) = 0;
																			 *(_t689 + _t639 - 0x30) = 0;
																			asm("movups xmm0, [edx-0x44]");
																			asm("movups [eax+0x18], xmm0");
																			asm("movq xmm0, [edx-0x34]");
																			asm("movq [eax+0x28], xmm0");
																			_t405 = _t405 + 0x30;
																			 *(_t639 - 0x34) = 0;
																			 *((intOrPtr*)(_t639 - 0x30)) = 0xf;
																			 *((char*)(_t639 - 0x44)) = 0;
																			__eflags = _t639 - 0x2c - _t676;
																		} while (_t639 - 0x2c != _t676);
																	}
																	return _t405;
																} else {
																	_t561 =  *0xe7ea30; // 0x0
																	_t519 = _t518 + 1;
																	_v28 = _t519;
																	_t565 = (0x2aaaaaab * (_t561 - _t686) >> 0x20 >> 3 >> 0x1f) + (0x2aaaaaab * (_t561 - _t686) >> 0x20 >> 3);
																	_t643 = _t565 >> 1;
																	__eflags = _t565 - 0x5555555 - _t643;
																	if(_t565 <= 0x5555555 - _t643) {
																		_t410 = _t643 + _t565;
																		__eflags = _t410 - _t519;
																		_t411 =  <  ? _t519 : _t410;
																	} else {
																		_t411 = _t519;
																	}
																	_t567 = _t411 + _t411 * 2 << 4;
																	_v32 = _t567;
																	__eflags = _t411 - 0x5555555;
																	if(_t411 <= 0x5555555) {
																		__eflags = _t567 - 0x1000;
																		if(_t567 < 0x1000) {
																			__eflags = _t567;
																			if(__eflags == 0) {
																				_t675 = 0;
																				__eflags = 0;
																			} else {
																				_push(_t567);
																				_t426 = E00E2C07D(_t643, __eflags);
																				_t706 = _t706 + 4;
																				_t675 = _t426;
																			}
																			goto L99;
																		} else {
																			goto L94;
																		}
																	} else {
																		_t567 = _t567 | 0xffffffff;
																		L94:
																		_t427 = _t567 + 0x23;
																		_t638 = _t643 | 0xffffffff;
																		__eflags = _t427 - _t567;
																		_t428 =  <=  ? _t638 : _t427;
																		_push( <=  ? _t638 : _t427);
																		_t429 = E00E2C07D(_t638, _t427 - _t567);
																		_t706 = _t706 + 4;
																		__eflags = _t429;
																		if(__eflags == 0) {
																			L111:
																			E00E4957C(_t519, _t559, _t638, _t675, __eflags);
																			goto L112;
																		} else {
																			_t285 = _t429 + 0x23; // 0x23
																			_t675 = _t285 & 0xffffffe0;
																			 *(_t675 - 4) = _t429;
																			L99:
																			_push(_t567);
																			_push(_t675);
																			_t413 = _v24;
																			_t692 = (_v16 + _v16 * 2 << 4) + _t675;
																			_v16 = _t692;
																			 *(_t692 + 0x10) = 0;
																			 *(_t692 + 0x14) = 0;
																			asm("movups xmm0, [eax]");
																			asm("movups [esi], xmm0");
																			asm("movq xmm0, [eax+0x10]");
																			asm("movq [esi+0x10], xmm0");
																			 *(_t413 + 0x10) = 0;
																			 *((intOrPtr*)(_t413 + 0x14)) = 0xf;
																			 *_t413 = 0;
																			 *(_t692 + 0x28) = 0;
																			 *(_t692 + 0x2c) = 0;
																			asm("movups xmm0, [eax+0x18]");
																			asm("movups [esi+0x18], xmm0");
																			asm("movq xmm0, [eax+0x28]");
																			asm("movq [esi+0x28], xmm0");
																			 *(_t413 + 0x28) = 0;
																			 *((intOrPtr*)(_t413 + 0x2c)) = 0xf;
																			 *((char*)(_t413 + 0x18)) = 0;
																			_t644 =  *0xe7ea2c; // 0x0
																			_t414 = _v20;
																			__eflags = _t414 - _t644;
																			if(_t414 != _t644) {
																				L113();
																				_t302 = _t692 + 0x30; // 0x30
																				_t706 = _t706 + 4;
																			}
																			L113();
																			_t693 =  *0xe7ea28; // 0x0
																			_t706 = _t706 + 8;
																			__eflags = _t693;
																			if(_t693 == 0) {
																				L110:
																				 *0xe7ea28 = _t675;
																				 *0xe7ea2c = (_t519 + _t519 * 2 << 4) + _t675;
																				_t573 = _v32 + _t675;
																				__eflags = _t573;
																				 *0xe7ea30 = _t573;
																				return _v16;
																			} else {
																				_t519 =  *0xe7ea2c; // 0x0
																				__eflags = _t693 - _t519;
																				if(_t693 != _t519) {
																					do {
																						E00E1F5C0(_t519, _t693, _t675);
																						_t693 = _t693 + 0x30;
																						__eflags = _t693 - _t519;
																					} while (_t693 != _t519);
																					_t693 =  *0xe7ea28; // 0x0
																				}
																				_t574 =  *0xe7ea30; // 0x0
																				_t577 = (0x2aaaaaab * (_t574 - _t693) >> 0x20 >> 3 >> 0x1f) + (0x2aaaaaab * (_t574 - _t693) >> 0x20 >> 3) + ((0x2aaaaaab * (_t574 - _t693) >> 0x20 >> 3 >> 0x1f) + (0x2aaaaaab * (_t574 - _t693) >> 0x20 >> 3)) * 2 << 4;
																				__eflags = _t577 - 0x1000;
																				if(_t577 < 0x1000) {
																					L109:
																					_push(_t577);
																					E00E2C347(_t693);
																					_t519 = _v28;
																					goto L110;
																				} else {
																					_t638 =  *(_t693 - 4);
																					_t559 = _t577 + 0x23;
																					_t686 = _t693 - _t638;
																					_t311 = _t686 - 4; // -4
																					__eflags = _t311 - 0x1f;
																					if(__eflags > 0) {
																						goto L111;
																					} else {
																						_t693 = _t638;
																						goto L109;
																					}
																				}
																			}
																		}
																	}
																}
															} else {
																goto L81;
															}
														}
													}
												}
											} else {
												CloseHandle(_t684);
												goto L85;
											}
										}
									} else {
										goto L10;
									}
								}
							}
						}
						goto L117;
					}
				}
				L117:
			}

0x00e235d0
0x00e235d0
0x00e235d3
0x00e235d5
0x00e235e0
0x00e235e1
0x00e235e7
0x00e235ec
0x00e235ee
0x00e235f3
0x00e235f7
0x00e235fd
0x00e23603
0x00e23609
0x00e2360e
0x00e23610
0x00e23613
0x00e23618
0x00e23dc1
0x00e23dc4
0x00e23dd1
0x00e23ddb
0x00000000
0x00e23620
0x00e23620
0x00e23623
0x00e23625
0x00e2362c
0x00e23633
0x00e23637
0x00e2363a
0x00e23640
0x00e23640
0x00e23642
0x00e23643
0x00e2364e
0x00e23653
0x00e2366f
0x00e2367a
0x00e2367d
0x00e23680
0x00e23684
0x00e2368b
0x00e23690
0x00e23695
0x00e236f9
0x00e23710
0x00e23717
0x00e2371c
0x00e23722
0x00e23727
0x00e2372a
0x00e2372c
0x00e237c0
0x00e237d7
0x00e237de
0x00e237e3
0x00e237e9
0x00e237ee
0x00e237f1
0x00e237f3
0x00e23887
0x00e2389e
0x00e238a5
0x00e238aa
0x00e238b0
0x00e238b5
0x00e238b8
0x00e238ba
0x00e2394a
0x00e23961
0x00e23968
0x00e2396d
0x00e23973
0x00e23978
0x00e2397b
0x00e2397d
0x00000000
0x00e23983
0x00e23983
0x00e23989
0x00e2398c
0x00e23993
0x00e23996
0x00e23998
0x00000000
0x00e2399e
0x00e2399e
0x00e239a6
0x00e239a9
0x00e239ac
0x00e239b1
0x00e239b8
0x00e239bb
0x00e239c0
0x00e239c3
0x00e239ca
0x00e239ce
0x00e239d1
0x00e239d4
0x00e239e0
0x00e239e2
0x00e239e5
0x00e239ea
0x00e239ed
0x00e239f0
0x00e239f2
0x00e23d71
0x00e23d71
0x00e23d75
0x00e23d78
0x00e23d7b
0x00e23da7
0x00e23da7
0x00e23daa
0x00e23db1
0x00e23db8
0x00000000
0x00e23d7d
0x00e23d7d
0x00e23d80
0x00e23d83
0x00e23d85
0x00e23d8b
0x00e23d9d
0x00e23d9d
0x00e23d9f
0x00e23da4
0x00000000
0x00e23d8d
0x00e23d8d
0x00e23d90
0x00e23d98
0x00e23d9b
0x00000000
0x00000000
0x00000000
0x00000000
0x00e23d9b
0x00e23d8b
0x00e23a00
0x00e23a00
0x00e23a00
0x00e23a02
0x00e23a0b
0x00e23a12
0x00e23a15
0x00e23a19
0x00e23a21
0x00e23a29
0x00e23a2e
0x00e23a31
0x00e23a34
0x00e23a3b
0x00e23a3f
0x00e23a42
0x00e23a44
0x00e23a51
0x00e23a56
0x00e23a59
0x00e23a5c
0x00e23a5f
0x00e23bdc
0x00e23bdc
0x00e23bdf
0x00e23be2
0x00e23c4e
0x00e23c55
0x00e23c5c
0x00e23c60
0x00e23c65
0x00e23c68
0x00e23c68
0x00000000
0x00e23be4
0x00e23be4
0x00e23be7
0x00e23bf1
0x00e23bf4
0x00e23bfe
0x00e23c05
0x00e23c07
0x00000000
0x00e23c0d
0x00e23c0d
0x00e23c12
0x00e23c15
0x00e23c18
0x00e23c1f
0x00e23c24
0x00e23c2d
0x00e23c32
0x00e23c38
0x00e23c3c
0x00e23c6b
0x00e23c6f
0x00e23c72
0x00e23c77
0x00e23c79
0x00e23c7b
0x00e23cba
0x00e23cba
0x00e23cc1
0x00e23cc3
0x00e23d05
0x00e23d05
0x00e23d09
0x00e23d0c
0x00e23d0f
0x00000000
0x00e23d11
0x00e23d11
0x00e23d14
0x00e23d15
0x00e23d17
0x00e23d1d
0x00e23d33
0x00e23d33
0x00e23d35
0x00e23d3a
0x00000000
0x00e23d1f
0x00e23d1f
0x00e23d22
0x00e23d27
0x00e23d2a
0x00e23d2d
0x00000000
0x00000000
0x00000000
0x00000000
0x00e23d2d
0x00e23d1d
0x00e23cc5
0x00e23cc5
0x00e23cce
0x00e23cd1
0x00e23cd4
0x00000000
0x00e23cd6
0x00e23cd6
0x00e23cdc
0x00e23cdd
0x00e23cdf
0x00e23ce5
0x00e23cfb
0x00e23cfb
0x00e23cfd
0x00e23d02
0x00000000
0x00e23ce7
0x00e23ce7
0x00e23cea
0x00e23cf2
0x00e23cf5
0x00000000
0x00000000
0x00000000
0x00000000
0x00e23cf5
0x00e23ce5
0x00e23cd4
0x00e23c7d
0x00e23c7d
0x00e23c80
0x00e23c83
0x00e23c86
0x00e23c89
0x00000000
0x00e23c8b
0x00e23c8b
0x00e23c8e
0x00e23c8f
0x00e23c91
0x00e23c97
0x00e23cad
0x00e23cad
0x00e23caf
0x00e23cb4
0x00e23cb7
0x00000000
0x00e23c99
0x00e23c99
0x00e23c9c
0x00e23ca4
0x00e23ca7
0x00000000
0x00000000
0x00000000
0x00000000
0x00e23ca7
0x00e23c97
0x00e23c89
0x00e23c7b
0x00e23c07
0x00e23a65
0x00e23a65
0x00e23a68
0x00e23a6f
0x00e23a76
0x00e23a7a
0x00e23a7c
0x00000000
0x00e23a82
0x00e23a82
0x00e23a8a
0x00e23a8d
0x00e23a90
0x00e23a95
0x00e23a9c
0x00e23a9f
0x00e23aa4
0x00e23aab
0x00e23aae
0x00e23ab1
0x00e23abb
0x00e23abf
0x00e23ac4
0x00e23acf
0x00e23ad9
0x00e23ae0
0x00e23ae5
0x00e23aeb
0x00e23aee
0x00e23af5
0x00e23afc
0x00e23b00
0x00e23b04
0x00e23b0c
0x00e23b11
0x00e23b18
0x00e23b22
0x00e23b2a
0x00e23b34
0x00e23b3b
0x00e23b42
0x00e23b4a
0x00e23b51
0x00e23b55
0x00e23b5a
0x00e23b60
0x00e23bc6
0x00e23bc7
0x00e23bc8
0x00e23b62
0x00e23b62
0x00e23b65
0x00e23b6f
0x00e23b74
0x00e23b7b
0x00e23b82
0x00e23b86
0x00e23b90
0x00e23b95
0x00e23b9c
0x00e23ba3
0x00e23bad
0x00e23bb7
0x00e23bb7
0x00e23bcd
0x00e23bd3
0x00e23bd8
0x00000000
0x00e23bd8
0x00e23a7c
0x00000000
0x00e23d3d
0x00e23d3d
0x00e23d44
0x00e23d47
0x00e23d4a
0x00e23d56
0x00e23d58
0x00e23d5b
0x00e23d60
0x00e23d63
0x00e23d66
0x00e23d69
0x00e23d69
0x00000000
0x00e23a00
0x00e239f2
0x00e23998
0x00e238c0
0x00e238c0
0x00e238c6
0x00e238c9
0x00e238d0
0x00e238d3
0x00e238d5
0x00000000
0x00e238db
0x00e238db
0x00e238e3
0x00e238e6
0x00e238e9
0x00e238ee
0x00e238f5
0x00e238f8
0x00e23906
0x00e23909
0x00e2390e
0x00e23911
0x00e23914
0x00000000
0x00e23916
0x00e23916
0x00e23919
0x00e2391a
0x00e2391c
0x00e23922
0x00e23938
0x00e23938
0x00e2393a
0x00e2393f
0x00000000
0x00e23924
0x00e23924
0x00e23927
0x00e2392f
0x00e23932
0x00000000
0x00000000
0x00000000
0x00000000
0x00e23932
0x00e23922
0x00e23914
0x00e238d5
0x00e237f9
0x00e237f9
0x00e237ff
0x00e23802
0x00e23809
0x00e2380c
0x00e2380e
0x00000000
0x00e23814
0x00e23814
0x00e2381c
0x00e2381f
0x00e23822
0x00e23827
0x00e2382e
0x00e23831
0x00e2383f
0x00e23842
0x00e23847
0x00e2384a
0x00e2384d
0x00000000
0x00e23853
0x00e23853
0x00e23856
0x00e23857
0x00e23859
0x00e2385f
0x00e23875
0x00e23875
0x00e23877
0x00e2387c
0x00e2387f
0x00000000
0x00e23861
0x00e23861
0x00e23864
0x00e2386c
0x00e2386f
0x00000000
0x00000000
0x00000000
0x00000000
0x00e2386f
0x00e2385f
0x00e2384d
0x00e2380e
0x00e23732
0x00e23732
0x00e23738
0x00e2373b
0x00e23742
0x00e23745
0x00e23747
0x00000000
0x00e2374d
0x00e2374d
0x00e23755
0x00e23758
0x00e2375b
0x00e23760
0x00e23767
0x00e2376a
0x00e23778
0x00e2377b
0x00e23780
0x00e23783
0x00e23786
0x00e23942
0x00e23942
0x00000000
0x00e2378c
0x00e2378c
0x00e2378f
0x00e23790
0x00e23792
0x00e23798
0x00e237ae
0x00e237ae
0x00e237b0
0x00e237b5
0x00e237b8
0x00000000
0x00e2379a
0x00e2379a
0x00e2379d
0x00e237a5
0x00e237a8
0x00000000
0x00000000
0x00000000
0x00000000
0x00e237a8
0x00e23798
0x00e23786
0x00e23747
0x00e23697
0x00e23697
0x00e2369e
0x00e2369e
0x00e236a1
0x00e236a1
0x00e236a8
0x00e236ae
0x00e236db
0x00e236de
0x00e236df
0x00e236e8
0x00000000
0x00e236ee
0x00e236ee
0x00000000
0x00e236ee
0x00e236b0
0x00e236b0
0x00e236b0
0x00e236b3
0x00e236bb
0x00e236d1
0x00e236d1
0x00e236d3
0x00e236d8
0x00000000
0x00e236bd
0x00e236bd
0x00e236c0
0x00e236cb
0x00e23ddc
0x00e23ddc
0x00e23de1
0x00e23de1
0x00e23de6
0x00e23de7
0x00e23de8
0x00e23de9
0x00e23dea
0x00e23deb
0x00e23dec
0x00e23ded
0x00e23dee
0x00e23def
0x00e23df0
0x00e23df1
0x00e23df3
0x00e23df5
0x00e23e00
0x00e23e01
0x00e23e07
0x00e23e0c
0x00e23e0e
0x00e23e11
0x00e23e12
0x00e23e13
0x00e23e14
0x00e23e18
0x00e23e1e
0x00e23e2a
0x00e23e31
0x00e23e37
0x00e23e3d
0x00e23e3f
0x00e23e42
0x00e23e44
0x00e24093
0x00e24094
0x00e2409b
0x00e240a2
0x00e240b0
0x00e240ba
0x00e23e4a
0x00e23e4a
0x00e23e50
0x00e23e55
0x00e23e62
0x00e23e64
0x00e23e77
0x00e23e7f
0x00e23e89
0x00e23e93
0x00e23e97
0x00e23ea1
0x00e23eb0
0x00e23eb6
0x00e23eba
0x00e23ec4
0x00e23ece
0x00e23edd
0x00e23ee3
0x00e23ee7
0x00e23eee
0x00e23ef5
0x00e23f01
0x00e23f0a
0x00e23f0f
0x00e23f13
0x00e23f1a
0x00e23f21
0x00e23f25
0x00e23f2c
0x00e23f33
0x00e23f37
0x00e23f39
0x00e23f3d
0x00e23f42
0x00e23f48
0x00e23f4b
0x00e23f52
0x00e23f55
0x00e23f5c
0x00e23f62
0x00e23f68
0x00e23f6c
0x00e23f73
0x00e23f7a
0x00e23f80
0x00e23f86
0x00e23f8c
0x00e23f90
0x00e23f92
0x00e23f94
0x00e23f99
0x00e23f9e
0x00e23fa4
0x00e23fa6
0x00e23fab
0x00e23fac
0x00e23fb2
0x00e23fb2
0x00e23fac
0x00e23fb5
0x00e23fb5
0x00e23fbb
0x00e23fbf
0x00e23fc6
0x00e2403d
0x00e2403d
0x00e24044
0x00e2404b
0x00e24056
0x00e2405e
0x00e24069
0x00e24074
0x00e24078
0x00e24078
0x00e24083
0x00e2408e
0x00000000
0x00e23fc8
0x00e23fd3
0x00e23fd8
0x00e23fe2
0x00e23ff2
0x00e23ffa
0x00e23fff
0x00e24003
0x00e24009
0x00e2400c
0x00000000
0x00e2400e
0x00e2400e
0x00e24014
0x00e24015
0x00e24017
0x00e2401d
0x00e24033
0x00e24033
0x00e24035
0x00e2403a
0x00000000
0x00e2401f
0x00e2401f
0x00e24022
0x00e2402a
0x00e2402d
0x00e240bb
0x00e240c0
0x00e240c1
0x00e240c2
0x00e240c3
0x00e240c4
0x00e240c5
0x00e240c6
0x00e240c7
0x00e240c8
0x00e240c9
0x00e240ca
0x00e240cb
0x00e240cc
0x00e240cd
0x00e240ce
0x00e240cf
0x00e240d0
0x00e240d1
0x00e240d3
0x00e240d6
0x00e240dc
0x00e240dd
0x00e240e5
0x00e240e6
0x00e240ec
0x00e240f3
0x00e240fc
0x00e24105
0x00e2410f
0x00e24110
0x00e24118
0x00e2411a
0x00e24120
0x00e242fa
0x00e242fa
0x00e242ff
0x00e24300
0x00e24303
0x00e24306
0x00e24307
0x00e24308
0x00e2430a
0x00e2430c
0x00e24310
0x00e24313
0x00e24313
0x00e24315
0x00e24315
0x00e2431c
0x00e2431f
0x00e24329
0x00e2432d
0x00e24330
0x00e24335
0x00e2433a
0x00e24341
0x00e24348
0x00e2434c
0x00e24353
0x00e2435b
0x00e2435f
0x00e24363
0x00e24368
0x00e2436d
0x00e24370
0x00e24377
0x00e2437e
0x00e24382
0x00e24382
0x00e24315
0x00e24389
0x00e24126
0x00e24126
0x00e24133
0x00e2413b
0x00e24146
0x00e2414a
0x00e2414e
0x00e24150
0x00e24156
0x00e24159
0x00e2415b
0x00e24152
0x00e24152
0x00e24152
0x00e24161
0x00e24164
0x00e24167
0x00e2416c
0x00e24173
0x00e24179
0x00e241a2
0x00e241a4
0x00e241b3
0x00e241b3
0x00e241a6
0x00e241a6
0x00e241a7
0x00e241ac
0x00e241af
0x00e241af
0x00000000
0x00000000
0x00000000
0x00000000
0x00e2416e
0x00e2416e
0x00e2417b
0x00e2417b
0x00e2417e
0x00e24181
0x00e24183
0x00e24186
0x00e24187
0x00e2418c
0x00e2418f
0x00e24191
0x00e242f5
0x00e242f5
0x00000000
0x00e24197
0x00e24197
0x00e2419a
0x00e2419d
0x00e241b5
0x00e241b8
0x00e241b9
0x00e241bd
0x00e241c3
0x00e241c5
0x00e241c8
0x00e241cf
0x00e241d6
0x00e241d9
0x00e241dc
0x00e241e1
0x00e241e6
0x00e241ed
0x00e241f4
0x00e241f7
0x00e241fe
0x00e24205
0x00e24209
0x00e2420d
0x00e24212
0x00e24217
0x00e2421e
0x00e24225
0x00e24229
0x00e2422f
0x00e24238
0x00e2423a
0x00e2423e
0x00e24249
0x00e2424f
0x00e24252
0x00e24253
0x00e24258
0x00e2425e
0x00e24261
0x00e24263
0x00e242ca
0x00e242d5
0x00e242db
0x00e242e4
0x00e242e4
0x00e242e8
0x00e242f2
0x00e24265
0x00e24265
0x00e2426b
0x00e2426d
0x00e24270
0x00e24272
0x00e24277
0x00e2427a
0x00e2427a
0x00e2427e
0x00e2427e
0x00e24284
0x00e242a0
0x00e242a3
0x00e242a9
0x00e242bd
0x00e242bd
0x00e242bf
0x00e242c4
0x00000000
0x00e242ab
0x00e242ab
0x00e242ae
0x00e242b1
0x00e242b3
0x00e242b6
0x00e242b9
0x00000000
0x00e242bb
0x00e242bb
0x00000000
0x00e242bb
0x00e242b9
0x00e242a9
0x00e24263
0x00e24191
0x00e2416c
0x00000000
0x00000000
0x00000000
0x00e2402d
0x00e2401d
0x00e2400c
0x00e23e57
0x00e23e58
0x00000000
0x00e23e58
0x00e23e55
0x00000000
0x00000000
0x00000000
0x00e236cb
0x00e236bb
0x00e236ae
0x00000000
0x00e23695
0x00e23620
0x00000000

Strings

-deviceDir=, xrefs: 00E237D0, 00E237E2
-dumpDir=, xrefs: 00E23709, 00E2371B
-socketDir=, xrefs: 00E23897, 00E238A9
-console, xrefs: 00E23664, 00E23683
Global\HttpToUsbBridge, xrefs: 00E23E21
-testDeviceIds=, xrefs: 00E2395A, 00E2396C

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID:
String ID: -console$-deviceDir=$-dumpDir=$-socketDir=$-testDeviceIds=$Global\HttpToUsbBridge
API String ID: 0-966336716
Opcode ID: d418ce3324d72cb93976f88036e86777851a0a81e04043b21e3e49de698c279b
Instruction ID: 4fe8bc50bfe59425dcf297bba846dd5b91dcdc1e1648abdc85c900aea1eae73f
Opcode Fuzzy Hash: d418ce3324d72cb93976f88036e86777851a0a81e04043b21e3e49de698c279b
Instruction Fuzzy Hash: 86711271A00218DFDB14CFA9EC45BAEBBB5FB48310F104128E809B7296D7719A84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00E24F00, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 94
threadnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 57%

			E00E24F00(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				char _v16;
				signed int _v20;
				short _v420;
				intOrPtr _v424;
				void* __ebp;
				signed int _t19;
				char* _t37;
				char _t39;
				char* _t42;
				char* _t44;
				char* _t45;
				void* _t57;
				signed int _t59;
				void* _t60;
				char* _t62;
				void* _t63;
				char* _t64;

				_t55 = __edi;
				_t52 = __edx;
				_t19 =  *0xe7b068; // 0x1b9618b6
				_v20 = _t19 ^ _t59;
				 *[fs:0x0] =  &_v16;
				_t57 = __ecx;
				E00E20EA0(__ebx, __ecx, __edx, __edi);
				_t62 = _t60 - 0x184;
				_t42 = _t62;
				 *((intOrPtr*)(_t42 + 0x10)) = 0;
				 *((intOrPtr*)(_t42 + 0x14)) = 0xf;
				 *_t42 = 0;
				E00E14C40(__ebx, _t42, __edx, "Socket::InitializeSocket", 0x18);
				E00E12260(__ebx, 0x14, _t52, __edi, GetCurrentThreadId(), _t19 ^ _t59, __esi, __ebx,  *[fs:0x0], 0xe60bbb, 0xffffffff);
				_t39 = 0;
				_t63 = _t62 + 0x1c;
				if( *((intOrPtr*)(_t57 + 4)) != 0) {
					L4:
					_t39 = 1;
				} else {
					_t37 =  &_v420;
					__imp__#115(2, _t37); // executed
					if(_t37 == 0) {
						if(_v420 != 2) {
							__imp__#116();
						} else {
							 *((char*)(_t57 + 4)) = 1;
							goto L4;
						}
					}
				}
				E00E20EA0(_t39, 0x14, _t52, _t55);
				_t64 = _t63 - 0x18;
				_t44 = _t64;
				_v424 = _t64;
				 *((intOrPtr*)(_t44 + 0x10)) = 0;
				 *((intOrPtr*)(_t44 + 0x14)) = 0xf;
				 *_t44 = 0;
				E00E14C40(_t39, _t44, _t52, "-Result: ", 9);
				_v8 = 0;
				_t45 = _t64 - 0x18;
				 *((intOrPtr*)(_t45 + 0x10)) = 0;
				 *((intOrPtr*)(_t45 + 0x14)) = 0xf;
				 *_t45 = 0;
				E00E14C40(_t39, _t45, _t52, "Socket::InitializeSocket", 0x18);
				_push(GetCurrentThreadId());
				_v8 = 0xffffffff;
				E00E12110(_t39, 0x2f, _t52, _t55);
				E00E20EA0(_t39, 0x2f, _t52, _t55);
				if( *0xe7ea10 != 0) {
					_t54 =  ==  ? "FALSE" : "TRUE";
					E00E167A0(_t39,  ==  ? "FALSE" : "TRUE", _t55, _t39, E00E164F0(0xe7d8f8,  ==  ? "FALSE" : "TRUE"));
				}
				 *[fs:0x0] = _v16;
				return E00E2C067(_v20 ^ _t59);
			}

0x00e24f00
0x00e24f00
0x00e24f17
0x00e24f1e
0x00e24f27
0x00e24f2d
0x00e24f2f
0x00e24f34
0x00e24f37
0x00e24f3b
0x00e24f42
0x00e24f4e
0x00e24f51
0x00e24f61
0x00e24f66
0x00e24f68
0x00e24f6e
0x00e24f95
0x00e24f95
0x00e24f70
0x00e24f70
0x00e24f79
0x00e24f81
0x00e24f8b
0x00e25054
0x00e24f91
0x00e24f91
0x00000000
0x00e24f91
0x00e24f8b
0x00e24f81
0x00e24f97
0x00e24f9c
0x00e24f9f
0x00e24fa1
0x00e24fa9
0x00e24fb0
0x00e24fbc
0x00e24fbf
0x00e24fc7
0x00e24fce
0x00e24fd2
0x00e24fd9
0x00e24fe5
0x00e24fe8
0x00e24ff2
0x00e24ff8
0x00e24fff
0x00e25007
0x00e25013
0x00e25026
0x00e2502f
0x00e25034
0x00e2503c
0x00e25053

APIs

Part of subcall function 00E20EA0: __Mtx_unlock.LIBCPMT ref: 00E20F3F

GetCurrentThreadId.KERNEL32 ref: 00E24F56
WSAStartup.WS2_32(00000002,?), ref: 00E24F79
GetCurrentThreadId.KERNEL32 ref: 00E24FED
WSACleanup.WS2_32 ref: 00E25054

Strings

Socket::InitializeSocket, xrefs: 00E24F49, 00E24FE0
TRUE, xrefs: 00E2501C
-Result: , xrefs: 00E24FB7
FALSE, xrefs: 00E25015

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: CurrentThread$CleanupMtx_unlockStartup
String ID: -Result: $FALSE$Socket::InitializeSocket$TRUE
API String ID: 1656247640-275070851
Opcode ID: 29d3edce5f4848755b1027febf2b8a4cbdcd2756d82c58b9d0c0d86d8d919a09
Instruction ID: 79f0bf817081a1a593e495cffbff269855c66452683dbdf3b81a158959185b19
Opcode Fuzzy Hash: 29d3edce5f4848755b1027febf2b8a4cbdcd2756d82c58b9d0c0d86d8d919a09
Instruction Fuzzy Hash: 703126B0A013049FEB14AF34E9067AA7BE4AB02308F5465ADE8547B2C3CB76854487D2

Uniqueness

Uniqueness Score: -1.00%

Function 00E23330, Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00E23330(void* __ebx, signed int __ecx, struct _SECURITY_ATTRIBUTES* __edx, void* __eflags, intOrPtr* _a4, signed int _a8) {
				intOrPtr _v4;
				DWORD* _v8;
				struct _SECURITY_ATTRIBUTES* _v12;
				char _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				struct _SECURITY_ATTRIBUTES* _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				void* _v60;
				struct _SECURITY_ATTRIBUTES* _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				char _v84;
				char _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				struct _SECURITY_ATTRIBUTES* _v112;
				signed int _v128;
				char _v132;
				struct _SECURITY_ATTRIBUTES* _v136;
				struct _SECURITY_ATTRIBUTES* _v140;
				struct _SECURITY_ATTRIBUTES* _v144;
				struct _SECURITY_ATTRIBUTES* _v148;
				struct _SECURITY_ATTRIBUTES* _v152;
				struct _SECURITY_ATTRIBUTES* _v156;
				struct _SECURITY_ATTRIBUTES* _v160;
				struct _SECURITY_ATTRIBUTES* _v164;
				signed int _v168;
				struct _SECURITY_ATTRIBUTES* _v172;
				struct _SECURITY_ATTRIBUTES* _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				char _v192;
				signed int _v196;
				struct _SECURITY_ATTRIBUTES* _v200;
				DWORD* _v216;
				intOrPtr _v244;
				struct _SECURITY_ATTRIBUTES* _v248;
				intOrPtr _v296;
				struct _SECURITY_ATTRIBUTES* _v312;
				char _v320;
				signed int _v324;
				void* _v328;
				intOrPtr _v508;
				intOrPtr _v512;
				intOrPtr _v524;
				intOrPtr _v528;
				intOrPtr _v532;
				intOrPtr _v548;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t386;
				signed int _t387;
				struct _SECURITY_ATTRIBUTES* _t391;
				signed int _t399;
				signed int _t400;
				DWORD* _t402;
				signed int _t404;
				signed int _t408;
				signed int _t411;
				signed int _t414;
				signed int _t417;
				signed int _t420;
				signed int _t421;
				signed int _t423;
				signed int _t430;
				signed int _t431;
				void* _t433;
				long _t438;
				signed int _t446;
				struct _SECURITY_ATTRIBUTES* _t456;
				intOrPtr _t470;
				void* _t475;
				signed int _t476;
				signed int _t478;
				signed int _t479;
				signed int _t491;
				void* _t492;
				signed int _t494;
				signed int _t505;
				char _t506;
				intOrPtr _t507;
				signed int _t508;
				signed int _t515;
				char _t516;
				struct _SECURITY_ATTRIBUTES** _t518;
				signed int _t520;
				signed int _t521;
				char _t522;
				struct _SECURITY_ATTRIBUTES* _t525;
				signed int _t529;
				signed int _t533;
				void* _t534;
				signed int _t546;
				signed int _t554;
				signed int _t564;
				signed int _t574;
				struct _SECURITY_ATTRIBUTES* _t579;
				signed int _t585;
				void* _t596;
				signed int _t600;
				void* _t613;
				void* _t618;
				signed int _t619;
				signed int* _t625;
				intOrPtr* _t630;
				signed int _t636;
				signed int _t638;
				signed int _t640;
				signed int _t642;
				struct _SECURITY_ATTRIBUTES* _t649;
				struct _SECURITY_ATTRIBUTES* _t657;
				intOrPtr _t658;
				signed int _t660;
				signed int _t661;
				signed int _t663;
				unsigned int _t667;
				signed int _t669;
				signed int _t675;
				signed int _t676;
				signed int _t679;
				signed int _t689;
				intOrPtr _t698;
				struct _SECURITY_ATTRIBUTES* _t700;
				signed int _t701;
				signed int _t708;
				signed int _t716;
				signed int _t721;
				signed int _t726;
				struct _SECURITY_ATTRIBUTES* _t740;
				signed int _t742;
				void* _t748;
				signed int _t753;
				void* _t754;
				signed int _t758;
				signed int _t759;
				intOrPtr _t764;
				void* _t766;
				intOrPtr _t768;
				void* _t769;
				struct _SECURITY_ATTRIBUTES* _t770;
				DWORD* _t771;
				intOrPtr _t772;
				void* _t773;
				void* _t774;
				intOrPtr _t775;
				intOrPtr _t776;
				void* _t777;
				intOrPtr _t778;
				intOrPtr _t779;
				void* _t780;
				char _t781;
				intOrPtr _t782;
				void* _t783;
				struct _SECURITY_ATTRIBUTES** _t791;
				void* _t793;
				signed int _t794;
				intOrPtr _t795;
				signed int _t797;
				signed int _t798;
				void* _t802;
				intOrPtr* _t805;
				signed int _t807;
				void* _t808;
				signed int _t809;
				void* _t811;
				signed int _t813;
				signed int _t816;
				signed int _t819;
				signed int _t820;
				signed int _t822;
				signed int _t823;
				signed int _t825;
				signed int _t827;
				signed int _t829;
				signed int _t830;
				signed int _t831;
				void* _t832;
				void* _t834;
				signed int _t836;
				signed int _t837;
				void* _t838;
				void* _t840;
				void* _t843;
				void* _t845;

				_t740 = __edx;
				_t613 = __ebx;
				_push(0xffffffff);
				_push(0xe609e8);
				_push( *[fs:0x0]);
				_t386 =  *0xe7b068; // 0x1b9618b6
				_t387 = _t386 ^ _t829;
				_v20 = _t387;
				_push(_t808);
				_push(_t387);
				 *[fs:0x0] =  &_v16;
				_v32 = __ecx;
				_v44 = __ecx;
				_v48 = __ecx;
				_v36 = 0;
				_push(0x10);
				_v8 = 1;
				_t791 = E00E2C07D(__edx, __eflags);
				_v40 = _t791;
				_v8 = 2;
				asm("xorps xmm0, xmm0");
				asm("movups [edi], xmm0");
				_push(0x7800);
				 *_t791 = 0;
				_t791[1] = 0;
				_t791[2] = 0;
				_t791[3] = 0;
				_t391 = E00E495D8();
				_t836 = _t834 - 0x38 + 8;
				 *_t791 = _t391;
				if(_t391 == 0) {
					E00E11560( &_v60, _t808, "malloc failed.");
					E00E4309B( &_v60, 0xe79e34);
					goto L28;
				} else {
					E00E43C10(_t791, _t391, 0, 0x7800);
					_t845 = _t836 + 0xc;
					_t791[2] = 0x7800;
					_v28 = _t791;
					_v36 = 2;
					_v8 = 3;
					_t822 = 0;
					while(1) {
						_v24 = 0;
						_t579 = _t791[1];
						_push( &_v24);
						_push(_t791[2] - _t579);
						_push(_t579 +  *_v40);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x2c))))() == 0) {
							break;
						}
						_t791 = _v40;
						E00E17D10(_t613, _t791, _t791, _v24);
						_t596 = E00E49F80( *_t791, "POST", 4);
						_t845 = _t845 + 0xc;
						if(_t596 != 0 || _t822 != 0) {
							L11:
							_t822 = _t822 - _v24;
							if(_t822 > 0) {
								continue;
							} else {
								_v36 = 3;
								 *_v32 = _t791;
								_v8 = 6;
								L22:
								_t805 = _a8;
								if(_t805 != 0) {
									_t825 = _t823 | 0xffffffff;
									asm("lock xadd [edi+0x4], eax");
									if(_t825 == 0) {
										 *((intOrPtr*)( *_t805))();
										asm("lock xadd [edi+0x8], esi");
										if(_t825 == 1) {
											 *((intOrPtr*)( *_t805 + 4))();
										}
									}
								}
								goto L26;
							}
						} else {
							_t822 = E00E180D0(_t613,  *_t791, _t791[1], _t791);
							if(_t822 > 0) {
								_t822 = _t822 + E00E183E0(_t598, _t613,  *_t791, _t791[1], _t791);
							}
							if(_t822 > 0x30000) {
								_v36 = 3;
								 *_v32 = 0;
								_t600 =  *_t791;
								__eflags = _t600;
								if(_t600 != 0) {
									E00E48B06(_t600);
									_t845 = _t845 + 4;
									 *_t791 = 0;
								}
								_push(0x10);
								E00E2C347(_t791);
								_v8 = 5;
								_t807 = _a8;
								__eflags = _t807;
								if(_t807 != 0) {
									_t827 = _t822 | 0xffffffff;
									__eflags = _t827;
									asm("lock xadd [edi+0x4], eax");
									if(_t827 == 0) {
										 *((intOrPtr*)( *_t807))();
										asm("lock xadd [edi+0x8], esi");
										__eflags = _t827 == 1;
										if(_t827 == 1) {
											 *((intOrPtr*)( *_t807 + 4))();
										}
									}
								}
								L26:
								 *[fs:0x0] = _v16;
								return E00E2C067(_v20 ^ _t829);
							} else {
								if(_t791[2] >= _t822) {
									goto L11;
								} else {
									_push(_t822);
									_push( *_t791);
									_t740 = E00E495CD();
									_t836 = _t845 + 8;
									if(_t740 == 0) {
										L28:
										_t625 =  &_v72;
										E00E11560(_t625, _t808, "reaclloc failed.");
										E00E4309B( &_v72, 0xe79e34);
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t829);
										_t830 = _t836;
										_push(0xffffffff);
										_push(0xe60a62);
										_push( *[fs:0x0]);
										_t837 = _t836 - 0xc4;
										_t399 =  *0xe7b068; // 0x1b9618b6
										_t400 = _t399 ^ _t830;
										_v104 = _t400;
										_push(_t808);
										_push(_t791);
										_push(_t400);
										 *[fs:0x0] =  &_v100;
										_v248 = _t740;
										_v244 = _t625;
										_t402 = 1;
										_t809 = 0;
										_v184 = 0;
										_v216 = 1;
										__eflags = _t625 - 1;
										if(_t625 <= 1) {
											L95:
											 *[fs:0x0] = _v20;
											__eflags = _v24 ^ _t830;
											return E00E2C067(_v24 ^ _t830);
										} else {
											while(1) {
												_t741 =  *((intOrPtr*)(_t740 + _t402 * 4));
												_t630 =  *((intOrPtr*)(_t740 + _t402 * 4));
												_v32 = 0;
												_v28 = 0xf;
												_v48 = 0;
												_t793 = _t630 + 1;
												asm("o16 nop [eax+eax]");
												do {
													_t404 =  *_t630;
													_t630 = _t630 + 1;
													__eflags = _t404;
												} while (_t404 != 0);
												E00E14C40(_t613,  &_v48, _t741, _t741, _t630 - _t793);
												_v12 = 0;
												__eflags =  *0xe7bb1c - 0x10;
												_t407 =  >=  ? "-console" : "-console";
												__eflags = _v28 - 0x10;
												_t742 = _v48;
												_t794 = _v32;
												_t634 =  >=  ? _t742 :  &_v48;
												_v100 = _t742;
												_t408 = E00E190E0( >=  ? _t742 :  &_v48, _t794, 0,  >=  ? "-console" : "-console",  *0xe7bb18);
												_t837 = _t837 + 0xc;
												__eflags = _t408;
												if(_t408 != 0) {
													__eflags =  *0xe7bb7c - 0x10;
													_t410 =  >=  ? "-dumpDir=" : "-dumpDir=";
													__eflags = _v28 - 0x10;
													_t636 =  >=  ? _v100 :  &_v48;
													_t411 = E00E190E0(_t636, _t794, 0,  >=  ? "-dumpDir=" : "-dumpDir=", "\t");
													_t837 = _t837 + 0xc;
													__eflags = _t411;
													if(_t411 != 0) {
														__eflags =  *0xe7bb4c - 0x10;
														_t413 =  >=  ? "-deviceDir=" : "-deviceDir=";
														__eflags = _v28 - 0x10;
														_t638 =  >=  ? _v100 :  &_v48;
														_t414 = E00E190E0(_t638, _t794, 0,  >=  ? "-deviceDir=" : "-deviceDir=",  *0xe7bb48);
														_t837 = _t837 + 0xc;
														__eflags = _t414;
														if(_t414 != 0) {
															__eflags =  *0xe7bb34 - 0x10;
															_t416 =  >=  ? "-socketDir=" : "-socketDir=";
															__eflags = _v28 - 0x10;
															_t640 =  >=  ? _v100 :  &_v48;
															_t417 = E00E190E0(_t640, _t794, 0,  >=  ? "-socketDir=" : "-socketDir=",  *0xe7bb30);
															_t837 = _t837 + 0xc;
															__eflags = _t417;
															if(_t417 != 0) {
																__eflags =  *0xe7bb94 - 0x10;
																_t419 =  >=  ? "-testDeviceIds=" : "-testDeviceIds=";
																__eflags = _v28 - 0x10;
																_t642 =  >=  ? _v100 :  &_v48;
																_t420 = E00E190E0(_t642, _t794, 0,  >=  ? "-testDeviceIds=" : "-testDeviceIds=",  *0xe7bb90);
																_t837 = _t837 + 0xc;
																__eflags = _t420;
																if(_t420 != 0) {
																	goto L35;
																} else {
																	_t764 =  *0xe7bb90;
																	_v56 = _t420;
																	_v52 = 0xf;
																	_v72 = _t420;
																	__eflags = _t794 - _t764;
																	if(_t794 < _t764) {
																		goto L97;
																	} else {
																		_t802 = _t794 - _t764;
																		__eflags = _t802 - 0xffffffff;
																		_t685 =  <  ? _t802 : _t642 | 0xffffffff;
																		__eflags = _v28 - 0x10;
																		_t502 =  >=  ? _v100 :  &_v48;
																		_t503 = ( >=  ? _v100 :  &_v48) + _t764;
																		E00E14C40(_t613,  &_v72, _t764, ( >=  ? _v100 :  &_v48) + _t764,  <  ? _t802 : _t642 | 0xffffffff);
																		_t809 = _t809 | 0x00000020;
																		_v12 = 1;
																		__eflags = _v52 - 0x10;
																		_t505 = _v72;
																		_t794 = _v56;
																		_t688 =  >=  ? _t505 :  &_v72;
																		_t765 = _t794;
																		_v104 = _t505;
																		_t506 = E00E190E0( >=  ? _t505 :  &_v72, _t794, 0, ",", 1);
																		_t837 = _t837 + 0xc;
																		_v132 = _t506;
																		__eflags = _t794;
																		if(_t794 == 0) {
																			L90:
																			_v12 = 0;
																			_t507 = _v52;
																			__eflags = _t507 - 0x10;
																			if(_t507 < 0x10) {
																				L94:
																				_t643 = _v48;
																				_v56 = 0;
																				_v52 = 0xf;
																				_v72 = 0;
																				goto L36;
																			} else {
																				_t689 = _v104;
																				_t766 = _t507 + 1;
																				_t508 = _t689;
																				__eflags = _t766 - 0x1000;
																				if(_t766 < 0x1000) {
																					L93:
																					_push(_t766);
																					E00E2C347(_t689);
																					_t837 = _t837 + 8;
																					goto L94;
																				} else {
																					_t643 =  *(_t689 - 4);
																					_t748 = _t766 + 0x23;
																					__eflags = _t508 -  *(_t689 - 4) + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						goto L96;
																					} else {
																						goto L93;
																					}
																				}
																			}
																		} else {
																			do {
																				__eflags = _t794 - _t506;
																				_v80 = 0;
																				_v76 = 0xf;
																				_t691 =  <  ? _t794 : _t506;
																				_v96 = 0;
																				__eflags = _v52 - 0x10;
																				_t513 =  >=  ? _v104 :  &_v72;
																				E00E14C40(_t613,  &_v96, _t765,  >=  ? _v104 :  &_v72,  <  ? _t794 : _t506);
																				_t809 = _t809 | 0x00000040;
																				_v104 = _t809;
																				_v12 = 2;
																				__eflags = _v76 - 0x10;
																				_t794 = _v80;
																				_t767 = _t794;
																				_t643 =  >=  ? _v96 :  &_v96;
																				_t515 = E00E190E0(_t643, _t794, 0, "&", 1);
																				_t837 = _t837 + 0xc;
																				_v100 = _t515;
																				__eflags = _t515 - 0xffffffff;
																				if(_t515 == 0xffffffff) {
																					L71:
																					_t516 = _v132;
																					__eflags = _t516 - 0xffffffff;
																					if(_t516 == 0xffffffff) {
																						_v112 = 0;
																						_v108 = 0xf;
																						_v128 = 0;
																						E00E14C40(_t613,  &_v128, _t767, 0xe71f6b, 0);
																						_t518 =  &_v128;
																						_t809 = _t809 | 0x00000002;
																						__eflags = _t809;
																						goto L75;
																					} else {
																						_t774 = _t516 + 1;
																						_v144 = 0;
																						_t533 = _v56;
																						_v140 = 0xf;
																						_v160 = 0;
																						__eflags = _t533 - _t774;
																						if(_t533 < _t774) {
																							goto L97;
																						} else {
																							_t534 = _t533 - _t774;
																							__eflags = _t534 - 0xffffffff;
																							_t703 =  <  ? _t534 : _t643 | 0xffffffff;
																							__eflags = _v52 - 0x10;
																							_t536 =  >=  ? _v72 :  &_v72;
																							_t537 = ( >=  ? _v72 :  &_v72) + _t774;
																							E00E14C40(_t613,  &_v160, _t774, ( >=  ? _v72 :  &_v72) + _t774,  <  ? _t534 : _t643 | 0xffffffff);
																							_t518 =  &_v160;
																							_v12 = 6;
																							_t809 = _t809 | 0x00000201;
																							L75:
																							_v100 = _t809;
																							E00E160E0(_t613,  &_v72, _t518);
																							_t520 = _t809;
																							__eflags = _t520 & 0x00000002;
																							if((_t520 & 0x00000002) == 0) {
																								L80:
																								_v12 = 2;
																								__eflags = _t520 & 0x00000001;
																								if((_t520 & 0x00000001) == 0) {
																									L85:
																									_v12 = 1;
																									_t768 = _v76;
																									__eflags = _t768 - 0x10;
																									if(_t768 < 0x10) {
																										goto L89;
																									} else {
																										_t522 = _v96;
																										_t769 = _t768 + 1;
																										_t698 = _t522;
																										__eflags = _t769 - 0x1000;
																										if(_t769 < 0x1000) {
																											L88:
																											_push(_t769);
																											E00E2C347(_t522);
																											_t837 = _t837 + 8;
																											goto L89;
																										} else {
																											_t522 =  *((intOrPtr*)(_t522 - 4));
																											_t748 = _t769 + 0x23;
																											_t643 = _t698 - _t522 + 0xfffffffc;
																											__eflags = _t698 - _t522 + 0xfffffffc - 0x1f;
																											if(__eflags > 0) {
																												goto L96;
																											} else {
																												goto L88;
																											}
																										}
																									}
																								} else {
																									_t770 = _v140;
																									_v100 = _t520 & 0xfffffffe;
																									__eflags = _t770 - 0x10;
																									if(_t770 < 0x10) {
																										goto L85;
																									} else {
																										_t700 = _v160;
																										_t771 =  &(_t770->nLength);
																										_t525 = _t700;
																										__eflags = _t771 - 0x1000;
																										if(_t771 < 0x1000) {
																											L84:
																											_push(_t771);
																											E00E2C347(_t700);
																											_t837 = _t837 + 8;
																											goto L85;
																										} else {
																											_t643 =  *(_t700 - 4);
																											_t748 = _t771 + 0x23;
																											__eflags = _t525 -  *(_t700 - 4) + 0xfffffffc - 0x1f;
																											if(__eflags > 0) {
																												goto L96;
																											} else {
																												goto L84;
																											}
																										}
																									}
																								}
																							} else {
																								_t772 = _v108;
																								_t520 = _t520 & 0xfffffffd;
																								_v100 = _t520;
																								__eflags = _t772 - 0x10;
																								if(_t772 < 0x10) {
																									goto L80;
																								} else {
																									_t701 = _v128;
																									_t773 = _t772 + 1;
																									_t529 = _t701;
																									__eflags = _t773 - 0x1000;
																									if(_t773 < 0x1000) {
																										L79:
																										_push(_t773);
																										E00E2C347(_t701);
																										_t520 = _v100;
																										_t837 = _t837 + 8;
																										goto L80;
																									} else {
																										_t643 =  *(_t701 - 4);
																										_t748 = _t773 + 0x23;
																										__eflags = _t529 -  *(_t701 - 4) + 0xfffffffc - 0x1f;
																										if(__eflags > 0) {
																											goto L96;
																										} else {
																											goto L79;
																										}
																									}
																								}
																							}
																						}
																					}
																				} else {
																					_t767 = _t515 + 1;
																					_v112 = 0;
																					_v108 = 0xf;
																					_v128 = 0;
																					__eflags = _t794 - _t767;
																					if(_t794 < _t767) {
																						goto L97;
																					} else {
																						_t794 = _t794 - _t767;
																						__eflags = _t794 - 0xffffffff;
																						_t706 =  <  ? _t794 : _t643 | 0xffffffff;
																						__eflags = _v76 - 0x10;
																						_t540 =  >=  ? _v96 :  &_v96;
																						_t541 = ( >=  ? _v96 :  &_v96) + _t767;
																						E00E14C40(_t613,  &_v128, _t767, ( >=  ? _v96 :  &_v96) + _t767,  <  ? _t794 : _t643 | 0xffffffff);
																						_v12 = 3;
																						_t708 = _v100;
																						__eflags = _v80 - _t708;
																						_v144 = 0;
																						_t709 =  <  ? _v80 : _t708;
																						__eflags = _v76 - 0x10;
																						_t544 =  >=  ? _v96 :  &_v96;
																						_v140 = 0xf;
																						_v160 = 0;
																						E00E14C40(_t613,  &_v160, _t767,  >=  ? _v96 :  &_v96,  <  ? _v80 : _t708);
																						_t809 = _t809 | 0x00000180;
																						_v104 = _t809;
																						asm("movups xmm0, [ebp-0x98]");
																						_v160 = 0;
																						asm("movups xmm2, [ebp-0x78]");
																						_v128 = 0;
																						asm("movq xmm1, [ebp-0x88]");
																						asm("movq xmm3, [ebp-0x68]");
																						asm("movups [ebp-0xd0], xmm0");
																						_v144 = 0;
																						asm("movq [ebp-0xc0], xmm1");
																						_v140 = 0xf;
																						asm("movups [ebp-0xb8], xmm2");
																						_v112 = 0;
																						asm("movq [ebp-0xa8], xmm3");
																						_v108 = 0xf;
																						_v12 = 5;
																						_t546 =  *0xe7ea2c;
																						__eflags =  *0xe7ea30 - _t546;
																						if( *0xe7ea30 == _t546) {
																							_push( &_v216);
																							_push(_t546);
																							L116();
																						} else {
																							asm("movups [eax], xmm0");
																							_v200 = 0;
																							asm("movq [eax+0x10], xmm1");
																							 *(_t546 + 0x28) = 0;
																							 *(_t546 + 0x2c) = 0;
																							asm("movups [eax+0x18], xmm2");
																							_v196 = 0xf;
																							asm("movq [eax+0x28], xmm3");
																							 *0xe7ea2c =  *0xe7ea2c + 0x30;
																							_v216 = 0;
																							_v176 = 0;
																							_v172 = 0xf;
																							_v192 = 0;
																						}
																						_t643 =  &_v216;
																						E00E1F5C0(_t613, _t643, _t794);
																						_v12 = 2;
																						goto L71;
																					}
																				}
																				goto L146;
																				L89:
																				__eflags = _v52 - 0x10;
																				_t521 = _v72;
																				_t794 = _v56;
																				_t697 =  >=  ? _t521 :  &_v72;
																				_t765 = _t794;
																				_v104 = _t521;
																				_t506 = E00E190E0( >=  ? _t521 :  &_v72, _t794, 0, ",", 1);
																				_t809 = _v100;
																				_t837 = _t837 + 0xc;
																				_v132 = _t506;
																				__eflags = _t794;
																			} while (_t794 != 0);
																			goto L90;
																		}
																	}
																}
															} else {
																_t775 =  *0xe7bb30;
																_v112 = _t417;
																_v108 = 0xf;
																_v128 = _t417;
																__eflags = _t794 - _t775;
																if(_t794 < _t775) {
																	goto L97;
																} else {
																	_t794 = _t794 - _t775;
																	__eflags = _t794 - 0xffffffff;
																	_t713 =  <  ? _t794 : _t640 | 0xffffffff;
																	__eflags = _v28 - 0x10;
																	_t549 =  >=  ? _v100 :  &_v48;
																	_t550 = ( >=  ? _v100 :  &_v48) + _t775;
																	E00E14C40(_t613,  &_v128, _t775, ( >=  ? _v100 :  &_v48) + _t775,  <  ? _t794 : _t640 | 0xffffffff);
																	_t809 = _t809 | 0x00000010;
																	E00E160E0(_t613, 0xe7baf0,  &_v128);
																	_t776 = _v108;
																	__eflags = _t776 - 0x10;
																	if(_t776 < 0x10) {
																		goto L60;
																	} else {
																		_t716 = _v128;
																		_t777 = _t776 + 1;
																		_t554 = _t716;
																		__eflags = _t777 - 0x1000;
																		if(_t777 < 0x1000) {
																			L59:
																			_push(_t777);
																			E00E2C347(_t716);
																			_t837 = _t837 + 8;
																			goto L60;
																		} else {
																			_t643 =  *(_t716 - 4);
																			_t748 = _t777 + 0x23;
																			__eflags = _t554 -  *(_t716 - 4) + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L96;
																			} else {
																				goto L59;
																			}
																		}
																	}
																}
															}
														} else {
															_t778 =  *0xe7bb48;
															_v112 = _t414;
															_v108 = 0xf;
															_v128 = _t414;
															__eflags = _t794 - _t778;
															if(_t794 < _t778) {
																goto L97;
															} else {
																_t794 = _t794 - _t778;
																__eflags = _t794 - 0xffffffff;
																_t718 =  <  ? _t794 : _t638 | 0xffffffff;
																__eflags = _v28 - 0x10;
																_t559 =  >=  ? _v100 :  &_v48;
																_t560 = ( >=  ? _v100 :  &_v48) + _t778;
																E00E14C40(_t613,  &_v128, _t778, ( >=  ? _v100 :  &_v48) + _t778,  <  ? _t794 : _t638 | 0xffffffff);
																_t809 = _t809 | 0x00000008;
																E00E160E0(_t613, 0xe7bb50,  &_v128);
																_t779 = _v108;
																__eflags = _t779 - 0x10;
																if(_t779 < 0x10) {
																	goto L60;
																} else {
																	_t721 = _v128;
																	_t780 = _t779 + 1;
																	_t564 = _t721;
																	__eflags = _t780 - 0x1000;
																	if(_t780 < 0x1000) {
																		L53:
																		_push(_t780);
																		E00E2C347(_t721);
																		_t643 = _v48;
																		_t837 = _t837 + 8;
																		goto L36;
																	} else {
																		_t643 =  *(_t721 - 4);
																		_t748 = _t780 + 0x23;
																		__eflags = _t564 -  *(_t721 - 4) + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L96;
																		} else {
																			goto L53;
																		}
																	}
																}
															}
														}
													} else {
														_t781 = "\t";
														_v112 = _t411;
														_v108 = 0xf;
														_v128 = _t411;
														__eflags = _t794 - _t781;
														if(_t794 < _t781) {
															goto L97;
														} else {
															_t794 = _t794 - _t781;
															__eflags = _t794 - 0xffffffff;
															_t723 =  <  ? _t794 : _t636 | 0xffffffff;
															__eflags = _v28 - 0x10;
															_t569 =  >=  ? _v100 :  &_v48;
															_t570 = ( >=  ? _v100 :  &_v48) + _t781;
															E00E14C40(_t613,  &_v128, _t781, ( >=  ? _v100 :  &_v48) + _t781,  <  ? _t794 : _t636 | 0xffffffff);
															_t809 = _t809 | 0x00000004;
															E00E160E0(_t613, 0xe7ba90,  &_v128);
															_t782 = _v108;
															__eflags = _t782 - 0x10;
															if(_t782 < 0x10) {
																L60:
																_t643 = _v48;
																goto L36;
															} else {
																_t726 = _v128;
																_t783 = _t782 + 1;
																_t574 = _t726;
																__eflags = _t783 - 0x1000;
																if(_t783 < 0x1000) {
																	L47:
																	_push(_t783);
																	E00E2C347(_t726);
																	_t643 = _v48;
																	_t837 = _t837 + 8;
																	goto L36;
																} else {
																	_t643 =  *(_t726 - 4);
																	_t748 = _t783 + 0x23;
																	__eflags = _t574 -  *(_t726 - 4) + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L96;
																	} else {
																		goto L47;
																	}
																}
															}
														}
													}
												} else {
													 *0xe7ea10 = 1;
													L35:
													_t643 = _v100;
													L36:
													_v12 = 0xffffffff;
													_t421 = _v28;
													__eflags = _t421 - 0x10;
													if(_t421 < 0x10) {
														L40:
														_t402 =  &(_v136->nLength);
														_v136 = _t402;
														__eflags = _t402 - _v164;
														if(_t402 >= _v164) {
															goto L95;
														} else {
															_t740 = _v168;
															continue;
														}
													} else {
														_t76 = _t421 + 1; // 0x11
														_t748 = _t76;
														_t423 = _t643;
														__eflags = _t748 - 0x1000;
														if(_t748 < 0x1000) {
															L39:
															_push(_t748);
															E00E2C347(_t643);
															_t837 = _t837 + 8;
															goto L40;
														} else {
															_t643 =  *(_t643 - 4);
															_t748 = _t748 + 0x23;
															__eflags = _t423 - _t643 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																L96:
																E00E4957C(_t613, _t643, _t748, _t794, __eflags);
																L97:
																E00E160D0(_t613, _t643);
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t830);
																_t831 = _t837;
																_push(0xffffffff);
																_push(0xe60afa);
																_push( *[fs:0x0]);
																_t838 = _t837 - 0xb4;
																_t430 =  *0xe7b068; // 0x1b9618b6
																_t431 = _t430 ^ _t831;
																_v324 = _t431;
																_push(_t613);
																_push(_t809);
																_push(_t794);
																_push(_t431);
																 *[fs:0x0] =  &_v320;
																_t795 = _v296;
																_v312 = 0;
																_t433 = CreateMutexA(0, 0, "Global\\HttpToUsbBridge"); // executed
																_t614 = CloseHandle;
																_t811 = _t433;
																_v328 = _t811;
																__eflags = _t811;
																if(_t811 == 0) {
																	L114:
																	ReleaseMutex(_t811);
																	CloseHandle(_t811);
																	 *[fs:0x0] = _v24;
																	__eflags = _v28 ^ _t831;
																	return E00E2C067(_v28 ^ _t831);
																} else {
																	_t438 = GetLastError();
																	__eflags = _t438 - 0xb7;
																	if(_t438 != 0xb7) {
																		_t749 = _t795;
																		L29();
																		E00E43C10(_t795,  &_v172, 0, 0x8c);
																		_v172 = 0;
																		_v168 = 0;
																		_v16 = 1;
																		_v164 = 0;
																		_v160 = 0;
																		_v164 = E00E21430();
																		_v16 = 2;
																		_v156 = 0;
																		_v152 = 0;
																		_v148 = 0;
																		_v152 = E00E246D0(CloseHandle, _v4, _t795, _t795, __eflags);
																		_v16 = 3;
																		_v144 = 0;
																		_v140 = 0;
																		_v136 = 0;
																		_v140 = E00E213C0();
																		E00E2AE17(__eflags,  &_v132, 2);
																		_v84 = 0;
																		_v64 = 0;
																		_v60 = 0xf;
																		_v80 = 0;
																		_v40 = 0;
																		_v36 = 0xf;
																		_v56 = 0;
																		_push(0x1c);
																		_v16 = 7;
																		_t446 = E00E2C07D(_t795, __eflags);
																		_v176 = _t446;
																		_t840 = _t838 + 0x18;
																		 *(4 + _t446) = 1;
																		_t649 = _t446 + 0xc;
																		 *(_t446 + 8) = 1;
																		 *_t446 = 0xe72778;
																		_t649->nLength = 0xe729e8;
																		_t649->lpSecurityDescriptor = 0;
																		_t649->bInheritHandle = 0xffffffff;
																		 *(_t649 + 0xc) = 0xffffffff;
																		_t797 = _v168;
																		_v172 = _t649;
																		_v168 = _t446;
																		_v16 = 8;
																		__eflags = _t797;
																		if(_t797 != 0) {
																			__eflags = CloseHandle;
																			asm("lock xadd [edi+0x4], eax");
																			if(CloseHandle == 0) {
																				 *((intOrPtr*)( *_t797))();
																				asm("lock xadd [edi+0x8], ebx");
																				__eflags = (CloseHandle | 0xffffffff) == 1;
																				if((CloseHandle | 0xffffffff) == 1) {
																					 *((intOrPtr*)( *_t797 + 4))();
																				}
																			}
																			_t614 = CloseHandle;
																		}
																		_v16 = 0xa;
																		__eflags =  *0xe7bb60;
																		if( *0xe7bb60 == 0) {
																			L111:
																			__eflags =  *0xe7bb00;
																			if( *0xe7bb00 != 0) {
																				_v176 = _t840 - 0xc;
																				E00E22230(_t614, _t840 - 0xc, _t797, _t811, 0xe7ea28);
																				_v16 = 0xc;
																				E00E12D00(_t749, 0xe7baf0);
																				_v16 = 0xa;
																				E00E1F650(_t614,  &_v172, _t749);
																			}
																			E00E1F120(_t614,  &_v172);
																			E00E1EDB0(_t614,  &_v172);
																			goto L114;
																		} else {
																			E00E12D00(_t749, 0xe7bb50);
																			_v16 = 0xb;
																			__eflags = _v180 - 0x10;
																			_t454 =  >=  ? _v200 :  &_v200;
																			E00E14C40(_t614,  &_v80, _t749,  >=  ? _v200 :  &_v200, _v184);
																			_v16 = 0xa;
																			_t749 = _v180;
																			__eflags = _t749 - 0x10;
																			if(_t749 < 0x10) {
																				goto L111;
																			} else {
																				_t657 = _v200;
																				_t749 = _t749 + 1;
																				_t456 = _t657;
																				__eflags = _t749 - 0x1000;
																				if(_t749 < 0x1000) {
																					L110:
																					_push(_t749);
																					E00E2C347(_t657);
																					_t840 = _t840 + 8;
																					goto L111;
																				} else {
																					_t657 =  *(_t657 - 4);
																					_t749 = _t749 + 0x23;
																					__eflags = _t456 - _t657 + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						E00E4957C(_t614, _t657, _t749, _t797, __eflags);
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						_push(_t831);
																						_t832 = _t840;
																						_t843 = _t840 - 0x14;
																						_t658 = _v512;
																						_push(_t614);
																						_v532 = _v508;
																						_push(_t811);
																						_t813 =  *0xe7ea28; // 0x0
																						_v528 = _t658;
																						_t660 =  *0xe7ea2c; // 0x0
																						_t661 = _t660 - _t813;
																						_v524 = (0x2aaaaaab * (_t658 - _t813) >> 0x20 >> 3 >> 0x1f) + (0x2aaaaaab * (_t658 - _t813) >> 0x20 >> 3);
																						_push(_t797);
																						_t753 = 0x2aaaaaab * _t661 >> 0x20 >> 3;
																						_t618 = (_t753 >> 0x1f) + _t753;
																						__eflags = _t618 - 0x5555555;
																						if(_t618 == 0x5555555) {
																							L141:
																							E00E19CA0(_t661);
																							asm("int3");
																							_push(_t832);
																							_t470 = _v548;
																							_push(_t813);
																							_push(_t797);
																							_t798 = _t753;
																							__eflags = _t661 - _t798;
																							if(_t661 != _t798) {
																								_t754 = _t661 + 0x2c;
																								_t816 = _t470 - _t661;
																								__eflags = _t816;
																								do {
																									 *(_t470 + 0x10) = 0;
																									_t754 = _t754 + 0x30;
																									 *(_t470 + 0x14) = 0;
																									asm("movups xmm0, [edx-0x5c]");
																									asm("movups [eax], xmm0");
																									asm("movq xmm0, [edx-0x4c]");
																									asm("movq [eax+0x10], xmm0");
																									 *(_t754 - 0x4c) = 0;
																									 *((intOrPtr*)(_t754 - 0x48)) = 0xf;
																									 *((char*)(_t754 - 0x5c)) = 0;
																									 *(_t470 + 0x28) = 0;
																									 *(_t816 + _t754 - 0x30) = 0;
																									asm("movups xmm0, [edx-0x44]");
																									asm("movups [eax+0x18], xmm0");
																									asm("movq xmm0, [edx-0x34]");
																									asm("movq [eax+0x28], xmm0");
																									_t470 = _t470 + 0x30;
																									 *(_t754 - 0x34) = 0;
																									 *((intOrPtr*)(_t754 - 0x30)) = 0xf;
																									 *((char*)(_t754 - 0x44)) = 0;
																									__eflags = _t754 - 0x2c - _t798;
																								} while (_t754 - 0x2c != _t798);
																							}
																							return _t470;
																						} else {
																							_t663 =  *0xe7ea30; // 0x0
																							_t619 = _t618 + 1;
																							_v32 = _t619;
																							_t667 = (0x2aaaaaab * (_t663 - _t813) >> 0x20 >> 3 >> 0x1f) + (0x2aaaaaab * (_t663 - _t813) >> 0x20 >> 3);
																							_t758 = _t667 >> 1;
																							__eflags = _t667 - 0x5555555 - _t758;
																							if(_t667 <= 0x5555555 - _t758) {
																								_t475 = _t758 + _t667;
																								__eflags = _t475 - _t619;
																								_t476 =  <  ? _t619 : _t475;
																							} else {
																								_t476 = _t619;
																							}
																							_t669 = _t476 + _t476 * 2 << 4;
																							_v36 = _t669;
																							__eflags = _t476 - 0x5555555;
																							if(_t476 <= 0x5555555) {
																								__eflags = _t669 - 0x1000;
																								if(_t669 < 0x1000) {
																									__eflags = _t669;
																									if(__eflags == 0) {
																										_t797 = 0;
																										__eflags = 0;
																									} else {
																										_push(_t669);
																										_t491 = E00E2C07D(_t758, __eflags);
																										_t843 = _t843 + 4;
																										_t797 = _t491;
																									}
																									goto L128;
																								} else {
																									goto L123;
																								}
																							} else {
																								_t669 = _t669 | 0xffffffff;
																								L123:
																								_t492 = _t669 + 0x23;
																								_t753 = _t758 | 0xffffffff;
																								__eflags = _t492 - _t669;
																								_t493 =  <=  ? _t753 : _t492;
																								_push( <=  ? _t753 : _t492);
																								_t494 = E00E2C07D(_t753, _t492 - _t669);
																								_t843 = _t843 + 4;
																								__eflags = _t494;
																								if(__eflags == 0) {
																									L140:
																									E00E4957C(_t619, _t661, _t753, _t797, __eflags);
																									goto L141;
																								} else {
																									_t338 = _t494 + 0x23; // 0x23
																									_t797 = _t338 & 0xffffffe0;
																									 *(_t797 - 4) = _t494;
																									L128:
																									_push(_t669);
																									_push(_t797);
																									_t478 = _v28;
																									_t819 = (_v20 + _v20 * 2 << 4) + _t797;
																									_v20 = _t819;
																									 *(_t819 + 0x10) = 0;
																									 *(_t819 + 0x14) = 0;
																									asm("movups xmm0, [eax]");
																									asm("movups [esi], xmm0");
																									asm("movq xmm0, [eax+0x10]");
																									asm("movq [esi+0x10], xmm0");
																									 *(_t478 + 0x10) = 0;
																									 *((intOrPtr*)(_t478 + 0x14)) = 0xf;
																									 *_t478 = 0;
																									 *(_t819 + 0x28) = 0;
																									 *(_t819 + 0x2c) = 0;
																									asm("movups xmm0, [eax+0x18]");
																									asm("movups [esi+0x18], xmm0");
																									asm("movq xmm0, [eax+0x28]");
																									asm("movq [esi+0x28], xmm0");
																									 *(_t478 + 0x28) = 0;
																									 *((intOrPtr*)(_t478 + 0x2c)) = 0xf;
																									 *((char*)(_t478 + 0x18)) = 0;
																									_t759 =  *0xe7ea2c; // 0x0
																									_t479 = _v24;
																									__eflags = _t479 - _t759;
																									if(_t479 != _t759) {
																										L142();
																										_t355 = _t819 + 0x30; // 0x30
																										_t843 = _t843 + 4;
																									}
																									L142();
																									_t820 =  *0xe7ea28; // 0x0
																									_t843 = _t843 + 8;
																									__eflags = _t820;
																									if(_t820 == 0) {
																										L139:
																										 *0xe7ea28 = _t797;
																										 *0xe7ea2c = (_t619 + _t619 * 2 << 4) + _t797;
																										_t675 = _v36 + _t797;
																										__eflags = _t675;
																										 *0xe7ea30 = _t675;
																										return _v20;
																									} else {
																										_t619 =  *0xe7ea2c; // 0x0
																										__eflags = _t820 - _t619;
																										if(_t820 != _t619) {
																											do {
																												E00E1F5C0(_t619, _t820, _t797);
																												_t820 = _t820 + 0x30;
																												__eflags = _t820 - _t619;
																											} while (_t820 != _t619);
																											_t820 =  *0xe7ea28; // 0x0
																										}
																										_t676 =  *0xe7ea30; // 0x0
																										_t679 = (0x2aaaaaab * (_t676 - _t820) >> 0x20 >> 3 >> 0x1f) + (0x2aaaaaab * (_t676 - _t820) >> 0x20 >> 3) + ((0x2aaaaaab * (_t676 - _t820) >> 0x20 >> 3 >> 0x1f) + (0x2aaaaaab * (_t676 - _t820) >> 0x20 >> 3)) * 2 << 4;
																										__eflags = _t679 - 0x1000;
																										if(_t679 < 0x1000) {
																											L138:
																											_push(_t679);
																											E00E2C347(_t820);
																											_t619 = _v32;
																											goto L139;
																										} else {
																											_t753 =  *(_t820 - 4);
																											_t661 = _t679 + 0x23;
																											_t813 = _t820 - _t753;
																											_t364 = _t813 - 4; // -4
																											__eflags = _t364 - 0x1f;
																											if(__eflags > 0) {
																												goto L140;
																											} else {
																												_t820 = _t753;
																												goto L138;
																											}
																										}
																									}
																								}
																							}
																						}
																					} else {
																						goto L110;
																					}
																				}
																			}
																		}
																	} else {
																		CloseHandle(_t811);
																		goto L114;
																	}
																}
															} else {
																goto L39;
															}
														}
													}
												}
												goto L146;
											}
										}
									} else {
										 *_t791 = _t740;
										E00E43C10(_t791, _t791[1] + _t740, 0, _t822 - _t791[1]);
										_t845 = _t836 + 0xc;
										_t791[2] = _t822;
										goto L11;
									}
								}
							}
						}
						goto L146;
					}
					 *_v32 = 0;
					_t823 = _v40;
					_v36 = 3;
					_t585 =  *_t823;
					__eflags = _t585;
					if(_t585 != 0) {
						E00E48B06(_t585);
						_t845 = _t845 + 4;
						 *_t823 = 0;
					}
					_push(0x10);
					E00E2C347(_t823);
					_v8 = 4;
					goto L22;
				}
				L146:
			}

0x00e23330
0x00e23330
0x00e23333
0x00e23335
0x00e23340
0x00e23344
0x00e23349
0x00e2334b
0x00e2334e
0x00e23350
0x00e23354
0x00e2335c
0x00e2335f
0x00e23362
0x00e23365
0x00e2336c
0x00e2336e
0x00e2337a
0x00e2337c
0x00e2337f
0x00e23383
0x00e23386
0x00e23389
0x00e2338e
0x00e23394
0x00e2339b
0x00e233a2
0x00e233a9
0x00e233ae
0x00e233b1
0x00e233b5
0x00e2359f
0x00e235ad
0x00000000
0x00e233bb
0x00e233c3
0x00e233c8
0x00e233cb
0x00e233d2
0x00e233d5
0x00e233dc
0x00e233e0
0x00e233e2
0x00e233e8
0x00e233ef
0x00e233fe
0x00e23401
0x00e23402
0x00e2340a
0x00000000
0x00000000
0x00e23413
0x00e23418
0x00e23426
0x00e2342b
0x00e23430
0x00e2348f
0x00e2348f
0x00e23494
0x00000000
0x00e2349a
0x00e2349d
0x00e234a4
0x00e234a6
0x00e23551
0x00e23551
0x00e23556
0x00e23558
0x00e2355d
0x00e23562
0x00e23568
0x00e2356a
0x00e23570
0x00e23576
0x00e23576
0x00e23570
0x00e23562
0x00000000
0x00e23556
0x00e23436
0x00e23440
0x00e23444
0x00e23450
0x00e23450
0x00e23458
0x00e234b5
0x00e234bc
0x00e234c2
0x00e234c4
0x00e234c6
0x00e234c9
0x00e234ce
0x00e234d1
0x00e234d1
0x00e234d7
0x00e234da
0x00e234e2
0x00e234e9
0x00e234ec
0x00e234ee
0x00e234f4
0x00e234f4
0x00e234f9
0x00e234fe
0x00e23504
0x00e23506
0x00e2350b
0x00e2350c
0x00e23512
0x00e23512
0x00e2350c
0x00e234fe
0x00e23579
0x00e2357f
0x00e23596
0x00e2345a
0x00e2345d
0x00000000
0x00e2345f
0x00e2345f
0x00e23460
0x00e23467
0x00e23469
0x00e2346e
0x00e235b2
0x00e235b7
0x00e235ba
0x00e235c8
0x00e235cd
0x00e235ce
0x00e235cf
0x00e235d0
0x00e235d1
0x00e235d3
0x00e235d5
0x00e235e0
0x00e235e1
0x00e235e7
0x00e235ec
0x00e235ee
0x00e235f1
0x00e235f2
0x00e235f3
0x00e235f7
0x00e235fd
0x00e23603
0x00e23609
0x00e2360e
0x00e23610
0x00e23613
0x00e23616
0x00e23618
0x00e23dc1
0x00e23dc4
0x00e23dd1
0x00e23ddb
0x00000000
0x00e23620
0x00e23620
0x00e23623
0x00e23625
0x00e2362c
0x00e23633
0x00e23637
0x00e2363a
0x00e23640
0x00e23640
0x00e23642
0x00e23643
0x00e23643
0x00e2364e
0x00e23653
0x00e2365d
0x00e2366f
0x00e23676
0x00e2367a
0x00e2367d
0x00e23680
0x00e23684
0x00e2368b
0x00e23690
0x00e23693
0x00e23695
0x00e236f9
0x00e23710
0x00e23717
0x00e2371c
0x00e23722
0x00e23727
0x00e2372a
0x00e2372c
0x00e237c0
0x00e237d7
0x00e237de
0x00e237e3
0x00e237e9
0x00e237ee
0x00e237f1
0x00e237f3
0x00e23887
0x00e2389e
0x00e238a5
0x00e238aa
0x00e238b0
0x00e238b5
0x00e238b8
0x00e238ba
0x00e2394a
0x00e23961
0x00e23968
0x00e2396d
0x00e23973
0x00e23978
0x00e2397b
0x00e2397d
0x00000000
0x00e23983
0x00e23983
0x00e23989
0x00e2398c
0x00e23993
0x00e23996
0x00e23998
0x00000000
0x00e2399e
0x00e2399e
0x00e239a6
0x00e239a9
0x00e239ac
0x00e239b1
0x00e239b8
0x00e239bb
0x00e239c0
0x00e239c3
0x00e239ca
0x00e239ce
0x00e239d1
0x00e239d4
0x00e239e0
0x00e239e2
0x00e239e5
0x00e239ea
0x00e239ed
0x00e239f0
0x00e239f2
0x00e23d71
0x00e23d71
0x00e23d75
0x00e23d78
0x00e23d7b
0x00e23da7
0x00e23da7
0x00e23daa
0x00e23db1
0x00e23db8
0x00000000
0x00e23d7d
0x00e23d7d
0x00e23d80
0x00e23d83
0x00e23d85
0x00e23d8b
0x00e23d9d
0x00e23d9d
0x00e23d9f
0x00e23da4
0x00000000
0x00e23d8d
0x00e23d8d
0x00e23d90
0x00e23d98
0x00e23d9b
0x00000000
0x00000000
0x00000000
0x00000000
0x00e23d9b
0x00e23d8b
0x00e23a00
0x00e23a00
0x00e23a00
0x00e23a02
0x00e23a0b
0x00e23a12
0x00e23a15
0x00e23a19
0x00e23a21
0x00e23a29
0x00e23a2e
0x00e23a31
0x00e23a34
0x00e23a3b
0x00e23a3f
0x00e23a42
0x00e23a44
0x00e23a51
0x00e23a56
0x00e23a59
0x00e23a5c
0x00e23a5f
0x00e23bdc
0x00e23bdc
0x00e23bdf
0x00e23be2
0x00e23c4e
0x00e23c55
0x00e23c5c
0x00e23c60
0x00e23c65
0x00e23c68
0x00e23c68
0x00000000
0x00e23be4
0x00e23be4
0x00e23be7
0x00e23bf1
0x00e23bf4
0x00e23bfe
0x00e23c05
0x00e23c07
0x00000000
0x00e23c0d
0x00e23c0d
0x00e23c12
0x00e23c15
0x00e23c18
0x00e23c1f
0x00e23c24
0x00e23c2d
0x00e23c32
0x00e23c38
0x00e23c3c
0x00e23c6b
0x00e23c6f
0x00e23c72
0x00e23c77
0x00e23c79
0x00e23c7b
0x00e23cba
0x00e23cba
0x00e23cc1
0x00e23cc3
0x00e23d05
0x00e23d05
0x00e23d09
0x00e23d0c
0x00e23d0f
0x00000000
0x00e23d11
0x00e23d11
0x00e23d14
0x00e23d15
0x00e23d17
0x00e23d1d
0x00e23d33
0x00e23d33
0x00e23d35
0x00e23d3a
0x00000000
0x00e23d1f
0x00e23d1f
0x00e23d22
0x00e23d27
0x00e23d2a
0x00e23d2d
0x00000000
0x00000000
0x00000000
0x00000000
0x00e23d2d
0x00e23d1d
0x00e23cc5
0x00e23cc5
0x00e23cce
0x00e23cd1
0x00e23cd4
0x00000000
0x00e23cd6
0x00e23cd6
0x00e23cdc
0x00e23cdd
0x00e23cdf
0x00e23ce5
0x00e23cfb
0x00e23cfb
0x00e23cfd
0x00e23d02
0x00000000
0x00e23ce7
0x00e23ce7
0x00e23cea
0x00e23cf2
0x00e23cf5
0x00000000
0x00000000
0x00000000
0x00000000
0x00e23cf5
0x00e23ce5
0x00e23cd4
0x00e23c7d
0x00e23c7d
0x00e23c80
0x00e23c83
0x00e23c86
0x00e23c89
0x00000000
0x00e23c8b
0x00e23c8b
0x00e23c8e
0x00e23c8f
0x00e23c91
0x00e23c97
0x00e23cad
0x00e23cad
0x00e23caf
0x00e23cb4
0x00e23cb7
0x00000000
0x00e23c99
0x00e23c99
0x00e23c9c
0x00e23ca4
0x00e23ca7
0x00000000
0x00000000
0x00000000
0x00000000
0x00e23ca7
0x00e23c97
0x00e23c89
0x00e23c7b
0x00e23c07
0x00e23a65
0x00e23a65
0x00e23a68
0x00e23a6f
0x00e23a76
0x00e23a7a
0x00e23a7c
0x00000000
0x00e23a82
0x00e23a82
0x00e23a8a
0x00e23a8d
0x00e23a90
0x00e23a95
0x00e23a9c
0x00e23a9f
0x00e23aa4
0x00e23aab
0x00e23aae
0x00e23ab1
0x00e23abb
0x00e23abf
0x00e23ac4
0x00e23acf
0x00e23ad9
0x00e23ae0
0x00e23ae5
0x00e23aeb
0x00e23aee
0x00e23af5
0x00e23afc
0x00e23b00
0x00e23b04
0x00e23b0c
0x00e23b11
0x00e23b18
0x00e23b22
0x00e23b2a
0x00e23b34
0x00e23b3b
0x00e23b42
0x00e23b4a
0x00e23b51
0x00e23b55
0x00e23b5a
0x00e23b60
0x00e23bc6
0x00e23bc7
0x00e23bc8
0x00e23b62
0x00e23b62
0x00e23b65
0x00e23b6f
0x00e23b74
0x00e23b7b
0x00e23b82
0x00e23b86
0x00e23b90
0x00e23b95
0x00e23b9c
0x00e23ba3
0x00e23bad
0x00e23bb7
0x00e23bb7
0x00e23bcd
0x00e23bd3
0x00e23bd8
0x00000000
0x00e23bd8
0x00e23a7c
0x00000000
0x00e23d3d
0x00e23d3d
0x00e23d44
0x00e23d47
0x00e23d4a
0x00e23d56
0x00e23d58
0x00e23d5b
0x00e23d60
0x00e23d63
0x00e23d66
0x00e23d69
0x00e23d69
0x00000000
0x00e23a00
0x00e239f2
0x00e23998
0x00e238c0
0x00e238c0
0x00e238c6
0x00e238c9
0x00e238d0
0x00e238d3
0x00e238d5
0x00000000
0x00e238db
0x00e238db
0x00e238e3
0x00e238e6
0x00e238e9
0x00e238ee
0x00e238f5
0x00e238f8
0x00e23906
0x00e23909
0x00e2390e
0x00e23911
0x00e23914
0x00000000
0x00e23916
0x00e23916
0x00e23919
0x00e2391a
0x00e2391c
0x00e23922
0x00e23938
0x00e23938
0x00e2393a
0x00e2393f
0x00000000
0x00e23924
0x00e23924
0x00e23927
0x00e2392f
0x00e23932
0x00000000
0x00000000
0x00000000
0x00000000
0x00e23932
0x00e23922
0x00e23914
0x00e238d5
0x00e237f9
0x00e237f9
0x00e237ff
0x00e23802
0x00e23809
0x00e2380c
0x00e2380e
0x00000000
0x00e23814
0x00e23814
0x00e2381c
0x00e2381f
0x00e23822
0x00e23827
0x00e2382e
0x00e23831
0x00e2383f
0x00e23842
0x00e23847
0x00e2384a
0x00e2384d
0x00000000
0x00e23853
0x00e23853
0x00e23856
0x00e23857
0x00e23859
0x00e2385f
0x00e23875
0x00e23875
0x00e23877
0x00e2387c
0x00e2387f
0x00000000
0x00e23861
0x00e23861
0x00e23864
0x00e2386c
0x00e2386f
0x00000000
0x00000000
0x00000000
0x00000000
0x00e2386f
0x00e2385f
0x00e2384d
0x00e2380e
0x00e23732
0x00e23732
0x00e23738
0x00e2373b
0x00e23742
0x00e23745
0x00e23747
0x00000000
0x00e2374d
0x00e2374d
0x00e23755
0x00e23758
0x00e2375b
0x00e23760
0x00e23767
0x00e2376a
0x00e23778
0x00e2377b
0x00e23780
0x00e23783
0x00e23786
0x00e23942
0x00e23942
0x00000000
0x00e2378c
0x00e2378c
0x00e2378f
0x00e23790
0x00e23792
0x00e23798
0x00e237ae
0x00e237ae
0x00e237b0
0x00e237b5
0x00e237b8
0x00000000
0x00e2379a
0x00e2379a
0x00e2379d
0x00e237a5
0x00e237a8
0x00000000
0x00000000
0x00000000
0x00000000
0x00e237a8
0x00e23798
0x00e23786
0x00e23747
0x00e23697
0x00e23697
0x00e2369e
0x00e2369e
0x00e236a1
0x00e236a1
0x00e236a8
0x00e236ab
0x00e236ae
0x00e236db
0x00e236de
0x00e236df
0x00e236e2
0x00e236e8
0x00000000
0x00e236ee
0x00e236ee
0x00000000
0x00e236ee
0x00e236b0
0x00e236b0
0x00e236b0
0x00e236b3
0x00e236b5
0x00e236bb
0x00e236d1
0x00e236d1
0x00e236d3
0x00e236d8
0x00000000
0x00e236bd
0x00e236bd
0x00e236c0
0x00e236c8
0x00e236cb
0x00e23ddc
0x00e23ddc
0x00e23de1
0x00e23de1
0x00e23de6
0x00e23de7
0x00e23de8
0x00e23de9
0x00e23dea
0x00e23deb
0x00e23dec
0x00e23ded
0x00e23dee
0x00e23def
0x00e23df0
0x00e23df1
0x00e23df3
0x00e23df5
0x00e23e00
0x00e23e01
0x00e23e07
0x00e23e0c
0x00e23e0e
0x00e23e11
0x00e23e12
0x00e23e13
0x00e23e14
0x00e23e18
0x00e23e1e
0x00e23e2a
0x00e23e31
0x00e23e37
0x00e23e3d
0x00e23e3f
0x00e23e42
0x00e23e44
0x00e24093
0x00e24094
0x00e2409b
0x00e240a2
0x00e240b0
0x00e240ba
0x00e23e4a
0x00e23e4a
0x00e23e50
0x00e23e55
0x00e23e62
0x00e23e64
0x00e23e77
0x00e23e7f
0x00e23e89
0x00e23e93
0x00e23e97
0x00e23ea1
0x00e23eb0
0x00e23eb6
0x00e23eba
0x00e23ec4
0x00e23ece
0x00e23edd
0x00e23ee3
0x00e23ee7
0x00e23eee
0x00e23ef5
0x00e23f01
0x00e23f0a
0x00e23f0f
0x00e23f13
0x00e23f1a
0x00e23f21
0x00e23f25
0x00e23f2c
0x00e23f33
0x00e23f37
0x00e23f39
0x00e23f3d
0x00e23f42
0x00e23f48
0x00e23f4b
0x00e23f52
0x00e23f55
0x00e23f5c
0x00e23f62
0x00e23f68
0x00e23f6c
0x00e23f73
0x00e23f7a
0x00e23f80
0x00e23f86
0x00e23f8c
0x00e23f90
0x00e23f92
0x00e23f94
0x00e23f99
0x00e23f9e
0x00e23fa4
0x00e23fa6
0x00e23fab
0x00e23fac
0x00e23fb2
0x00e23fb2
0x00e23fac
0x00e23fb5
0x00e23fb5
0x00e23fbb
0x00e23fbf
0x00e23fc6
0x00e2403d
0x00e2403d
0x00e24044
0x00e2404b
0x00e24056
0x00e2405e
0x00e24069
0x00e24074
0x00e24078
0x00e24078
0x00e24083
0x00e2408e
0x00000000
0x00e23fc8
0x00e23fd3
0x00e23fd8
0x00e23fe2
0x00e23ff2
0x00e23ffa
0x00e23fff
0x00e24003
0x00e24009
0x00e2400c
0x00000000
0x00e2400e
0x00e2400e
0x00e24014
0x00e24015
0x00e24017
0x00e2401d
0x00e24033
0x00e24033
0x00e24035
0x00e2403a
0x00000000
0x00e2401f
0x00e2401f
0x00e24022
0x00e2402a
0x00e2402d
0x00e240bb
0x00e240c0
0x00e240c1
0x00e240c2
0x00e240c3
0x00e240c4
0x00e240c5
0x00e240c6
0x00e240c7
0x00e240c8
0x00e240c9
0x00e240ca
0x00e240cb
0x00e240cc
0x00e240cd
0x00e240ce
0x00e240cf
0x00e240d0
0x00e240d1
0x00e240d3
0x00e240d6
0x00e240dc
0x00e240dd
0x00e240e5
0x00e240e6
0x00e240ec
0x00e240f3
0x00e240fc
0x00e24105
0x00e2410f
0x00e24110
0x00e24118
0x00e2411a
0x00e24120
0x00e242fa
0x00e242fa
0x00e242ff
0x00e24300
0x00e24303
0x00e24306
0x00e24307
0x00e24308
0x00e2430a
0x00e2430c
0x00e24310
0x00e24313
0x00e24313
0x00e24315
0x00e24315
0x00e2431c
0x00e2431f
0x00e24329
0x00e2432d
0x00e24330
0x00e24335
0x00e2433a
0x00e24341
0x00e24348
0x00e2434c
0x00e24353
0x00e2435b
0x00e2435f
0x00e24363
0x00e24368
0x00e2436d
0x00e24370
0x00e24377
0x00e2437e
0x00e24382
0x00e24382
0x00e24315
0x00e24389
0x00e24126
0x00e24126
0x00e24133
0x00e2413b
0x00e24146
0x00e2414a
0x00e2414e
0x00e24150
0x00e24156
0x00e24159
0x00e2415b
0x00e24152
0x00e24152
0x00e24152
0x00e24161
0x00e24164
0x00e24167
0x00e2416c
0x00e24173
0x00e24179
0x00e241a2
0x00e241a4
0x00e241b3
0x00e241b3
0x00e241a6
0x00e241a6
0x00e241a7
0x00e241ac
0x00e241af
0x00e241af
0x00000000
0x00000000
0x00000000
0x00000000
0x00e2416e
0x00e2416e
0x00e2417b
0x00e2417b
0x00e2417e
0x00e24181
0x00e24183
0x00e24186
0x00e24187
0x00e2418c
0x00e2418f
0x00e24191
0x00e242f5
0x00e242f5
0x00000000
0x00e24197
0x00e24197
0x00e2419a
0x00e2419d
0x00e241b5
0x00e241b8
0x00e241b9
0x00e241bd
0x00e241c3
0x00e241c5
0x00e241c8
0x00e241cf
0x00e241d6
0x00e241d9
0x00e241dc
0x00e241e1
0x00e241e6
0x00e241ed
0x00e241f4
0x00e241f7
0x00e241fe
0x00e24205
0x00e24209
0x00e2420d
0x00e24212
0x00e24217
0x00e2421e
0x00e24225
0x00e24229
0x00e2422f
0x00e24238
0x00e2423a
0x00e2423e
0x00e24249
0x00e2424f
0x00e24252
0x00e24253
0x00e24258
0x00e2425e
0x00e24261
0x00e24263
0x00e242ca
0x00e242d5
0x00e242db
0x00e242e4
0x00e242e4
0x00e242e8
0x00e242f2
0x00e24265
0x00e24265
0x00e2426b
0x00e2426d
0x00e24270
0x00e24272
0x00e24277
0x00e2427a
0x00e2427a
0x00e2427e
0x00e2427e
0x00e24284
0x00e242a0
0x00e242a3
0x00e242a9
0x00e242bd
0x00e242bd
0x00e242bf
0x00e242c4
0x00000000
0x00e242ab
0x00e242ab
0x00e242ae
0x00e242b1
0x00e242b3
0x00e242b6
0x00e242b9
0x00000000
0x00e242bb
0x00e242bb
0x00000000
0x00e242bb
0x00e242b9
0x00e242a9
0x00e24263
0x00e24191
0x00e2416c
0x00000000
0x00000000
0x00000000
0x00e2402d
0x00e2401d
0x00e2400c
0x00e23e57
0x00e23e58
0x00000000
0x00e23e58
0x00e23e55
0x00000000
0x00000000
0x00000000
0x00e236cb
0x00e236bb
0x00e236ae
0x00000000
0x00e23695
0x00e23620
0x00e23474
0x00e2347b
0x00e23484
0x00e23489
0x00e2348c
0x00000000
0x00e2348c
0x00e2346e
0x00e2345d
0x00e23458
0x00000000
0x00e23430
0x00e2351a
0x00e23520
0x00e23523
0x00e2352a
0x00e2352c
0x00e2352e
0x00e23531
0x00e23536
0x00e23539
0x00e23539
0x00e2353f
0x00e23542
0x00e2354a
0x00000000
0x00e2354a
0x00000000

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00E235AD
__CxxThrowException@8.LIBVCRUNTIME ref: 00E235C8

Strings

malloc failed., xrefs: 00E23597
reaclloc failed., xrefs: 00E235B2
-console, xrefs: 00E23664, 00E23683
Global\HttpToUsbBridge, xrefs: 00E23E21
POST, xrefs: 00E2341F

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Exception@8Throw
String ID: -console$Global\HttpToUsbBridge$POST$malloc failed.$reaclloc failed.
API String ID: 2005118841-666443988
Opcode ID: 6af701cc88098e9d46e264e960eea7a22f25ded0a4387b8f6458be90c10e900f
Instruction ID: 60c55ae8304242d41d0d1580b0bb4e86361c420ee3a07f891faa9e75ab967156
Opcode Fuzzy Hash: 6af701cc88098e9d46e264e960eea7a22f25ded0a4387b8f6458be90c10e900f
Instruction Fuzzy Hash: AD819DB0E002159BDB11DF64D845BAEF7F5BF44714F248219E818BB381DB79AE54CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E25790, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 99
threadnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 39%

			E00E25790(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v24;
				char _v40;
				char _v41;
				intOrPtr _v48;
				void* __ebp;
				signed int _t26;
				signed int _t27;
				intOrPtr _t47;
				char* _t50;
				char* _t53;
				char* _t54;
				intOrPtr* _t67;
				signed int _t69;
				void* _t70;
				char* _t72;
				void* _t73;
				char* _t74;

				_t65 = __edi;
				_t62 = __edx;
				_t48 = __ebx;
				_push(0xffffffff);
				_push(0xe60c88);
				_push( *[fs:0x0]);
				_t26 =  *0xe7b068; // 0x1b9618b6
				_t27 = _t26 ^ _t69;
				_v20 = _t27;
				_push(_t27);
				 *[fs:0x0] =  &_v16;
				_t67 = __ecx;
				E00E20EA0(__ebx, __ecx, __edx, __edi);
				_t72 = _t70 - 0xc;
				_t50 = _t72;
				 *((intOrPtr*)(_t50 + 0x10)) = 0;
				 *((intOrPtr*)(_t50 + 0x14)) = 0xf;
				 *_t50 = 0;
				E00E14C40(__ebx, _t50, __edx, "Socket::AcceptSocket", 0x14);
				_push(GetCurrentThreadId());
				E00E12260(__ebx, 0xcb, _t62, __edi);
				_t73 = _t72 + 0x1c;
				_t52 = _t67;
				_v41 = 0;
				_v24 = 0;
				if( *((intOrPtr*)( *((intOrPtr*)( *_t67 + 0xc))))() != 0) {
					_t47 =  *((intOrPtr*)(_t67 + 8));
					if(_t47 != 0xffffffff) {
						_v24 = 0x10;
						_t52 =  &_v40;
						asm("xorps xmm0, xmm0");
						asm("movups [ebp-0x24], xmm0"); // executed
						__imp__#1(_t47,  &_v40,  &_v24); // executed
						 *((intOrPtr*)(_t67 + 0xc)) = _t47;
						_v41 = 1;
					}
				}
				E00E20EA0(_t48, _t52, _t62, _t65);
				_t74 = _t73 - 0x18;
				_t53 = _t74;
				_v48 = _t74;
				 *((intOrPtr*)(_t53 + 0x10)) = 0;
				 *((intOrPtr*)(_t53 + 0x14)) = 0xf;
				 *_t53 = 0;
				E00E14C40(_t48, _t53, _t62, "-Result: ", 9);
				_v8 = 0;
				_t54 = _t74 - 0x18;
				 *((intOrPtr*)(_t54 + 0x10)) = 0;
				 *((intOrPtr*)(_t54 + 0x14)) = 0xf;
				 *_t54 = 0;
				E00E14C40(_t48, _t54, _t62, "Socket::AcceptSocket", 0x14);
				_push(GetCurrentThreadId());
				_v8 = 0xffffffff;
				E00E12110(_t48, 0xe0, _t62, _t65);
				E00E20EA0(_t48, 0xe0, _t62, _t65);
				if( *0xe7ea10 != 0) {
					_t64 =  ==  ? "FALSE" : "TRUE";
					E00E167A0(_t48,  ==  ? "FALSE" : "TRUE", _t65, _v41, E00E164F0(0xe7d8f8,  ==  ? "FALSE" : "TRUE"));
				}
				 *[fs:0x0] = _v16;
				return E00E2C067(_v20 ^ _t69);
			}

0x00e25790
0x00e25790
0x00e25790
0x00e25793
0x00e25795
0x00e257a0
0x00e257a4
0x00e257a9
0x00e257ab
0x00e257af
0x00e257b3
0x00e257b9
0x00e257bb
0x00e257c0
0x00e257c3
0x00e257c7
0x00e257ce
0x00e257da
0x00e257dd
0x00e257e7
0x00e257ed
0x00e257f4
0x00e257f7
0x00e257f9
0x00e257fd
0x00e2580b
0x00e2580d
0x00e25813
0x00e25818
0x00e25820
0x00e25823
0x00e25828
0x00e2582c
0x00e25832
0x00e25835
0x00e25835
0x00e25813
0x00e25839
0x00e2583e
0x00e25841
0x00e25843
0x00e25848
0x00e2584f
0x00e2585b
0x00e2585e
0x00e25866
0x00e2586d
0x00e25871
0x00e25878
0x00e25884
0x00e25887
0x00e25891
0x00e25897
0x00e2589e
0x00e258a6
0x00e258b2
0x00e258c7
0x00e258d0
0x00e258d5
0x00e258de
0x00e258f4

APIs

Part of subcall function 00E20EA0: __Mtx_unlock.LIBCPMT ref: 00E20F3F

GetCurrentThreadId.KERNEL32 ref: 00E257E2
accept.WS2_32(?,?,00000000), ref: 00E2582C
GetCurrentThreadId.KERNEL32 ref: 00E2588C

Strings

Socket::AcceptSocket, xrefs: 00E257D5, 00E2587F
TRUE, xrefs: 00E258BD
-Result: , xrefs: 00E25856
FALSE, xrefs: 00E258B8

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: CurrentThread$Mtx_unlockaccept
String ID: -Result: $FALSE$Socket::AcceptSocket$TRUE
API String ID: 3515271716-2204795643
Opcode ID: 7136e91152487196da3df65319477f5c044a72aa2ac990e8fed41e783bef9889
Instruction ID: 09af6dc8adb780bf6cbd2be5efa6870846045dd4c72f85154bb6b75ef339e2c4
Opcode Fuzzy Hash: 7136e91152487196da3df65319477f5c044a72aa2ac990e8fed41e783bef9889
Instruction Fuzzy Hash: 493115B09003449FEB08EF78D906B9E7BE0AF05318F24565CE8147B3C2DBB68945C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00E251A0, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 93
threadnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00E251A0(intOrPtr* __ecx, void* __edx, void* __edi, void* __eflags) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __ebp;
				signed int _t16;
				intOrPtr _t25;
				void* _t36;
				void* _t37;
				char* _t41;
				intOrPtr* _t43;
				char* _t44;
				char* _t45;
				void* _t54;
				intOrPtr* _t55;
				signed int _t57;
				void* _t58;
				char* _t60;
				void* _t61;
				char* _t62;

				_t53 = __edi;
				_t50 = __edx;
				_t16 =  *0xe7b068; // 0x1b9618b6
				 *[fs:0x0] =  &_v16;
				_t55 = __ecx;
				E00E20EA0(_t36, __ecx, __edx, __edi);
				_t60 = _t58 - 0xfffffffffffffff0;
				_t41 = _t60;
				 *((intOrPtr*)(_t41 + 0x10)) = 0;
				 *((intOrPtr*)(_t41 + 0x14)) = 0xf;
				 *_t41 = 0;
				E00E14C40(_t36, _t41, __edx, "Socket::CreateSocket", 0x14);
				E00E12260(_t36, 0x57, _t50, __edi, GetCurrentThreadId(), _t16 ^ _t57, _t54, _t36,  *[fs:0x0], 0xe60bf8, 0xffffffff);
				_t61 = _t60 + 0x1c;
				_t43 = _t55;
				_t37 = 0;
				_t25 =  *((intOrPtr*)( *((intOrPtr*)( *_t55 + 0xc))))();
				if(_t25 != 0 &&  *((intOrPtr*)(_t55 + 8)) == 0xffffffff) {
					__imp__#23(2, 1, 0); // executed
					_t43 = 1;
					 *((intOrPtr*)(_t55 + 8)) = _t25;
					_t37 =  !=  ? 1 : 0;
				}
				E00E20EA0(_t37, _t43, _t50, _t53);
				_t62 = _t61 - 0x18;
				_t44 = _t62;
				_v20 = _t62;
				 *((intOrPtr*)(_t44 + 0x10)) = 0;
				 *((intOrPtr*)(_t44 + 0x14)) = 0xf;
				 *_t44 = 0;
				E00E14C40(_t37, _t44, _t50, "-Result: ", 9);
				_v8 = 0;
				_t45 = _t62 - 0x18;
				 *((intOrPtr*)(_t45 + 0x10)) = 0;
				 *((intOrPtr*)(_t45 + 0x14)) = 0xf;
				 *_t45 = 0;
				E00E14C40(_t37, _t45, _t50, "Socket::CreateSocket", 0x14);
				_push(GetCurrentThreadId());
				_v8 = 0xffffffff;
				E00E12110(_t37, 0x65, _t50, _t53);
				E00E20EA0(_t37, 0x65, _t50, _t53);
				if( *0xe7ea10 != 0) {
					_t52 =  ==  ? "FALSE" : "TRUE";
					E00E167A0(_t37,  ==  ? "FALSE" : "TRUE", _t53, _t37, E00E164F0(0xe7d8f8,  ==  ? "FALSE" : "TRUE"));
				}
				 *[fs:0x0] = _v16;
				return _t37;
			}

0x00e251a0
0x00e251a0
0x00e251b6
0x00e251c1
0x00e251c7
0x00e251c9
0x00e251ce
0x00e251d1
0x00e251d5
0x00e251dc
0x00e251e8
0x00e251eb
0x00e251fb
0x00e25202
0x00e25205
0x00e25207
0x00e2520c
0x00e25210
0x00e2521e
0x00e2522a
0x00e2522f
0x00e25232
0x00e25232
0x00e25235
0x00e2523a
0x00e2523d
0x00e2523f
0x00e25244
0x00e2524b
0x00e25257
0x00e2525a
0x00e25262
0x00e25269
0x00e2526d
0x00e25274
0x00e25280
0x00e25283
0x00e2528d
0x00e25293
0x00e2529a
0x00e252a2
0x00e252ae
0x00e252c1
0x00e252ca
0x00e252cf
0x00e252d7
0x00e252e4

APIs

Part of subcall function 00E20EA0: __Mtx_unlock.LIBCPMT ref: 00E20F3F

GetCurrentThreadId.KERNEL32 ref: 00E251F0
socket.WS2_32(00000002,00000001,00000000), ref: 00E2521E
GetCurrentThreadId.KERNEL32 ref: 00E25288

Strings

TRUE, xrefs: 00E252B7
-Result: , xrefs: 00E25252
Socket::CreateSocket, xrefs: 00E251E3, 00E2527B
FALSE, xrefs: 00E252B0

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: CurrentThread$Mtx_unlocksocket
String ID: -Result: $FALSE$Socket::CreateSocket$TRUE
API String ID: 1732464555-1934306783
Opcode ID: db6957ccf9421c5e057e95455b8afa5952e3e590708d1c5477a5bbb0a1fbc5bf
Instruction ID: 001cb0554576d32f6b999f2b853087ed075477182bcced4219bbbcaa672c0666
Opcode Fuzzy Hash: db6957ccf9421c5e057e95455b8afa5952e3e590708d1c5477a5bbb0a1fbc5bf
Instruction Fuzzy Hash: EF3148B1A40304ABEB14AF78DC077993BE4AB01318F24566DF5247B3D3CBB6894587E2

Uniqueness

Uniqueness Score: -1.00%

Function 00E16370, Relevance: 9.1, APIs: 6, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00E16370(void* __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				char _v16;
				char _v24;
				signed int _v32;
				intOrPtr* _v36;
				char _v40;
				char _v44;
				intOrPtr* _v48;
				char _v68;
				char _v120;
				signed int _t40;
				signed int _t41;
				intOrPtr* _t44;
				intOrPtr _t48;
				intOrPtr _t50;
				void* _t57;
				signed int _t62;
				signed int _t63;
				void* _t64;
				intOrPtr _t66;
				intOrPtr _t73;
				void* _t79;
				signed int _t82;
				intOrPtr* _t85;
				intOrPtr* _t86;
				void* _t92;
				signed int _t95;
				void* _t103;

				_t79 = __edx;
				_t64 = _t92;
				_t95 = (_t92 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t64 + 4));
				_t90 = _t95;
				_push(0xffffffff);
				_push(0xe5fcdf);
				_push( *[fs:0x0]);
				_push(_t64);
				_t40 =  *0xe7b068; // 0x1b9618b6
				_t41 = _t40 ^ _t95;
				_v32 = _t41;
				_push(_t41);
				 *[fs:0x0] =  &_v24;
				_t85 =  *((intOrPtr*)(_t64 + 8));
				_v36 = _t85;
				E00E297C6( &_v44, 0);
				_v16 = 0;
				_t82 =  *0xe7d9b8; // 0x1
				_t44 =  *0xe7ea44; // 0xc75030
				_v48 = _t44;
				if(_t82 == 0) {
					E00E297C6( &_v40, _t82);
					_t103 =  *0xe7d9b8 - _t82; // 0x1
					if(_t103 == 0) {
						_t62 =  *0xe7d9a0; // 0x1
						_t63 = _t62 + 1;
						 *0xe7d9a0 = _t63;
						 *0xe7d9b8 = _t63;
					}
					E00E2981E( &_v40);
					_t82 =  *0xe7d9b8; // 0x1
				}
				_t66 =  *((intOrPtr*)(_t85 + 4));
				if(_t82 >=  *((intOrPtr*)(_t66 + 0xc))) {
					_t86 = 0;
					__eflags = 0;
					L8:
					if( *((char*)(_t66 + 0x14)) == 0) {
						L11:
						if(_t86 != 0) {
							L19:
							E00E2981E( &_v44);
							 *[fs:0x0] = _v24;
							return E00E2C067(_v32 ^ _t90);
						}
						L12:
						_t48 = _v48;
						if(_t48 == 0) {
							_push(0x18);
							_t86 = E00E2C07D(_t79, __eflags);
							_v48 = _t86;
							_v16 = 1;
							_t73 =  *((intOrPtr*)(_v36 + 4));
							__eflags = _t73;
							if(_t73 != 0) {
								_t50 =  *((intOrPtr*)(_t73 + 0x18));
								__eflags = _t50;
								if(_t50 == 0) {
									_t28 = _t73 + 0x1c; // 0x1e
									_t50 = _t28;
								}
							} else {
								_t50 = 0xe71f6b;
							}
							E00E11AD0( &_v120, _t50); // executed
							 *((intOrPtr*)(_t86 + 4)) = 0;
							 *_t86 = 0xe6336c;
							E00E2A23D(_t79, _t82, __eflags,  &_v68);
							asm("movups xmm0, [eax]");
							asm("movups [esi+0x8], xmm0");
							E00E11B90( &_v120);
							_v36 = _t86;
							_v16 = 2;
							E00E29AA4(__eflags, _t86);
							 *((intOrPtr*)( *_t86 + 4))();
							 *0xe7ea44 = _t86;
						} else {
							_t86 = _t48;
						}
						goto L19;
					}
					_t57 = E00E29AD0();
					if(_t82 >=  *((intOrPtr*)(_t57 + 0xc))) {
						goto L12;
					}
					_t86 =  *((intOrPtr*)( *((intOrPtr*)(_t57 + 8)) + _t82 * 4));
					goto L11;
				}
				_t86 =  *((intOrPtr*)( *((intOrPtr*)(_t66 + 8)) + _t82 * 4));
				if(_t86 != 0) {
					goto L19;
				}
				goto L8;
			}

0x00e16370
0x00e16371
0x00e16379
0x00e16380
0x00e16384
0x00e16386
0x00e16388
0x00e16393
0x00e16394
0x00e16398
0x00e1639d
0x00e1639f
0x00e163a4
0x00e163a8
0x00e163ae
0x00e163b6
0x00e163b9
0x00e163be
0x00e163c5
0x00e163cb
0x00e163d0
0x00e163d5
0x00e163db
0x00e163e0
0x00e163e6
0x00e163e8
0x00e163ed
0x00e163ee
0x00e163f3
0x00e163f3
0x00e163fb
0x00e16400
0x00e16400
0x00e16406
0x00e1640c
0x00e1641e
0x00e1641e
0x00e16420
0x00e16424
0x00e16436
0x00e16438
0x00e164c5
0x00e164c8
0x00e164d2
0x00e164ec
0x00e164ec
0x00e1643e
0x00e1643e
0x00e16443
0x00e16449
0x00e16450
0x00e16455
0x00e16458
0x00e1645f
0x00e16462
0x00e16464
0x00e1646d
0x00e16470
0x00e16472
0x00e16474
0x00e16474
0x00e16474
0x00e16466
0x00e16466
0x00e16466
0x00e1647b
0x00e16483
0x00e1648b
0x00e16491
0x00e1649c
0x00e1649f
0x00e164a3
0x00e164a8
0x00e164ac
0x00e164b0
0x00e164bc
0x00e164bf
0x00e16445
0x00e16445
0x00e16445
0x00000000
0x00e16443
0x00e16426
0x00e1642e
0x00000000
0x00000000
0x00e16433
0x00000000
0x00e16433
0x00e16411
0x00e16416
0x00000000
0x00000000
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E163B9
std::_Lockit::_Lockit.LIBCPMT ref: 00E163DB
std::_Lockit::~_Lockit.LIBCPMT ref: 00E163FB
__Getctype.LIBCPMT ref: 00E16491
std::_Facet_Register.LIBCPMT ref: 00E164B0
std::_Lockit::~_Lockit.LIBCPMT ref: 00E164C8

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 319e083b5832be3aed5614b63269bf12d38311eeeae55ca7b479eee5ac7e708d
Instruction ID: 6100db8ea3351724cf4f70a6fb68fb34b6b6d7df306d8c3de5ac7a878f51e6bc
Opcode Fuzzy Hash: 319e083b5832be3aed5614b63269bf12d38311eeeae55ca7b479eee5ac7e708d
Instruction Fuzzy Hash: 72419B719042148FCB24DF58D841AAEB7F4FF48714F24516DE81ABB352EB30AD89CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E4D63D, Relevance: 7.7, APIs: 5, Instructions: 188
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00E4D63D(void* __ebx, signed int __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr* _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr* _v20;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v60;
				char _v276;
				short _v278;
				short _v280;
				char _v448;
				signed int _v452;
				short _v454;
				intOrPtr _v456;
				signed int _v460;
				intOrPtr _v464;
				signed int _v468;
				signed int _v472;
				intOrPtr _v512;
				char _v536;
				intOrPtr _v540;
				signed int _v544;
				intOrPtr _v548;
				signed int _v560;
				char _v708;
				signed int _v712;
				short _v714;
				signed int* _v716;
				signed int _v720;
				signed int _v724;
				signed int _v728;
				signed int* _v732;
				intOrPtr _v736;
				signed int _v740;
				signed int _v744;
				signed int _v748;
				signed int _v752;
				char _v824;
				char _v1252;
				char _v1264;
				intOrPtr _v1276;
				signed int _v1288;
				signed int _t238;
				signed int _t240;
				void* _t243;
				signed int _t246;
				signed int _t248;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				signed int _t257;
				signed int _t258;
				signed int _t260;
				signed int _t262;
				void* _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				signed int _t269;
				signed int _t272;
				signed int _t279;
				signed int _t282;
				signed int _t283;
				intOrPtr _t284;
				signed int _t287;
				signed int _t289;
				signed int _t290;
				intOrPtr _t292;
				signed int _t295;
				signed int _t296;
				signed int _t298;
				signed int _t318;
				signed int _t320;
				signed int _t322;
				signed int _t327;
				void* _t329;
				signed int _t331;
				void* _t332;
				intOrPtr _t333;
				signed int _t338;
				signed int _t339;
				intOrPtr* _t344;
				signed int _t358;
				signed int _t360;
				signed int _t362;
				intOrPtr* _t363;
				signed int _t365;
				intOrPtr* _t370;
				intOrPtr* _t375;
				intOrPtr* _t378;
				void* _t381;
				signed int _t382;
				intOrPtr* _t385;
				intOrPtr* _t386;
				signed int _t395;
				intOrPtr _t398;
				intOrPtr* _t399;
				signed int _t401;
				signed int* _t405;
				signed int _t406;
				intOrPtr* _t412;
				signed int _t421;
				short _t422;
				void* _t423;
				void* _t425;
				signed int _t426;
				signed int _t428;
				intOrPtr _t429;
				signed int _t432;
				intOrPtr _t433;
				signed int _t435;
				signed int _t438;
				intOrPtr _t444;
				signed int _t445;
				signed int _t447;
				signed int _t448;
				signed int _t452;
				signed int _t454;
				signed int _t457;
				signed int* _t458;
				intOrPtr* _t459;
				short _t460;
				void* _t462;
				signed int _t464;
				signed int _t466;
				void* _t468;
				void* _t469;
				void* _t471;
				signed int _t472;
				void* _t473;
				void* _t475;
				signed int _t476;
				void* _t478;
				void* _t480;
				signed int _t492;

				_t420 = __edx;
				_t462 = _t468;
				_t469 = _t468 - 0x10;
				_push(__ebx);
				_push(__esi);
				_v12 = 1;
				_t238 = E00E4F56D(0x6a6); // executed
				_t358 = _t238;
				_t239 = 0;
				_pop(_t370);
				if(_t358 == 0) {
					L20:
					return _t239;
				} else {
					_push(__edi);
					_t2 = _t358 + 4; // 0x4
					_t428 = _t2;
					 *_t428 = 0;
					 *_t358 = 1;
					_t444 = _a4;
					_t240 = _t444 + 0x30;
					_push( *_t240);
					_v16 = _t240;
					_push(0xe69918);
					_push( *0xe69854);
					E00E4D577(_t358, _t370, __edx, _t428, _t444, _t428, 0x351, 3);
					_t471 = _t469 + 0x18;
					_v8 = 0xe69854;
					while(1) {
						L2:
						_t243 = E00E57004(_t428, 0x351, 0xe69914);
						_t472 = _t471 + 0xc;
						if(_t243 != 0) {
							break;
						} else {
							_t8 = _v16 + 0x10; // 0x10
							_t412 = _t8;
							_t338 =  *_v16;
							_v16 = _t412;
							_t370 =  *_t412;
							_v20 = _t370;
							goto L4;
						}
						while(1) {
							L4:
							_t420 =  *_t338;
							if(_t420 !=  *_t370) {
								break;
							}
							if(_t420 == 0) {
								L8:
								_t339 = 0;
							} else {
								_t420 =  *((intOrPtr*)(_t338 + 2));
								if(_t420 !=  *((intOrPtr*)(_t370 + 2))) {
									break;
								} else {
									_t338 = _t338 + 4;
									_t370 = _t370 + 4;
									if(_t420 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							_push(_v20);
							_push(0xe69918);
							asm("sbb eax, eax");
							_v12 = _v12 &  !( ~_t339);
							_t344 = _v8 + 0xc;
							_v8 = _t344;
							_push( *_t344);
							E00E4D577(_t358, _t370, _t420, _t428, _t444, _t428, 0x351, 3);
							_t471 = _t472 + 0x18;
							if(_v8 < 0xe69884) {
								goto L2;
							} else {
								if(_v12 != 0) {
									E00E4F1E8(_t358);
									_t435 = _t428 | 0xffffffff;
									__eflags =  *(_t444 + 0x28);
									if(__eflags != 0) {
										asm("lock xadd [ecx], eax");
										if(__eflags == 0) {
											E00E4F1E8( *(_t444 + 0x28));
										}
									}
									__eflags =  *(_t444 + 0x24);
									if( *(_t444 + 0x24) != 0) {
										asm("lock xadd [eax], edi");
										__eflags = _t435 == 1;
										if(_t435 == 1) {
											E00E4F1E8( *(_t444 + 0x24));
										}
									}
									 *(_t444 + 0x24) = 0;
									 *(_t444 + 0x1c) = 0;
									 *(_t444 + 0x28) = 0;
									 *((intOrPtr*)(_t444 + 0x20)) = 0;
									_t239 =  *((intOrPtr*)(_t444 + 0x40));
								} else {
									_t438 = _t428 | 0xffffffff;
									_t492 =  *(_t444 + 0x28);
									if(_t492 != 0) {
										asm("lock xadd [ecx], eax");
										if(_t492 == 0) {
											E00E4F1E8( *(_t444 + 0x28));
										}
									}
									if( *(_t444 + 0x24) != 0) {
										asm("lock xadd [eax], edi");
										if(_t438 == 1) {
											E00E4F1E8( *(_t444 + 0x24));
										}
									}
									 *(_t444 + 0x24) =  *(_t444 + 0x24) & 0x00000000;
									_t28 = _t358 + 4; // 0x4
									_t239 = _t28;
									 *(_t444 + 0x1c) =  *(_t444 + 0x1c) & 0x00000000;
									 *(_t444 + 0x28) = _t358;
									 *((intOrPtr*)(_t444 + 0x20)) = _t239;
								}
								goto L20;
							}
							goto L131;
						}
						asm("sbb eax, eax");
						_t339 = _t338 | 0x00000001;
						__eflags = _t339;
						goto L10;
					}
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00E49599();
					asm("int3");
					_push(_t462);
					_t464 = _t472;
					_t473 = _t472 - 0x1d0;
					_t246 =  *0xe7b068; // 0x1b9618b6
					_v60 = _t246 ^ _t464;
					_t248 = _v44;
					_push(_t358);
					_push(_t444);
					_t445 = _v40;
					_push(_t428);
					_t429 = _v48;
					_v512 = _t429;
					__eflags = _t248;
					if(_t248 == 0) {
						_v460 = 1;
						_v468 = 0;
						_t360 = 0;
						_v452 = 0;
						__eflags = _t445;
						if(__eflags == 0) {
							L79:
							E00E4D63D(_t360, _t420, _t429, _t445, __eflags, _t429); // executed
							goto L80;
						} else {
							__eflags =  *_t445 - 0x4c;
							if( *_t445 != 0x4c) {
								L59:
								_t254 = E00E4D199(_t360, _t370, _t420, _t429, _t445, _t445,  &_v276, 0x83,  &_v448, 0x55, 0);
								_t475 = _t473 + 0x18;
								__eflags = _t254;
								if(_t254 != 0) {
									__eflags = 0;
									_t421 = _t429 + 0x20;
									_t447 = 0;
									_v452 = _t421;
									do {
										__eflags = _t447;
										if(_t447 == 0) {
											L74:
											_t255 = _v460;
										} else {
											_t375 =  *_t421;
											_t256 =  &_v276;
											while(1) {
												__eflags =  *_t256 -  *_t375;
												_t429 = _v464;
												if( *_t256 !=  *_t375) {
													break;
												}
												__eflags =  *_t256;
												if( *_t256 == 0) {
													L67:
													_t257 = 0;
												} else {
													_t422 =  *((intOrPtr*)(_t256 + 2));
													__eflags = _t422 -  *((intOrPtr*)(_t375 + 2));
													_v454 = _t422;
													_t421 = _v452;
													if(_t422 !=  *((intOrPtr*)(_t375 + 2))) {
														break;
													} else {
														_t256 = _t256 + 4;
														_t375 = _t375 + 4;
														__eflags = _v454;
														if(_v454 != 0) {
															continue;
														} else {
															goto L67;
														}
													}
												}
												L69:
												__eflags = _t257;
												if(_t257 == 0) {
													_t360 = _t360 + 1;
													__eflags = _t360;
													goto L74;
												} else {
													_t258 =  &_v276;
													_push(_t258);
													_push(_t447);
													_push(_t429);
													L83();
													_t421 = _v452;
													_t475 = _t475 + 0xc;
													__eflags = _t258;
													if(_t258 == 0) {
														_t255 = 0;
														_v460 = 0;
													} else {
														_t360 = _t360 + 1;
														goto L74;
													}
												}
												goto L75;
											}
											asm("sbb eax, eax");
											_t257 = _t256 | 0x00000001;
											__eflags = 0;
											goto L69;
										}
										L75:
										_t447 = _t447 + 1;
										_t421 = _t421 + 0x10;
										_v452 = _t421;
										__eflags = _t447 - 5;
									} while (_t447 <= 5);
									__eflags = _t255;
									if(__eflags != 0) {
										goto L79;
									} else {
										__eflags = _t360;
										if(__eflags != 0) {
											goto L79;
										} else {
										}
									}
								}
								goto L80;
							} else {
								__eflags =  *(_t445 + 2) - 0x43;
								if( *(_t445 + 2) != 0x43) {
									goto L59;
								} else {
									__eflags =  *((short*)(_t445 + 4)) - 0x5f;
									if( *((short*)(_t445 + 4)) != 0x5f) {
										goto L59;
									} else {
										while(1) {
											_t260 = E00E5803E(_t445, 0xe6990c);
											_t362 = _t260;
											_v472 = _t362;
											_pop(_t377);
											__eflags = _t362;
											if(_t362 == 0) {
												break;
											}
											_t262 = _t260 - _t445;
											__eflags = _t262;
											_v460 = _t262 >> 1;
											if(_t262 == 0) {
												break;
											} else {
												_t264 = 0x3b;
												__eflags =  *_t362 - _t264;
												if( *_t362 == _t264) {
													break;
												} else {
													_t432 = _v460;
													_t363 = 0xe69854;
													_v456 = 1;
													do {
														_t265 = E00E4E161( *_t363, _t445, _t432);
														_t473 = _t473 + 0xc;
														__eflags = _t265;
														if(_t265 != 0) {
															goto L45;
														} else {
															_t378 =  *_t363;
															_t423 = _t378 + 2;
															do {
																_t333 =  *_t378;
																_t378 = _t378 + 2;
																__eflags = _t333 - _v468;
															} while (_t333 != _v468);
															_t377 = _t378 - _t423 >> 1;
															__eflags = _t432 - _t378 - _t423 >> 1;
															if(_t432 != _t378 - _t423 >> 1) {
																goto L45;
															}
														}
														break;
														L45:
														_v456 = _v456 + 1;
														_t363 = _t363 + 0xc;
														__eflags = _t363 - 0xe69884;
													} while (_t363 <= 0xe69884);
													_t360 = _v472 + 2;
													_t266 = E00E57FE3(_t377, _t360, 0xe69914);
													_t429 = _v464;
													_t448 = _t266;
													_pop(_t381);
													__eflags = _t448;
													if(_t448 != 0) {
														L48:
														__eflags = _v456 - 5;
														if(_v456 > 5) {
															_t382 = _v452;
															goto L54;
														} else {
															_push(_t448);
															_t269 = E00E4E0FC( &_v276, 0x83, _t360);
															_t476 = _t473 + 0x10;
															__eflags = _t269;
															if(_t269 != 0) {
																L82:
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																E00E49599();
																asm("int3");
																_push(_t464);
																_t466 = _t476;
																_t272 =  *0xe7b068; // 0x1b9618b6
																_v560 = _t272 ^ _t466;
																_push(_t360);
																_t365 = _v544;
																_push(_t448);
																_push(_t429);
																_t433 = _v548;
																_v1288 = _t365;
																_v1276 = E00E4FBAD(_t381, _t420) + 0x278;
																_t279 = E00E4D199(_t365, _t381, _t420, _t433, _v540, _v540,  &_v824, 0x83,  &_v1252, 0x55,  &_v1264);
																_t478 = _t476 - 0x2e4 + 0x18;
																__eflags = _t279;
																if(_t279 == 0) {
																	L122:
																	__eflags = 0;
																	goto L123;
																} else {
																	_t102 = _t365 + 2; // 0x6
																	_t452 = _t102 << 4;
																	__eflags = _t452;
																	_t282 =  &_v280;
																	_v724 = _t452;
																	_t385 =  *((intOrPtr*)(_t452 + _t433));
																	while(1) {
																		_v712 = _v712 & 0x00000000;
																		__eflags =  *_t282 -  *_t385;
																		_t454 = _v724;
																		if( *_t282 !=  *_t385) {
																			break;
																		}
																		__eflags =  *_t282;
																		if( *_t282 == 0) {
																			L89:
																			_t283 = _v712;
																		} else {
																			_t460 =  *((intOrPtr*)(_t282 + 2));
																			__eflags = _t460 -  *((intOrPtr*)(_t385 + 2));
																			_v714 = _t460;
																			_t454 = _v724;
																			if(_t460 !=  *((intOrPtr*)(_t385 + 2))) {
																				break;
																			} else {
																				_t282 = _t282 + 4;
																				_t385 = _t385 + 4;
																				__eflags = _v714;
																				if(_v714 != 0) {
																					continue;
																				} else {
																					goto L89;
																				}
																			}
																		}
																		L91:
																		__eflags = _t283;
																		if(_t283 != 0) {
																			_t386 =  &_v280;
																			_t425 = _t386 + 2;
																			do {
																				_t284 =  *_t386;
																				_t386 = _t386 + 2;
																				__eflags = _t284 - _v712;
																			} while (_t284 != _v712);
																			_v728 = (_t386 - _t425 >> 1) + 1;
																			_t287 = E00E4F56D(4 + ((_t386 - _t425 >> 1) + 1) * 2);
																			_v740 = _t287;
																			__eflags = _t287;
																			if(_t287 == 0) {
																				goto L122;
																			} else {
																				_v736 =  *((intOrPtr*)(_t454 + _t433));
																				_v748 =  *(_t433 + 0xa0 + _t365 * 4);
																				_v752 =  *(_t433 + 8);
																				_v716 = _t287 + 4;
																				_t289 = E00E4B7D6(_t287 + 4, _v728,  &_v280);
																				_t480 = _t478 + 0xc;
																				__eflags = _t289;
																				if(_t289 != 0) {
																					_t290 = _v712;
																					_push(_t290);
																					_push(_t290);
																					_push(_t290);
																					_push(_t290);
																					_push(_t290);
																					E00E49599();
																					asm("int3");
																					_t292 =  *0xe7e50c; // 0x0
																					return _t292;
																				} else {
																					__eflags = _v280 - 0x43;
																					 *((intOrPtr*)(_t454 + _t433)) = _v716;
																					if(_v280 != 0x43) {
																						L100:
																						_t295 = E00E4CEA6(_t365, _t433,  &_v708);
																						_t395 = _v712;
																					} else {
																						__eflags = _v278;
																						if(_v278 != 0) {
																							goto L100;
																						} else {
																							_t395 = _v712;
																							_t295 = _t395;
																						}
																					}
																					 *(_t433 + 0xa0 + _t365 * 4) = _t295;
																					__eflags = _t365 - 2;
																					if(_t365 != 2) {
																						__eflags = _t365 - 1;
																						if(_t365 != 1) {
																							__eflags = _t365 - 5;
																							if(_t365 == 5) {
																								 *((intOrPtr*)(_t433 + 0x14)) = _v720;
																							}
																						} else {
																							 *((intOrPtr*)(_t433 + 0x10)) = _v720;
																						}
																					} else {
																						_t458 = _v732;
																						_t426 = _t395;
																						_t405 = _t458;
																						 *(_t433 + 8) = _v720;
																						_v716 = _t458;
																						_v728 = _t458[8];
																						_v720 = _t458[9];
																						while(1) {
																							__eflags =  *(_t433 + 8) -  *_t405;
																							if( *(_t433 + 8) ==  *_t405) {
																								break;
																							}
																							_t459 = _v716;
																							_t426 = _t426 + 1;
																							_t327 =  *_t405;
																							 *_t459 = _v728;
																							_v720 = _t405[1];
																							_t405 = _t459 + 8;
																							 *((intOrPtr*)(_t459 + 4)) = _v720;
																							_t365 = _v744;
																							_t458 = _v732;
																							_v728 = _t327;
																							_v716 = _t405;
																							__eflags = _t426 - 5;
																							if(_t426 < 5) {
																								continue;
																							} else {
																							}
																							L108:
																							__eflags = _t426 - 5;
																							if(__eflags == 0) {
																								_t318 = E00E53D19(_t365, _t433, _t458, __eflags, _v712, 1, 0xe697c8, 0x7f,  &_v536,  *(_t433 + 8), 1);
																								_t480 = _t480 + 0x1c;
																								__eflags = _t318;
																								if(_t318 == 0) {
																									_t406 = _v712;
																								} else {
																									_t320 = _v712;
																									do {
																										 *(_t466 + _t320 * 2 - 0x20c) =  *(_t466 + _t320 * 2 - 0x20c) & 0x000001ff;
																										_t320 = _t320 + 1;
																										__eflags = _t320 - 0x7f;
																									} while (_t320 < 0x7f);
																									_t322 = E00E43D7E( &_v536,  *0xe7b2a0, 0xfe);
																									_t480 = _t480 + 0xc;
																									__eflags = _t322;
																									_t406 = 0 | _t322 == 0x00000000;
																								}
																								_t458[1] = _t406;
																								 *_t458 =  *(_t433 + 8);
																							}
																							 *(_t433 + 0x18) = _t458[1];
																							goto L120;
																						}
																						__eflags = _t426;
																						if(_t426 != 0) {
																							 *_t458 =  *(_t458 + _t426 * 8);
																							_t458[1] =  *(_t458 + 4 + _t426 * 8);
																							 *(_t458 + _t426 * 8) = _v728;
																							 *(_t458 + 4 + _t426 * 8) = _v720;
																						}
																						goto L108;
																					}
																					L120:
																					_t296 = _t365 * 0xc;
																					_t198 = _t296 + 0xe69850; // 0xe13c60
																					 *0xe63210(_t433);
																					_t298 =  *((intOrPtr*)( *_t198))();
																					_t398 = _v736;
																					__eflags = _t298;
																					if(_t298 == 0) {
																						__eflags = _t398 - 0xe7b3b0;
																						if(_t398 != 0xe7b3b0) {
																							_t457 = _t365 + _t365;
																							__eflags = _t457;
																							asm("lock xadd [eax], ecx");
																							if(_t457 != 0) {
																								goto L127;
																							} else {
																								E00E4F1E8( *((intOrPtr*)(_t433 + 0x28 + _t457 * 8)));
																								E00E4F1E8( *((intOrPtr*)(_t433 + 0x24 + _t457 * 8)));
																								E00E4F1E8( *(_t433 + 0xa0 + _t365 * 4));
																								_t401 = _v712;
																								 *(_v724 + _t433) = _t401;
																								 *(_t433 + 0xa0 + _t365 * 4) = _t401;
																							}
																						}
																						_t399 = _v740;
																						 *_t399 = 1;
																						 *((intOrPtr*)(_t433 + 0x28 + (_t365 + _t365) * 8)) = _t399;
																					} else {
																						 *((intOrPtr*)(_v724 + _t433)) = _t398;
																						E00E4F1E8( *(_t433 + 0xa0 + _t365 * 4));
																						 *(_t433 + 0xa0 + _t365 * 4) = _v748;
																						E00E4F1E8(_v740);
																						 *(_t433 + 8) = _v752;
																						goto L122;
																					}
																					goto L123;
																				}
																			}
																		} else {
																			L123:
																			__eflags = _v16 ^ _t466;
																			return E00E2C067(_v16 ^ _t466);
																		}
																		goto L131;
																	}
																	asm("sbb eax, eax");
																	_t283 = _t282 | 0x00000001;
																	__eflags = _t283;
																	goto L91;
																}
															} else {
																_t329 = _t448 + _t448;
																__eflags = _t329 - 0x106;
																if(_t329 >= 0x106) {
																	E00E2CA39();
																	goto L82;
																} else {
																	 *((short*)(_t464 + _t329 - 0x10c)) = 0;
																	_t331 =  &_v276;
																	_push(_t331);
																	_push(_v456);
																	_push(_t429);
																	L83();
																	_t382 = _v452;
																	_t473 = _t476 + 0xc;
																	__eflags = _t331;
																	if(_t331 != 0) {
																		_t382 = _t382 + 1;
																		_v452 = _t382;
																	}
																	L54:
																	_t445 = _t360 + _t448 * 2;
																	_t267 =  *_t445 & 0x0000ffff;
																	_t420 = _t267;
																	__eflags = _t267;
																	if(_t267 != 0) {
																		_t445 = _t445 + 2;
																		__eflags = _t445;
																		_t420 =  *_t445 & 0x0000ffff;
																	}
																	__eflags = _t420;
																	if(_t420 != 0) {
																		continue;
																	} else {
																		__eflags = _t382;
																		if(__eflags != 0) {
																			goto L79;
																		} else {
																			break;
																		}
																		goto L80;
																	}
																}
															}
														}
													} else {
														_t332 = 0x3b;
														__eflags =  *_t360 - _t332;
														if( *_t360 != _t332) {
															break;
														} else {
															goto L48;
														}
													}
												}
											}
											goto L131;
										}
										goto L80;
									}
								}
							}
						}
					} else {
						__eflags = _t445;
						if(_t445 != 0) {
							_push(_t445);
							_push(_t248);
							_push(_t429);
							L83();
						}
						L80:
						__eflags = _v12 ^ _t464;
						return E00E2C067(_v12 ^ _t464);
					}
				}
				L131:
			}

0x00e4d63d
0x00e4d640
0x00e4d642
0x00e4d645
0x00e4d646
0x00e4d64f
0x00e4d652
0x00e4d657
0x00e4d659
0x00e4d65b
0x00e4d65e
0x00e4d77b
0x00e4d780
0x00e4d664
0x00e4d664
0x00e4d665
0x00e4d665
0x00e4d668
0x00e4d66b
0x00e4d66d
0x00e4d670
0x00e4d673
0x00e4d675
0x00e4d678
0x00e4d67d
0x00e4d68b
0x00e4d695
0x00e4d698
0x00e4d69b
0x00e4d69b
0x00e4d6a6
0x00e4d6ab
0x00e4d6b0
0x00000000
0x00e4d6b6
0x00e4d6b9
0x00e4d6b9
0x00e4d6bc
0x00e4d6be
0x00e4d6c1
0x00e4d6c3
0x00e4d6c3
0x00e4d6c3
0x00e4d6c6
0x00e4d6c6
0x00e4d6c6
0x00e4d6cc
0x00000000
0x00000000
0x00e4d6d1
0x00e4d6e8
0x00e4d6e8
0x00e4d6d3
0x00e4d6d3
0x00e4d6db
0x00000000
0x00e4d6dd
0x00e4d6dd
0x00e4d6e0
0x00e4d6e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00e4d6e6
0x00e4d6db
0x00e4d6f1
0x00e4d6f1
0x00e4d6f6
0x00e4d6fb
0x00e4d6ff
0x00e4d70b
0x00e4d70e
0x00e4d711
0x00e4d71b
0x00e4d723
0x00e4d72b
0x00000000
0x00e4d731
0x00e4d735
0x00e4d782
0x00e4d78b
0x00e4d78e
0x00e4d790
0x00e4d794
0x00e4d798
0x00e4d79d
0x00e4d7a2
0x00e4d798
0x00e4d7a6
0x00e4d7a8
0x00e4d7aa
0x00e4d7ae
0x00e4d7af
0x00e4d7b4
0x00e4d7b9
0x00e4d7af
0x00e4d7bc
0x00e4d7bf
0x00e4d7c2
0x00e4d7c5
0x00e4d7c8
0x00e4d737
0x00e4d73a
0x00e4d73d
0x00e4d73f
0x00e4d743
0x00e4d747
0x00e4d74c
0x00e4d751
0x00e4d747
0x00e4d757
0x00e4d759
0x00e4d75e
0x00e4d763
0x00e4d768
0x00e4d75e
0x00e4d769
0x00e4d76d
0x00e4d76d
0x00e4d770
0x00e4d774
0x00e4d777
0x00e4d777
0x00000000
0x00e4d77a
0x00000000
0x00e4d72b
0x00e4d6ec
0x00e4d6ee
0x00e4d6ee
0x00000000
0x00e4d6ee
0x00e4d7cf
0x00e4d7d0
0x00e4d7d1
0x00e4d7d2
0x00e4d7d3
0x00e4d7d4
0x00e4d7d9
0x00e4d7dc
0x00e4d7dd
0x00e4d7df
0x00e4d7e5
0x00e4d7ec
0x00e4d7ef
0x00e4d7f2
0x00e4d7f3
0x00e4d7f4
0x00e4d7f7
0x00e4d7f8
0x00e4d7fb
0x00e4d801
0x00e4d803
0x00e4d828
0x00e4d832
0x00e4d838
0x00e4d83a
0x00e4d840
0x00e4d842
0x00e4da9c
0x00e4da9d
0x00000000
0x00e4d848
0x00e4d848
0x00e4d84c
0x00e4d9ba
0x00e4d9d1
0x00e4d9d6
0x00e4d9d9
0x00e4d9db
0x00e4d9e1
0x00e4d9e3
0x00e4d9e6
0x00e4d9e8
0x00e4d9ee
0x00e4d9ee
0x00e4d9f0
0x00e4da77
0x00e4da77
0x00e4d9f6
0x00e4d9f6
0x00e4d9f8
0x00e4d9fe
0x00e4da01
0x00e4da04
0x00e4da0a
0x00000000
0x00000000
0x00e4da0c
0x00e4da10
0x00e4da39
0x00e4da3b
0x00e4da12
0x00e4da12
0x00e4da16
0x00e4da1a
0x00e4da21
0x00e4da27
0x00000000
0x00e4da29
0x00e4da29
0x00e4da2c
0x00e4da2f
0x00e4da37
0x00000000
0x00000000
0x00000000
0x00000000
0x00e4da37
0x00e4da27
0x00e4da46
0x00e4da46
0x00e4da48
0x00e4da76
0x00e4da76
0x00000000
0x00e4da4a
0x00e4da4a
0x00e4da50
0x00e4da51
0x00e4da52
0x00e4da53
0x00e4da58
0x00e4da5e
0x00e4da61
0x00e4da63
0x00e4da6c
0x00e4da6e
0x00e4da65
0x00e4da65
0x00000000
0x00e4da66
0x00e4da63
0x00000000
0x00e4da48
0x00e4da3f
0x00e4da41
0x00e4da44
0x00000000
0x00e4da44
0x00e4da7d
0x00e4da7d
0x00e4da7e
0x00e4da81
0x00e4da87
0x00e4da87
0x00e4da90
0x00e4da92
0x00000000
0x00e4da94
0x00e4da94
0x00e4da96
0x00000000
0x00e4da98
0x00e4da98
0x00e4da96
0x00e4da92
0x00000000
0x00e4d852
0x00e4d852
0x00e4d857
0x00000000
0x00e4d85d
0x00e4d85d
0x00e4d862
0x00000000
0x00e4d868
0x00e4d868
0x00e4d86e
0x00e4d873
0x00e4d875
0x00e4d87c
0x00e4d87d
0x00e4d87f
0x00000000
0x00000000
0x00e4d885
0x00e4d885
0x00e4d889
0x00e4d88f
0x00000000
0x00e4d895
0x00e4d897
0x00e4d898
0x00e4d89b
0x00000000
0x00e4d8a1
0x00e4d8a1
0x00e4d8a7
0x00e4d8ac
0x00e4d8b6
0x00e4d8ba
0x00e4d8bf
0x00e4d8c2
0x00e4d8c4
0x00000000
0x00e4d8c6
0x00e4d8c6
0x00e4d8c8
0x00e4d8cb
0x00e4d8cb
0x00e4d8ce
0x00e4d8d1
0x00e4d8d1
0x00e4d8dc
0x00e4d8de
0x00e4d8e0
0x00000000
0x00000000
0x00e4d8e0
0x00000000
0x00e4d8e2
0x00e4d8e2
0x00e4d8e8
0x00e4d8eb
0x00e4d8eb
0x00e4d8f9
0x00e4d902
0x00e4d907
0x00e4d90d
0x00e4d910
0x00e4d911
0x00e4d913
0x00e4d921
0x00e4d921
0x00e4d928
0x00e4d989
0x00000000
0x00e4d92a
0x00e4d92a
0x00e4d938
0x00e4d93d
0x00e4d940
0x00e4d942
0x00e4dab9
0x00e4dabb
0x00e4dabc
0x00e4dabd
0x00e4dabe
0x00e4dabf
0x00e4dac0
0x00e4dac5
0x00e4dac8
0x00e4dac9
0x00e4dad1
0x00e4dad8
0x00e4dadb
0x00e4dadc
0x00e4dadf
0x00e4dae3
0x00e4dae4
0x00e4dae7
0x00e4daf7
0x00e4db1a
0x00e4db1f
0x00e4db22
0x00e4db24
0x00e4ddfc
0x00e4ddfc
0x00000000
0x00e4db2a
0x00e4db2a
0x00e4db2d
0x00e4db2d
0x00e4db30
0x00e4db36
0x00e4db3f
0x00e4db41
0x00e4db44
0x00e4db4b
0x00e4db4e
0x00e4db54
0x00000000
0x00000000
0x00e4db56
0x00e4db5a
0x00e4db83
0x00e4db83
0x00e4db5c
0x00e4db5c
0x00e4db60
0x00e4db64
0x00e4db6b
0x00e4db71
0x00000000
0x00e4db73
0x00e4db73
0x00e4db76
0x00e4db79
0x00e4db81
0x00000000
0x00000000
0x00000000
0x00000000
0x00e4db81
0x00e4db71
0x00e4db90
0x00e4db90
0x00e4db92
0x00e4db9b
0x00e4dba1
0x00e4dba4
0x00e4dba4
0x00e4dba7
0x00e4dbaa
0x00e4dbaa
0x00e4dbba
0x00e4dbc8
0x00e4dbcd
0x00e4dbd4
0x00e4dbd6
0x00000000
0x00e4dbdc
0x00e4dbe2
0x00e4dbef
0x00e4dbf8
0x00e4dc0b
0x00e4dc12
0x00e4dc17
0x00e4dc1a
0x00e4dc1c
0x00e4de7e
0x00e4de84
0x00e4de85
0x00e4de86
0x00e4de87
0x00e4de88
0x00e4de89
0x00e4de8e
0x00e4de8f
0x00e4de95
0x00e4dc22
0x00e4dc22
0x00e4dc30
0x00e4dc33
0x00e4dc49
0x00e4dc50
0x00e4dc56
0x00e4dc35
0x00e4dc35
0x00e4dc3d
0x00000000
0x00e4dc3f
0x00e4dc3f
0x00e4dc45
0x00e4dc45
0x00e4dc3d
0x00e4dc5c
0x00e4dc63
0x00e4dc66
0x00e4dd86
0x00e4dd89
0x00e4dd96
0x00e4dd99
0x00e4dda1
0x00e4dda1
0x00e4dd8b
0x00e4dd91
0x00e4dd91
0x00e4dc6c
0x00e4dc6c
0x00e4dc72
0x00e4dc7a
0x00e4dc7c
0x00e4dc7f
0x00e4dc88
0x00e4dc91
0x00e4dc97
0x00e4dc9a
0x00e4dc9c
0x00000000
0x00000000
0x00e4dc9e
0x00e4dca4
0x00e4dca5
0x00e4dcb0
0x00e4dcb8
0x00e4dcc0
0x00e4dcc3
0x00e4dcc6
0x00e4dccc
0x00e4dcd2
0x00e4dcd8
0x00e4dcde
0x00e4dce1
0x00000000
0x00000000
0x00e4dce3
0x00e4dd08
0x00e4dd08
0x00e4dd0b
0x00e4dd28
0x00e4dd2d
0x00e4dd30
0x00e4dd32
0x00e4dd70
0x00e4dd34
0x00e4dd34
0x00e4dd3a
0x00e4dd3f
0x00e4dd47
0x00e4dd48
0x00e4dd48
0x00e4dd5f
0x00e4dd66
0x00e4dd69
0x00e4dd6b
0x00e4dd6b
0x00e4dd76
0x00e4dd7c
0x00e4dd7c
0x00e4dd81
0x00000000
0x00e4dd81
0x00e4dce5
0x00e4dce7
0x00e4dcec
0x00e4dcf2
0x00e4dcfb
0x00e4dd04
0x00e4dd04
0x00000000
0x00e4dce7
0x00e4dda4
0x00e4dda4
0x00e4dda8
0x00e4ddb0
0x00e4ddb6
0x00e4ddb9
0x00e4ddbf
0x00e4ddc1
0x00e4de0f
0x00e4de15
0x00e4de1c
0x00e4de1c
0x00e4de22
0x00e4de26
0x00000000
0x00e4de28
0x00e4de2c
0x00e4de35
0x00e4de41
0x00e4de4f
0x00e4de55
0x00e4de58
0x00e4de58
0x00e4de26
0x00e4de67
0x00e4de6f
0x00e4de78
0x00e4ddc3
0x00e4ddc9
0x00e4ddd3
0x00e4dde5
0x00e4ddec
0x00e4ddf9
0x00000000
0x00e4ddf9
0x00000000
0x00e4ddc1
0x00e4dc1c
0x00e4db94
0x00e4ddfe
0x00e4de03
0x00e4de0e
0x00e4de0e
0x00000000
0x00e4db92
0x00e4db8b
0x00e4db8d
0x00e4db8d
0x00000000
0x00e4db8d
0x00e4d948
0x00e4d948
0x00e4d94b
0x00e4d950
0x00e4dab4
0x00000000
0x00e4d956
0x00e4d958
0x00e4d960
0x00e4d966
0x00e4d967
0x00e4d96d
0x00e4d96e
0x00e4d973
0x00e4d979
0x00e4d97c
0x00e4d97e
0x00e4d980
0x00e4d981
0x00e4d981
0x00e4d98f
0x00e4d98f
0x00e4d992
0x00e4d995
0x00e4d997
0x00e4d99a
0x00e4d99c
0x00e4d99c
0x00e4d99f
0x00e4d99f
0x00e4d9a2
0x00e4d9a5
0x00000000
0x00e4d9ab
0x00e4d9ab
0x00e4d9ad
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00e4d9ad
0x00e4d9a5
0x00e4d950
0x00e4d942
0x00e4d915
0x00e4d917
0x00e4d918
0x00e4d91b
0x00000000
0x00000000
0x00000000
0x00000000
0x00e4d91b
0x00e4d913
0x00e4d89b
0x00000000
0x00e4d88f
0x00000000
0x00e4d9b3
0x00e4d862
0x00e4d857
0x00e4d84c
0x00e4d805
0x00e4d805
0x00e4d807
0x00e4d809
0x00e4d80a
0x00e4d80b
0x00e4d80c
0x00e4d811
0x00e4daa3
0x00e4daa8
0x00e4dab3
0x00e4dab3
0x00e4d803
0x00000000

APIs

Part of subcall function 00E4F56D: RtlAllocateHeap.NTDLL(00000000,?,?,?,00E2C097,?,?,00E1108B,00000008), ref: 00E4F59F

_free.LIBCMT ref: 00E4D74C
_free.LIBCMT ref: 00E4D763
_free.LIBCMT ref: 00E4D782
_free.LIBCMT ref: 00E4D79D
_free.LIBCMT ref: 00E4D7B4

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 8ccb917b3e6df83ebdec9f0328ae705264872697fb46c6218ad598b15e120ce3
Instruction ID: b743a5bd84bcb0bb2655225bf977e241e2b9cf0f5f11ff7fe8ad337e53f6e38e
Opcode Fuzzy Hash: 8ccb917b3e6df83ebdec9f0328ae705264872697fb46c6218ad598b15e120ce3
Instruction Fuzzy Hash: 3551A172A04304AFDB24DF69EC41AAA77F8FF59724F15156AE809F7251E731EA00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E11AD0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00E11AD0(intOrPtr __ecx, intOrPtr _a4) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				char _v32;
				char _v56;
				void* __esi;
				signed int _t36;
				signed int _t46;
				void* _t56;
				char* _t66;
				intOrPtr _t73;
				char* _t74;
				void* _t79;
				signed int _t80;
				void* _t81;

				_t65 = __ecx;
				_push(0xffffffff);
				_push(0xe5f76a);
				_push( *[fs:0x0]);
				_t80 = _t79 - 0x10;
				_t36 =  *0xe7b068; // 0x1b9618b6
				_push(_t36 ^ _t77);
				 *[fs:0x0] =  &_v16;
				_t73 = __ecx;
				_v20 = __ecx;
				E00E297C6(__ecx, 0);
				_v8 = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((char*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				 *((char*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(__ecx + 0x14)) = 0;
				 *((short*)(__ecx + 0x18)) = 0;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((short*)(__ecx + 0x20)) = 0;
				 *((intOrPtr*)(__ecx + 0x24)) = 0;
				 *((char*)(__ecx + 0x28)) = 0;
				 *((intOrPtr*)(__ecx + 0x2c)) = 0;
				 *((char*)(__ecx + 0x30)) = 0;
				_t41 = _a4;
				_v8 = 6;
				if(_a4 == 0) {
					_t66 =  &_v32;
					E00E11560(_t66, __ecx, "bad locale name");
					E00E4309B( &_v32, 0xe79e34);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0xffffffff);
					_push(0xe5f790);
					_push( *[fs:0x0]);
					_push(_t73);
					_t46 =  *0xe7b068; // 0x1b9618b6
					_push(_t46 ^ _t80);
					 *[fs:0x0] =  &_v56;
					_t74 = _t66;
					E00E29C28(_t66, _t74);
					_t50 =  *((intOrPtr*)(_t74 + 0x2c));
					_t81 = _t80 + 4;
					if( *((intOrPtr*)(_t74 + 0x2c)) != 0) {
						E00E48B06(_t50);
						_t81 = _t81 + 4;
					}
					 *((intOrPtr*)(_t74 + 0x2c)) = 0;
					_t51 =  *((intOrPtr*)(_t74 + 0x24));
					if( *((intOrPtr*)(_t74 + 0x24)) != 0) {
						E00E48B06(_t51);
						_t81 = _t81 + 4;
					}
					 *((intOrPtr*)(_t74 + 0x24)) = 0;
					_t52 =  *((intOrPtr*)(_t74 + 0x1c));
					if( *((intOrPtr*)(_t74 + 0x1c)) != 0) {
						E00E48B06(_t52);
						_t81 = _t81 + 4;
					}
					 *((intOrPtr*)(_t74 + 0x1c)) = 0;
					_t53 =  *((intOrPtr*)(_t74 + 0x14));
					if( *((intOrPtr*)(_t74 + 0x14)) != 0) {
						E00E48B06(_t53);
						_t81 = _t81 + 4;
					}
					 *((intOrPtr*)(_t74 + 0x14)) = 0;
					_t54 =  *((intOrPtr*)(_t74 + 0xc));
					if( *((intOrPtr*)(_t74 + 0xc)) != 0) {
						E00E48B06(_t54);
						_t81 = _t81 + 4;
					}
					 *((intOrPtr*)(_t74 + 0xc)) = 0;
					_t55 =  *((intOrPtr*)(_t74 + 4));
					if( *((intOrPtr*)(_t74 + 4)) != 0) {
						E00E48B06(_t55);
					}
					 *((intOrPtr*)(_t74 + 4)) = 0;
					_t56 = E00E2981E(_t74);
					 *[fs:0x0] = _v20;
					return _t56;
				} else {
					E00E29BDD(_t65, __ecx, _t41); // executed
					 *[fs:0x0] = _v16;
					return _t73;
				}
			}

0x00e11ad0
0x00e11ad3
0x00e11ad5
0x00e11ae0
0x00e11ae1
0x00e11ae5
0x00e11aec
0x00e11af0
0x00e11af6
0x00e11af8
0x00e11afd
0x00e11b02
0x00e11b09
0x00e11b10
0x00e11b14
0x00e11b1b
0x00e11b21
0x00e11b28
0x00e11b2c
0x00e11b2f
0x00e11b33
0x00e11b36
0x00e11b39
0x00e11b3c
0x00e11b3f
0x00e11b42
0x00e11b48
0x00e11b6d
0x00e11b70
0x00e11b7e
0x00e11b83
0x00e11b84
0x00e11b85
0x00e11b86
0x00e11b87
0x00e11b88
0x00e11b89
0x00e11b8a
0x00e11b8b
0x00e11b8c
0x00e11b8d
0x00e11b8e
0x00e11b8f
0x00e11b93
0x00e11b95
0x00e11ba0
0x00e11ba1
0x00e11ba2
0x00e11ba9
0x00e11bad
0x00e11bb3
0x00e11bb6
0x00e11bbb
0x00e11bbe
0x00e11bc3
0x00e11bc6
0x00e11bcb
0x00e11bcb
0x00e11bce
0x00e11bd5
0x00e11bda
0x00e11bdd
0x00e11be2
0x00e11be2
0x00e11be5
0x00e11bec
0x00e11bf1
0x00e11bf4
0x00e11bf9
0x00e11bf9
0x00e11bfc
0x00e11c03
0x00e11c08
0x00e11c0b
0x00e11c10
0x00e11c10
0x00e11c13
0x00e11c1a
0x00e11c1f
0x00e11c22
0x00e11c27
0x00e11c27
0x00e11c2a
0x00e11c31
0x00e11c36
0x00e11c39
0x00e11c3e
0x00e11c43
0x00e11c4a
0x00e11c52
0x00e11c5e
0x00e11b4a
0x00e11b4c
0x00e11b59
0x00e11b65
0x00e11b65

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E11AFD
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00E11B4C

Part of subcall function 00E29BDD: _Yarn.LIBCPMT ref: 00E29BFC
Part of subcall function 00E29BDD: _Yarn.LIBCPMT ref: 00E29C20

__CxxThrowException@8.LIBVCRUNTIME ref: 00E11B7E

Strings

bad locale name, xrefs: 00E11B68

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
String ID: bad locale name
API String ID: 3628047217-1405518554
Opcode ID: ae986b982a3399a43f448c23029279f4ea07910905e7ec009b1112c99c09f844
Instruction ID: 0efb5e4d81b39d1a3331b7fcbd7dcce696c7a362333ebacabfa7fbffb9eb1e97
Opcode Fuzzy Hash: ae986b982a3399a43f448c23029279f4ea07910905e7ec009b1112c99c09f844
Instruction Fuzzy Hash: C0119D71904B44DFD320DF69C905B9BBBF8EF18710F008A5EE499E3A81E775A608CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00E53E1E, Relevance: 4.7, APIs: 3, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E00E53E1E(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				intOrPtr _v12;
				void* _v24;
				signed int _t41;
				signed int _t49;
				void* _t52;
				void* _t54;
				signed int _t56;
				void* _t60;
				intOrPtr _t63;
				void* _t64;
				intOrPtr _t68;
				intOrPtr* _t71;
				intOrPtr _t85;
				intOrPtr* _t91;
				intOrPtr _t93;
				signed int _t96;
				void* _t97;
				intOrPtr* _t98;
				intOrPtr* _t100;
				void* _t103;

				_push(__ecx);
				_push(__ecx);
				_t41 =  *0xe7b068; // 0x1b9618b6
				_v8 = _t41 ^ _t96;
				_t93 = _a20;
				if(_t93 > 0) {
					_t68 = E00E4B489(_a16, _t93);
					_t103 = _t68 - _t93;
					_t4 = _t68 + 1; // 0x1
					_t93 = _t4;
					if(_t103 >= 0) {
						_t93 = _t68;
					}
				}
				_t88 = _a32;
				if(_a32 == 0) {
					_t88 =  *((intOrPtr*)( *_a4 + 8));
					_a32 =  *((intOrPtr*)( *_a4 + 8));
				}
				_t85 = E00E55791(_t88, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t93, 0, 0);
				_t98 = _t97 + 0x18;
				_v12 = _t85;
				if(_t85 == 0) {
					L39:
					return E00E2C067(_v8 ^ _t96);
				} else {
					_t17 = _t85 + _t85 + 8; // 0x8
					asm("sbb eax, eax");
					_t49 = _t85 + _t85 & _t17;
					if(_t49 == 0) {
						_t71 = 0;
						L15:
						if(_t71 == 0) {
							L37:
							_t95 = 0;
							L38:
							E00E2BC4E(_t71);
							goto L39;
						}
						_t52 = E00E55791(_t88, 1, _a16, _t93, _t71, _t85);
						_t100 = _t98 + 0x18;
						if(_t52 == 0) {
							goto L37;
						}
						_t90 = _v12;
						_t54 = E00E5118A(_a8, _a12, _t71, _v12, 0, 0, 0, 0, 0); // executed
						_t95 = _t54;
						if(_t95 == 0) {
							goto L37;
						}
						if((_a12 & 0x00000400) == 0) {
							_t31 = _t95 + _t95 + 8; // 0x8
							asm("sbb eax, eax");
							_t56 = _t95 + _t95 & _t31;
							if(_t56 == 0) {
								_t91 = 0;
								L31:
								if(_t91 == 0 || E00E5118A(_a8, _a12, _t71, _v12, _t91, _t95, 0, 0, 0) == 0) {
									L36:
									E00E2BC4E(_t91);
									goto L37;
								} else {
									_push(0);
									_push(0);
									if(_a28 != 0) {
										_push(_a28);
										_push(_a24);
									} else {
										_push(0);
										_push(0);
									}
									_push(_t95);
									_push(_t91);
									_push(0);
									_push(_a32);
									_t60 = E00E5580D();
									_t95 = _t60;
									if(_t60 != 0) {
										E00E2BC4E(_t91);
										goto L38;
									} else {
										goto L36;
									}
								}
							}
							if(_t56 > 0x400) {
								_t91 = E00E4F56D(_t56);
								if(_t91 == 0) {
									goto L36;
								}
								 *_t91 = 0xdddd;
								L29:
								_t91 = _t91 + 8;
								goto L31;
							}
							E00E2C840();
							_t91 = _t100;
							if(_t91 == 0) {
								goto L36;
							}
							 *_t91 = 0xcccc;
							goto L29;
						}
						_t63 = _a28;
						if(_t63 == 0) {
							goto L38;
						}
						if(_t95 > _t63) {
							goto L37;
						}
						_t64 = E00E5118A(_a8, _a12, _t71, _t90, _a24, _t63, 0, 0, 0);
						_t95 = _t64;
						if(_t64 != 0) {
							goto L38;
						}
						goto L37;
					}
					if(_t49 > 0x400) {
						_t71 = E00E4F56D(_t49);
						if(_t71 == 0) {
							L13:
							_t85 = _v12;
							goto L15;
						}
						 *_t71 = 0xdddd;
						L12:
						_t71 = _t71 + 8;
						goto L13;
					}
					E00E2C840();
					_t71 = _t98;
					if(_t71 == 0) {
						goto L13;
					}
					 *_t71 = 0xcccc;
					goto L12;
				}
			}

0x00e53e23
0x00e53e24
0x00e53e25
0x00e53e2c
0x00e53e31
0x00e53e37
0x00e53e3d
0x00e53e43
0x00e53e46
0x00e53e46
0x00e53e49
0x00e53e4b
0x00e53e4b
0x00e53e49
0x00e53e4d
0x00e53e52
0x00e53e59
0x00e53e5c
0x00e53e5c
0x00e53e7d
0x00e53e7f
0x00e53e82
0x00e53e87
0x00e53fe5
0x00e53ff8
0x00e53e8d
0x00e53e90
0x00e53e95
0x00e53e97
0x00e53e99
0x00e53ed0
0x00e53ed2
0x00e53ed4
0x00e53fda
0x00e53fda
0x00e53fdc
0x00e53fdd
0x00000000
0x00e53fe3
0x00e53ee3
0x00e53ee8
0x00e53eed
0x00000000
0x00000000
0x00e53ef3
0x00e53f05
0x00e53f0a
0x00e53f0e
0x00000000
0x00000000
0x00e53f1c
0x00e53f59
0x00e53f5e
0x00e53f60
0x00e53f62
0x00e53f93
0x00e53f95
0x00e53f97
0x00e53fd3
0x00e53fd4
0x00000000
0x00e53fb4
0x00e53fb6
0x00e53fb7
0x00e53fbb
0x00e53ff9
0x00e53ffc
0x00e53fbd
0x00e53fbd
0x00e53fbe
0x00e53fbe
0x00e53fbf
0x00e53fc0
0x00e53fc1
0x00e53fc2
0x00e53fc5
0x00e53fca
0x00e53fd1
0x00e54002
0x00000000
0x00000000
0x00000000
0x00000000
0x00e53fd1
0x00e53f97
0x00e53f66
0x00e53f81
0x00e53f86
0x00000000
0x00000000
0x00e53f88
0x00e53f8e
0x00e53f8e
0x00000000
0x00e53f8e
0x00e53f68
0x00e53f6d
0x00e53f71
0x00000000
0x00000000
0x00e53f73
0x00000000
0x00e53f73
0x00e53f1e
0x00e53f23
0x00000000
0x00000000
0x00e53f2b
0x00000000
0x00000000
0x00e53f42
0x00e53f47
0x00e53f4b
0x00000000
0x00000000
0x00000000
0x00e53f51
0x00e53ea0
0x00e53ebb
0x00e53ec0
0x00e53ecb
0x00e53ecb
0x00000000
0x00e53ecb
0x00e53ec2
0x00e53ec8
0x00e53ec8
0x00000000
0x00e53ec8
0x00e53ea2
0x00e53ea7
0x00e53eab
0x00000000
0x00000000
0x00e53ead
0x00000000
0x00e53ead

APIs

__freea.LIBCMT ref: 00E53FD4

Part of subcall function 00E4F56D: RtlAllocateHeap.NTDLL(00000000,?,?,?,00E2C097,?,?,00E1108B,00000008), ref: 00E4F59F

__freea.LIBCMT ref: 00E53FDD
__freea.LIBCMT ref: 00E54002

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: __freea$AllocateHeap
String ID:
API String ID: 2243444508-0
Opcode ID: 9cf87b762f01bff88181b1f4eb86f71b0721ac4c1a361100a61579e82baa3347
Instruction ID: 48a1963b8f90186c08397388d7a13b7501d33b7614c2619bad667634fac1dad9
Opcode Fuzzy Hash: 9cf87b762f01bff88181b1f4eb86f71b0721ac4c1a361100a61579e82baa3347
Instruction Fuzzy Hash: 11510372B0021AAFDB249E60DC42EEB37F9DB40796F255929FD04B7140EB30DE1886B0

Uniqueness

Uniqueness Score: -1.00%

Function 00E4A1D3, Relevance: 4.6, APIs: 3, Instructions: 143
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00E4A1D3(void* __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				intOrPtr _v0;
				char _v8;
				char _v12;
				signed int _v16;
				char _v20;
				signed int _v44;
				char _v80;
				char _v84;
				void* _v93;
				char _v100;
				char _v104;
				char* _v108;
				char _v112;
				void* __ebp;
				intOrPtr* _t72;
				signed int _t73;
				char _t74;
				void* _t77;
				signed int _t82;
				char _t86;
				signed int _t97;
				signed int _t108;
				signed int _t112;
				char _t118;
				void* _t122;
				void* _t123;
				signed int _t127;
				signed int _t128;
				void* _t131;
				signed int _t133;
				signed int _t135;
				signed int _t145;
				void* _t147;
				intOrPtr* _t158;
				intOrPtr _t160;
				void* _t161;
				signed int _t164;
				void* _t168;
				void* _t170;
				void* _t171;
				void* _t172;

				_t155 = __edx;
				_push(__ebx);
				_push(__esi);
				_t164 = __ecx;
				_push(__edi);
				_push( *((intOrPtr*)( *((intOrPtr*)(__ecx + 4)))));
				_t72 =  *((intOrPtr*)(__ecx));
				_push( *_t72); // executed
				L22(); // executed
				_t158 = _t72;
				_pop(_t131);
				if(_t158 == 0) {
					L4:
					_t73 = 0;
					goto L5;
				} else {
					_t74 = E00E4FBAD(_t131, __edx);
					_v12 = _t74;
					_t127 = 0;
					_v20 =  *((intOrPtr*)(_t74 + 0x4c));
					_t133 =  *(_t74 + 0x48);
					_v16 = _t133;
					_v8 = 0;
					_t77 = E00E535E6(0, _t133, __edx,  &_v8, 0, 0, _t158, 0,  &_v20);
					_t171 = _t170 + 0x18;
					if(_t77 == 0) {
						_t128 = E00E4F56D(_v8 + 4);
						__eflags = _t128;
						if(_t128 == 0) {
							goto L4;
						} else {
							_t133 =  &_v20;
							_t13 = _t128 + 4; // 0x4
							_t82 = E00E535E6(_t128, _t133, __edx, 0, _t13, _v8, _t158, 0xffffffff, _t133);
							_t171 = _t171 + 0x18;
							__eflags = _t82;
							if(_t82 == 0) {
								_t135 = _t133 | 0xffffffff;
								_t160 = _v20;
								_t16 = ( *((intOrPtr*)( *_t164)) +  *((intOrPtr*)( *_t164))) * 8; // 0x33fffff1
								__eflags =  *(_t160 + _t16 + 0x24);
								if(__eflags != 0) {
									asm("lock xadd [edx], eax");
									if(__eflags == 0) {
										_t19 = ( *((intOrPtr*)( *_t164)) +  *((intOrPtr*)( *_t164))) * 8; // 0x33fffff1
										E00E4F1E8( *((intOrPtr*)(_t160 + _t19 + 0x24)));
										_pop(_t145);
										 *(_t160 + 0x24 + ( *((intOrPtr*)( *_t164)) +  *((intOrPtr*)( *_t164))) * 8) =  *(_t160 + 0x24 + ( *((intOrPtr*)( *_t164)) +  *((intOrPtr*)( *_t164))) * 8) & 0x00000000;
										_t135 = _t145 | 0xffffffff;
										__eflags = _t135;
									}
								}
								_t86 = _v12;
								__eflags =  *(_t86 + 0x350) & 0x00000002;
								if(( *(_t86 + 0x350) & 0x00000002) == 0) {
									__eflags =  *0xe7b4b8 & 0x00000001;
									if(( *0xe7b4b8 & 0x00000001) == 0) {
										_t34 = ( *((intOrPtr*)( *_t164)) +  *((intOrPtr*)( *_t164))) * 8; // 0x33fffff1
										__eflags =  *(_t160 + _t34 + 0x24);
										if( *(_t160 + _t34 + 0x24) != 0) {
											asm("lock xadd [eax], ecx");
											__eflags = _t135 == 1;
											if(_t135 == 1) {
												_t37 = ( *((intOrPtr*)( *_t164)) +  *((intOrPtr*)( *_t164))) * 8; // 0x33fffff1
												E00E4F1E8( *((intOrPtr*)(_t160 + _t37 + 0x24)));
												_t97 =  *((intOrPtr*)( *_t164)) +  *((intOrPtr*)( *_t164));
												_t39 = _t160 + 0x24 + _t97 * 8;
												 *_t39 =  *(_t160 + 0x24 + _t97 * 8) & 0x00000000;
												__eflags =  *_t39;
											}
										}
									}
								}
								_t45 = _t160 + 0xc; // 0xfffe2ab4
								_t46 = _t128 + 4; // 0x4
								_t73 = _t46;
								 *_t128 =  *_t45;
								 *(_t160 + 0x24 + ( *((intOrPtr*)( *_t164)) +  *((intOrPtr*)( *_t164))) * 8) = _t128;
								 *((intOrPtr*)(_t160 + 0x1c + ( *((intOrPtr*)( *_t164)) +  *((intOrPtr*)( *_t164))) * 8)) = _t73;
								L5:
								return _t73;
							} else {
								__eflags = _t82 - 0x16;
								if(_t82 == 0x16) {
									L20:
									_t127 = 0;
									__eflags = 0;
									goto L21;
								} else {
									__eflags = _t82 - 0x22;
									if(_t82 == 0x22) {
										goto L20;
									} else {
										E00E4F1E8(_t128);
										goto L4;
									}
								}
							}
						}
					} else {
						if(_t77 == 0x16 || _t77 == 0x22) {
							L21:
							_push(_t127);
							_push(_t127);
							_push(_t127);
							_push(_t127);
							_push(_t127);
							E00E49599();
							asm("int3");
							_t168 = _t171;
							_push(_t133);
							__eflags = _v44;
							if(_v44 == 0) {
								_t123 = E00E4D5B8(_t127, _t133, _t155, _v0, 0); // executed
								return _t123;
							}
							_push(_t164);
							_push(_t158);
							_t161 = 0;
							_t108 = E00E5331D( &_v12, 0, 0, _a4, 0x7fffffff);
							_t172 = _t171 + 0x14;
							__eflags = _t108;
							if(_t108 == 0) {
								L27:
								_t164 = E00E4E623(_v12, 2);
								_pop(_t147);
								__eflags = _t164;
								if(_t164 == 0) {
									L33:
									E00E4F1E8(_t164);
									return _t161;
								}
								_t112 = E00E5331D(_t161, _t164, _v12, _a4, 0xffffffff);
								_t172 = _t172 + 0x14;
								__eflags = _t112;
								if(_t112 == 0) {
									_t161 = E00E4D5B8(_t127, _t147, _t155, _v0, _t164);
									goto L33;
								}
								__eflags = _t112 - 0x16;
								if(_t112 != 0x16) {
									__eflags = _t112 - 0x22;
									if(_t112 != 0x22) {
										goto L33;
									}
								}
							} else {
								__eflags = _t108 - 0x16;
								if(_t108 != 0x16) {
									__eflags = _t108 - 0x22;
									if(_t108 != 0x22) {
										goto L27;
									}
								}
							}
							_push(_t161);
							_push(_t161);
							_push(_t161);
							_push(_t161);
							_push(_t161);
							E00E49599();
							asm("int3");
							_push(_t168);
							E00E5128C();
							_v112 =  &_v84;
							_v108 =  &_v80;
							_t118 = 4;
							_v100 = _t118;
							_v104 = _t118;
							_push( &_v100);
							_push( &_v112);
							_push( &_v104); // executed
							_t122 = E00E4A182(_t127, _t161, _t164, __eflags); // executed
							return _t122;
						} else {
							goto L4;
						}
					}
				}
				goto L37;
			}

0x00e4a1d3
0x00e4a1db
0x00e4a1dc
0x00e4a1dd
0x00e4a1df
0x00e4a1e3
0x00e4a1e5
0x00e4a1e7
0x00e4a1e9
0x00e4a1ee
0x00e4a1f1
0x00e4a1f4
0x00e4a239
0x00e4a239
0x00000000
0x00e4a1f6
0x00e4a1f6
0x00e4a1fb
0x00e4a1fe
0x00e4a203
0x00e4a206
0x00e4a213
0x00e4a218
0x00e4a21b
0x00e4a220
0x00e4a225
0x00e4a24e
0x00e4a251
0x00e4a253
0x00000000
0x00e4a255
0x00e4a255
0x00e4a25f
0x00e4a265
0x00e4a26a
0x00e4a26d
0x00e4a26f
0x00e4a28e
0x00e4a291
0x00e4a298
0x00e4a29c
0x00e4a29e
0x00e4a2a2
0x00e4a2a6
0x00e4a2ae
0x00e4a2b2
0x00e4a2b9
0x00e4a2be
0x00e4a2c3
0x00e4a2c3
0x00e4a2c3
0x00e4a2a6
0x00e4a2c6
0x00e4a2c9
0x00e4a2d0
0x00e4a2d2
0x00e4a2d9
0x00e4a2e1
0x00e4a2e5
0x00e4a2e7
0x00e4a2e9
0x00e4a2ed
0x00e4a2ee
0x00e4a2f6
0x00e4a2fa
0x00e4a304
0x00e4a306
0x00e4a306
0x00e4a306
0x00e4a306
0x00e4a2ee
0x00e4a2e7
0x00e4a2d9
0x00e4a30b
0x00e4a30e
0x00e4a30e
0x00e4a311
0x00e4a319
0x00e4a323
0x00e4a23b
0x00e4a241
0x00e4a271
0x00e4a271
0x00e4a274
0x00e4a32c
0x00e4a32c
0x00e4a32c
0x00000000
0x00e4a27a
0x00e4a27a
0x00e4a27d
0x00000000
0x00e4a283
0x00e4a284
0x00000000
0x00e4a289
0x00e4a27d
0x00e4a274
0x00e4a26f
0x00e4a227
0x00e4a22a
0x00e4a32e
0x00e4a32e
0x00e4a32f
0x00e4a330
0x00e4a331
0x00e4a332
0x00e4a333
0x00e4a338
0x00e4a33c
0x00e4a33e
0x00e4a33f
0x00e4a343
0x00e4a34a
0x00000000
0x00e4a350
0x00e4a353
0x00e4a354
0x00e4a35d
0x00e4a365
0x00e4a36a
0x00e4a36d
0x00e4a36f
0x00e4a37b
0x00e4a385
0x00e4a388
0x00e4a389
0x00e4a38b
0x00e4a3bc
0x00e4a3bd
0x00000000
0x00e4a3c6
0x00e4a397
0x00e4a39c
0x00e4a39f
0x00e4a3a1
0x00e4a3ba
0x00000000
0x00e4a3ba
0x00e4a3a3
0x00e4a3a6
0x00e4a3a8
0x00e4a3ab
0x00000000
0x00e4a3ad
0x00e4a3ab
0x00e4a371
0x00e4a371
0x00e4a374
0x00e4a376
0x00e4a379
0x00000000
0x00000000
0x00e4a379
0x00e4a374
0x00e4a3cb
0x00e4a3cc
0x00e4a3cd
0x00e4a3ce
0x00e4a3cf
0x00e4a3d0
0x00e4a3d5
0x00e4a3d8
0x00e4a3de
0x00e4a3e6
0x00e4a3f1
0x00e4a3f4
0x00e4a3f5
0x00e4a3f8
0x00e4a3fe
0x00e4a402
0x00e4a406
0x00e4a407
0x00e4a40f
0x00000000
0x00000000
0x00000000
0x00e4a22a
0x00e4a225
0x00000000

APIs

Part of subcall function 00E4FBAD: GetLastError.KERNEL32(00E7BC08,ios_base::failbit set,?,00E484A4,00E79760,00000008,?,00000001), ref: 00E4FBB2
Part of subcall function 00E4FBAD: SetLastError.KERNEL32(00000000,00000002,000000FF,?,00E484A4,00E79760,00000008,?,00000001), ref: 00E4FC50

_free.LIBCMT ref: 00E4A284
_free.LIBCMT ref: 00E4A2B2
_free.LIBCMT ref: 00E4A2FA

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: 98537ad5f4018835eaa0bcf44f956747557f65e2f657637c6a01dc276de2653a
Instruction ID: 04a35a0ab0ad0c7babd4421ce55607018b5e3c6a47c89d8e5d8427bca3b6891b
Opcode Fuzzy Hash: 98537ad5f4018835eaa0bcf44f956747557f65e2f657637c6a01dc276de2653a
Instruction Fuzzy Hash: E441AD316041059FD724CFACE885A69B7E9EF49324B6815ADF805E73A2EB32EC10DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00E4A339, Relevance: 4.6, APIs: 3, Instructions: 97
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00E4A339(void* __ecx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				char _v8;
				char _v28;
				char _v32;
				void* _v41;
				char _v48;
				char _v52;
				char* _v56;
				char _v60;
				void* __ebp;
				void* _t20;
				void* _t24;
				char _t30;
				void* _t34;
				void* _t35;
				void* _t36;
				void* _t39;
				void* _t46;
				void* _t48;
				void* _t54;
				void* _t55;

				_t50 = __esi;
				_push(__ecx);
				if(_a8 == 0) {
					_t35 = E00E4D5B8(_t36, __ecx, _t46, _a4, 0); // executed
					return _t35;
				}
				_push(__esi);
				_push(__edi);
				_t48 = 0;
				_t20 = E00E5331D( &_v8, 0, 0, _a8, 0x7fffffff);
				_t55 = _t54 + 0x14;
				__eflags = _t20;
				if(_t20 == 0) {
					L5:
					_t50 = E00E4E623(_v8, 2);
					_pop(_t39);
					__eflags = _t50;
					if(_t50 == 0) {
						L11:
						E00E4F1E8(_t50);
						return _t48;
					}
					_t24 = E00E5331D(_t48, _t50, _v8, _a8, 0xffffffff);
					_t55 = _t55 + 0x14;
					__eflags = _t24;
					if(_t24 == 0) {
						_t48 = E00E4D5B8(_t36, _t39, _t46, _a4, _t50);
						goto L11;
					}
					__eflags = _t24 - 0x16;
					if(_t24 != 0x16) {
						__eflags = _t24 - 0x22;
						if(_t24 != 0x22) {
							goto L11;
						}
					}
				} else {
					__eflags = _t20 - 0x16;
					if(_t20 != 0x16) {
						__eflags = _t20 - 0x22;
						if(_t20 != 0x22) {
							goto L5;
						}
					}
				}
				_push(_t48);
				_push(_t48);
				_push(_t48);
				_push(_t48);
				_push(_t48);
				E00E49599();
				asm("int3");
				E00E5128C();
				_v60 =  &_v32;
				_v56 =  &_v28;
				_t30 = 4;
				_v48 = _t30;
				_v52 = _t30;
				_push( &_v48);
				_push( &_v60);
				_push( &_v52); // executed
				_t34 = E00E4A182(_t36, _t48, _t50, __eflags); // executed
				return _t34;
			}

0x00e4a339
0x00e4a33e
0x00e4a343
0x00e4a34a
0x00000000
0x00e4a350
0x00e4a353
0x00e4a354
0x00e4a35d
0x00e4a365
0x00e4a36a
0x00e4a36d
0x00e4a36f
0x00e4a37b
0x00e4a385
0x00e4a388
0x00e4a389
0x00e4a38b
0x00e4a3bc
0x00e4a3bd
0x00000000
0x00e4a3c6
0x00e4a397
0x00e4a39c
0x00e4a39f
0x00e4a3a1
0x00e4a3ba
0x00000000
0x00e4a3ba
0x00e4a3a3
0x00e4a3a6
0x00e4a3a8
0x00e4a3ab
0x00000000
0x00e4a3ad
0x00e4a3ab
0x00e4a371
0x00e4a371
0x00e4a374
0x00e4a376
0x00e4a379
0x00000000
0x00000000
0x00e4a379
0x00e4a374
0x00e4a3cb
0x00e4a3cc
0x00e4a3cd
0x00e4a3ce
0x00e4a3cf
0x00e4a3d0
0x00e4a3d5
0x00e4a3de
0x00e4a3e6
0x00e4a3f1
0x00e4a3f4
0x00e4a3f5
0x00e4a3f8
0x00e4a3fe
0x00e4a402
0x00e4a406
0x00e4a407
0x00e4a40f

APIs

__cftoe.LIBCMT ref: 00E4A365
__cftoe.LIBCMT ref: 00E4A397
_free.LIBCMT ref: 00E4A3BD

Part of subcall function 00E49599: IsProcessorFeaturePresent.KERNEL32(00000017,00E4956B,00000000,?,00000004,00000000,?,?,?,00E49578,00000000,00000000,00000000,00000000,00000000,00E5D87A), ref: 00E4959B
Part of subcall function 00E49599: GetCurrentProcess.KERNEL32(C0000417), ref: 00E495BE
Part of subcall function 00E49599: TerminateProcess.KERNEL32(00000000), ref: 00E495C5

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Process__cftoe$CurrentFeaturePresentProcessorTerminate_free
String ID:
API String ID: 3294049834-0
Opcode ID: 015141911b5a0c1dd8b5a1a81d1d5f408091490da7c75f780f2a404881a2dca7
Instruction ID: 1fbdd149d068d598fd273c3e858b5f75e40ea1f6f8d2c04da94544607b02790b
Opcode Fuzzy Hash: 015141911b5a0c1dd8b5a1a81d1d5f408091490da7c75f780f2a404881a2dca7
Instruction Fuzzy Hash: 1421C772848108BACB20AE95AC05EEF7BECDF45730F2461B6FD14F6181FE319B048692

Uniqueness

Uniqueness Score: -1.00%

Function 00E1F120, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc failed., xrefs: 00E1F59D

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID:
String ID: malloc failed.
API String ID: 0-2942071506
Opcode ID: a4cb24cc674c3dedef1ade5daec39d5a32be344d27e9f2f3db0d3e37032f4006
Instruction ID: 314d3abaa82815640a604290be2b3b5b59befd55943287fbbeea9248c9189bd7
Opcode Fuzzy Hash: a4cb24cc674c3dedef1ade5daec39d5a32be344d27e9f2f3db0d3e37032f4006
Instruction Fuzzy Hash: 16319C34A01605CFCB14CF64D891FAAB3B2FF49744F2052A9E515AB3A1DB35EE84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E56854, Relevance: 3.2, APIs: 2, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00E563ED: GetOEMCP.KERNEL32(00000000,00E56663,00E4E7F3,00000000,8304488B,8304488B,00000000,?,00E4E7F3), ref: 00E56418

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00E566AA,?,00000000,00E4E7F3,558B0000,?,?,?,?,8304488B), ref: 00E568B2
GetCPInfo.KERNEL32(00000000,00E566AA,?,?,00E566AA,?,00000000,00E4E7F3,558B0000,?,?,?,?,8304488B,00000000), ref: 00E568F4

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 38489b4376ff77d387f84330724b63608cf26b9700a39cde174bff64f5475baa
Instruction ID: 87d2d2eaef90acd139703645eb79f12ebd285d78661cadf03ca3ca487622cecb
Opcode Fuzzy Hash: 38489b4376ff77d387f84330724b63608cf26b9700a39cde174bff64f5475baa
Instruction Fuzzy Hash: F1513570A003459EDB208F75C8506BAFBF5EF90309F54686FD896BB252E734994DCB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E56648, Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00E563ED: GetOEMCP.KERNEL32(00000000,00E56663,00E4E7F3,00000000,8304488B,8304488B,00000000,?,00E4E7F3), ref: 00E56418

_free.LIBCMT ref: 00E566C0
_free.LIBCMT ref: 00E566F6

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ec0bdb281d7413407e28a8947b6ab6557e7cb89135f989384e9498e5d501c5b1
Instruction ID: 083886816319b3f1bc81b37627a6c1f7ea93492b19ac525e18f9483c482d0d37
Opcode Fuzzy Hash: ec0bdb281d7413407e28a8947b6ab6557e7cb89135f989384e9498e5d501c5b1
Instruction Fuzzy Hash: DE31B271900249AFDB00EF58D880A9A7BF4EF44325F51186AFD14BB2A1EB72DD58CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00E16220, Relevance: 3.1, APIs: 2, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 00E11FC0: __CxxThrowException@8.LIBVCRUNTIME ref: 00E11FED
Part of subcall function 00E11FC0: __CxxThrowException@8.LIBVCRUNTIME ref: 00E12032
Part of subcall function 00E11FC0: ___std_exception_copy.LIBVCRUNTIME ref: 00E1205F

std::locale::_Init.LIBCPMT ref: 00E162B2

Part of subcall function 00E29AD6: __EH_prolog3.LIBCMT ref: 00E29ADD
Part of subcall function 00E29AD6: std::_Lockit::_Lockit.LIBCPMT ref: 00E29AE8
Part of subcall function 00E29AD6: std::locale::_Setgloballocale.LIBCPMT ref: 00E29B03
Part of subcall function 00E29AD6: _Yarn.LIBCPMT ref: 00E29B19
Part of subcall function 00E29AD6: std::_Lockit::~_Lockit.LIBCPMT ref: 00E29B59

Part of subcall function 00E16370: std::_Lockit::_Lockit.LIBCPMT ref: 00E163B9
Part of subcall function 00E16370: std::_Lockit::_Lockit.LIBCPMT ref: 00E163DB
Part of subcall function 00E16370: std::_Lockit::~_Lockit.LIBCPMT ref: 00E163FB
Part of subcall function 00E16370: std::_Lockit::~_Lockit.LIBCPMT ref: 00E164C8

std::ios_base::_Addstd.LIBCPMT ref: 00E16345

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8Throwstd::locale::_$AddstdH_prolog3InitSetgloballocaleYarn___std_exception_copystd::ios_base::_
String ID:
API String ID: 1936500140-0
Opcode ID: cbb6739e3cc04da21e0ab8002afbde0d02a1f8ff0be53737add6972c6f876ea5
Instruction ID: 710df807dff7255d0df5f8ad7d191f684caf1c170d3dfb99fb4dd951c966c431
Opcode Fuzzy Hash: cbb6739e3cc04da21e0ab8002afbde0d02a1f8ff0be53737add6972c6f876ea5
Instruction Fuzzy Hash: D74180B0600705EFE710DF64C949B9ABBF4FF45714F104229E414ABBC0D7B6A998CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E5118A, Relevance: 3.0, APIs: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringEx.KERNELBASE(?,00E53F0A,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00E511BE
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00E53F0A,?,?,00000000,?,00000000), ref: 00E511DC

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 832ed7d991d7df5a7d19b51fd2fd3aa69a7c1ba8640eaa2ef3d9dd1789224345
Instruction ID: 41f722c7cb2f1da5d730f291adbb86160ff4ab70ca0f84c2a9526cd02697f43f
Opcode Fuzzy Hash: 832ed7d991d7df5a7d19b51fd2fd3aa69a7c1ba8640eaa2ef3d9dd1789224345
Instruction Fuzzy Hash: CAF0643210151ABBCF126FA1ED05ADE3FA6AB483A1F058554FE1829020CA32CA35AB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E564C5, Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(E8458D00,?,00E4E7FF,00E4E7F3,00000000), ref: 00E564F7

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 2a72079c3217d70dd05aa716c763c4f67b488f435a271cfc15b861054508765d
Instruction ID: c954ac4d3ea978b7e1a989a989d06e679c057c7b45752c7184f2c2c08d3be1e6
Opcode Fuzzy Hash: 2a72079c3217d70dd05aa716c763c4f67b488f435a271cfc15b861054508765d
Instruction Fuzzy Hash: FB415BB05042589BDB218B18CC84BF77BFDEB04709F641CECE98A97042E2719D4DDB50

Uniqueness

Uniqueness Score: -1.00%

Function 00E57079, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 00E4E623: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00E4FD4F,00000001,00000364,00000002,000000FF,?,?,?,00E4A076,00E4F5B0), ref: 00E4E664

_free.LIBCMT ref: 00E570E8

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 8f43dbee032e269fb25bf3ad9ad9b4dde1850fcdd4775fe14f62505e124306cc
Instruction ID: d9f1859d2d5331444fa3955a6e9d379af0389960414d9a82572b55426ce99cb5
Opcode Fuzzy Hash: 8f43dbee032e269fb25bf3ad9ad9b4dde1850fcdd4775fe14f62505e124306cc
Instruction Fuzzy Hash: 57012B72A043169BC3208F68E8819AAFBD8EB05370F151669E984B76C0D7706C14C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00E4CD3C, Relevance: 1.5, APIs: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E4E623: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00E4FD4F,00000001,00000364,00000002,000000FF,?,?,?,00E4A076,00E4F5B0), ref: 00E4E664

_free.LIBCMT ref: 00E4CD5C

Part of subcall function 00E4F1E8: HeapFree.KERNEL32(00000000,00000000,?,00E57BF8,?,00000000,?,?,?,00E57E9D,?,00000007,?,?,00E582A2,?), ref: 00E4F1FE
Part of subcall function 00E4F1E8: GetLastError.KERNEL32(?,?,00E57BF8,?,00000000,?,?,?,00E57E9D,?,00000007,?,?,00E582A2,?,?), ref: 00E4F210

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: 73d14eb9e81cdb0646db5295cd60201d518c2adc6b99977a4a3d13d3980b000d
Instruction ID: e9d8a3dcf5646b350f403d97e9d68fdd3b7e35b7ee457ac9208c5e83ffaac4a0
Opcode Fuzzy Hash: 73d14eb9e81cdb0646db5295cd60201d518c2adc6b99977a4a3d13d3980b000d
Instruction Fuzzy Hash: 030129B2D00209ABCB50DFA9D441A9EBBF8FB48710F104266E918E7340E771AA10CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00E4E623, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00E4FD4F,00000001,00000364,00000002,000000FF,?,?,?,00E4A076,00E4F5B0), ref: 00E4E664

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4414a114c25fe3adc37ea37cc0c028a043797f17e0dd49c2e3529252db9aa705
Instruction ID: c8c845e08575ac197ed3dcba757fb4de544205c73d3b67858155869951ac0ef6
Opcode Fuzzy Hash: 4414a114c25fe3adc37ea37cc0c028a043797f17e0dd49c2e3529252db9aa705
Instruction Fuzzy Hash: A7F0B431605124AA9B615E62BC05B6B3788BF617A0F1A6491F809BA291CB20E84046E4

Uniqueness

Uniqueness Score: -1.00%

Function 00E4F56D, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00E2C097,?,?,00E1108B,00000008), ref: 00E4F59F

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3d160de890ce83b5377f3cda24536ae52534670b371d36948d696683f087648d
Instruction ID: dfccaf3f2b9a4a03e007959532b248252218dcfff393616634735dfef6d0cd51
Opcode Fuzzy Hash: 3d160de890ce83b5377f3cda24536ae52534670b371d36948d696683f087648d
Instruction Fuzzy Hash: 0FE06D36A012217AE6312E66BC04BAB7A88DF85FF5F192131FC05B6590DB68DD5181E1

Uniqueness

Uniqueness Score: -1.00%

Function 00E2C07D, Relevance: 1.5, APIs: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00E2CB62

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 42b14aa6ecf03ab1e35c2a03c73c16a8b1a1c7d3f7775062fcec767e29365b16
Instruction ID: 98347f9daa8ea576859f08dc2815faadee0c66d13c1a35de9f4484434c59894c
Opcode Fuzzy Hash: 42b14aa6ecf03ab1e35c2a03c73c16a8b1a1c7d3f7775062fcec767e29365b16
Instruction Fuzzy Hash: D1E0923440461DA6CB206678F816CAD379C5E00364B70A721B928B50D2EF70DB568190

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00E25900, Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 285
threadnetworkCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00E25900(void* __ebx, void* __ecx, void* __edx, void* __eflags, char _a4, intOrPtr* _a8) {
				intOrPtr _v0;
				char _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr* _v24;
				char _v28;
				intOrPtr _v284;
				char _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				char _v316;
				intOrPtr* _v324;
				char _v344;
				intOrPtr _v348;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t60;
				long _t65;
				intOrPtr _t67;
				intOrPtr _t77;
				signed int _t83;
				long _t88;
				char _t106;
				char _t111;
				char _t113;
				signed int _t116;
				void* _t117;
				char _t118;
				char* _t121;
				char* _t123;
				char* _t124;
				intOrPtr _t131;
				char* _t132;
				char* _t134;
				char* _t135;
				char* _t137;
				char* _t138;
				intOrPtr* _t143;
				intOrPtr _t149;
				char* _t150;
				signed int _t155;
				intOrPtr* _t158;
				void* _t160;
				void* _t161;
				void* _t164;
				char _t165;
				signed int _t166;
				void* _t168;
				char* _t170;
				void* _t171;
				char* _t172;
				char* _t173;
				signed int _t174;
				char* _t177;
				void* _t178;
				char* _t179;
				char* _t180;
				void* _t181;
				char* _t182;
				char* _t186;

				_t147 = __edx;
				_t117 = __ebx;
				_t60 =  *0xe7b068; // 0x1b9618b6
				_v20 = _t60 ^ _t166;
				 *[fs:0x0] =  &_v16;
				_t161 = __ecx;
				E00E20EA0(__ebx, __ecx, __edx, _t155);
				_t170 = _t168 - 0x114;
				_t121 = _t170;
				 *((intOrPtr*)(_t121 + 0x10)) = 0;
				 *((intOrPtr*)(_t121 + 0x14)) = 0xf;
				 *_t121 = 0;
				E00E14C40(__ebx, _t121, __edx, "Socket::SelectServerSocket", 0x1a);
				_t65 = GetCurrentThreadId();
				_t122 = 0xe8;
				E00E12260(__ebx, 0xe8, _t147, _t155, _t65, _t60 ^ _t166, _t155, _t160,  *[fs:0x0], 0xe60cc6, 0xffffffff);
				_t67 =  *((intOrPtr*)(_t161 + 0xc));
				_t156 = _t155 | 0xffffffff;
				_t171 = _t170 + 0x1c;
				if(_t67 != (_t155 | 0xffffffff)) {
					_v284 = _t67;
					_t122 =  &_v288;
					_v288 = 1;
					_t116 = _t67 + 1;
					_v28 = 1;
					_v24 = 0;
					__imp__#18(_t116,  &_v288, 0, 0,  &_v28);
					_t156 = _t116;
				}
				E00E20EA0(_t117, _t122, _t147, _t156);
				_t172 = _t171 - 0x18;
				_t123 = _t172;
				_v292 = _t172;
				 *((intOrPtr*)(_t123 + 0x10)) = 0;
				 *((intOrPtr*)(_t123 + 0x14)) = 0xf;
				 *_t123 = 0;
				E00E14C40(_t117, _t123, _t147, "-Result: ", 9);
				_t173 = _t172 - 0x18;
				_v8 = 0;
				_t124 = _t173;
				 *((intOrPtr*)(_t124 + 0x10)) = 0;
				 *((intOrPtr*)(_t124 + 0x14)) = 0xf;
				 *_t124 = 0;
				E00E14C40(_t117, _t124, _t147, "Socket::SelectServerSocket", 0x1a);
				_push(GetCurrentThreadId());
				_v8 = 0xffffffff;
				E00E12110(_t117, 0xf7, _t147, _t156);
				_t174 = _t173 + 0x34;
				E00E20EA0(_t117, 0xf7, _t147, _t156);
				E00E1EA80(_t117,  &_v316, _t156, _t156, _t161);
				_v8 = 1;
				if( *0xe7ea10 != 0) {
					_t154 =  >=  ? _v316 :  &_v316;
					E00E167A0(_t117,  >=  ? _v316 :  &_v316, _t156, _v296 - 0x10, E00E178C0(0xe7d8f8,  >=  ? _v316 :  &_v316, _v300));
					_t174 = _t174 + 8;
				}
				_t149 = _v296;
				if(_t149 < 0x10) {
					L8:
					 *[fs:0x0] = _v16;
					return E00E2C067(_v20 ^ _t166);
				} else {
					_t131 = _v316;
					_t150 = _t149 + 1;
					_t77 = _t131;
					if(_t150 < 0x1000) {
						L7:
						_push(_t150);
						E00E2C347(_t131);
						goto L8;
					} else {
						_t131 =  *((intOrPtr*)(_t131 - 4));
						_t150 = _t150 + 0x23;
						if(_t77 - _t131 + 0xfffffffc > 0x1f) {
							E00E4957C(_t117, _t131, _t150, _t156, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t166);
							_push(0xffffffff);
							_t83 =  *0xe7b068; // 0x1b9618b6
							 *[fs:0x0] =  &_v344;
							_v348 = _t131;
							E00E20EA0(_t117, _t131, _t150, _t156);
							_t177 = _t174 - 0xfffffffffffffff0;
							_t132 = _t177;
							 *((intOrPtr*)(_t132 + 0x10)) = 0;
							 *((intOrPtr*)(_t132 + 0x14)) = 0xf;
							 *_t132 = 0;
							E00E14C40(_t117, _t132, _t150, "Socket::ReceiveData", 0x13);
							_t88 = GetCurrentThreadId();
							_t133 = 0xff;
							E00E12260(_t117, 0xff, _t150, _t156, _t88, _t83 ^ _t174, _t156, _t161, _t117,  *[fs:0x0], 0xe60d00);
							_t158 = _v324;
							_t178 = _t177 + 0x1c;
							_t118 = 0;
							__eflags = _t158;
							if(_t158 != 0) {
								_t165 = _a4;
								__eflags = _t165;
								if(_t165 > 0) {
									_t133 = _v24;
									_t111 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0xc))))();
									__eflags = _t111;
									if(_t111 != 0) {
										_t113 =  *((intOrPtr*)(_v24 + 0xc));
										__eflags = _t113 - 0xffffffff;
										if(_t113 != 0xffffffff) {
											__imp__#16(_t113, _t158, _t165, 0);
											__eflags = _t113;
											if(_t113 > 0) {
												_t133 = _a8;
												_t118 = 1;
												 *_a8 = _t113;
											}
										}
									}
								}
							}
							E00E20EA0(_t118, _t133, _t150, _t158);
							_t179 = _t178 - 0x18;
							_t134 = _t179;
							_v0 = _t179;
							 *((intOrPtr*)(_t134 + 0x10)) = 0;
							 *((intOrPtr*)(_t134 + 0x14)) = 0xf;
							 *_t134 = 0;
							E00E14C40(_t118, _t134, _t150, "-RecvBuf: ", 0xa);
							_t180 = _t179 - 0x18;
							_v12 = 0;
							_t135 = _t180;
							 *((intOrPtr*)(_t135 + 0x10)) = 0;
							 *((intOrPtr*)(_t135 + 0x14)) = 0xf;
							 *_t135 = 0;
							E00E14C40(_t118, _t135, _t150, "Socket::ReceiveData", 0x13);
							_push(GetCurrentThreadId());
							_t136 = 0x110;
							_v12 = 0xffffffff;
							E00E12110(_t118, 0x110, _t150, _t158);
							_t181 = _t180 + 0x34;
							__eflags = _t158;
							if(_t158 != 0) {
								E00E20EA0(_t118, 0x110, _t150, _t158);
								_t186 = _t181 - 0x18;
								_t143 = _t158;
								_t150 = _t186;
								_t164 = _t143 + 1;
								 *((intOrPtr*)(_t150 + 0x10)) = 0;
								 *((intOrPtr*)(_t150 + 0x14)) = 0xf;
								 *_t150 = 0;
								do {
									_t106 =  *_t143;
									_t143 = _t143 + 1;
									__eflags = _t106;
								} while (_t106 != 0);
								__eflags = _t143 - _t164;
								_t136 = _t150;
								E00E14C40(_t118, _t150, _t150, _t158, _t143 - _t164);
								E00E12350(_t118, _t158);
								_t181 = _t186 + 0x18;
							}
							E00E20EA0(_t118, _t136, _t150, _t158);
							_t182 = _t181 - 0x18;
							_t137 = _t182;
							_v0 = _t182;
							 *((intOrPtr*)(_t137 + 0x10)) = 0;
							 *((intOrPtr*)(_t137 + 0x14)) = 0xf;
							 *_t137 = 0;
							E00E14C40(_t118, _t137, _t150, "-Result: ", 9);
							_v12 = 1;
							_t138 = _t182 - 0x18;
							 *((intOrPtr*)(_t138 + 0x10)) = 0;
							 *((intOrPtr*)(_t138 + 0x14)) = 0xf;
							 *_t138 = 0;
							E00E14C40(_t118, _t138, _t150, "Socket::ReceiveData", 0x13);
							_push(GetCurrentThreadId());
							_v12 = 0xffffffff;
							E00E12110(_t118, 0x114, _t150, _t158);
							E00E20EA0(_t118, 0x114, _t150, _t158);
							__eflags =  *0xe7ea10;
							if( *0xe7ea10 != 0) {
								__eflags = _t118;
								_t152 =  ==  ? "FALSE" : "TRUE";
								E00E167A0(_t118,  ==  ? "FALSE" : "TRUE", _t158, __eflags, E00E164F0(0xe7d8f8,  ==  ? "FALSE" : "TRUE"));
							}
							 *[fs:0x0] = _v20;
							return _t118;
						} else {
							goto L7;
						}
					}
				}
			}

0x00e25900
0x00e25900
0x00e25917
0x00e2591e
0x00e25927
0x00e2592d
0x00e2592f
0x00e25934
0x00e25937
0x00e2593b
0x00e25942
0x00e2594e
0x00e25951
0x00e25956
0x00e2595c
0x00e25961
0x00e25966
0x00e25969
0x00e2596c
0x00e25971
0x00e25976
0x00e25981
0x00e25987
0x00e25992
0x00e25993
0x00e2599b
0x00e259a2
0x00e259a8
0x00e259a8
0x00e259aa
0x00e259af
0x00e259b2
0x00e259b4
0x00e259bc
0x00e259c3
0x00e259cf
0x00e259d2
0x00e259d7
0x00e259da
0x00e259e1
0x00e259e5
0x00e259ec
0x00e259f8
0x00e259fb
0x00e25a05
0x00e25a0b
0x00e25a12
0x00e25a17
0x00e25a1a
0x00e25a27
0x00e25a2c
0x00e25a3a
0x00e25a4f
0x00e25a61
0x00e25a66
0x00e25a66
0x00e25a69
0x00e25a72
0x00e25a9f
0x00e25aa4
0x00e25abb
0x00e25a74
0x00e25a74
0x00e25a7a
0x00e25a7b
0x00e25a83
0x00e25a95
0x00e25a95
0x00e25a97
0x00000000
0x00e25a85
0x00e25a85
0x00e25a88
0x00e25a93
0x00e25abc
0x00e25ac1
0x00e25ac2
0x00e25ac3
0x00e25ac4
0x00e25ac5
0x00e25ac6
0x00e25ac7
0x00e25ac8
0x00e25ac9
0x00e25aca
0x00e25acb
0x00e25acc
0x00e25acd
0x00e25ace
0x00e25acf
0x00e25ad0
0x00e25ad3
0x00e25ae7
0x00e25af2
0x00e25af8
0x00e25afb
0x00e25b00
0x00e25b03
0x00e25b07
0x00e25b0e
0x00e25b1a
0x00e25b1d
0x00e25b22
0x00e25b28
0x00e25b2d
0x00e25b32
0x00e25b35
0x00e25b38
0x00e25b3a
0x00e25b3c
0x00e25b3e
0x00e25b41
0x00e25b43
0x00e25b45
0x00e25b4d
0x00e25b4f
0x00e25b51
0x00e25b56
0x00e25b59
0x00e25b5c
0x00e25b63
0x00e25b69
0x00e25b6b
0x00e25b6d
0x00e25b70
0x00e25b72
0x00e25b72
0x00e25b6b
0x00e25b5c
0x00e25b51
0x00e25b43
0x00e25b74
0x00e25b79
0x00e25b7c
0x00e25b7e
0x00e25b83
0x00e25b8a
0x00e25b96
0x00e25b99
0x00e25b9e
0x00e25ba1
0x00e25ba8
0x00e25bac
0x00e25bb3
0x00e25bbf
0x00e25bc2
0x00e25bcc
0x00e25bcd
0x00e25bd2
0x00e25bd9
0x00e25bde
0x00e25be1
0x00e25be3
0x00e25be5
0x00e25bea
0x00e25bed
0x00e25bef
0x00e25bf1
0x00e25bf4
0x00e25bfb
0x00e25c02
0x00e25c05
0x00e25c05
0x00e25c07
0x00e25c08
0x00e25c08
0x00e25c0c
0x00e25c10
0x00e25c12
0x00e25c17
0x00e25c1c
0x00e25c1c
0x00e25c1f
0x00e25c24
0x00e25c27
0x00e25c29
0x00e25c2e
0x00e25c35
0x00e25c41
0x00e25c44
0x00e25c4c
0x00e25c53
0x00e25c57
0x00e25c5e
0x00e25c6a
0x00e25c6d
0x00e25c77
0x00e25c7d
0x00e25c84
0x00e25c8c
0x00e25c91
0x00e25c98
0x00e25c9f
0x00e25cab
0x00e25cb4
0x00e25cb9
0x00e25cc1
0x00e25ccf
0x00000000
0x00000000
0x00000000
0x00e25a93
0x00e25a83

APIs

Part of subcall function 00E20EA0: __Mtx_unlock.LIBCPMT ref: 00E20F3F

GetCurrentThreadId.KERNEL32 ref: 00E25956
select.WS2_32(?,?,00000000,00000000,?), ref: 00E259A2
GetCurrentThreadId.KERNEL32 ref: 00E25A00
GetCurrentThreadId.KERNEL32 ref: 00E25B22
recv.WS2_32(?,?,?,00000000), ref: 00E25B63
GetCurrentThreadId.KERNEL32 ref: 00E25BC7
GetCurrentThreadId.KERNEL32 ref: 00E25C72

Strings

Socket::ReceiveData, xrefs: 00E25B15, 00E25BBA, 00E25C65
Socket::SelectServerSocket, xrefs: 00E25949, 00E259F3
TRUE, xrefs: 00E25CA1
-RecvBuf: , xrefs: 00E25B91
-Result: , xrefs: 00E259CA, 00E25C3C
FALSE, xrefs: 00E25C9A

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: CurrentThread$Mtx_unlockrecvselect
String ID: -RecvBuf: $-Result: $FALSE$Socket::ReceiveData$Socket::SelectServerSocket$TRUE
API String ID: 450161907-1939653524
Opcode ID: c6f305e37c4f6c1bcd16a2d01ede4cc1b585ce6cb1822269b4d5c05fbb959525
Instruction ID: 7b890447e45b0cc21d068490f090ebca3c45558afdec42c1ce7244bcac4fae95
Opcode Fuzzy Hash: c6f305e37c4f6c1bcd16a2d01ede4cc1b585ce6cb1822269b4d5c05fbb959525
Instruction Fuzzy Hash: 73A126B1A003049BEB14EF28DD0679E7BA4EF45318F24569CE8147F3C2CB768A4587E2

Uniqueness

Uniqueness Score: -1.00%

Function 00E26780, Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 368
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00E26780(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, char _a12) {
				signed int _v8;
				char _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				char _v56;
				signed int _v60;
				intOrPtr _v64;
				char _v68;
				struct _WIN32_FIND_DATAA _v388;
				void* _v392;
				signed int _v396;
				intOrPtr* _v400;
				intOrPtr _v404;
				signed int _v408;
				signed int _v412;
				char _v428;
				signed int _v432;
				signed int _v436;
				char _v452;
				intOrPtr _v456;
				char _v476;
				intOrPtr _v484;
				intOrPtr _v488;
				void* __ebp;
				signed int _t147;
				signed int _t148;
				CHAR* _t150;
				void* _t151;
				signed int _t152;
				signed int _t153;
				int _t155;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t169;
				intOrPtr _t170;
				void* _t174;
				void* _t185;
				char* _t186;
				intOrPtr _t188;
				intOrPtr _t192;
				void* _t196;
				char* _t197;
				intOrPtr _t202;
				intOrPtr _t206;
				intOrPtr _t211;
				void* _t215;
				char* _t219;
				intOrPtr* _t225;
				intOrPtr* _t226;
				signed int* _t231;
				signed int _t232;
				signed int _t236;
				signed int _t241;
				intOrPtr _t243;
				char _t244;
				intOrPtr _t251;
				intOrPtr _t252;
				intOrPtr _t255;
				signed int _t257;
				signed int _t258;
				signed int _t259;
				void* _t260;
				signed int _t265;
				signed int _t269;
				void* _t270;
				signed int _t272;
				signed int _t273;
				void* _t274;
				void* _t275;
				signed int _t276;
				signed int _t277;
				void* _t278;
				signed int _t282;
				signed int _t283;
				intOrPtr* _t287;
				void* _t288;
				char _t289;
				signed int* _t290;
				signed int _t298;
				void* _t300;

				_t215 = __ebx;
				_t294 = _t298;
				_push(0xffffffff);
				_push(0xe60e91);
				_push( *[fs:0x0]);
				_t147 =  *0xe7b068; // 0x1b9618b6
				_t148 = _t147 ^ _t298;
				_v20 = _t148;
				_push(__esi);
				_push(__edi);
				_push(_t148);
				 *[fs:0x0] =  &_v16;
				_v404 = __ecx;
				_t287 = _a4;
				asm("xorps xmm0, xmm0");
				asm("movq [ebp-0x1c], xmm0");
				_v396 = _t287;
				_v24 = 0;
				_v400 = _t287;
				_v396 = _a8;
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v8 = 0;
				_t150 = E00E16850( &_v452, _a8, "\\*.*");
				_t300 = _t298 - 0x1cc + 4;
				if(_t150[0x14] >= 0x10) {
					_t150 =  *_t150;
				}
				_t151 = FindFirstFileA(_t150,  &_v388);
				_t257 = _v432;
				_v392 = _t151;
				if(_t257 < 0x10) {
					L6:
					_v436 = 0;
					_v432 = 0xf;
					_v452 = 0;
					if(_t151 != 0xffffffff) {
						_t288 = _v392;
						do {
							_t219 = ".";
							_t152 =  &(_v388.cFileName);
							while(1) {
								_t258 =  *_t152;
								__eflags = _t258 -  *_t219;
								if(_t258 !=  *_t219) {
									break;
								}
								__eflags = _t258;
								if(_t258 == 0) {
									L14:
									_t153 = 0;
								} else {
									_t277 =  *((intOrPtr*)(_t152 + 1));
									_t33 =  &(_t219[1]); // 0x69000000
									__eflags = _t277 -  *_t33;
									if(_t277 !=  *_t33) {
										break;
									} else {
										_t152 = _t152 + 2;
										_t219 =  &(_t219[2]);
										__eflags = _t277;
										if(_t277 != 0) {
											continue;
										} else {
											goto L14;
										}
									}
								}
								L16:
								__eflags = _t153;
								if(_t153 == 0) {
									goto L56;
								} else {
									_t162 = "..";
									_t225 =  &(_v388.cFileName);
									while(1) {
										_t259 =  *_t225;
										__eflags = _t259 -  *_t162;
										if(_t259 !=  *_t162) {
											break;
										}
										__eflags = _t259;
										if(_t259 == 0) {
											L22:
											_t163 = 0;
										} else {
											_t276 =  *((intOrPtr*)(_t225 + 1));
											_t36 = _t162 + 1; // 0x6900002e
											__eflags = _t276 -  *_t36;
											if(_t276 !=  *_t36) {
												break;
											} else {
												_t225 = _t225 + 2;
												_t162 = _t162 + 2;
												__eflags = _t276;
												if(_t276 != 0) {
													continue;
												} else {
													goto L22;
												}
											}
										}
										L24:
										__eflags = _t163;
										if(_t163 == 0) {
											goto L56;
										} else {
											__eflags = _v388.dwFileAttributes & 0x00000010;
											if((_v388.dwFileAttributes & 0x00000010) == 0) {
												_t226 =  &(_v388.cFileName);
												_v40 = 0;
												_v36 = 0xf;
												_t260 = _t226 + 1;
												_v56 = 0;
												do {
													_t164 =  *_t226;
													_t226 = _t226 + 1;
													__eflags = _t164;
												} while (_t164 != 0);
												E00E14C40(_t215,  &_v56, _t260,  &(_v388.cFileName), _t226 - _t260);
												_v8 = 6;
												__eflags =  *0xe7babc - 0x10;
												_t168 =  >=  ? "request_" : "request_";
												_t282 = _v36;
												__eflags = _t282 - 0x10;
												_t289 = _v56;
												_t261 = _v40;
												_t230 =  >=  ? _t289 :  &_v56;
												_t169 = E00E190E0( >=  ? _t289 :  &_v56, _v40, 0,  >=  ? "request_" : "request_",  *0xe7bab8);
												_t300 = _t300 + 0xc;
												__eflags = _t169 - 0xffffffff;
												if(_t169 == 0xffffffff) {
													L51:
													_v8 = 0;
													__eflags = _t282 - 0x10;
													if(_t282 < 0x10) {
														L55:
														_t282 = _v396;
														_t288 = _v392;
														goto L56;
													} else {
														_t115 = _t282 + 1; // 0x10
														_t231 = _t115;
														_t170 = _t289;
														__eflags = _t231 - 0x1000;
														if(_t231 < 0x1000) {
															L54:
															_push(_t231);
															E00E2C347(_t289);
															_t300 = _t300 + 8;
															goto L55;
														} else {
															_t289 =  *((intOrPtr*)(_t289 - 4));
															_t231 =  &(_t231[8]);
															__eflags = _t170 - _t289 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L59;
															} else {
																goto L54;
															}
														}
													}
												} else {
													_t185 = E00E16850( &_v476, _v396, "\\");
													_v8 = 7;
													_t186 = E00E16940( &_v428, _t185,  &_v56);
													_t300 = _t300 + 8;
													_v8 = 8;
													_t241 = _v28;
													__eflags = _v24 - _t241;
													if(_v24 == _t241) {
														_push(_t186);
														E00E270B0(_t215,  &_v32, _t282, _t289, _t241);
													} else {
														 *(_t241 + 0x10) = 0;
														 *(_t241 + 0x14) = 0;
														asm("movups xmm0, [eax]");
														asm("movups [ecx], xmm0");
														asm("movq xmm0, [eax+0x10]");
														asm("movq [ecx+0x10], xmm0");
														 *(_t186 + 0x10) = 0;
														 *(_t186 + 0x14) = 0xf;
														 *_t186 = 0;
														_v28 = _v28 + 0x18;
													}
													_v8 = 7;
													_t269 = _v408;
													__eflags = _t269 - 0x10;
													if(_t269 < 0x10) {
														L46:
														_v8 = 6;
														_t261 = _v456;
														_v412 = 0;
														_v408 = 0xf;
														_v428 = 0;
														__eflags = _t261 - 0x10;
														if(_t261 < 0x10) {
															L50:
															_t289 = _v56;
															_t282 = _v36;
															goto L51;
														} else {
															_t243 = _v476;
															_t261 = _t261 + 1;
															_t188 = _t243;
															__eflags = _t261 - 0x1000;
															if(_t261 < 0x1000) {
																L49:
																_push(_t261);
																E00E2C347(_t243);
																_t300 = _t300 + 8;
																goto L50;
															} else {
																_t231 =  *(_t243 - 4);
																_t261 = _t261 + 0x23;
																__eflags = _t188 - _t231 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L59;
																} else {
																	goto L49;
																}
															}
														}
													} else {
														_t244 = _v428;
														_t270 = _t269 + 1;
														_t192 = _t244;
														__eflags = _t270 - 0x1000;
														if(_t270 < 0x1000) {
															L45:
															_push(_t270);
															E00E2C347(_t244);
															_t300 = _t300 + 8;
															goto L46;
														} else {
															_t231 =  *(_t244 - 4);
															_t261 = _t270 + 0x23;
															__eflags = _t192 - _t231 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L59;
															} else {
																goto L45;
															}
														}
													}
												}
											} else {
												__eflags = _a12;
												if(_a12 == 0) {
													goto L56;
												} else {
													asm("xorps xmm0, xmm0");
													_v60 = 0;
													asm("movq [ebp-0x40], xmm0");
													_t196 = E00E16850( &_v428, _t282, "\\");
													_t300 = _t300 + 4;
													_v8 = 1;
													_t197 = E00E12C00(_t196,  &(_v388.cFileName));
													_v40 = 0;
													_v36 = 0;
													asm("movups xmm0, [eax]");
													asm("movups [ebp-0x34], xmm0");
													asm("movq xmm0, [eax+0x10]");
													asm("movq [ebp-0x24], xmm0");
													 *(_t197 + 0x10) = 0;
													 *(_t197 + 0x14) = 0xf;
													 *_t197 = 0;
													_push(1);
													_v8 = 2;
													E00E26780(_t215, _v404, _t282, _t288,  &_v68,  &_v56);
													_v8 = 4;
													_t272 = _v36;
													__eflags = _t272 - 0x10;
													if(_t272 < 0x10) {
														L31:
														_v40 = 0;
														_v36 = 0xf;
														_v56 = 0;
														_v8 = 5;
														_t273 = _v408;
														__eflags = _t273 - 0x10;
														if(_t273 < 0x10) {
															L35:
															_push(_v400);
															_v412 = 0;
															_v408 = 0xf;
															_v428 = 0;
															E00E27340(_t215,  &_v32, _t282, _v32, _v68, _v64);
															_v8 = 0;
															L60();
															goto L56;
														} else {
															_t251 = _v428;
															_t274 = _t273 + 1;
															_t202 = _t251;
															__eflags = _t274 - 0x1000;
															if(_t274 < 0x1000) {
																L34:
																_push(_t274);
																E00E2C347(_t251);
																_t300 = _t300 + 8;
																goto L35;
															} else {
																_t231 =  *(_t251 - 4);
																_t261 = _t274 + 0x23;
																__eflags = _t202 - _t231 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L59;
																} else {
																	goto L34;
																}
															}
														}
													} else {
														_t252 = _v56;
														_t275 = _t272 + 1;
														_t206 = _t252;
														__eflags = _t275 - 0x1000;
														if(_t275 < 0x1000) {
															L30:
															_push(_t275);
															E00E2C347(_t252);
															_t300 = _t300 + 8;
															goto L31;
														} else {
															_t56 = _t252 - 4; // 0xfffb1ddf
															_t231 =  *_t56;
															_t261 = _t275 + 0x23;
															__eflags = _t206 - _t231 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L59;
															} else {
																goto L30;
															}
														}
													}
												}
											}
										}
										goto L69;
									}
									asm("sbb eax, eax");
									_t163 = _t162 | 0x00000001;
									__eflags = _t163;
									goto L24;
								}
								goto L69;
							}
							asm("sbb eax, eax");
							_t153 = _t152 | 0x00000001;
							__eflags = _t153;
							goto L16;
							L56:
							_t155 = FindNextFileA(_t288,  &_v388);
							__eflags = _t155;
						} while (_t155 != 0);
						FindClose(_t288);
						_t287 = _v400;
						 *_t287 = _v32;
						 *((intOrPtr*)(_t287 + 4)) = _v28;
						 *((intOrPtr*)(_t287 + 8)) = _v24;
						goto L58;
					} else {
						 *((intOrPtr*)(_t287 + 4)) = _v28;
						 *_t287 = _v32;
						 *((intOrPtr*)(_t287 + 8)) = _v24;
						L58:
						_v32 = 0;
						_v28 = 0;
						_v24 = 0;
						L60();
						 *[fs:0x0] = _v16;
						return E00E2C067(_v20 ^ _t294);
					}
				} else {
					_t255 = _v452;
					_t278 = _t257 + 1;
					_t211 = _t255;
					if(_t278 < 0x1000) {
						L5:
						_push(_t278);
						E00E2C347(_t255);
						_t151 = _v392;
						_t300 = _t300 + 8;
						goto L6;
					} else {
						_t231 =  *(_t255 - 4);
						_t261 = _t278 + 0x23;
						if(_t211 - _t231 + 0xfffffffc > 0x1f) {
							L59:
							_t174 = E00E4957C(_t215, _t231, _t261, _t282, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t289);
							_t290 = _t231;
							_t232 =  *_t290;
							__eflags = _t232;
							if(_t232 == 0) {
								L65:
								return _t174;
							} else {
								E00E27220(_t215, _t232, _t290[1], _t282, _t290, _t232, _t282);
								_t283 =  *_t290;
								_t236 = (0x2aaaaaab * (_t290[2] - _t283) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_t290[2] - _t283) >> 0x20 >> 2) + ((0x2aaaaaab * (_t290[2] - _t283) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_t290[2] - _t283) >> 0x20 >> 2)) * 2 << 3;
								__eflags = _t236 - 0x1000;
								if(_t236 < 0x1000) {
									L64:
									_push(_t236);
									_t174 = E00E2C347(_t283);
									 *_t290 = 0;
									_t290[1] = 0;
									_t290[2] = 0;
									goto L65;
								} else {
									_t265 =  *(_t283 - 4);
									_t236 = _t236 + 0x23;
									_t141 = _t283 - _t265 - 4; // -4
									__eflags = _t141 - 0x1f;
									if(__eflags > 0) {
										E00E4957C(_t215, _t236, _t265, _t285, __eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push("invalid vector<T> subscript");
										E00E2A005();
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										return E00E27220(_t215, _v488, _v484, _t285, _t290, _t236, _t294);
									} else {
										_t283 = _t265;
										goto L64;
									}
								}
							}
						} else {
							goto L5;
						}
					}
				}
				L69:
			}

0x00e26780
0x00e26781
0x00e26783
0x00e26785
0x00e26790
0x00e26797
0x00e2679c
0x00e2679e
0x00e267a1
0x00e267a2
0x00e267a3
0x00e267a7
0x00e267ad
0x00e267b3
0x00e267b6
0x00e267bc
0x00e267c1
0x00e267c7
0x00e267ce
0x00e267d4
0x00e267da
0x00e267e1
0x00e267e8
0x00e267f6
0x00e26803
0x00e26808
0x00e2680f
0x00e26811
0x00e26811
0x00e2681b
0x00e26821
0x00e26827
0x00e26830
0x00e26867
0x00e26867
0x00e26871
0x00e2687b
0x00e26885
0x00e2689d
0x00e268a3
0x00e268a3
0x00e268a8
0x00e268b0
0x00e268b0
0x00e268b2
0x00e268b4
0x00000000
0x00000000
0x00e268b6
0x00e268b8
0x00e268cc
0x00e268cc
0x00e268ba
0x00e268ba
0x00e268bd
0x00e268bd
0x00e268c0
0x00000000
0x00e268c2
0x00e268c2
0x00e268c5
0x00e268c8
0x00e268ca
0x00000000
0x00000000
0x00000000
0x00000000
0x00e268ca
0x00e268c0
0x00e268d5
0x00e268d5
0x00e268d7
0x00000000
0x00e268dd
0x00e268dd
0x00e268e2
0x00e268e8
0x00e268e8
0x00e268ea
0x00e268ec
0x00000000
0x00000000
0x00e268ee
0x00e268f0
0x00e26904
0x00e26904
0x00e268f2
0x00e268f2
0x00e268f5
0x00e268f5
0x00e268f8
0x00000000
0x00e268fa
0x00e268fa
0x00e268fd
0x00e26900
0x00e26902
0x00000000
0x00000000
0x00000000
0x00000000
0x00e26902
0x00e268f8
0x00e2690d
0x00e2690d
0x00e2690f
0x00000000
0x00e26915
0x00e26915
0x00e2691c
0x00e26a76
0x00e26a7c
0x00e26a83
0x00e26a8a
0x00e26a8d
0x00e26a91
0x00e26a91
0x00e26a93
0x00e26a94
0x00e26a94
0x00e26aa5
0x00e26aaa
0x00e26ab1
0x00e26ac3
0x00e26aca
0x00e26acd
0x00e26ad0
0x00e26ad3
0x00e26ad6
0x00e26adc
0x00e26ae1
0x00e26ae4
0x00e26ae7
0x00e26c03
0x00e26c03
0x00e26c07
0x00e26c0a
0x00e26c37
0x00e26c37
0x00e26c3d
0x00000000
0x00e26c0c
0x00e26c0c
0x00e26c0c
0x00e26c0f
0x00e26c11
0x00e26c17
0x00e26c2d
0x00e26c2d
0x00e26c2f
0x00e26c34
0x00000000
0x00e26c19
0x00e26c19
0x00e26c1c
0x00e26c24
0x00e26c27
0x00000000
0x00000000
0x00000000
0x00000000
0x00e26c27
0x00e26c17
0x00e26aed
0x00e26afe
0x00e26b06
0x00e26b13
0x00e26b18
0x00e26b1b
0x00e26b1f
0x00e26b22
0x00e26b25
0x00e26b5c
0x00e26b61
0x00e26b27
0x00e26b27
0x00e26b2e
0x00e26b35
0x00e26b38
0x00e26b3b
0x00e26b40
0x00e26b45
0x00e26b4c
0x00e26b53
0x00e26b56
0x00e26b56
0x00e26b66
0x00e26b6a
0x00e26b70
0x00e26b73
0x00e26ba4
0x00e26ba4
0x00e26ba8
0x00e26bae
0x00e26bb8
0x00e26bc2
0x00e26bc9
0x00e26bcc
0x00e26bfd
0x00e26bfd
0x00e26c00
0x00000000
0x00e26bce
0x00e26bce
0x00e26bd4
0x00e26bd5
0x00e26bd7
0x00e26bdd
0x00e26bf3
0x00e26bf3
0x00e26bf5
0x00e26bfa
0x00000000
0x00e26bdf
0x00e26bdf
0x00e26be2
0x00e26bea
0x00e26bed
0x00000000
0x00000000
0x00000000
0x00000000
0x00e26bed
0x00e26bdd
0x00e26b75
0x00e26b75
0x00e26b7b
0x00e26b7c
0x00e26b7e
0x00e26b84
0x00e26b9a
0x00e26b9a
0x00e26b9c
0x00e26ba1
0x00000000
0x00e26b86
0x00e26b86
0x00e26b89
0x00e26b91
0x00e26b94
0x00000000
0x00000000
0x00000000
0x00000000
0x00e26b94
0x00e26b84
0x00e26b73
0x00e26922
0x00e26922
0x00e26926
0x00000000
0x00e2692c
0x00e2692c
0x00e2692f
0x00e2693d
0x00e26948
0x00e2694d
0x00e26956
0x00e2695d
0x00e26962
0x00e26969
0x00e26970
0x00e26973
0x00e26977
0x00e2697c
0x00e26981
0x00e26988
0x00e2698f
0x00e2699b
0x00e269a1
0x00e269a6
0x00e269ab
0x00e269af
0x00e269b2
0x00e269b5
0x00e269e3
0x00e269e3
0x00e269ea
0x00e269f1
0x00e269f5
0x00e269f9
0x00e269ff
0x00e26a02
0x00e26a33
0x00e26a33
0x00e26a3c
0x00e26a49
0x00e26a56
0x00e26a60
0x00e26a68
0x00e26a6c
0x00000000
0x00e26a04
0x00e26a04
0x00e26a0a
0x00e26a0b
0x00e26a0d
0x00e26a13
0x00e26a29
0x00e26a29
0x00e26a2b
0x00e26a30
0x00000000
0x00e26a15
0x00e26a15
0x00e26a18
0x00e26a20
0x00e26a23
0x00000000
0x00000000
0x00000000
0x00000000
0x00e26a23
0x00e26a13
0x00e269b7
0x00e269b7
0x00e269ba
0x00e269bb
0x00e269bd
0x00e269c3
0x00e269d9
0x00e269d9
0x00e269db
0x00e269e0
0x00000000
0x00e269c5
0x00e269c5
0x00e269c5
0x00e269c8
0x00e269d0
0x00e269d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00e269d3
0x00e269c3
0x00e269b5
0x00e26926
0x00e2691c
0x00000000
0x00e2690f
0x00e26908
0x00e2690a
0x00e2690a
0x00000000
0x00e2690a
0x00000000
0x00e268d7
0x00e268d0
0x00e268d2
0x00e268d2
0x00000000
0x00e26c43
0x00e26c4b
0x00e26c51
0x00e26c51
0x00e26c5a
0x00e26c60
0x00e26c69
0x00e26c6e
0x00e26c74
0x00000000
0x00e26887
0x00e2688d
0x00e26893
0x00e26895
0x00e26c77
0x00e26c7a
0x00e26c81
0x00e26c88
0x00e26c8f
0x00e26c99
0x00e26cb0
0x00e26cb0
0x00e26832
0x00e26832
0x00e26838
0x00e26839
0x00e26841
0x00e26857
0x00e26857
0x00e26859
0x00e2685e
0x00e26864
0x00000000
0x00e26843
0x00e26843
0x00e26846
0x00e26851
0x00e26cb3
0x00e26cb3
0x00e26cb8
0x00e26cb9
0x00e26cba
0x00e26cbb
0x00e26cbc
0x00e26cbd
0x00e26cbe
0x00e26cbf
0x00e26f20
0x00e26f21
0x00e26f23
0x00e26f25
0x00e26f27
0x00e26f8d
0x00e26f8e
0x00e26f29
0x00e26f2e
0x00e26f3b
0x00e26f51
0x00e26f54
0x00e26f5a
0x00e26f6e
0x00e26f6e
0x00e26f70
0x00e26f78
0x00e26f7e
0x00e26f85
0x00000000
0x00e26f5c
0x00e26f5c
0x00e26f5f
0x00e26f64
0x00e26f67
0x00e26f6a
0x00e26f8f
0x00e26f94
0x00e26f95
0x00e26f96
0x00e26f97
0x00e26f98
0x00e26f99
0x00e26f9a
0x00e26f9b
0x00e26f9c
0x00e26f9d
0x00e26f9e
0x00e26f9f
0x00e26fa0
0x00e26fa5
0x00e26faa
0x00e26fab
0x00e26fac
0x00e26fad
0x00e26fae
0x00e26faf
0x00e26fc3
0x00e26f6c
0x00e26f6c
0x00000000
0x00e26f6c
0x00e26f6a
0x00e26f5a
0x00000000
0x00000000
0x00000000
0x00e26851
0x00e26841
0x00000000

APIs

FindFirstFileA.KERNEL32(00000000,?,0000000C), ref: 00E2681B
FindNextFileA.KERNEL32(?,?), ref: 00E26C4B
FindClose.KERNEL32(?), ref: 00E26C5A

Strings

`*, xrefs: 00E268DD
h , xrefs: 00E268A3
request_, xrefs: 00E26AB8, 00E26AD9
\*.*, xrefs: 00E267EF

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: \*.*$`*$h $request_
API String ID: 3541575487-130714493
Opcode ID: 1690e47dc0a1c44c57332fd6ba054892eb592137097db4a218762429569251be
Instruction ID: 7f206633c392f33eb325f3a860d4733157a4982b43e1d2e1a81ab4692414ff19
Opcode Fuzzy Hash: 1690e47dc0a1c44c57332fd6ba054892eb592137097db4a218762429569251be
Instruction Fuzzy Hash: 82E1C071D002689FDF19CF64E9457EEBBB1EF45308F209288E449B7291DB759E88CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00E58B28, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 253
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 68%

			E00E58B28(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4, signed short* _a8, intOrPtr _a12) {
				intOrPtr* _v8;
				short _v12;
				signed int _v32;
				intOrPtr _v40;
				signed int _v52;
				char _v272;
				short _v292;
				void* __ebp;
				void* _t33;
				short* _t34;
				intOrPtr* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed short _t39;
				signed short* _t42;
				intOrPtr _t45;
				void* _t47;
				signed int _t50;
				void* _t52;
				signed int _t56;
				void* _t69;
				void* _t73;
				void* _t74;
				void* _t78;
				intOrPtr* _t85;
				short* _t87;
				intOrPtr* _t92;
				intOrPtr* _t96;
				short _t114;
				void* _t115;
				intOrPtr* _t117;
				intOrPtr _t120;
				signed int* _t121;
				intOrPtr* _t124;
				signed short _t126;
				int _t128;
				void* _t132;
				signed int _t133;

				_push(__ecx);
				_push(__ecx);
				_push(__ebx);
				_t85 = _a4;
				_push(__esi);
				_push(__edi);
				_t33 = E00E4FBAD(__ecx, __edx);
				_t114 = 0;
				_v12 = 0;
				_t3 = _t33 + 0x50; // 0x50
				_t124 = _t3;
				_t4 = _t124 + 0x250; // 0x2a0
				_t34 = _t4;
				 *((intOrPtr*)(_t124 + 8)) = 0;
				 *_t34 = 0;
				_t6 = _t124 + 4; // 0x54
				_t117 = _t6;
				_v8 = _t34;
				_t92 = _t85;
				_t35 = _t85 + 0x80;
				 *_t124 = _t85;
				 *_t117 = _t35;
				if( *_t35 != 0) {
					E00E58AB9(0xe6ac90, 0x16, _t117);
					_t92 =  *_t124;
					_t132 = _t132 + 0xc;
					_t114 = 0;
				}
				_push(_t124);
				if( *_t92 == _t114) {
					E00E5841E(_t92);
					goto L12;
				} else {
					if( *((intOrPtr*)( *_t117)) == _t114) {
						E00E58542();
					} else {
						E00E584A7(_t92);
					}
					if( *((intOrPtr*)(_t124 + 8)) == 0) {
						_t78 = E00E58AB9(0xe6a980, 0x40, _t124);
						_t132 = _t132 + 0xc;
						if(_t78 != 0) {
							_push(_t124);
							if( *((intOrPtr*)( *_t117)) == 0) {
								E00E58542();
							} else {
								E00E584A7(0);
							}
							L12:
						}
					}
				}
				if( *((intOrPtr*)(_t124 + 8)) == 0) {
					L37:
					_t37 = 0;
					goto L38;
				} else {
					_t38 = _t85 + 0x100;
					if( *_t85 != 0 ||  *_t38 != 0) {
						_t39 = E00E58972(_t85, _t38, _t124);
					} else {
						_t39 = GetACP();
					}
					_t126 = _t39;
					if(_t126 == 0 || _t126 == 0xfde8 || IsValidCodePage(_t126 & 0x0000ffff) == 0) {
						goto L37;
					} else {
						_t42 = _a8;
						if(_t42 != 0) {
							 *_t42 = _t126;
						}
						_t120 = _a12;
						if(_t120 == 0) {
							L36:
							_t37 = 1;
							L38:
							return _t37;
						} else {
							_t96 = _v8;
							_t15 = _t120 + 0x120; // 0xe4d462
							_t87 = _t15;
							 *_t87 = 0;
							_t115 = _t96 + 2;
							do {
								_t45 =  *_t96;
								_t96 = _t96 + 2;
							} while (_t45 != _v12);
							_t98 = _t96 - _t115 >> 1;
							_push((_t96 - _t115 >> 1) + 1);
							_t47 = E00E4E0FC(_t87, 0x55, _v8);
							_t133 = _t132 + 0x10;
							if(_t47 != 0) {
								L39:
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E00E49599();
								asm("int3");
								_t131 = _t133;
								_t50 =  *0xe7b068; // 0x1b9618b6
								_v52 = _t50 ^ _t133;
								_push(_t87);
								_push(_t126);
								_push(_t120);
								_t52 = E00E4FBAD(_t98, _t115);
								_t88 = _t52;
								_t121 =  *(E00E4FBAD(_t98, _t115) + 0x34c);
								_t128 = E00E5926B(_v40);
								asm("sbb ecx, ecx");
								_t56 = GetLocaleInfoW(_t128, ( ~( *(_t52 + 0x64)) & 0xfffff005) + 0x1002,  &_v292, 0x78);
								if(_t56 != 0) {
									if(E00E558BA(_t88, _t121, _t128,  *((intOrPtr*)(_t88 + 0x54)),  &_v272) == 0 && E00E5939F(_t128) != 0) {
										 *_t121 =  *_t121 | 0x00000004;
										_t121[2] = _t128;
										_t121[1] = _t128;
									}
								} else {
									 *_t121 =  *_t121 & _t56;
								}
								return E00E2C067(_v32 ^ _t131);
							} else {
								if(E00E5104D(_t87, 0x1001, _t120, 0x40) == 0) {
									goto L37;
								} else {
									_t20 = _t120 + 0x80; // 0xe4d3c2
									_t87 = _t20;
									_t21 = _t120 + 0x120; // 0xe4d462
									if(E00E5104D(_t21, 0x1002, _t87, 0x40) == 0) {
										goto L37;
									} else {
										_push(0x5f);
										_t69 = E00E5F617(_t98);
										_t98 = _t87;
										if(_t69 != 0) {
											L31:
											_t22 = _t120 + 0x120; // 0xe4d462
											if(E00E5104D(_t22, 7, _t87, 0x40) == 0) {
												goto L37;
											} else {
												goto L32;
											}
										} else {
											_push(0x2e);
											_t74 = E00E5F617(_t98);
											_t98 = _t87;
											if(_t74 == 0) {
												L32:
												_t120 = _t120 + 0x100;
												if(_t126 != 0xfde9) {
													E00E5D9B9(_t98, _t126, _t120, 0x10, 0xa);
													goto L36;
												} else {
													_push(5);
													_t73 = E00E4E0FC(_t120, 0x10, L"utf8");
													_t133 = _t133 + 0x10;
													if(_t73 != 0) {
														goto L39;
													} else {
														goto L36;
													}
												}
											} else {
												goto L31;
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00e58b2d
0x00e58b2e
0x00e58b2f
0x00e58b30
0x00e58b33
0x00e58b34
0x00e58b35
0x00e58b3c
0x00e58b3e
0x00e58b41
0x00e58b41
0x00e58b44
0x00e58b44
0x00e58b4a
0x00e58b4d
0x00e58b50
0x00e58b50
0x00e58b53
0x00e58b56
0x00e58b58
0x00e58b5e
0x00e58b60
0x00e58b65
0x00e58b6f
0x00e58b74
0x00e58b76
0x00e58b79
0x00e58b79
0x00e58b7b
0x00e58b7f
0x00e58bc8
0x00000000
0x00e58b81
0x00e58b86
0x00e58b8f
0x00e58b88
0x00e58b88
0x00e58b88
0x00e58b9a
0x00e58ba4
0x00e58ba9
0x00e58bae
0x00e58bb4
0x00e58bb8
0x00e58bc1
0x00e58bba
0x00e58bba
0x00e58bba
0x00e58bcd
0x00e58bcd
0x00e58bae
0x00e58b9a
0x00e58bd3
0x00e58d0f
0x00e58d0f
0x00000000
0x00e58bd9
0x00e58bd9
0x00e58be2
0x00e58bf3
0x00e58be9
0x00e58be9
0x00e58be9
0x00e58bfa
0x00e58bfe
0x00000000
0x00e58c22
0x00e58c22
0x00e58c27
0x00e58c29
0x00e58c29
0x00e58c2b
0x00e58c30
0x00e58d0a
0x00e58d0c
0x00e58d11
0x00e58d17
0x00e58c36
0x00e58c36
0x00e58c39
0x00e58c39
0x00e58c41
0x00e58c44
0x00e58c47
0x00e58c47
0x00e58c4a
0x00e58c4d
0x00e58c55
0x00e58c5a
0x00e58c61
0x00e58c66
0x00e58c6b
0x00e58d18
0x00e58d1a
0x00e58d1b
0x00e58d1c
0x00e58d1d
0x00e58d1e
0x00e58d1f
0x00e58d24
0x00e58d28
0x00e58d30
0x00e58d37
0x00e58d3a
0x00e58d3b
0x00e58d3f
0x00e58d40
0x00e58d45
0x00e58d4d
0x00e58d5c
0x00e58d68
0x00e58d79
0x00e58d81
0x00e58d9b
0x00e58da8
0x00e58dab
0x00e58dae
0x00e58dae
0x00e58d83
0x00e58d83
0x00e58d85
0x00e58dcb
0x00e58c71
0x00e58c81
0x00000000
0x00e58c87
0x00e58c89
0x00e58c89
0x00e58c95
0x00e58ca3
0x00000000
0x00e58ca5
0x00e58ca5
0x00e58ca8
0x00e58cae
0x00e58cb1
0x00e58cc1
0x00e58cc6
0x00e58cd4
0x00000000
0x00000000
0x00000000
0x00000000
0x00e58cb3
0x00e58cb3
0x00e58cb6
0x00e58cbc
0x00e58cbf
0x00e58cd6
0x00e58cd6
0x00e58ce2
0x00e58d02
0x00000000
0x00e58ce4
0x00e58ce4
0x00e58cee
0x00e58cf3
0x00e58cf8
0x00000000
0x00e58cfa
0x00000000
0x00e58cfa
0x00e58cf8
0x00000000
0x00000000
0x00000000
0x00e58cbf
0x00e58cb1
0x00e58ca3
0x00e58c81
0x00e58c6b
0x00e58c30
0x00e58bfe

APIs

Part of subcall function 00E4FBAD: GetLastError.KERNEL32(00E7BC08,ios_base::failbit set,?,00E484A4,00E79760,00000008,?,00000001), ref: 00E4FBB2
Part of subcall function 00E4FBAD: SetLastError.KERNEL32(00000000,00000002,000000FF,?,00E484A4,00E79760,00000008,?,00000001), ref: 00E4FC50

GetACP.KERNEL32(00000055,?,?,?,?,?,00E4D342,?,?,?,?,?,?,00000004), ref: 00E58BE9
IsValidCodePage.KERNEL32(00000000,00000055,?,?,?,?,?,00E4D342,?,?,?,?,?,?,00000004), ref: 00E58C14
_wcschr.LIBVCRUNTIME ref: 00E58CA8
_wcschr.LIBVCRUNTIME ref: 00E58CB6
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,00E4D342,00000000,00E4D462), ref: 00E58D79

Strings

utf8, xrefs: 00E58CE6

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: 88ff6aea01e29ae7d2341a9de2dba375926a00e352e38c1c8fade31624e1f9bd
Instruction ID: a9c4b1943811cc23fcc4c1d699b0ce17154d2d7ba5ecd2ee038b91d2c47168fe
Opcode Fuzzy Hash: 88ff6aea01e29ae7d2341a9de2dba375926a00e352e38c1c8fade31624e1f9bd
Instruction Fuzzy Hash: 5271F475A00206AAD724AB34DD42BABB3ECEF54706F146C29FD05B71C1FFB099488761

Uniqueness

Uniqueness Score: -1.00%

Function 00E5A4A5, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1343
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E00E5A4A5(void* __eflags, signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr* _a16, signed int _a20, intOrPtr _a24) {
				intOrPtr _v0;
				signed int _v8;
				char _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				signed int _v464;
				void _v468;
				signed int _v472;
				signed int _v932;
				signed int _v936;
				signed int _v1392;
				signed int _v1396;
				signed int _v1400;
				char _v1860;
				signed int _v1864;
				signed int _v1868;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				signed int _v1884;
				signed int _v1888;
				signed int _v1892;
				signed int _v1896;
				signed int _v1900;
				signed int _v1904;
				signed int _v1908;
				signed int _v1912;
				intOrPtr _v1916;
				signed int _v1920;
				intOrPtr* _v1924;
				signed int _v1928;
				char _v1936;
				signed int _v1944;
				char _v2404;
				signed int _v2408;
				intOrPtr _v2452;
				signed int _v2456;
				void* __edi;
				signed int _t741;
				intOrPtr _t751;
				signed int _t755;
				signed int _t756;
				signed int _t760;
				signed short _t765;
				signed int _t767;
				signed int _t773;
				signed int _t774;
				signed int _t780;
				intOrPtr _t787;
				void* _t788;
				unsigned int* _t790;
				signed int _t799;
				signed int _t804;
				signed int _t805;
				signed int _t806;
				signed int _t809;
				signed int _t810;
				signed int _t811;
				signed int _t813;
				signed int _t814;
				signed int _t815;
				signed int _t816;
				signed int _t821;
				signed int _t822;
				signed int _t828;
				signed int _t829;
				signed int _t832;
				signed int _t837;
				signed int _t845;
				signed int* _t848;
				signed int _t852;
				signed int _t863;
				signed int _t864;
				signed int _t865;
				signed int _t866;
				char* _t867;
				signed int _t870;
				signed int _t876;
				signed int _t878;
				signed int _t882;
				signed int _t885;
				signed int _t894;
				signed int _t897;
				signed int _t899;
				signed int _t902;
				signed int _t903;
				signed int _t906;
				signed int _t919;
				signed int _t920;
				signed int _t921;
				signed int _t922;
				char* _t923;
				signed int _t926;
				signed int* _t929;
				signed int _t932;
				signed int _t934;
				signed int _t938;
				signed int _t941;
				signed int _t949;
				signed int _t952;
				signed int _t956;
				intOrPtr _t960;
				void* _t961;
				unsigned int* _t963;
				unsigned int _t973;
				signed int _t974;
				void* _t977;
				signed int _t978;
				void* _t980;
				signed int _t993;
				signed int _t995;
				unsigned int _t1000;
				signed int _t1001;
				void* _t1004;
				signed int _t1005;
				void* _t1007;
				signed int _t1012;
				signed int _t1016;
				signed int _t1018;
				signed int _t1026;
				intOrPtr _t1027;
				void* _t1028;
				signed int _t1032;
				signed int _t1035;
				void* _t1039;
				signed int _t1040;
				signed int _t1042;
				signed int _t1044;
				signed int _t1046;
				signed int _t1047;
				signed int _t1048;
				signed int _t1049;
				intOrPtr* _t1062;
				signed int _t1068;
				signed int _t1070;
				signed int _t1071;
				signed int _t1076;
				signed int _t1077;
				signed int _t1080;
				signed int _t1081;
				signed int _t1083;
				signed int _t1084;
				signed int _t1085;
				signed int _t1089;
				signed int _t1093;
				signed int _t1094;
				signed int _t1095;
				signed int _t1097;
				signed int _t1098;
				signed int _t1099;
				signed int _t1100;
				signed int _t1101;
				signed int _t1102;
				signed int _t1103;
				signed int _t1105;
				signed int _t1106;
				signed int _t1107;
				signed int _t1108;
				signed int _t1109;
				void* _t1110;
				signed int _t1111;
				intOrPtr _t1115;
				signed int _t1116;
				signed int _t1117;
				signed int _t1122;
				void* _t1123;
				intOrPtr _t1126;
				signed int _t1127;
				signed int _t1130;
				signed int _t1135;
				signed int _t1138;
				signed short _t1139;
				signed int _t1142;
				unsigned int _t1143;
				char _t1152;
				signed int _t1154;
				signed int _t1155;
				signed int _t1156;
				signed int _t1157;
				signed int _t1158;
				signed int _t1159;
				signed int _t1161;
				signed int _t1163;
				signed int _t1164;
				signed int _t1165;
				signed int _t1166;
				signed int _t1167;
				signed int _t1169;
				unsigned int _t1171;
				signed int _t1176;
				intOrPtr* _t1178;
				signed int _t1180;
				intOrPtr* _t1182;
				intOrPtr _t1185;
				signed short _t1186;
				void* _t1191;
				signed int _t1192;
				unsigned int _t1194;
				signed int _t1195;
				signed int _t1196;
				void* _t1197;
				signed int _t1198;
				signed int _t1199;
				signed int _t1200;
				signed int _t1203;
				signed int _t1204;
				signed int _t1205;
				signed int _t1206;
				signed int _t1209;
				signed int _t1210;
				signed int _t1211;
				signed int _t1212;
				signed int _t1214;
				signed int _t1217;
				signed int _t1218;
				signed int _t1221;
				signed int _t1223;
				signed short* _t1224;
				signed int _t1228;
				signed int _t1229;
				signed int _t1230;
				unsigned int* _t1231;
				signed int _t1232;
				signed int _t1235;
				signed int _t1236;
				signed int _t1237;
				signed int _t1238;
				signed int _t1240;
				signed int _t1241;
				signed int _t1242;
				signed int _t1243;
				signed int _t1244;
				signed int _t1246;
				signed int _t1247;
				signed int _t1248;
				signed int _t1249;
				signed int _t1250;
				unsigned int* _t1251;
				signed int _t1252;
				signed int _t1256;
				signed int _t1258;
				signed int _t1260;
				signed int _t1262;
				signed int _t1263;
				signed int* _t1265;
				signed int* _t1268;
				signed int _t1271;
				signed int _t1278;

				_t741 =  *0xe7b068; // 0x1b9618b6
				_v8 = _t741 ^ _t1263;
				_v1924 = _a16;
				_v1904 = _a20;
				E00E5DC4C(__eflags,  &_v1944);
				if((_v1944 & 0x0000001f) != 0x1f) {
					E00E5DCB6(__eflags,  &_v1944);
					_v1936 = 1;
				} else {
					_v1936 = 0;
				}
				_t1026 = _a4;
				_t1223 = _a8;
				_t1185 = 0x20;
				_t1271 = _t1223;
				if(_t1271 > 0 || _t1271 >= 0 && _t1026 >= 0) {
					_t751 = _t1185;
				} else {
					_t751 = 0x2d;
				}
				_t1062 = _v1924;
				_t1138 = _v1904;
				 *_t1062 = _t751;
				 *(_t1062 + 8) = _t1138;
				if((_t1223 & 0x7ff00000) != 0) {
					L11:
					_t755 = E00E4FE59( &_a4);
					__eflags = _t755;
					if(_t755 != 0) {
						 *(_v1924 + 4) = 1;
					}
					_t756 = _t755 - 1;
					__eflags = _t756;
					if(_t756 == 0) {
						_push("1#INF");
						goto L310;
					} else {
						_t773 = _t756 - 1;
						__eflags = _t773;
						if(_t773 == 0) {
							_push("1#QNAN");
							goto L310;
						} else {
							_t774 = _t773 - 1;
							__eflags = _t774;
							if(_t774 == 0) {
								_push("1#SNAN");
								goto L310;
							} else {
								__eflags = _t774 == 1;
								if(_t774 == 1) {
									_push("1#IND");
									L310:
									_push(_a24);
									_t1066 = _v1904;
									_push(_v1904);
									goto L311;
								} else {
									_v1928 = _v1928 & 0x00000000;
									_a8 = _t1223 & 0x7fffffff;
									_a4 = _t1026;
									_t1278 = _a4;
									asm("fst qword [ebp-0x778]");
									_t1228 = _v1912;
									_v1920 = _a12 + 1;
									_t1076 = _t1228 >> 0x14;
									_t780 = _t1076 & 0x000007ff;
									__eflags = _t780;
									if(_t780 != 0) {
										_t780 = 0;
										_t1032 = 0;
										__eflags = 0;
									} else {
										_t1032 = 1;
									}
									_t1229 = _t1228 & 0x000fffff;
									_v1888 = _v1916 + _t780;
									asm("adc esi, edx");
									_t1077 = _t1076 & 0x000007ff;
									_v1868 = _t1077 + _t1032;
									E00E5DD10(_t1077, _t1278);
									_push(_t1077);
									_push(_t1077);
									 *_t1265 = _t1278;
									_t1080 = E00E5F090(E00E5DE20(_t1077, _v1916 + _t780), _t1278);
									_v1900 = _t1080;
									_t1191 = 0x20;
									__eflags = _t1080 - 0x7fffffff;
									if(_t1080 == 0x7fffffff) {
										L22:
										__eflags = 0;
										_v1900 = 0;
									} else {
										__eflags = _t1080 - 0x80000000;
										if(_t1080 == 0x80000000) {
											goto L22;
										}
									}
									_t1142 = _v1868;
									__eflags = _t1229;
									_v468 = _v1888;
									_v464 = _t1229;
									_v936 = _v936 & 0x00000000;
									_t1035 = (0 | _t1229 != 0x00000000) + 1;
									_v472 = _t1035;
									__eflags = _t1142 - 0x433;
									if(_t1142 < 0x433) {
										__eflags = _t1142 - 0x35;
										if(_t1142 == 0x35) {
											L110:
											_t787 =  *((intOrPtr*)(_t1263 + _t1035 * 4 - 0x1d4));
											_t204 =  &_v1912;
											 *_t204 = _v1912 & 0x00000000;
											__eflags =  *_t204;
											asm("bsr eax, eax");
											if( *_t204 == 0) {
												_t788 = 0;
												__eflags = 0;
											} else {
												_t788 = _t787 + 1;
											}
											_t1230 = _t1035;
											_t1192 = _t1191 - _t788;
											__eflags = _t1192;
											_v1888 = _t1230;
											_t1081 = _t1230;
											_t790 =  &(( &_v472)[_t1230]);
											_v1884 = _t790;
											_t1231 = _t790;
											while(1) {
												__eflags = _t1081 - _t1035;
												if(_t1081 >= _t1035) {
													_t215 =  &_v1872;
													 *_t215 = _v1872 & 0x00000000;
													__eflags =  *_t215;
												} else {
													_v1872 =  *(_t1263 + _t1081 * 4 - 0x1d0);
												}
												_t217 = _t1081 - 1; // -1
												__eflags = _t217 - _t1035;
												if(_t217 >= _t1035) {
													_t1143 = 0;
													__eflags = 0;
												} else {
													_t1143 =  *_t1231;
												}
												_t1231 = _t1231 - 4;
												 *(_t1263 + _t1081 * 4 - 0x1d0) = _t1143 >> 0x0000001f | _v1872 + _v1872;
												_t1081 = _t1081 - 1;
												__eflags = _t1081 - 0xffffffff;
												if(_t1081 == 0xffffffff) {
													break;
												}
												_t1035 = _v472;
											}
											_t1232 = _v1888;
											__eflags = _t1192 - 1;
											if(_t1192 >= 1) {
												_v472 = _t1232;
											} else {
												_v472 = _t1232 + 1;
											}
											_t1194 = 0x434 >> 5;
											E00E43C10(0x434 >> 5,  &_v1396, 0, 0x434);
											__eflags = 1;
											 *(_t1263 + 0xbad63d) = 1 << (0x00000434 - _v1868 & 0x0000001f);
										} else {
											_v1396 = _v1396 & 0x00000000;
											_v1392 = 0x100000;
											_v1400 = 2;
											__eflags = _t1229;
											if(_t1229 != 0) {
												_t1110 = 0;
												__eflags = 0;
												while(1) {
													_t960 =  *((intOrPtr*)(_t1263 + _t1110 - 0x570));
													__eflags = _t960 -  *((intOrPtr*)(_t1263 + _t1110 - 0x1d0));
													if(_t960 !=  *((intOrPtr*)(_t1263 + _t1110 - 0x1d0))) {
														goto L110;
													}
													_t1110 = _t1110 + 4;
													__eflags = _t1110 - 8;
													if(_t1110 != 8) {
														continue;
													} else {
														_t174 =  &_v1912;
														 *_t174 = _v1912 & 0x00000000;
														__eflags =  *_t174;
														asm("bsr eax, esi");
														if( *_t174 == 0) {
															_t961 = 0;
															__eflags = 0;
														} else {
															_t961 = _t960 + 1;
														}
														_t1250 = _t1035;
														_t1212 = _t1191 - _t961;
														__eflags = _t1212;
														_v1888 = _t1250;
														_t1111 = _t1250;
														_t963 =  &(( &_v472)[_t1250]);
														_v1884 = _t963;
														_t1251 = _t963;
														while(1) {
															__eflags = _t1111 - _t1035;
															if(_t1111 >= _t1035) {
																_t185 =  &_v1872;
																 *_t185 = _v1872 & 0x00000000;
																__eflags =  *_t185;
															} else {
																_v1872 =  *(_t1263 + _t1111 * 4 - 0x1d0);
															}
															_t187 = _t1111 - 1; // -1
															__eflags = _t187 - _t1035;
															if(_t187 >= _t1035) {
																_t1171 = 0;
																__eflags = 0;
															} else {
																_t1171 =  *_t1251;
															}
															_t1251 = _t1251 - 4;
															 *(_t1263 + _t1111 * 4 - 0x1d0) = _t1171 >> 0x0000001e | _v1872 << 0x00000002;
															_t1111 = _t1111 - 1;
															__eflags = _t1111 - 0xffffffff;
															if(_t1111 == 0xffffffff) {
																break;
															}
															_t1035 = _v472;
														}
														_t1252 = _v1888;
														__eflags = _t1212 - 2;
														if(_t1212 >= 2) {
															_v472 = _t1252;
														} else {
															_v472 = _t1252 + 1;
														}
														_t1194 = 0x435 >> 5;
														E00E43C10(0x435 >> 5,  &_v1396, 0, 0x435);
														 *(_t1263 + 0xbad63d) = 1 << (0x00000435 - _v1868 & 0x0000001f);
													}
													goto L126;
												}
											}
											goto L110;
										}
										L126:
										_t799 = _t1194 + 1;
										_t1039 = 0x1cc;
										_v1400 = _t799;
										_v936 = _t799;
										__eflags = _t799 << 2;
										E00E49055( &_v932, 0x1cc,  &_v1396, _t799 << 2);
										_t1268 =  &(_t1265[7]);
									} else {
										_v1396 = _v1396 & 0x00000000;
										_v1392 = 0x100000;
										_v1400 = 2;
										__eflags = _t1229;
										if(_t1229 == 0) {
											L59:
											_t973 = _t1142 - 0x432;
											_t974 = _t973 & 0x0000001f;
											_t1256 = _t973 >> 5;
											_v1868 = _t974;
											_v1876 = _t1256;
											_v1888 = _t1191 - _t974;
											_t977 = E00E5F310(1, _t1191 - _t974, 0);
											_t1115 =  *((intOrPtr*)(_t1263 + _t1035 * 4 - 0x1d4));
											_t978 = _t977 - 1;
											_t118 =  &_v1912;
											 *_t118 = _v1912 & 0x00000000;
											__eflags =  *_t118;
											asm("bsr ecx, ecx");
											_v1908 = _t978;
											_v1884 =  !_t978;
											if( *_t118 == 0) {
												_t980 = 0;
												__eflags = 0;
											} else {
												_t980 = _t1115 + 1;
											}
											_t1176 = _t1035 + _t1256;
											_t1214 = _t1191 - _t980;
											_v1880 = _t1214;
											_v1892 = _t1176;
											__eflags = _t1176 - 0x73;
											if(_t1176 != 0x73) {
												L65:
												_t1116 = 0;
												__eflags = 0;
											} else {
												__eflags = _v1868 - _t1214;
												if(_v1868 <= _t1214) {
													goto L65;
												} else {
													_t1116 = 1;
												}
											}
											__eflags = _t1176 - 0x73;
											if(_t1176 > 0x73) {
												L87:
												__eflags = 0;
												_t1039 = 0x1cc;
												_v1400 = 0;
												_v472 = 0;
												E00E49055( &_v468, 0x1cc,  &_v1396, 0);
												_t1265 =  &(_t1265[4]);
											} else {
												__eflags = _t1116;
												if(_t1116 != 0) {
													goto L87;
												} else {
													__eflags = _t1176 - 0x72;
													if(_t1176 >= 0x72) {
														_t1176 = 0x72;
														_v1892 = _t1176;
													}
													_t1117 = _t1176;
													_v1896 = _t1117;
													__eflags = _t1176 - 0xffffffff;
													if(_t1176 != 0xffffffff) {
														_t1217 = _v1876;
														_t1258 = _t1176 - _t1217;
														__eflags = _t1258;
														_t1178 =  &_v468 + _t1258 * 4;
														while(1) {
															__eflags = _t1117 - _t1217;
															if(_t1117 < _t1217) {
																break;
															}
															__eflags = _t1258 - _t1035;
															if(_t1258 >= _t1035) {
																_t993 = 0;
																__eflags = 0;
															} else {
																_t993 =  *_t1178;
															}
															_v1872 = _t993;
															__eflags = _t1258 - 1 - _t1035;
															if(_t1258 - 1 >= _t1035) {
																_t995 = 0;
																__eflags = 0;
															} else {
																_t995 =  *(_t1178 - 4);
															}
															_t1178 = _t1178 - 4;
															_t1122 = _v1896;
															 *(_t1263 + _t1122 * 4 - 0x1d0) = (_t995 & _v1884) >> _v1888 | (_v1872 & _v1908) << _v1868;
															_t1117 = _t1122 - 1;
															_t1258 = _t1258 - 1;
															_v1896 = _t1117;
															__eflags = _t1117 - 0xffffffff;
															if(_t1117 != 0xffffffff) {
																_t1035 = _v472;
																continue;
															}
															break;
														}
														_t1176 = _v1892;
														_t1214 = _v1880;
														_t1256 = _v1876;
													}
													__eflags = _t1256;
													if(_t1256 != 0) {
														__eflags = 0;
														memset( &_v468, 0, _t1256 << 2);
														_t1265 =  &(_t1265[3]);
														_t1214 = _v1880;
													}
													_t1039 = 0x1cc;
													__eflags = _v1868 - _t1214;
													if(_v1868 <= _t1214) {
														_v472 = _t1176;
													} else {
														_v472 = _t1176 + 1;
													}
												}
											}
											_v1392 = _v1392 & 0x00000000;
											_v1396 = 2;
											_v1400 = 1;
											_v936 = 1;
											_push(4);
										} else {
											_t1123 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((intOrPtr*)(_t1263 + _t1123 - 0x570)) -  *((intOrPtr*)(_t1263 + _t1123 - 0x1d0));
												if( *((intOrPtr*)(_t1263 + _t1123 - 0x570)) !=  *((intOrPtr*)(_t1263 + _t1123 - 0x1d0))) {
													goto L59;
												}
												_t1123 = _t1123 + 4;
												__eflags = _t1123 - 8;
												if(_t1123 != 8) {
													continue;
												} else {
													_t1000 = _t1142 - 0x431;
													_t1001 = _t1000 & 0x0000001f;
													_t1260 = _t1000 >> 5;
													_v1868 = _t1001;
													_v1872 = _t1260;
													_v1908 = _t1191 - _t1001;
													_t1004 = E00E5F310(1, _t1191 - _t1001, 0);
													_t1126 =  *((intOrPtr*)(_t1263 + _t1035 * 4 - 0x1d4));
													_t1005 = _t1004 - 1;
													_t61 =  &_v1912;
													 *_t61 = _v1912 & 0x00000000;
													__eflags =  *_t61;
													asm("bsr ecx, ecx");
													_v1884 = _t1005;
													_v1888 =  !_t1005;
													if( *_t61 == 0) {
														_t1007 = 0;
														__eflags = 0;
													} else {
														_t1007 = _t1126 + 1;
													}
													_t1180 = _t1035 + _t1260;
													_t1218 = _t1191 - _t1007;
													_v1880 = _t1218;
													_v1896 = _t1180;
													__eflags = _t1180 - 0x73;
													if(_t1180 != 0x73) {
														L34:
														_t1127 = 0;
														__eflags = 0;
													} else {
														__eflags = _v1868 - _t1218;
														if(_v1868 <= _t1218) {
															goto L34;
														} else {
															_t1127 = 1;
														}
													}
													__eflags = _t1180 - 0x73;
													if(_t1180 > 0x73) {
														L56:
														__eflags = 0;
														_t1039 = 0x1cc;
														_v1400 = 0;
														_v472 = 0;
														E00E49055( &_v468, 0x1cc,  &_v1396, 0);
														_t1265 =  &(_t1265[4]);
													} else {
														__eflags = _t1127;
														if(_t1127 != 0) {
															goto L56;
														} else {
															__eflags = _t1180 - 0x72;
															if(_t1180 >= 0x72) {
																_t1180 = 0x72;
																_v1896 = _t1180;
															}
															_t1130 = _t1180;
															_v1892 = _t1130;
															__eflags = _t1180 - 0xffffffff;
															if(_t1180 != 0xffffffff) {
																_t1221 = _v1872;
																_t1262 = _t1180 - _t1221;
																__eflags = _t1262;
																_t1182 =  &_v468 + _t1262 * 4;
																while(1) {
																	__eflags = _t1130 - _t1221;
																	if(_t1130 < _t1221) {
																		break;
																	}
																	__eflags = _t1262 - _t1035;
																	if(_t1262 >= _t1035) {
																		_t1016 = 0;
																		__eflags = 0;
																	} else {
																		_t1016 =  *_t1182;
																	}
																	_v1876 = _t1016;
																	__eflags = _t1262 - 1 - _t1035;
																	if(_t1262 - 1 >= _t1035) {
																		_t1018 = 0;
																		__eflags = 0;
																	} else {
																		_t1018 =  *(_t1182 - 4);
																	}
																	_t1182 = _t1182 - 4;
																	_t1135 = _v1892;
																	 *(_t1263 + _t1135 * 4 - 0x1d0) = (_t1018 & _v1888) >> _v1908 | (_v1876 & _v1884) << _v1868;
																	_t1130 = _t1135 - 1;
																	_t1262 = _t1262 - 1;
																	_v1892 = _t1130;
																	__eflags = _t1130 - 0xffffffff;
																	if(_t1130 != 0xffffffff) {
																		_t1035 = _v472;
																		continue;
																	}
																	break;
																}
																_t1180 = _v1896;
																_t1218 = _v1880;
																_t1260 = _v1872;
															}
															__eflags = _t1260;
															if(_t1260 != 0) {
																__eflags = 0;
																memset( &_v468, 0, _t1260 << 2);
																_t1265 =  &(_t1265[3]);
																_t1218 = _v1880;
															}
															_t1039 = 0x1cc;
															__eflags = _v1868 - _t1218;
															if(_v1868 <= _t1218) {
																_v472 = _t1180;
															} else {
																_v472 = _t1180 + 1;
															}
														}
													}
													_v1392 = _v1392 & 0x00000000;
													_t1012 = 4;
													__eflags = 1;
													_v1396 = _t1012;
													_v1400 = 1;
													_v936 = 1;
													_push(_t1012);
												}
												goto L58;
											}
											goto L59;
										}
										L58:
										_push( &_v1396);
										_push(_t1039);
										_push( &_v932);
										E00E49055();
										_t1268 =  &(_t1265[4]);
									}
									_t804 = _v1900;
									_t1083 = 0xa;
									_v1888 = _t1083;
									__eflags = _t804;
									if(_t804 < 0) {
										_t805 =  ~_t804;
										_t806 = _t805 / _t1083;
										_v1892 = _t806;
										_t1084 = _t805 % _t1083;
										_v1912 = _t1084;
										__eflags = _t806;
										if(_t806 == 0) {
											L249:
											__eflags = _t1084;
											if(_t1084 != 0) {
												_t845 =  *(0xe6963c + _t1084 * 4);
												_v1912 = _t845;
												__eflags = _t845;
												if(_t845 == 0) {
													L260:
													__eflags = 0;
													_push(0);
													_v472 = 0;
													_v2408 = 0;
													goto L261;
												} else {
													__eflags = _t845 - 1;
													if(_t845 != 1) {
														_t1095 = _v472;
														__eflags = _t1095;
														if(_t1095 != 0) {
															_t1200 = 0;
															_t1238 = 0;
															__eflags = 0;
															do {
																_t1155 = _t845 *  *(_t1263 + _t1238 * 4 - 0x1d0) >> 0x20;
																 *(_t1263 + _t1238 * 4 - 0x1d0) = _t845 *  *(_t1263 + _t1238 * 4 - 0x1d0) + _t1200;
																_t845 = _v1912;
																asm("adc edx, 0x0");
																_t1238 = _t1238 + 1;
																_t1200 = _t1155;
																__eflags = _t1238 - _t1095;
															} while (_t1238 != _t1095);
															__eflags = _t1200;
															if(_t1200 != 0) {
																_t852 = _v472;
																__eflags = _t852 - 0x73;
																if(_t852 >= 0x73) {
																	goto L260;
																} else {
																	 *(_t1263 + _t852 * 4 - 0x1d0) = _t1200;
																	_v472 = _v472 + 1;
																}
															}
														}
													}
												}
											}
										} else {
											do {
												__eflags = _t806 - 0x26;
												if(_t806 > 0x26) {
													_t806 = 0x26;
												}
												_t1096 =  *(0xe695a6 + _t806 * 4) & 0x000000ff;
												_v1868 = _t806;
												_v1400 = ( *(0xe695a6 + _t806 * 4) & 0x000000ff) + ( *(0xe695a7 + _t806 * 4) & 0x000000ff);
												E00E43C10(_t1096 << 2,  &_v1396, 0, _t1096 << 2);
												_t863 = E00E43110( &(( &_v1396)[_t1096]), 0xe68ca0 + ( *(0xe695a4 + _v1868 * 4) & 0x0000ffff) * 4, ( *(0xe695a7 + _t806 * 4) & 0x000000ff) << 2);
												_t1203 = _v1400;
												_t1268 =  &(_t1268[6]);
												__eflags = _t1203 - 1;
												if(_t1203 > 1) {
													__eflags = _v472 - 1;
													if(_v472 > 1) {
														__eflags = _t1203 - _v472;
														_t1156 =  &_v1396;
														_t502 = _t1203 - _v472 > 0;
														__eflags = _t502;
														_t864 = _t863 & 0xffffff00 | _t502;
														if(_t502 >= 0) {
															_t1156 =  &_v468;
														}
														_v1876 = _t1156;
														_t1097 =  &_v468;
														__eflags = _t864;
														if(_t864 == 0) {
															_t1097 =  &_v1396;
														}
														_v1908 = _t1097;
														__eflags = _t864;
														if(_t864 == 0) {
															_t1098 = _v472;
															_v1896 = _t1098;
														} else {
															_t1098 = _t1203;
															_v1896 = _t1203;
														}
														__eflags = _t864;
														if(_t864 != 0) {
															_t1203 = _v472;
														}
														_t865 = 0;
														_t1240 = 0;
														_v1864 = 0;
														__eflags = _t1098;
														if(_t1098 == 0) {
															L243:
															_v472 = _t865;
															_t866 = _t865 << 2;
															__eflags = _t866;
															_push(_t866);
															_t867 =  &_v1860;
															goto L244;
														} else {
															do {
																__eflags =  *(_t1156 + _t1240 * 4);
																if( *(_t1156 + _t1240 * 4) != 0) {
																	_t1159 = 0;
																	_t1099 = _t1240;
																	_v1880 = _v1880 & 0;
																	_v1872 = 0;
																	__eflags = _t1203;
																	if(_t1203 == 0) {
																		L240:
																		__eflags = _t1099 - 0x73;
																		if(_t1099 == 0x73) {
																			goto L258;
																		} else {
																			_t1098 = _v1896;
																			_t1156 = _v1876;
																			goto L242;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1099 - 0x73;
																			if(_t1099 == 0x73) {
																				goto L235;
																			}
																			__eflags = _t1099 - _t865;
																			if(_t1099 == _t865) {
																				 *(_t1263 + _t1099 * 4 - 0x740) =  *(_t1263 + _t1099 * 4 - 0x740) & 0x00000000;
																				_t885 = _v1880 + 1 + _t1240;
																				__eflags = _t885;
																				_v1864 = _t885;
																			}
																			_t878 =  *(_v1908 + _v1880 * 4);
																			_t1161 = _v1876;
																			_t1159 = _t878 *  *(_t1161 + _t1240 * 4) >> 0x20;
																			asm("adc edx, 0x0");
																			 *(_t1263 + _t1099 * 4 - 0x740) =  *(_t1263 + _t1099 * 4 - 0x740) + _t878 *  *(_t1161 + _t1240 * 4) + _v1872;
																			asm("adc edx, 0x0");
																			_t882 = _v1880 + 1;
																			_t1099 = _t1099 + 1;
																			_v1880 = _t882;
																			__eflags = _t882 - _t1203;
																			_v1872 = _t1159;
																			_t865 = _v1864;
																			_v1928 = _t1159;
																			if(_t882 != _t1203) {
																				continue;
																			} else {
																				goto L235;
																			}
																			while(1) {
																				L235:
																				__eflags = _t1159;
																				if(_t1159 == 0) {
																					goto L240;
																				}
																				__eflags = _t1099 - 0x73;
																				if(_t1099 == 0x73) {
																					goto L258;
																				} else {
																					__eflags = _t1099 - _t865;
																					if(_t1099 == _t865) {
																						_t559 = _t1263 + _t1099 * 4 - 0x740;
																						 *_t559 =  *(_t1263 + _t1099 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t559;
																						_t565 = _t1099 + 1; // 0x1
																						_v1864 = _t565;
																					}
																					_t876 = _t1159;
																					_t1159 = 0;
																					 *(_t1263 + _t1099 * 4 - 0x740) =  *(_t1263 + _t1099 * 4 - 0x740) + _t876;
																					_t865 = _v1864;
																					asm("adc edx, edx");
																					_t1099 = _t1099 + 1;
																					continue;
																				}
																				goto L246;
																			}
																			goto L240;
																		}
																		goto L235;
																	}
																} else {
																	__eflags = _t1240 - _t865;
																	if(_t1240 == _t865) {
																		 *(_t1263 + _t1240 * 4 - 0x740) =  *(_t1263 + _t1240 * 4 - 0x740) & 0x00000000;
																		_t521 = _t1240 + 1; // 0x1
																		_t865 = _t521;
																		_v1864 = _t865;
																	}
																	goto L242;
																}
																goto L246;
																L242:
																_t1240 = _t1240 + 1;
																__eflags = _t1240 - _t1098;
															} while (_t1240 != _t1098);
															goto L243;
														}
													} else {
														_t1241 = _v468;
														_v1928 = _t1241;
														_v472 = _t1203;
														E00E49055( &_v468, _t1039,  &_v1396, _t1203 << 2);
														_t1268 =  &(_t1268[4]);
														__eflags = _t1241;
														if(_t1241 == 0) {
															goto L202;
														} else {
															__eflags = _t1241 - 1;
															if(_t1241 == 1) {
																goto L245;
															} else {
																__eflags = _v472;
																if(_v472 == 0) {
																	goto L245;
																} else {
																	_t1100 = 0;
																	_t1204 = _v1928;
																	_t1242 = 0;
																	__eflags = 0;
																	_t1047 = _v472;
																	do {
																		_t894 = _t1204;
																		_t1157 = _t894 *  *(_t1263 + _t1242 * 4 - 0x1d0) >> 0x20;
																		 *(_t1263 + _t1242 * 4 - 0x1d0) = _t894 *  *(_t1263 + _t1242 * 4 - 0x1d0) + _t1100;
																		asm("adc edx, 0x0");
																		_t1242 = _t1242 + 1;
																		_t1100 = _t1157;
																		__eflags = _t1242 - _t1047;
																	} while (_t1242 != _t1047);
																	goto L207;
																}
															}
														}
													}
												} else {
													_t1205 = _v1396;
													__eflags = _t1205;
													if(_t1205 != 0) {
														__eflags = _t1205 - 1;
														if(_t1205 == 1) {
															goto L245;
														} else {
															__eflags = _v472;
															if(_v472 == 0) {
																goto L245;
															} else {
																_t1101 = 0;
																_t1243 = 0;
																__eflags = 0;
																_t1046 = _v472;
																do {
																	_t899 = _t1205;
																	_t1158 = _t899 *  *(_t1263 + _t1243 * 4 - 0x1d0) >> 0x20;
																	 *(_t1263 + _t1243 * 4 - 0x1d0) = _t899 *  *(_t1263 + _t1243 * 4 - 0x1d0) + _t1101;
																	asm("adc edx, 0x0");
																	_t1243 = _t1243 + 1;
																	_t1101 = _t1158;
																	__eflags = _t1243 - _t1046;
																} while (_t1243 != _t1046);
																L207:
																_t1039 = 0x1cc;
																__eflags = _t1100;
																if(_t1100 == 0) {
																	goto L245;
																} else {
																	_t897 = _v472;
																	__eflags = _t897 - 0x73;
																	if(_t897 >= 0x73) {
																		L258:
																		_v2408 = 0;
																		_v472 = 0;
																		E00E49055( &_v468, _t1039,  &_v2404, 0);
																		_t1268 =  &(_t1268[4]);
																		_t870 = 0;
																	} else {
																		 *(_t1263 + _t897 * 4 - 0x1d0) = _t1100;
																		_v472 = _v472 + 1;
																		goto L245;
																	}
																}
															}
														}
													} else {
														L202:
														_v2408 = 0;
														_v472 = 0;
														_push(0);
														_t867 =  &_v2404;
														L244:
														_push(_t867);
														_push(_t1039);
														_push( &_v468);
														E00E49055();
														_t1268 =  &(_t1268[4]);
														L245:
														_t870 = 1;
													}
												}
												L246:
												__eflags = _t870;
												if(_t870 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_v472 = _v472 & 0x00000000;
													_push(0);
													L261:
													_push( &_v2404);
													_t848 =  &_v468;
													goto L262;
												} else {
													goto L247;
												}
												goto L263;
												L247:
												_t806 = _v1892 - _v1868;
												__eflags = _t806;
												_v1892 = _t806;
											} while (_t806 != 0);
											_t1084 = _v1912;
											goto L249;
										}
									} else {
										_t902 = _t804 / _t1083;
										_v1908 = _t902;
										_t1102 = _t804 % _t1083;
										_v1928 = _t1102;
										__eflags = _t902;
										if(_t902 == 0) {
											L183:
											__eflags = _t1102;
											if(_t1102 != 0) {
												_t903 =  *(0xe6963c + _t1102 * 4);
												_v1928 = _t903;
												__eflags = _t903;
												if(_t903 != 0) {
													__eflags = _t903 - 1;
													if(_t903 != 1) {
														_t1103 = _v936;
														__eflags = _t1103;
														if(_t1103 != 0) {
															_t1206 = 0;
															_t1244 = 0;
															__eflags = 0;
															do {
																_t1163 = _t903 *  *(_t1263 + _t1244 * 4 - 0x3a0) >> 0x20;
																 *(_t1263 + _t1244 * 4 - 0x3a0) = _t903 *  *(_t1263 + _t1244 * 4 - 0x3a0) + _t1206;
																_t903 = _v1928;
																asm("adc edx, 0x0");
																_t1244 = _t1244 + 1;
																_t1206 = _t1163;
																__eflags = _t1244 - _t1103;
															} while (_t1244 != _t1103);
															__eflags = _t1206;
															if(_t1206 != 0) {
																_t906 = _v936;
																__eflags = _t906 - 0x73;
																if(_t906 >= 0x73) {
																	goto L185;
																} else {
																	 *(_t1263 + _t906 * 4 - 0x3a0) = _t1206;
																	_v936 = _v936 + 1;
																}
															}
														}
													}
												} else {
													L185:
													_v2408 = 0;
													_v936 = 0;
													_push(0);
													goto L189;
												}
											}
										} else {
											do {
												__eflags = _t902 - 0x26;
												if(_t902 > 0x26) {
													_t902 = 0x26;
												}
												_t1104 =  *(0xe695a6 + _t902 * 4) & 0x000000ff;
												_v1876 = _t902;
												_v1400 = ( *(0xe695a6 + _t902 * 4) & 0x000000ff) + ( *(0xe695a7 + _t902 * 4) & 0x000000ff);
												E00E43C10(_t1104 << 2,  &_v1396, 0, _t1104 << 2);
												_t919 = E00E43110( &(( &_v1396)[_t1104]), 0xe68ca0 + ( *(0xe695a4 + _v1876 * 4) & 0x0000ffff) * 4, ( *(0xe695a7 + _t902 * 4) & 0x000000ff) << 2);
												_t1209 = _v1400;
												_t1268 =  &(_t1268[6]);
												__eflags = _t1209 - 1;
												if(_t1209 > 1) {
													__eflags = _v936 - 1;
													if(_v936 > 1) {
														__eflags = _t1209 - _v936;
														_t1164 =  &_v1396;
														_t314 = _t1209 - _v936 > 0;
														__eflags = _t314;
														_t920 = _t919 & 0xffffff00 | _t314;
														if(_t314 >= 0) {
															_t1164 =  &_v932;
														}
														_v1868 = _t1164;
														_t1105 =  &_v932;
														__eflags = _t920;
														if(_t920 == 0) {
															_t1105 =  &_v1396;
														}
														_v1872 = _t1105;
														__eflags = _t920;
														if(_t920 == 0) {
															_t1106 = _v936;
															_v1892 = _t1106;
														} else {
															_t1106 = _t1209;
															_v1892 = _t1209;
														}
														__eflags = _t920;
														if(_t920 != 0) {
															_t1209 = _v936;
														}
														_t921 = 0;
														_t1246 = 0;
														_v1864 = 0;
														__eflags = _t1106;
														if(_t1106 == 0) {
															L176:
															_v936 = _t921;
															_t922 = _t921 << 2;
															__eflags = _t922;
															goto L177;
														} else {
															do {
																__eflags =  *(_t1164 + _t1246 * 4);
																if( *(_t1164 + _t1246 * 4) != 0) {
																	_t1167 = 0;
																	_t1107 = _t1246;
																	_v1880 = _v1880 & 0;
																	_v1896 = 0;
																	__eflags = _t1209;
																	if(_t1209 == 0) {
																		L173:
																		__eflags = _t1107 - 0x73;
																		if(_t1107 == 0x73) {
																			goto L186;
																		} else {
																			_t1106 = _v1892;
																			_t1164 = _v1868;
																			goto L175;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1107 - 0x73;
																			if(_t1107 == 0x73) {
																				goto L168;
																			}
																			__eflags = _t1107 - _t921;
																			if(_t1107 == _t921) {
																				 *(_t1263 + _t1107 * 4 - 0x740) =  *(_t1263 + _t1107 * 4 - 0x740) & 0x00000000;
																				_t941 = _v1880 + 1 + _t1246;
																				__eflags = _t941;
																				_v1864 = _t941;
																			}
																			_t934 =  *(_v1872 + _v1880 * 4);
																			_t1169 = _v1868;
																			_t1167 = _t934 *  *(_t1169 + _t1246 * 4) >> 0x20;
																			asm("adc edx, 0x0");
																			 *(_t1263 + _t1107 * 4 - 0x740) =  *(_t1263 + _t1107 * 4 - 0x740) + _t934 *  *(_t1169 + _t1246 * 4) + _v1896;
																			asm("adc edx, 0x0");
																			_t938 = _v1880 + 1;
																			_t1107 = _t1107 + 1;
																			_v1880 = _t938;
																			__eflags = _t938 - _t1209;
																			_v1896 = _t1167;
																			_t921 = _v1864;
																			_v1912 = _t1167;
																			if(_t938 != _t1209) {
																				continue;
																			} else {
																				goto L168;
																			}
																			while(1) {
																				L168:
																				__eflags = _t1167;
																				if(_t1167 == 0) {
																					goto L173;
																				}
																				__eflags = _t1107 - 0x73;
																				if(_t1107 == 0x73) {
																					L186:
																					__eflags = 0;
																					_v2408 = 0;
																					_v936 = 0;
																					_push(0);
																					_t929 =  &_v2404;
																					goto L187;
																				} else {
																					__eflags = _t1107 - _t921;
																					if(_t1107 == _t921) {
																						_t371 = _t1263 + _t1107 * 4 - 0x740;
																						 *_t371 =  *(_t1263 + _t1107 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t371;
																						_t377 = _t1107 + 1; // 0x1
																						_v1864 = _t377;
																					}
																					_t932 = _t1167;
																					_t1167 = 0;
																					 *(_t1263 + _t1107 * 4 - 0x740) =  *(_t1263 + _t1107 * 4 - 0x740) + _t932;
																					_t921 = _v1864;
																					asm("adc edx, edx");
																					_t1107 = _t1107 + 1;
																					continue;
																				}
																				goto L180;
																			}
																			goto L173;
																		}
																		goto L168;
																	}
																} else {
																	__eflags = _t1246 - _t921;
																	if(_t1246 == _t921) {
																		 *(_t1263 + _t1246 * 4 - 0x740) =  *(_t1263 + _t1246 * 4 - 0x740) & 0x00000000;
																		_t333 = _t1246 + 1; // 0x1
																		_t921 = _t333;
																		_v1864 = _t921;
																	}
																	goto L175;
																}
																goto L180;
																L175:
																_t1246 = _t1246 + 1;
																__eflags = _t1246 - _t1106;
															} while (_t1246 != _t1106);
															goto L176;
														}
													} else {
														_t1247 = _v932;
														_v1884 = _t1247;
														_v936 = _t1209;
														E00E49055( &_v932, _t1039,  &_v1396, _t1209 << 2);
														_t1268 =  &(_t1268[4]);
														__eflags = _t1247;
														if(_t1247 != 0) {
															__eflags = _t1247 - 1;
															if(_t1247 == 1) {
																goto L179;
															} else {
																__eflags = _v936;
																if(_v936 == 0) {
																	goto L179;
																} else {
																	_t1108 = 0;
																	_t1210 = _v1884;
																	_t1248 = 0;
																	__eflags = 0;
																	_t1049 = _v936;
																	do {
																		_t949 = _t1210;
																		_t1165 = _t949 *  *(_t1263 + _t1248 * 4 - 0x3a0) >> 0x20;
																		 *(_t1263 + _t1248 * 4 - 0x3a0) = _t949 *  *(_t1263 + _t1248 * 4 - 0x3a0) + _t1108;
																		asm("adc edx, 0x0");
																		_t1248 = _t1248 + 1;
																		_t1108 = _t1165;
																		__eflags = _t1248 - _t1049;
																	} while (_t1248 != _t1049);
																	goto L147;
																}
															}
														} else {
															_v1400 = 0;
															_v936 = 0;
															_push(0);
															_t923 =  &_v1396;
															goto L178;
														}
													}
												} else {
													_t1211 = _v1396;
													__eflags = _t1211;
													if(_t1211 != 0) {
														__eflags = _t1211 - 1;
														if(_t1211 == 1) {
															goto L179;
														} else {
															__eflags = _v936;
															if(_v936 == 0) {
																goto L179;
															} else {
																_t1109 = 0;
																_t1249 = 0;
																__eflags = 0;
																_t1048 = _v936;
																do {
																	_t956 = _t1211;
																	_t1166 = _t956 *  *(_t1263 + _t1249 * 4 - 0x3a0) >> 0x20;
																	 *(_t1263 + _t1249 * 4 - 0x3a0) = _t956 *  *(_t1263 + _t1249 * 4 - 0x3a0) + _t1109;
																	asm("adc edx, 0x0");
																	_t1249 = _t1249 + 1;
																	_t1109 = _t1166;
																	__eflags = _t1249 - _t1048;
																} while (_t1249 != _t1048);
																L147:
																_t1039 = 0x1cc;
																__eflags = _t1108;
																if(_t1108 == 0) {
																	goto L179;
																} else {
																	_t952 = _v936;
																	__eflags = _t952 - 0x73;
																	if(_t952 < 0x73) {
																		 *(_t1263 + _t952 * 4 - 0x3a0) = _t1108;
																		_v936 = _v936 + 1;
																		goto L179;
																	} else {
																		_v1400 = 0;
																		_v936 = 0;
																		_push(0);
																		_t929 =  &_v1396;
																		L187:
																		_push(_t929);
																		_push(_t1039);
																		_push( &_v932);
																		E00E49055();
																		_t1268 =  &(_t1268[4]);
																		_t926 = 0;
																	}
																}
															}
														}
													} else {
														_t922 = 0;
														_v1864 = 0;
														_v936 = 0;
														L177:
														_push(_t922);
														_t923 =  &_v1860;
														L178:
														_push(_t923);
														_push(_t1039);
														_push( &_v932);
														E00E49055();
														_t1268 =  &(_t1268[4]);
														L179:
														_t926 = 1;
													}
												}
												L180:
												__eflags = _t926;
												if(_t926 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_t406 =  &_v936;
													 *_t406 = _v936 & 0x00000000;
													__eflags =  *_t406;
													_push(0);
													L189:
													_push( &_v2404);
													_t848 =  &_v932;
													L262:
													_push(_t1039);
													_push(_t848);
													E00E49055();
													_t1268 =  &(_t1268[4]);
												} else {
													goto L181;
												}
												goto L263;
												L181:
												_t902 = _v1908 - _v1876;
												__eflags = _t902;
												_v1908 = _t902;
											} while (_t902 != 0);
											_t1102 = _v1928;
											goto L183;
										}
									}
									L263:
									_t1195 = _v1904;
									_t1235 = _t1195;
									_t1085 = _v472;
									_v1876 = _t1235;
									__eflags = _t1085;
									if(_t1085 != 0) {
										_t1237 = 0;
										_t1199 = 0;
										__eflags = 0;
										_t1044 = 0xa;
										do {
											_t837 =  *(_t1263 + _t1199 * 4 - 0x1d0);
											_t1154 = _t837 * _t1044 >> 0x20;
											 *(_t1263 + _t1199 * 4 - 0x1d0) = _t837 * _t1044 + _t1237;
											asm("adc edx, 0x0");
											_t1199 = _t1199 + 1;
											_t1237 = _t1154;
											__eflags = _t1199 - _t1085;
										} while (_t1199 != _t1085);
										_v1912 = _t1237;
										__eflags = _t1237;
										_t1235 = _v1876;
										if(_t1237 != 0) {
											_t1094 = _v472;
											__eflags = _t1094 - 0x73;
											if(_t1094 >= 0x73) {
												__eflags = 0;
												_v2408 = 0;
												_v472 = 0;
												E00E49055( &_v468, 0x1cc,  &_v2404, 0);
												_t1268 =  &(_t1268[4]);
											} else {
												 *(_t1263 + _t1094 * 4 - 0x1d0) = _t1154;
												_v472 = _v472 + 1;
											}
										}
										_t1195 = _t1235;
									}
									_t809 = E00E4ADA0( &_v472,  &_v936);
									__eflags = _t809 - 0xa;
									if(_t809 != 0xa) {
										__eflags = _t809;
										if(_t809 != 0) {
											_t810 = _t809 + 0x30;
											__eflags = _t810;
											_t1235 = _t1195 + 1;
											 *_t1195 = _t810;
											goto L282;
										} else {
											_t811 = _v1900 - 1;
										}
									} else {
										_v1900 = _v1900 + 1;
										_t1235 = _t1195 + 1;
										_t828 = _v936;
										 *_t1195 = 0x31;
										_v1876 = _t1235;
										__eflags = _t828;
										if(_t828 != 0) {
											_t1198 = 0;
											_t1236 = _t828;
											_t1093 = 0;
											__eflags = 0;
											_t1042 = 0xa;
											do {
												_t829 =  *(_t1263 + _t1093 * 4 - 0x3a0);
												 *(_t1263 + _t1093 * 4 - 0x3a0) = _t829 * _t1042 + _t1198;
												asm("adc edx, 0x0");
												_t1093 = _t1093 + 1;
												_t1198 = _t829 * _t1042 >> 0x20;
												__eflags = _t1093 - _t1236;
											} while (_t1093 != _t1236);
											_t1235 = _v1876;
											__eflags = _t1198;
											if(_t1198 != 0) {
												_t832 = _v936;
												__eflags = _t832 - 0x73;
												if(_t832 >= 0x73) {
													_v2408 = 0;
													_v936 = 0;
													E00E49055( &_v932, 0x1cc,  &_v2404, 0);
													_t1268 =  &(_t1268[4]);
												} else {
													 *(_t1263 + _t832 * 4 - 0x3a0) = _t1198;
													_v936 = _v936 + 1;
												}
											}
										}
										L282:
										_t811 = _v1900;
									}
									 *(_v1924 + 4) = _t811;
									_t1066 = _v1920;
									__eflags = _t811;
									if(_t811 >= 0) {
										__eflags = _t1066 - 0x7fffffff;
										if(_t1066 <= 0x7fffffff) {
											_t1066 = _t1066 + _t811;
											__eflags = _t1066;
										}
									}
									_t813 = _a24 - 1;
									__eflags = _t813 - _t1066;
									if(_t813 >= _t1066) {
										_t813 = _t1066;
									}
									_t814 = _t813 + _v1904;
									_v1920 = _t814;
									__eflags = _t1235 - _t814;
									if(__eflags != 0) {
										while(1) {
											_t815 = _v472;
											__eflags = _t815;
											if(__eflags == 0) {
												goto L303;
											}
											_t1196 = 0;
											_t1040 = _t815;
											_t1089 = 0;
											__eflags = 0;
											do {
												_t816 =  *(_t1263 + _t1089 * 4 - 0x1d0);
												 *(_t1263 + _t1089 * 4 - 0x1d0) = _t816 * 0x3b9aca00 + _t1196;
												asm("adc edx, 0x0");
												_t1089 = _t1089 + 1;
												_t1196 = _t816 * 0x3b9aca00 >> 0x20;
												__eflags = _t1089 - _t1040;
											} while (_t1089 != _t1040);
											__eflags = _t1196;
											if(_t1196 != 0) {
												_t822 = _v472;
												__eflags = _t822 - 0x73;
												if(_t822 >= 0x73) {
													__eflags = 0;
													_v2408 = 0;
													_v472 = 0;
													E00E49055( &_v468, 0x1cc,  &_v2404, 0);
													_t1268 =  &(_t1268[4]);
												} else {
													 *(_t1263 + _t822 * 4 - 0x1d0) = _t1196;
													_v472 = _v472 + 1;
												}
											}
											_t821 = E00E4ADA0( &_v472,  &_v936);
											_t1197 = 8;
											_t1066 = _v1920 - _t1235;
											__eflags = _t1066;
											do {
												_t707 = _t821 % _v1888;
												_t821 = _t821 / _v1888;
												_t1152 = _t707 + 0x30;
												__eflags = _t1066 - _t1197;
												if(_t1066 >= _t1197) {
													 *((char*)(_t1197 + _t1235)) = _t1152;
												}
												_t1197 = _t1197 - 1;
												__eflags = _t1197 - 0xffffffff;
											} while (_t1197 != 0xffffffff);
											__eflags = _t1066 - 9;
											if(_t1066 > 9) {
												_t1066 = 9;
											}
											_t1235 = _t1235 + _t1066;
											__eflags = _t1235 - _v1920;
											if(__eflags != 0) {
												continue;
											}
											goto L303;
										}
									}
									L303:
									 *_t1235 = 0;
									goto L304;
								}
							}
						}
					}
				} else {
					_t1066 = _t1223 & 0x000fffff;
					if((_t1026 | _t1223 & 0x000fffff) != 0) {
						goto L11;
					} else {
						_push(0xe6b874);
						_push(_a24);
						 *(_v1924 + 4) =  *(_v1924 + 4) & 0x00000000;
						_push(_t1138);
						L311:
						if(E00E4E107() != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00E49599();
							asm("int3");
							_push(_t1263);
							_push(_t1026);
							_push(_t1223);
							_t1027 = 0;
							__eflags = 0;
							_t760 = 0xe3;
							_push(_t1185);
							_v2452 = 0;
							_v2456 = 0xe3;
							do {
								_v12 = 0x55;
								asm("cdq");
								_t1068 = _t760 + _t1027 - _t1138 >> 1;
								_v24 = _t1068;
								_t1028 = 0x19;
								_t1224 =  *(0xe6c9b8 + _t1068 * 8);
								_t1070 = _v0 - _t1224;
								__eflags = _t1070;
								while(1) {
									_t1139 =  *(_t1224 + _t1070) & 0x0000ffff;
									__eflags = _t1139 - 0x41 - _t1028;
									if(_t1139 - 0x41 <= _t1028) {
										_t1139 = _t1139 + 0x00000020 & 0x0000ffff;
									}
									_t1186 =  *_t1224 & 0x0000ffff;
									__eflags = _t1186 - 0x41 - _t1028;
									if(_t1186 - 0x41 > _t1028) {
										_t765 = _t1186;
									} else {
										_t765 = _t1186 + 0x00000020 & 0x0000ffff;
									}
									_t1224 =  &(_t1224[1]);
									_t730 =  &_v12;
									 *_t730 = _v12 - 1;
									__eflags =  *_t730;
									if( *_t730 == 0) {
										break;
									}
									__eflags = _t1139;
									if(_t1139 != 0) {
										__eflags = _t1139 - _t765;
										if(_t1139 == _t765) {
											continue;
										}
									}
									break;
								}
								_t1071 = _v24;
								_t1138 = (_t1139 & 0x0000ffff) - (_t765 & 0x0000ffff);
								__eflags = _t1138;
								if(_t1138 == 0) {
									_t767 =  *(0xe6c9bc + _t1071 * 8);
								} else {
									goto L326;
								}
								L332:
								return _t767;
								goto L333;
								L326:
								__eflags = _t1138;
								if(_t1138 >= 0) {
									_t760 = _v20;
									_t737 = _t1071 + 1; // 0x1
									_t1027 = _t737;
									_v16 = _t1027;
								} else {
									_t734 = _t1071 - 1; // -1
									_t760 = _t734;
									_v20 = _t760;
								}
								__eflags = _t1027 - _t760;
							} while (_t1027 <= _t760);
							_t767 = _t760 | 0xffffffff;
							goto L332;
						} else {
							L304:
							_t1276 = _v1936;
							if(_v1936 != 0) {
								E00E5DC69(_t1066, _t1276,  &_v1944);
							}
							return E00E2C067(_v8 ^ _t1263);
						}
					}
				}
				L333:
			}

0x00e5a4b0
0x00e5a4b7
0x00e5a4bd
0x00e5a4c6
0x00e5a4d3
0x00e5a4e4
0x00e5a4f6
0x00e5a4fc
0x00e5a4e6
0x00e5a4e6
0x00e5a4e6
0x00e5a504
0x00e5a508
0x00e5a50e
0x00e5a50f
0x00e5a511
0x00e5a51e
0x00e5a519
0x00e5a51b
0x00e5a51b
0x00e5a520
0x00e5a526
0x00e5a52c
0x00e5a530
0x00e5a53d
0x00e5a565
0x00e5a569
0x00e5a56f
0x00e5a571
0x00e5a579
0x00e5a579
0x00e5a580
0x00e5a580
0x00e5a583
0x00e5b7ed
0x00000000
0x00e5a589
0x00e5a589
0x00e5a589
0x00e5a58c
0x00e5b7d0
0x00000000
0x00e5a592
0x00e5a592
0x00e5a592
0x00e5a595
0x00e5b7c9
0x00000000
0x00e5a59b
0x00e5a59b
0x00e5a59e
0x00e5b7c2
0x00e5b7d5
0x00e5b7d5
0x00e5b7d8
0x00e5b7de
0x00000000
0x00e5a5a4
0x00e5a5ad
0x00e5a5b5
0x00e5a5b8
0x00e5a5bb
0x00e5a5be
0x00e5a5c4
0x00e5a5cc
0x00e5a5d2
0x00e5a5dc
0x00e5a5dc
0x00e5a5df
0x00e5a5e8
0x00e5a5ef
0x00e5a5ef
0x00e5a5e1
0x00e5a5e5
0x00e5a5e5
0x00e5a5f7
0x00e5a5ff
0x00e5a605
0x00e5a607
0x00e5a610
0x00e5a616
0x00e5a61b
0x00e5a61c
0x00e5a61d
0x00e5a62c
0x00e5a62e
0x00e5a636
0x00e5a637
0x00e5a63d
0x00e5a647
0x00e5a647
0x00e5a649
0x00e5a63f
0x00e5a63f
0x00e5a645
0x00000000
0x00000000
0x00e5a645
0x00e5a64f
0x00e5a65d
0x00e5a65f
0x00e5a668
0x00e5a66e
0x00e5a675
0x00e5a676
0x00e5a67c
0x00e5a682
0x00e5aa64
0x00e5aa67
0x00e5ab7f
0x00e5ab7f
0x00e5ab86
0x00e5ab86
0x00e5ab86
0x00e5ab8d
0x00e5ab90
0x00e5ab95
0x00e5ab95
0x00e5ab92
0x00e5ab92
0x00e5ab92
0x00e5ab97
0x00e5ab99
0x00e5ab99
0x00e5aba1
0x00e5aba7
0x00e5aba9
0x00e5abac
0x00e5abb2
0x00e5abb4
0x00e5abb4
0x00e5abb6
0x00e5abc7
0x00e5abc7
0x00e5abc7
0x00e5abb8
0x00e5abbf
0x00e5abbf
0x00e5abce
0x00e5abd1
0x00e5abd3
0x00e5abd9
0x00e5abd9
0x00e5abd5
0x00e5abd5
0x00e5abd5
0x00e5abe1
0x00e5abeb
0x00e5abf2
0x00e5abf3
0x00e5abf6
0x00000000
0x00000000
0x00e5abf8
0x00e5abf8
0x00e5ac00
0x00e5ac06
0x00e5ac09
0x00e5ac16
0x00e5ac0b
0x00e5ac0e
0x00e5ac0e
0x00e5ac2f
0x00e5ac3b
0x00e5ac48
0x00e5ac4a
0x00e5aa6d
0x00e5aa6d
0x00e5aa74
0x00e5aa7e
0x00e5aa88
0x00e5aa8a
0x00e5aa90
0x00e5aa90
0x00e5aa92
0x00e5aa92
0x00e5aa99
0x00e5aaa0
0x00000000
0x00000000
0x00e5aaa6
0x00e5aaa9
0x00e5aaac
0x00000000
0x00e5aaae
0x00e5aaae
0x00e5aaae
0x00e5aaae
0x00e5aab5
0x00e5aab8
0x00e5aabd
0x00e5aabd
0x00e5aaba
0x00e5aaba
0x00e5aaba
0x00e5aabf
0x00e5aac1
0x00e5aac1
0x00e5aac9
0x00e5aacf
0x00e5aad1
0x00e5aad4
0x00e5aada
0x00e5aadc
0x00e5aadc
0x00e5aade
0x00e5aaef
0x00e5aaef
0x00e5aaef
0x00e5aae0
0x00e5aae7
0x00e5aae7
0x00e5aaf6
0x00e5aaf9
0x00e5aafb
0x00e5ab01
0x00e5ab01
0x00e5aafd
0x00e5aafd
0x00e5aafd
0x00e5ab09
0x00e5ab14
0x00e5ab1b
0x00e5ab1c
0x00e5ab1f
0x00000000
0x00000000
0x00e5ab21
0x00e5ab21
0x00e5ab29
0x00e5ab2f
0x00e5ab32
0x00e5ab3f
0x00e5ab34
0x00e5ab37
0x00e5ab37
0x00e5ab58
0x00e5ab64
0x00e5ab73
0x00e5ab73
0x00000000
0x00e5aaac
0x00e5aa92
0x00000000
0x00e5aa8a
0x00e5ac51
0x00e5ac51
0x00e5ac54
0x00e5ac59
0x00e5ac5f
0x00e5ac65
0x00e5ac78
0x00e5ac7d
0x00e5a688
0x00e5a688
0x00e5a68f
0x00e5a699
0x00e5a6a3
0x00e5a6a5
0x00e5a8a1
0x00e5a8a1
0x00e5a8ad
0x00e5a8b0
0x00e5a8b5
0x00e5a8bd
0x00e5a8c4
0x00e5a8ca
0x00e5a8cf
0x00e5a8d6
0x00e5a8d7
0x00e5a8d7
0x00e5a8d7
0x00e5a8de
0x00e5a8e1
0x00e5a8e9
0x00e5a8ef
0x00e5a8f6
0x00e5a8f6
0x00e5a8f1
0x00e5a8f1
0x00e5a8f1
0x00e5a8f8
0x00e5a8fb
0x00e5a8fd
0x00e5a903
0x00e5a909
0x00e5a90c
0x00e5a91a
0x00e5a91a
0x00e5a91a
0x00e5a90e
0x00e5a90e
0x00e5a914
0x00000000
0x00e5a916
0x00e5a916
0x00e5a916
0x00e5a914
0x00e5a91c
0x00e5a91f
0x00e5aa12
0x00e5aa12
0x00e5aa14
0x00e5aa1a
0x00e5aa20
0x00e5aa35
0x00e5aa3a
0x00e5a925
0x00e5a925
0x00e5a927
0x00000000
0x00e5a92d
0x00e5a92d
0x00e5a930
0x00e5a934
0x00e5a935
0x00e5a935
0x00e5a93b
0x00e5a93d
0x00e5a943
0x00e5a946
0x00e5a94c
0x00e5a954
0x00e5a954
0x00e5a95c
0x00e5a95f
0x00e5a95f
0x00e5a961
0x00000000
0x00000000
0x00e5a963
0x00e5a965
0x00e5a96b
0x00e5a96b
0x00e5a967
0x00e5a967
0x00e5a967
0x00e5a96d
0x00e5a976
0x00e5a978
0x00e5a97f
0x00e5a97f
0x00e5a97a
0x00e5a97a
0x00e5a97a
0x00e5a987
0x00e5a9a6
0x00e5a9ae
0x00e5a9b5
0x00e5a9b6
0x00e5a9b7
0x00e5a9bd
0x00e5a9c0
0x00e5a9c2
0x00000000
0x00e5a9c2
0x00000000
0x00e5a9c0
0x00e5a9ca
0x00e5a9d0
0x00e5a9d6
0x00e5a9d6
0x00e5a9dc
0x00e5a9de
0x00e5a9e8
0x00e5a9ea
0x00e5a9ea
0x00e5a9ec
0x00e5a9ec
0x00e5a9f2
0x00e5a9f7
0x00e5a9fd
0x00e5aa0a
0x00e5a9ff
0x00e5aa02
0x00e5aa02
0x00e5a9fd
0x00e5a927
0x00e5aa3d
0x00e5aa47
0x00e5aa51
0x00e5aa57
0x00e5aa5d
0x00e5a6ab
0x00e5a6ab
0x00e5a6ab
0x00e5a6ad
0x00e5a6b4
0x00e5a6bb
0x00000000
0x00000000
0x00e5a6c1
0x00e5a6c4
0x00e5a6c7
0x00000000
0x00e5a6c9
0x00e5a6c9
0x00e5a6d5
0x00e5a6d8
0x00e5a6dd
0x00e5a6e5
0x00e5a6ec
0x00e5a6f2
0x00e5a6f7
0x00e5a6fe
0x00e5a6ff
0x00e5a6ff
0x00e5a6ff
0x00e5a706
0x00e5a709
0x00e5a711
0x00e5a717
0x00e5a71e
0x00e5a71e
0x00e5a719
0x00e5a719
0x00e5a719
0x00e5a720
0x00e5a723
0x00e5a725
0x00e5a72b
0x00e5a731
0x00e5a734
0x00e5a742
0x00e5a742
0x00e5a742
0x00e5a736
0x00e5a736
0x00e5a73c
0x00000000
0x00e5a73e
0x00e5a73e
0x00e5a73e
0x00e5a73c
0x00e5a744
0x00e5a747
0x00e5a83a
0x00e5a83a
0x00e5a83c
0x00e5a842
0x00e5a848
0x00e5a85d
0x00e5a862
0x00e5a74d
0x00e5a74d
0x00e5a74f
0x00000000
0x00e5a755
0x00e5a755
0x00e5a758
0x00e5a75c
0x00e5a75d
0x00e5a75d
0x00e5a763
0x00e5a765
0x00e5a76b
0x00e5a76e
0x00e5a774
0x00e5a77c
0x00e5a77c
0x00e5a784
0x00e5a787
0x00e5a787
0x00e5a789
0x00000000
0x00000000
0x00e5a78b
0x00e5a78d
0x00e5a793
0x00e5a793
0x00e5a78f
0x00e5a78f
0x00e5a78f
0x00e5a795
0x00e5a79e
0x00e5a7a0
0x00e5a7a7
0x00e5a7a7
0x00e5a7a2
0x00e5a7a2
0x00e5a7a2
0x00e5a7af
0x00e5a7ce
0x00e5a7d6
0x00e5a7dd
0x00e5a7de
0x00e5a7df
0x00e5a7e5
0x00e5a7e8
0x00e5a7ea
0x00000000
0x00e5a7ea
0x00000000
0x00e5a7e8
0x00e5a7f2
0x00e5a7f8
0x00e5a7fe
0x00e5a7fe
0x00e5a804
0x00e5a806
0x00e5a810
0x00e5a812
0x00e5a812
0x00e5a814
0x00e5a814
0x00e5a81a
0x00e5a81f
0x00e5a825
0x00e5a832
0x00e5a827
0x00e5a82a
0x00e5a82a
0x00e5a825
0x00e5a74f
0x00e5a865
0x00e5a870
0x00e5a871
0x00e5a872
0x00e5a878
0x00e5a87e
0x00e5a884
0x00e5a884
0x00000000
0x00e5a6c7
0x00000000
0x00e5a6ad
0x00e5a885
0x00e5a88b
0x00e5a892
0x00e5a893
0x00e5a894
0x00e5a899
0x00e5a899
0x00e5ac80
0x00e5ac8a
0x00e5ac8b
0x00e5ac91
0x00e5ac93
0x00e5b0f3
0x00e5b0f5
0x00e5b0f7
0x00e5b0fd
0x00e5b0ff
0x00e5b105
0x00e5b107
0x00e5b454
0x00e5b454
0x00e5b456
0x00e5b45c
0x00e5b463
0x00e5b469
0x00e5b46b
0x00e5b509
0x00e5b509
0x00e5b50b
0x00e5b50c
0x00e5b512
0x00000000
0x00e5b471
0x00e5b471
0x00e5b474
0x00e5b47a
0x00e5b480
0x00e5b482
0x00e5b488
0x00e5b48a
0x00e5b48a
0x00e5b48c
0x00e5b48c
0x00e5b495
0x00e5b49c
0x00e5b4a2
0x00e5b4a5
0x00e5b4a6
0x00e5b4a8
0x00e5b4a8
0x00e5b4ac
0x00e5b4ae
0x00e5b4b0
0x00e5b4b6
0x00e5b4b9
0x00000000
0x00e5b4bb
0x00e5b4bb
0x00e5b4c2
0x00e5b4c2
0x00e5b4b9
0x00e5b4ae
0x00e5b482
0x00e5b474
0x00e5b46b
0x00e5b10d
0x00e5b10d
0x00e5b10d
0x00e5b110
0x00e5b114
0x00e5b114
0x00e5b115
0x00e5b127
0x00e5b134
0x00e5b143
0x00e5b16d
0x00e5b172
0x00e5b178
0x00e5b17b
0x00e5b17e
0x00e5b214
0x00e5b21b
0x00e5b2a1
0x00e5b2a7
0x00e5b2ad
0x00e5b2ad
0x00e5b2ad
0x00e5b2b0
0x00e5b2b2
0x00e5b2b2
0x00e5b2b8
0x00e5b2be
0x00e5b2c4
0x00e5b2c6
0x00e5b2c8
0x00e5b2c8
0x00e5b2ce
0x00e5b2d4
0x00e5b2d6
0x00e5b2e2
0x00e5b2e8
0x00e5b2d8
0x00e5b2d8
0x00e5b2da
0x00e5b2da
0x00e5b2ee
0x00e5b2f0
0x00e5b2f2
0x00e5b2f2
0x00e5b2f8
0x00e5b2fa
0x00e5b2fc
0x00e5b302
0x00e5b304
0x00e5b40b
0x00e5b40b
0x00e5b411
0x00e5b411
0x00e5b414
0x00e5b415
0x00000000
0x00e5b30a
0x00e5b30a
0x00e5b30a
0x00e5b30e
0x00e5b32e
0x00e5b330
0x00e5b332
0x00e5b338
0x00e5b33e
0x00e5b340
0x00e5b3ed
0x00e5b3ed
0x00e5b3f0
0x00000000
0x00e5b3f6
0x00e5b3f6
0x00e5b3fc
0x00000000
0x00e5b3fc
0x00e5b346
0x00e5b346
0x00e5b346
0x00e5b349
0x00000000
0x00000000
0x00e5b34b
0x00e5b34d
0x00e5b355
0x00e5b35e
0x00e5b35e
0x00e5b360
0x00e5b360
0x00e5b372
0x00e5b375
0x00e5b37b
0x00e5b384
0x00e5b387
0x00e5b394
0x00e5b397
0x00e5b398
0x00e5b399
0x00e5b39f
0x00e5b3a1
0x00e5b3a7
0x00e5b3ad
0x00e5b3b3
0x00000000
0x00000000
0x00000000
0x00000000
0x00e5b3b5
0x00e5b3b5
0x00e5b3b5
0x00e5b3b7
0x00000000
0x00000000
0x00e5b3b9
0x00e5b3bc
0x00000000
0x00e5b3c2
0x00e5b3c2
0x00e5b3c4
0x00e5b3c6
0x00e5b3c6
0x00e5b3c6
0x00e5b3ce
0x00e5b3d1
0x00e5b3d1
0x00e5b3d7
0x00e5b3d9
0x00e5b3db
0x00e5b3e2
0x00e5b3e8
0x00e5b3ea
0x00000000
0x00e5b3ea
0x00000000
0x00e5b3bc
0x00000000
0x00e5b3b5
0x00000000
0x00e5b346
0x00e5b310
0x00e5b310
0x00e5b312
0x00e5b318
0x00e5b320
0x00e5b320
0x00e5b323
0x00e5b323
0x00000000
0x00e5b312
0x00000000
0x00e5b402
0x00e5b402
0x00e5b403
0x00e5b403
0x00000000
0x00e5b30a
0x00e5b221
0x00e5b221
0x00e5b233
0x00e5b240
0x00e5b248
0x00e5b24d
0x00e5b250
0x00e5b252
0x00000000
0x00e5b258
0x00e5b258
0x00e5b25b
0x00000000
0x00e5b261
0x00e5b261
0x00e5b268
0x00000000
0x00e5b26e
0x00e5b274
0x00e5b276
0x00e5b27c
0x00e5b27c
0x00e5b27e
0x00e5b280
0x00e5b280
0x00e5b282
0x00e5b28b
0x00e5b292
0x00e5b295
0x00e5b296
0x00e5b298
0x00e5b298
0x00000000
0x00e5b29c
0x00e5b268
0x00e5b25b
0x00e5b252
0x00e5b184
0x00e5b184
0x00e5b18a
0x00e5b18c
0x00e5b1a8
0x00e5b1ab
0x00000000
0x00e5b1b1
0x00e5b1b1
0x00e5b1b8
0x00000000
0x00e5b1be
0x00e5b1c4
0x00e5b1c6
0x00e5b1c6
0x00e5b1c8
0x00e5b1ca
0x00e5b1ca
0x00e5b1cc
0x00e5b1d5
0x00e5b1dc
0x00e5b1df
0x00e5b1e0
0x00e5b1e2
0x00e5b1e2
0x00e5b1e6
0x00e5b1e6
0x00e5b1eb
0x00e5b1ed
0x00000000
0x00e5b1f3
0x00e5b1f3
0x00e5b1f9
0x00e5b1fc
0x00e5b4ca
0x00e5b4cd
0x00e5b4d3
0x00e5b4e8
0x00e5b4ed
0x00e5b4f0
0x00e5b202
0x00e5b202
0x00e5b209
0x00000000
0x00e5b209
0x00e5b1fc
0x00e5b1ed
0x00e5b1b8
0x00e5b18e
0x00e5b18e
0x00e5b190
0x00e5b196
0x00e5b19c
0x00e5b19d
0x00e5b41b
0x00e5b41b
0x00e5b422
0x00e5b423
0x00e5b424
0x00e5b429
0x00e5b42c
0x00e5b42c
0x00e5b42c
0x00e5b18c
0x00e5b42e
0x00e5b42e
0x00e5b430
0x00e5b4f7
0x00e5b4fe
0x00e5b505
0x00e5b518
0x00e5b51e
0x00e5b51f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00e5b436
0x00e5b43c
0x00e5b43c
0x00e5b442
0x00e5b442
0x00e5b44e
0x00000000
0x00e5b44e
0x00e5ac99
0x00e5ac99
0x00e5ac9b
0x00e5aca1
0x00e5aca3
0x00e5aca9
0x00e5acab
0x00e5b019
0x00e5b019
0x00e5b01b
0x00e5b021
0x00e5b028
0x00e5b02e
0x00e5b030
0x00e5b08f
0x00e5b092
0x00e5b098
0x00e5b09e
0x00e5b0a0
0x00e5b0a6
0x00e5b0a8
0x00e5b0a8
0x00e5b0aa
0x00e5b0aa
0x00e5b0b3
0x00e5b0ba
0x00e5b0c0
0x00e5b0c3
0x00e5b0c4
0x00e5b0c6
0x00e5b0c6
0x00e5b0ca
0x00e5b0cc
0x00e5b0d2
0x00e5b0d8
0x00e5b0db
0x00000000
0x00e5b0e1
0x00e5b0e1
0x00e5b0e8
0x00e5b0e8
0x00e5b0db
0x00e5b0cc
0x00e5b0a0
0x00e5b032
0x00e5b032
0x00e5b034
0x00e5b03a
0x00e5b040
0x00000000
0x00e5b040
0x00e5b030
0x00e5acb1
0x00e5acb1
0x00e5acb1
0x00e5acb4
0x00e5acb8
0x00e5acb8
0x00e5acb9
0x00e5accb
0x00e5acd8
0x00e5ace7
0x00e5ad11
0x00e5ad16
0x00e5ad1c
0x00e5ad1f
0x00e5ad22
0x00e5ad96
0x00e5ad9d
0x00e5ae6a
0x00e5ae70
0x00e5ae76
0x00e5ae76
0x00e5ae76
0x00e5ae79
0x00e5ae7b
0x00e5ae7b
0x00e5ae81
0x00e5ae87
0x00e5ae8d
0x00e5ae8f
0x00e5ae91
0x00e5ae91
0x00e5ae97
0x00e5ae9d
0x00e5ae9f
0x00e5aeab
0x00e5aeb1
0x00e5aea1
0x00e5aea1
0x00e5aea3
0x00e5aea3
0x00e5aeb7
0x00e5aeb9
0x00e5aebb
0x00e5aebb
0x00e5aec1
0x00e5aec3
0x00e5aec5
0x00e5aecb
0x00e5aecd
0x00e5afd4
0x00e5afd4
0x00e5afda
0x00e5afda
0x00000000
0x00e5aed3
0x00e5aed3
0x00e5aed3
0x00e5aed7
0x00e5aef7
0x00e5aef9
0x00e5aefb
0x00e5af01
0x00e5af07
0x00e5af09
0x00e5afb6
0x00e5afb6
0x00e5afb9
0x00000000
0x00e5afbf
0x00e5afbf
0x00e5afc5
0x00000000
0x00e5afc5
0x00e5af0f
0x00e5af0f
0x00e5af0f
0x00e5af12
0x00000000
0x00000000
0x00e5af14
0x00e5af16
0x00e5af1e
0x00e5af27
0x00e5af27
0x00e5af29
0x00e5af29
0x00e5af3b
0x00e5af3e
0x00e5af44
0x00e5af4d
0x00e5af50
0x00e5af5d
0x00e5af60
0x00e5af61
0x00e5af62
0x00e5af68
0x00e5af6a
0x00e5af70
0x00e5af76
0x00e5af7c
0x00000000
0x00000000
0x00000000
0x00000000
0x00e5af7e
0x00e5af7e
0x00e5af7e
0x00e5af80
0x00000000
0x00000000
0x00e5af82
0x00e5af85
0x00e5b043
0x00e5b043
0x00e5b045
0x00e5b04b
0x00e5b051
0x00e5b052
0x00000000
0x00e5af8b
0x00e5af8b
0x00e5af8d
0x00e5af8f
0x00e5af8f
0x00e5af8f
0x00e5af97
0x00e5af9a
0x00e5af9a
0x00e5afa0
0x00e5afa2
0x00e5afa4
0x00e5afab
0x00e5afb1
0x00e5afb3
0x00000000
0x00e5afb3
0x00000000
0x00e5af85
0x00000000
0x00e5af7e
0x00000000
0x00e5af0f
0x00e5aed9
0x00e5aed9
0x00e5aedb
0x00e5aee1
0x00e5aee9
0x00e5aee9
0x00e5aeec
0x00e5aeec
0x00000000
0x00e5aedb
0x00000000
0x00e5afcb
0x00e5afcb
0x00e5afcc
0x00e5afcc
0x00000000
0x00e5aed3
0x00e5ada3
0x00e5ada3
0x00e5adb5
0x00e5adc2
0x00e5adca
0x00e5adcf
0x00e5add2
0x00e5add4
0x00e5adf0
0x00e5adf3
0x00000000
0x00e5adf9
0x00e5adf9
0x00e5ae00
0x00000000
0x00e5ae06
0x00e5ae0c
0x00e5ae0e
0x00e5ae14
0x00e5ae14
0x00e5ae16
0x00e5ae18
0x00e5ae18
0x00e5ae1a
0x00e5ae23
0x00e5ae2a
0x00e5ae2d
0x00e5ae2e
0x00e5ae30
0x00e5ae30
0x00000000
0x00e5ae18
0x00e5ae00
0x00e5add6
0x00e5add8
0x00e5adde
0x00e5ade4
0x00e5ade5
0x00000000
0x00e5ade5
0x00e5add4
0x00e5ad24
0x00e5ad24
0x00e5ad2a
0x00e5ad2c
0x00e5ad41
0x00e5ad44
0x00000000
0x00e5ad4a
0x00e5ad4a
0x00e5ad51
0x00000000
0x00e5ad57
0x00e5ad5d
0x00e5ad5f
0x00e5ad5f
0x00e5ad61
0x00e5ad63
0x00e5ad63
0x00e5ad65
0x00e5ad6e
0x00e5ad75
0x00e5ad78
0x00e5ad79
0x00e5ad7b
0x00e5ad7b
0x00e5ae34
0x00e5ae34
0x00e5ae39
0x00e5ae3b
0x00000000
0x00e5ae41
0x00e5ae41
0x00e5ae47
0x00e5ae4a
0x00e5ad84
0x00e5ad8b
0x00000000
0x00e5ae50
0x00e5ae52
0x00e5ae58
0x00e5ae5e
0x00e5ae5f
0x00e5b058
0x00e5b058
0x00e5b05f
0x00e5b060
0x00e5b061
0x00e5b066
0x00e5b069
0x00e5b069
0x00e5ae4a
0x00e5ae3b
0x00e5ad51
0x00e5ad2e
0x00e5ad2e
0x00e5ad30
0x00e5ad36
0x00e5afdd
0x00e5afdd
0x00e5afde
0x00e5afe4
0x00e5afe4
0x00e5afeb
0x00e5afec
0x00e5afed
0x00e5aff2
0x00e5aff5
0x00e5aff5
0x00e5aff5
0x00e5ad2c
0x00e5aff7
0x00e5aff7
0x00e5aff9
0x00e5b06d
0x00e5b074
0x00e5b074
0x00e5b074
0x00e5b07b
0x00e5b07d
0x00e5b083
0x00e5b084
0x00e5b525
0x00e5b525
0x00e5b526
0x00e5b527
0x00e5b52c
0x00000000
0x00000000
0x00000000
0x00000000
0x00e5affb
0x00e5b001
0x00e5b001
0x00e5b007
0x00e5b007
0x00e5b013
0x00000000
0x00e5b013
0x00e5acab
0x00e5b52f
0x00e5b52f
0x00e5b535
0x00e5b537
0x00e5b53d
0x00e5b543
0x00e5b545
0x00e5b549
0x00e5b54b
0x00e5b54b
0x00e5b54d
0x00e5b54e
0x00e5b54e
0x00e5b555
0x00e5b559
0x00e5b560
0x00e5b563
0x00e5b564
0x00e5b566
0x00e5b566
0x00e5b56a
0x00e5b570
0x00e5b572
0x00e5b57d
0x00e5b57f
0x00e5b585
0x00e5b588
0x00e5b59b
0x00e5b59e
0x00e5b5a4
0x00e5b5b9
0x00e5b5be
0x00e5b58a
0x00e5b58c
0x00e5b593
0x00e5b593
0x00e5b588
0x00e5b5c1
0x00e5b5c1
0x00e5b5d1
0x00e5b5d8
0x00e5b5db
0x00e5b677
0x00e5b679
0x00e5b684
0x00e5b684
0x00e5b686
0x00e5b689
0x00000000
0x00e5b67b
0x00e5b681
0x00e5b681
0x00e5b5e1
0x00e5b5e1
0x00e5b5e7
0x00e5b5ea
0x00e5b5f0
0x00e5b5f3
0x00e5b5f9
0x00e5b5fb
0x00e5b603
0x00e5b605
0x00e5b607
0x00e5b607
0x00e5b609
0x00e5b60a
0x00e5b60a
0x00e5b615
0x00e5b61c
0x00e5b61f
0x00e5b620
0x00e5b622
0x00e5b622
0x00e5b626
0x00e5b631
0x00e5b633
0x00e5b635
0x00e5b63b
0x00e5b63e
0x00e5b652
0x00e5b658
0x00e5b66d
0x00e5b672
0x00e5b640
0x00e5b640
0x00e5b647
0x00e5b647
0x00e5b63e
0x00e5b633
0x00e5b68b
0x00e5b68b
0x00e5b68b
0x00e5b697
0x00e5b69a
0x00e5b6a0
0x00e5b6a2
0x00e5b6a4
0x00e5b6aa
0x00e5b6ac
0x00e5b6ac
0x00e5b6ac
0x00e5b6aa
0x00e5b6b1
0x00e5b6b2
0x00e5b6b4
0x00e5b6b6
0x00e5b6b6
0x00e5b6b8
0x00e5b6be
0x00e5b6c4
0x00e5b6c6
0x00e5b6cc
0x00e5b6cc
0x00e5b6d2
0x00e5b6d4
0x00000000
0x00000000
0x00e5b6da
0x00e5b6dc
0x00e5b6de
0x00e5b6de
0x00e5b6e0
0x00e5b6e0
0x00e5b6f0
0x00e5b6f7
0x00e5b6fa
0x00e5b6fb
0x00e5b6fd
0x00e5b6fd
0x00e5b706
0x00e5b708
0x00e5b70a
0x00e5b710
0x00e5b713
0x00e5b724
0x00e5b727
0x00e5b72d
0x00e5b742
0x00e5b747
0x00e5b715
0x00e5b715
0x00e5b71c
0x00e5b71c
0x00e5b713
0x00e5b758
0x00e5b767
0x00e5b768
0x00e5b768
0x00e5b76a
0x00e5b76c
0x00e5b76c
0x00e5b772
0x00e5b775
0x00e5b777
0x00e5b779
0x00e5b779
0x00e5b77c
0x00e5b77d
0x00e5b77d
0x00e5b782
0x00e5b785
0x00e5b789
0x00e5b789
0x00e5b78a
0x00e5b78c
0x00e5b792
0x00000000
0x00000000
0x00000000
0x00e5b792
0x00e5b6cc
0x00e5b798
0x00e5b798
0x00000000
0x00e5b798
0x00e5a59e
0x00e5a595
0x00e5a58c
0x00e5a53f
0x00e5a543
0x00e5a54b
0x00000000
0x00e5a54d
0x00e5a553
0x00e5a558
0x00e5a55b
0x00e5a55f
0x00e5b7df
0x00e5b7e9
0x00e5b7f6
0x00e5b7f7
0x00e5b7f8
0x00e5b7f9
0x00e5b7fa
0x00e5b7fb
0x00e5b800
0x00e5b803
0x00e5b809
0x00e5b80a
0x00e5b80b
0x00e5b80b
0x00e5b80d
0x00e5b812
0x00e5b813
0x00e5b816
0x00e5b819
0x00e5b81b
0x00e5b822
0x00e5b827
0x00e5b829
0x00e5b82e
0x00e5b82f
0x00e5b839
0x00e5b839
0x00e5b83b
0x00e5b83b
0x00e5b842
0x00e5b845
0x00e5b84a
0x00e5b84a
0x00e5b84d
0x00e5b853
0x00e5b856
0x00e5b860
0x00e5b858
0x00e5b85b
0x00e5b85b
0x00e5b862
0x00e5b865
0x00e5b865
0x00e5b865
0x00e5b869
0x00000000
0x00000000
0x00e5b86b
0x00e5b86e
0x00e5b870
0x00e5b873
0x00000000
0x00000000
0x00e5b873
0x00000000
0x00e5b86e
0x00e5b875
0x00e5b881
0x00e5b881
0x00e5b883
0x00e5b8a7
0x00000000
0x00000000
0x00000000
0x00e5b8ae
0x00e5b8b4
0x00000000
0x00e5b885
0x00e5b885
0x00e5b887
0x00e5b891
0x00e5b894
0x00e5b894
0x00e5b897
0x00e5b889
0x00e5b889
0x00e5b889
0x00e5b88c
0x00e5b88c
0x00e5b89a
0x00e5b89a
0x00e5b8a2
0x00000000
0x00e5b7eb
0x00e5b79b
0x00e5b79b
0x00e5b7a5
0x00e5b7ae
0x00e5b7b3
0x00e5b7c1
0x00e5b7c1
0x00e5b7e9
0x00e5a54b
0x00000000

APIs

__floor_pentium4.LIBCMT ref: 00E5A620

Strings

1#IND, xrefs: 00E5B7C2
1#QNAN, xrefs: 00E5B7D0
1#INF, xrefs: 00E5B7ED
1#SNAN, xrefs: 00E5B7C9

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 0dffc3c522de0896ea901f932412940d3396f2f50ce38fab77657b9fd79f67cd
Instruction ID: 8e21c7cfa7dab91c381c9d1b0fe871e74bee165d490c78549e30380669cf5224
Opcode Fuzzy Hash: 0dffc3c522de0896ea901f932412940d3396f2f50ce38fab77657b9fd79f67cd
Instruction Fuzzy Hash: 33C24E71E046288FDB25CE28DD407EAB3B5EB48306F1456EAD84DF7241E774AE898F41

Uniqueness

Uniqueness Score: -1.00%

Function 00E592BC, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E00E592BC(void* __ecx, signed int _a4, intOrPtr _a8) {
				short _v8;
				short _t17;
				signed int _t18;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t36;
				intOrPtr* _t37;

				_push(__ecx);
				_t23 = _a4;
				if(_t23 == 0) {
					L21:
					_t12 = _a8 + 8; // 0x51ceb70f
					if(GetLocaleInfoW( *_t12, 0x20001004,  &_v8, 2) != 0) {
						_t17 = _v8;
						if(_t17 == 0) {
							_t17 = GetACP();
						}
						L25:
						return _t17;
					}
					L22:
					_t17 = 0;
					goto L25;
				}
				_t18 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t36 = 0xe6b714;
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t36) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t18;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t37 = 0xe6b71c;
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t37) {
								break;
							}
							if(_t31 == 0) {
								L17:
								if(_t18 != 0) {
									_t17 = E00E49F2F(_t23, _t23);
									goto L25;
								}
								_t8 = _a8 + 8; // 0x51ceb70f
								if(GetLocaleInfoW( *_t8, 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t17 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t37 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t37 = _t37 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t18 = _t18 | 0x00000001;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t36 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t36 = _t36 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				goto L9;
			}

0x00e592c1
0x00e592c2
0x00e592c9
0x00e5936d
0x00e5937b
0x00e59386
0x00e5938c
0x00e59391
0x00e59393
0x00e59393
0x00e59399
0x00e5939e
0x00e5939e
0x00e59388
0x00e59388
0x00000000
0x00e59388
0x00e592cf
0x00e592d4
0x00000000
0x00000000
0x00e592da
0x00e592df
0x00e592e1
0x00e592e1
0x00e592e7
0x00000000
0x00000000
0x00e592ec
0x00e59303
0x00e59303
0x00e5930c
0x00e5930e
0x00000000
0x00000000
0x00e59310
0x00e59315
0x00e59317
0x00e59317
0x00e5931d
0x00000000
0x00000000
0x00e59322
0x00e59340
0x00e59342
0x00e59365
0x00000000
0x00e5936a
0x00e59352
0x00e5935d
0x00000000
0x00000000
0x00e5935f
0x00000000
0x00e5935f
0x00e59324
0x00e5932c
0x00000000
0x00000000
0x00e5932e
0x00e59331
0x00e59337
0x00000000
0x00000000
0x00000000
0x00e59339
0x00e5933b
0x00e5933d
0x00000000
0x00e5933d
0x00e592ee
0x00e592f6
0x00000000
0x00000000
0x00e592f8
0x00e592fb
0x00e59301
0x00000000
0x00000000
0x00000000
0x00e59301
0x00e59307
0x00e59309
0x00000000

APIs

GetLocaleInfoW.KERNEL32(51CEB70F,2000000B,00000000,00000002,00000000,?,?,?,00E595E2,?,00000000), ref: 00E59355
GetLocaleInfoW.KERNEL32(51CEB70F,20001004,00000000,00000002,00000000,?,?,?,00E595E2,?,00000000), ref: 00E5937E
GetACP.KERNEL32(?,?,00E595E2,?,00000000), ref: 00E59393

Strings

OCP, xrefs: 00E59310
ACP, xrefs: 00E592DA

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: d40264c4cad809e1d0a9ea2575e2cd441b227b0fe8fd97ab1ed98a6b0dfa9c62
Instruction ID: 6625fb91745071f0f5587b52f47bfe01007f14b74a0732058536eea63a06ed3b
Opcode Fuzzy Hash: d40264c4cad809e1d0a9ea2575e2cd441b227b0fe8fd97ab1ed98a6b0dfa9c62
Instruction Fuzzy Hash: 6121A732700100E6D7308F65D905BEB73AAEB50B5AF1A5C64ED0AF7192E732DD48C350

Uniqueness

Uniqueness Score: -1.00%

Function 00E59497, Relevance: 7.7, APIs: 5, Instructions: 184
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00E59497(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, signed int _a4, short* _a8, short* _a12) {
				signed int _v8;
				int _v12;
				int _v16;
				char _v20;
				signed int* _v24;
				short* _v28;
				void* __ebp;
				signed int _t39;
				void* _t45;
				signed int* _t46;
				signed int _t47;
				short* _t48;
				int _t49;
				short* _t55;
				short* _t56;
				short* _t57;
				int _t65;
				int _t67;
				short* _t71;
				intOrPtr _t74;
				void* _t76;
				short* _t77;
				intOrPtr _t84;
				short* _t88;
				short* _t91;
				short** _t102;
				short* _t103;
				signed int _t105;
				signed short _t108;
				signed int _t109;
				void* _t110;

				_t39 =  *0xe7b068; // 0x1b9618b6
				_v8 = _t39 ^ _t109;
				_t88 = _a12;
				_t105 = _a4;
				_v28 = _a8;
				_v24 = E00E4FBAD(__ecx, __edx) + 0x50;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t45 = E00E4FBAD(__ecx, __edx);
				_t99 = 0;
				 *((intOrPtr*)(_t45 + 0x34c)) =  &_v20;
				_t91 = _t105 + 0x80;
				_t46 = _v24;
				 *_t46 = _t105;
				_t102 =  &(_t46[1]);
				 *_t102 = _t91;
				if(_t91 != 0 &&  *_t91 != 0) {
					_t84 =  *0xe6ada4; // 0x17
					E00E59434(_t91, 0, 0xe6ac90, _t84 - 1, _t102);
					_t46 = _v24;
					_t110 = _t110 + 0xc;
					_t99 = 0;
				}
				_v20 = _t99;
				_t47 =  *_t46;
				if(_t47 == 0 ||  *_t47 == _t99) {
					_t48 =  *_t102;
					__eflags = _t48;
					if(_t48 == 0) {
						L19:
						_v20 = 0x104;
						_t49 = GetUserDefaultLCID();
						_v12 = _t49;
						_v16 = _t49;
						goto L20;
					}
					__eflags =  *_t48 - _t99;
					if(__eflags == 0) {
						goto L19;
					}
					E00E58DCE(_t91, _t99, __eflags,  &_v20);
					_pop(_t91);
					goto L20;
				} else {
					_t71 =  *_t102;
					if(_t71 == 0) {
						L8:
						E00E58EB4(_t91, _t99, __eflags,  &_v20);
						L9:
						_pop(_t91);
						if(_v20 != 0) {
							_t103 = 0;
							__eflags = 0;
							L25:
							asm("sbb esi, esi");
							_t108 = E00E592BC(_t91,  ~_t105 & _t105 + 0x00000100,  &_v20);
							__eflags = _t108;
							if(_t108 == 0) {
								L22:
								L23:
								return E00E2C067(_v8 ^ _t109);
							}
							_t55 = IsValidCodePage(_t108 & 0x0000ffff);
							__eflags = _t55;
							if(_t55 == 0) {
								goto L22;
							}
							_t56 = IsValidLocale(_v16, 1);
							__eflags = _t56;
							if(_t56 == 0) {
								goto L22;
							}
							_t57 = _v28;
							__eflags = _t57;
							if(_t57 != 0) {
								 *_t57 = _t108;
							}
							E00E5114B(_v16,  &(_v24[0x94]), 0x55, _t103);
							__eflags = _t88;
							if(_t88 == 0) {
								L34:
								goto L23;
							}
							_t33 =  &(_t88[0x90]); // 0xe4d45b
							E00E5114B(_v16, _t33, 0x55, _t103);
							_t65 = GetLocaleInfoW(_v16, 0x1001, _t88, 0x40);
							__eflags = _t65;
							if(_t65 == 0) {
								goto L22;
							}
							_t36 =  &(_t88[0x40]); // 0xe4d3bb
							_t67 = GetLocaleInfoW(_v12, 0x1002, _t36, 0x40);
							__eflags = _t67;
							if(_t67 == 0) {
								goto L22;
							}
							_t38 =  &(_t88[0x80]); // 0xe4d43b
							E00E5D9B9(_t38, _t108, _t38, 0x10, 0xa);
							goto L34;
						}
						_t74 =  *0xe6ac8c; // 0x41
						_t76 = E00E59434(_t91, _t99, 0xe6a980, _t74 - 1, _v24);
						_t110 = _t110 + 0xc;
						if(_t76 == 0) {
							L20:
							_t103 = 0;
							__eflags = 0;
							L21:
							if(_v20 != 0) {
								goto L25;
							}
							goto L22;
						}
						_t77 =  *_t102;
						_t103 = 0;
						if(_t77 == 0) {
							L14:
							E00E58EB4(_t91, _t99, __eflags,  &_v20);
							L15:
							_pop(_t91);
							goto L21;
						}
						_t123 =  *_t77;
						if( *_t77 == 0) {
							goto L14;
						}
						E00E58E19(_t91, _t99, _t123,  &_v20);
						goto L15;
					}
					_t119 =  *_t71 - _t99;
					if( *_t71 == _t99) {
						goto L8;
					}
					E00E58E19(_t91, _t99, _t119,  &_v20);
					goto L9;
				}
			}

0x00e5949f
0x00e594a6
0x00e594ad
0x00e594b1
0x00e594b5
0x00e594c3
0x00e594c8
0x00e594c9
0x00e594ca
0x00e594cb
0x00e594d3
0x00e594d5
0x00e594db
0x00e594e1
0x00e594e4
0x00e594e6
0x00e594e9
0x00e594ed
0x00e594f4
0x00e59501
0x00e59506
0x00e59509
0x00e5950c
0x00e5950c
0x00e5950e
0x00e59511
0x00e59515
0x00e59585
0x00e59587
0x00e59589
0x00e5959c
0x00e5959c
0x00e595a3
0x00e595a9
0x00e595ac
0x00000000
0x00e595ac
0x00e5958b
0x00e5958e
0x00000000
0x00000000
0x00e59594
0x00e59599
0x00000000
0x00e5951c
0x00e5951c
0x00e59520
0x00e59532
0x00e59536
0x00e5953b
0x00e5953f
0x00e59540
0x00e595ca
0x00e595ca
0x00e595cc
0x00e595d8
0x00e595e2
0x00e595e6
0x00e595e8
0x00e595b7
0x00e595b9
0x00e595c9
0x00e595c9
0x00e595ee
0x00e595f4
0x00e595f6
0x00000000
0x00000000
0x00e595fd
0x00e59603
0x00e59605
0x00000000
0x00000000
0x00e59607
0x00e5960a
0x00e5960c
0x00e5960e
0x00e5960e
0x00e5961f
0x00e59624
0x00e59626
0x00e59686
0x00000000
0x00e59688
0x00e5962b
0x00e59635
0x00e59645
0x00e5964b
0x00e5964d
0x00000000
0x00000000
0x00e59655
0x00e59664
0x00e5966a
0x00e5966c
0x00000000
0x00000000
0x00e59676
0x00e5967e
0x00000000
0x00e59683
0x00e59546
0x00e59555
0x00e5955a
0x00e5955f
0x00e595af
0x00e595af
0x00e595af
0x00e595b1
0x00e595b5
0x00000000
0x00000000
0x00000000
0x00e595b5
0x00e59561
0x00e59563
0x00e59567
0x00e59579
0x00e5957d
0x00e59582
0x00e59582
0x00000000
0x00e59582
0x00e59569
0x00e5956c
0x00000000
0x00000000
0x00e59572
0x00000000
0x00e59572
0x00e59522
0x00e59525
0x00000000
0x00000000
0x00e5952b
0x00000000
0x00e5952b

APIs

Part of subcall function 00E4FBAD: GetLastError.KERNEL32(00E7BC08,ios_base::failbit set,?,00E484A4,00E79760,00000008,?,00000001), ref: 00E4FBB2
Part of subcall function 00E4FBAD: SetLastError.KERNEL32(00000000,00000002,000000FF,?,00E484A4,00E79760,00000008,?,00000001), ref: 00E4FC50

Part of subcall function 00E4FBAD: _free.LIBCMT ref: 00E4FC0F
Part of subcall function 00E4FBAD: _free.LIBCMT ref: 00E4FC45

GetUserDefaultLCID.KERNEL32(00000055,?,?), ref: 00E595A3
IsValidCodePage.KERNEL32(00000000), ref: 00E595EE
IsValidLocale.KERNEL32(?,00000001), ref: 00E595FD
GetLocaleInfoW.KERNEL32(?,00001001,00E4D33B,00000040,?,00E4D45B,00000055,00000000,?,?,00000055,00000000), ref: 00E59645
GetLocaleInfoW.KERNEL32(?,00001002,00E4D3BB,00000040), ref: 00E59664

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: 6d4ff1a1aab5775efd015d5be7fb7238598b88aa42de648fb383d703a80085b4
Instruction ID: 37ac48102ed272d8cb023d44942568671fbf9fed5f0bc1d11ba864405ce46f8d
Opcode Fuzzy Hash: 6d4ff1a1aab5775efd015d5be7fb7238598b88aa42de648fb383d703a80085b4
Instruction Fuzzy Hash: 38517F71A00205EFDB11DFA5DC41AFEB7B8AF48706F141869ED05F7152EBB09A18CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00E27340, Relevance: 4.9, APIs: 3, Instructions: 417
COMMONCrypto

Download Yara Rule

C-Code - Quality: 67%

			E00E27340(void* __ebx, signed int __ecx, void* __edi, signed int _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				char _v41;
				intOrPtr* _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				intOrPtr _v76;
				intOrPtr _v88;
				void* __esi;
				void* __ebp;
				signed int _t192;
				signed int _t193;
				intOrPtr _t196;
				signed int _t199;
				intOrPtr _t205;
				signed int _t207;
				signed int _t213;
				signed int _t220;
				signed int _t225;
				signed int _t226;
				signed int* _t232;
				signed int _t233;
				intOrPtr* _t249;
				signed int _t257;
				unsigned int _t267;
				void* _t268;
				signed int _t269;
				signed int _t272;
				signed int _t277;
				void* _t278;
				intOrPtr _t280;
				signed int _t287;
				intOrPtr _t293;
				signed int _t296;
				signed int _t298;
				signed int _t299;
				char* _t306;
				signed int _t312;
				signed int _t314;
				intOrPtr _t315;
				intOrPtr _t316;
				signed int _t327;
				unsigned int _t334;
				signed int _t340;
				intOrPtr _t341;
				intOrPtr _t345;
				signed int _t353;
				signed int _t354;
				signed int _t361;
				intOrPtr _t363;
				signed int _t365;
				intOrPtr* _t366;
				intOrPtr* _t367;
				intOrPtr* _t368;
				intOrPtr _t369;
				intOrPtr _t370;
				intOrPtr _t372;
				signed int _t376;
				signed int _t377;
				intOrPtr _t378;
				signed int _t381;
				void* _t383;
				intOrPtr _t384;
				intOrPtr _t388;
				void* _t391;

				_t281 = __ebx;
				_push(0xffffffff);
				_push(0xe60f28);
				_push( *[fs:0x0]);
				_t384 = _t383 - 0x3c;
				_t192 =  *0xe7b068; // 0x1b9618b6
				_t193 = _t192 ^ _t381;
				_v24 = _t193;
				_push(__ebx);
				_push(_t193);
				 *[fs:0x0] =  &_v16;
				_v20 = _t384;
				_v48 = __ecx;
				_t372 = _a8;
				_v60 = __ecx;
				_t196 = _a12;
				_v76 = _t196;
				_t199 =  *_v48;
				_t361 = (0x2aaaaaab * (_t196 - _t372) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_t196 - _t372) >> 0x20 >> 2);
				_t287 = _a4;
				_v52 = _t199;
				_v72 = _t361;
				_v64 = (0x2aaaaaab * (_t287 - _t199) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_t287 - _t199) >> 0x20 >> 2);
				_t205 = _v48;
				if(_t361 != 1 || _t287 !=  *((intOrPtr*)(_t205 + 4))) {
					_v41 = 0;
					__eflags = _t361;
					if(__eflags == 0) {
						goto L42;
					} else {
						goto L4;
					}
				} else {
					_v41 = 1;
					L4:
					_t327 =  *((intOrPtr*)(_t205 + 8));
					_t207 =  *((intOrPtr*)(_t205 + 4));
					_v40 = _t207;
					_v56 = _t327;
					if(_t361 <= (0x2aaaaaab * (_t327 - _t207) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_t327 - _t207) >> 0x20 >> 2)) {
						_t213 = _v40;
						_v56 = _t213;
						_t334 = 0x2aaaaaab * (_t213 - _t287) >> 0x20 >> 2;
						__eflags = _t361 - (_t334 >> 0x1f) + _t334;
						if(_t361 >= (_t334 >> 0x1f) + _t334) {
							_t220 = _t287 + (_t361 + _t361 * 2) * 8;
							_v72 = _t220;
							L45();
							_t336 = _v40;
							 *((intOrPtr*)(_v48 + 4)) = _t220;
							_t293 = _a4;
							E00E27220(_t281, _t293, _v40, _t361, _t372, _t220, _t287);
							asm("xorps xmm0, xmm0");
							_v8 = 8;
							_t363 = _a4;
							asm("movq [ebp-0x20], xmm0");
							_v28 = 0;
							_v36 = _t363;
							_v32 = _t363;
							_v28 = _v48;
							_v8 = 9;
							while(1) {
								__eflags = _t372 - _v76;
								if(_t372 == _v76) {
									goto L41;
								}
								_t293 = _t363;
								E00E12D00(_t336, _t372);
								_t363 = _t363 + 0x18;
								_t372 = _t372 + 0x18;
								_v32 = _t363;
							}
							goto L41;
						} else {
							_t225 = _v40;
							_t365 = _t361 + _t361 * 2 << 3;
							_t296 = _t225 - _t365;
							_v52 = _t365;
							_push(_t296);
							_push(_t225);
							_v68 = _t296;
							L45();
							_t388 = _t384 + 8;
							 *((intOrPtr*)(_v48 + 4)) = _t225;
							_t226 = _a4;
							_t298 = _v68;
							_v40 = _t226;
							__eflags = _t226 - _t298;
							if(_t226 == _t298) {
								L35:
								_push(_t298);
								_t339 = _t365 + _t226;
								_t293 = _t226;
								E00E27220(_t281, _t293, _t365 + _t226, _t365, _t372);
								asm("xorps xmm0, xmm0");
								_v8 = 3;
								_t363 = _a4;
								asm("movq [ebp-0x20], xmm0");
								_v28 = 0;
								_v36 = _t363;
								_v32 = _t363;
								_v28 = _v48;
								_v8 = 4;
								while(1) {
									__eflags = _t372 - _v76;
									if(_t372 == _v76) {
										break;
									}
									_t293 = _t363;
									E00E12D00(_t339, _t372);
									_t363 = _t363 + 0x18;
									_t372 = _t372 + 0x18;
									_v32 = _t363;
								}
								L41:
								_push(_t293);
								E00E27220(_t281, _t363, _t363, _t363, _t372);
								goto L42;
							} else {
								_t340 = _v52;
								_t107 = _t298 + 0x14; // 0x20
								_t366 = _t107;
								_v64 = _t340 - 4;
								do {
									_t366 = _t366 - 0x18;
									_t232 = _t366 - 0x14 + _t340;
									_t298 = _t366 - 0x14;
									_v68 = _t232;
									__eflags = _t232 - _t298;
									if(_t232 == _t298) {
										goto L33;
									} else {
										_t341 =  *((intOrPtr*)(_t366 + _t340));
										__eflags = _t341 - 0x10;
										if(_t341 < 0x10) {
											L32:
											 *((intOrPtr*)(_v64 + _t366)) = 0;
											_t340 = _v52;
											 *((intOrPtr*)(_t366 + _t340)) = 0xf;
											 *_t232 = 0;
											asm("movups xmm0, [edi-0x14]");
											asm("movups [eax], xmm0");
											asm("movq xmm0, [edi-0x4]");
											asm("movq [eax+0x10], xmm0");
											 *((intOrPtr*)(_t366 - 4)) = 0;
											 *_t366 = 0xf;
											 *((char*)(_t366 - 0x14)) = 0;
											goto L33;
										} else {
											_t233 =  *_t232;
											_t299 = _t341 + 1;
											__eflags = _t299 - 0x1000;
											if(_t299 < 0x1000) {
												L31:
												_push(_t299);
												E00E2C347(_t233);
												_t232 = _v68;
												_t298 = _t366 - 0x14;
												_t388 = _t388 + 8;
												goto L32;
											} else {
												_t343 =  *(_t233 - 4);
												_t299 = _t299 + 0x23;
												__eflags = _t233 - _t343 + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L44;
												} else {
													_t233 = _t343;
													goto L31;
												}
											}
										}
									}
									goto L49;
									L33:
									__eflags = _v40 - _t298;
								} while (_v40 != _t298);
								_t226 = _a4;
								_t365 = _v52;
								goto L35;
							}
						}
					} else {
						_t343 = 0x2aaaaaab * (_v40 - _v52) >> 0x20 >> 2;
						_v40 = 0xaaaaaaa;
						_t299 = (0x2aaaaaab * (_v40 - _v52) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v40 - _v52) >> 0x20 >> 2);
						if(_t361 > 0xaaaaaaa - _t299) {
							E00E19CA0(_t299);
							goto L44;
						} else {
							_t312 = _t299 + _t361;
							_v68 = _t312;
							_t267 = (0x2aaaaaab * (_v56 - _v52) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v56 - _v52) >> 0x20 >> 2);
							_t353 = _t267 >> 1;
							_v40 = _v40 - _t353;
							if(_t267 <= _v40) {
								_t268 = _t267 + _t353;
								__eflags = _t268 - _t312;
								_t269 =  <  ? _t312 : _t268;
								_v52 = _t269;
							} else {
								_t269 = _t312;
								_v52 = _t312;
							}
							_t299 = _t269 + _t269 * 2 << 3;
							if(_t269 <= 0xaaaaaaa) {
								__eflags = _t299 - 0x1000;
								if(__eflags < 0) {
									__eflags = _t299;
									if(__eflags == 0) {
										_t314 = 0;
										__eflags = 0;
									} else {
										_push(_t299);
										_t277 = E00E2C07D(_t353, __eflags);
										_t384 = _t384 + 4;
										_t314 = _t277;
									}
									goto L17;
								} else {
									goto L12;
								}
							} else {
								_t299 = _t299 | 0xffffffff;
								L12:
								_t55 = _t299 + 0x23; // 0x24
								_t278 = _t55;
								_t343 = _t353 | 0xffffffff;
								_t279 =  <=  ? _t353 | 0xffffffff : _t278;
								_push( <=  ? _t353 | 0xffffffff : _t278);
								_t280 = E00E2C07D(_t353 | 0xffffffff, _t278 - _t299);
								_t388 = _t384 + 4;
								if(_t280 == 0) {
									L44:
									E00E4957C(_t281, _t299, _t343, _t366, __eflags);
									E00E26FB0(_t299, _v64, _v60);
									E00E26FD0(_t281, _t366, _v56, _v52);
									E00E4309B(0, 0);
									_t241 = _v72;
									_v20 = _t388;
									_v72 = _v72 + _t241 * 2 << 4;
									E00E27320((_v72 + _t241 * 2 << 4) + _a4, _a4 + (_t241 + _t241 * 2 << 3), (_v72 + _t241 * 2 << 4) + _a4, _a4);
									_v8 = 5;
									_t367 = E00E220F0(_v60);
									_t345 =  *_t367;
									E00E27880(_t281, _t345, _t367, _t241 + _t241 * 2 << 3, (_t241 + _t241 * 2 << 3) + _a4);
									_t376 = _v56;
									E00E26FB0(_a4 + _v72, _t376,  *_t367);
									 *_t367 = _t376;
									E00E4309B(0, 0);
									_t306 = _v60;
									_v20 = _t388 + 4;
									_t249 = E00E220F0(_t306);
									_t377 = _v72;
									_t368 = _t249;
									E00E27320(_t306, _t377,  *_t368, _a4);
									_v8 = 0xa;
									E00E26FB0(_t306, _t377,  *_t368);
									 *_t368 = _v56;
									E00E4309B(0, 0);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t381);
									_push(_t377);
									_t378 = _v88;
									__eflags = _t306 - _t345;
									if(_t306 != _t345) {
										_t257 = _t378 - _t306;
										__eflags = _t257;
										do {
											 *((intOrPtr*)(_t378 + 0x10)) = 0;
											 *((intOrPtr*)(_t257 + _t306 + 0x14)) = 0;
											asm("movups xmm0, [ecx]");
											asm("movups [esi], xmm0");
											asm("movq xmm0, [ecx+0x10]");
											asm("movq [esi+0x10], xmm0");
											_t378 = _t378 + 0x18;
											 *((intOrPtr*)(_t306 + 0x10)) = 0;
											 *((intOrPtr*)(_t306 + 0x14)) = 0xf;
											 *_t306 = 0;
											_t306 = _t306 + 0x18;
											__eflags = _t306 - _t345;
										} while (_t306 != _t345);
									}
									_push(_t306);
									E00E27220(_t281, _t378, _t378, _t368, _t378);
									return _t378;
								} else {
									_t56 = _t280 + 0x23; // 0x23
									_t314 = _t56 & 0xffffffe0;
									 *((intOrPtr*)(_t314 - 4)) = _t280;
									L17:
									_t354 = _v64;
									asm("xorps xmm0, xmm0");
									_v8 = 0;
									_v40 = _t314;
									_v56 = _t314;
									asm("movq [ebp-0x20], xmm0");
									_v28 = 0;
									_t272 = _t314 + (_t354 + _t361 + (_t354 + _t361) * 2) * 8;
									_v60 = _t272;
									_v64 = _t272;
									_t369 = _t314 + (_t354 + _t354 * 2) * 8;
									_t315 = _v48;
									_v36 = _t369;
									_v32 = _t369;
									_v28 = _t315;
									_v8 = 1;
									asm("o16 nop [eax+eax]");
									while(_t372 != _v76) {
										_t315 = _t369;
										E00E12D00(_t354, _t372);
										_t369 = _t369 + 0x18;
										_t372 = _t372 + 0x18;
										_v32 = _t369;
									}
									_push(_t315);
									_t316 = _t369;
									E00E27220(_t281, _t316, _t369, _t369, _t372);
									_t370 = _v48;
									_t391 = _t384 + 4;
									__eflags = _v41;
									_t380 = _v40;
									_push(_t316);
									_push(_v40);
									if(_v41 == 0) {
										L45();
										_t391 = _t391 + 4;
										_push(_v60);
									}
									L45();
									L00E27290(_t281, _t370, _t370, _t380, _t380, _v68, _v52);
									L42:
									 *[fs:0x0] = _v16;
									__eflags = _v24 ^ _t381;
									return E00E2C067(_v24 ^ _t381);
								}
							}
						}
					}
				}
				L49:
			}

0x00e27340
0x00e27343
0x00e27345
0x00e27350
0x00e27351
0x00e27354
0x00e27359
0x00e2735b
0x00e2735e
0x00e27361
0x00e27365
0x00e2736b
0x00e27370
0x00e27373
0x00e27376
0x00e27379
0x00e2737e
0x00e27395
0x00e27397
0x00e27399
0x00e273a0
0x00e273a8
0x00e273b7
0x00e273ba
0x00e273c0
0x00e273cd
0x00e273d1
0x00e273d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00e273c7
0x00e273c7
0x00e273d9
0x00e273d9
0x00e273dc
0x00e273df
0x00e273e2
0x00e273fa
0x00e27564
0x00e27569
0x00e27575
0x00e2757f
0x00e27581
0x00e276c2
0x00e276c7
0x00e276ca
0x00e276d5
0x00e276d8
0x00e276db
0x00e276de
0x00e276e6
0x00e276e9
0x00e276f3
0x00e276f6
0x00e276fb
0x00e27702
0x00e27705
0x00e27708
0x00e2770b
0x00e27710
0x00e27710
0x00e27713
0x00000000
0x00000000
0x00e27716
0x00e27718
0x00e2771d
0x00e27720
0x00e27723
0x00e27723
0x00000000
0x00e27587
0x00e27587
0x00e2758d
0x00e27592
0x00e27594
0x00e27597
0x00e27598
0x00e2759b
0x00e2759e
0x00e275a6
0x00e275a9
0x00e275ac
0x00e275af
0x00e275b2
0x00e275b5
0x00e275b7
0x00e27665
0x00e27665
0x00e27666
0x00e27669
0x00e2766b
0x00e27673
0x00e27676
0x00e27680
0x00e27683
0x00e27688
0x00e2768f
0x00e27692
0x00e27695
0x00e27698
0x00e276a0
0x00e276a0
0x00e276a3
0x00000000
0x00000000
0x00e276aa
0x00e276ac
0x00e276b1
0x00e276b4
0x00e276b7
0x00e276b7
0x00e27728
0x00e27728
0x00e2772d
0x00000000
0x00e275bd
0x00e275bd
0x00e275c0
0x00e275c0
0x00e275c6
0x00e275d0
0x00e275d0
0x00e275d6
0x00e275d8
0x00e275db
0x00e275de
0x00e275e0
0x00000000
0x00e275e2
0x00e275e2
0x00e275e5
0x00e275e8
0x00e2761d
0x00e27620
0x00e27627
0x00e2762a
0x00e27631
0x00e27634
0x00e27638
0x00e2763b
0x00e27640
0x00e27645
0x00e2764c
0x00e27652
0x00000000
0x00e275ea
0x00e275ea
0x00e275ec
0x00e275ef
0x00e275f5
0x00e2760d
0x00e2760d
0x00e2760f
0x00e27614
0x00e27617
0x00e2761a
0x00000000
0x00e275f7
0x00e275f7
0x00e275fa
0x00e27602
0x00e27605
0x00000000
0x00e2760b
0x00e2760b
0x00000000
0x00e2760b
0x00e27605
0x00e275f5
0x00e275e8
0x00000000
0x00e27656
0x00e27656
0x00e27656
0x00e2765f
0x00e27662
0x00000000
0x00e27662
0x00e275b7
0x00e27400
0x00e27412
0x00e27417
0x00e2741d
0x00e27423
0x00e27753
0x00000000
0x00e27429
0x00e27434
0x00e27438
0x00e27443
0x00e27447
0x00e27449
0x00e2744f
0x00e27458
0x00e2745a
0x00e2745c
0x00e2745f
0x00e27451
0x00e27451
0x00e27453
0x00e27453
0x00e27465
0x00e2746d
0x00e27474
0x00e2747a
0x00e274a3
0x00e274a5
0x00e274b4
0x00e274b4
0x00e274a7
0x00e274a7
0x00e274a8
0x00e274ad
0x00e274b0
0x00e274b0
0x00000000
0x00000000
0x00000000
0x00000000
0x00e2746f
0x00e2746f
0x00e2747c
0x00e2747c
0x00e2747c
0x00e2747f
0x00e27484
0x00e27487
0x00e27488
0x00e2748d
0x00e27492
0x00e27758
0x00e27758
0x00e27763
0x00e2776e
0x00e27777
0x00e2777c
0x00e2777f
0x00e2778f
0x00e2779b
0x00e277a3
0x00e277b2
0x00e277bb
0x00e277bd
0x00e277c2
0x00e277cb
0x00e277d4
0x00e277d6
0x00e277db
0x00e277de
0x00e277e1
0x00e277e9
0x00e277ec
0x00e277f1
0x00e277f6
0x00e27800
0x00e2780c
0x00e2780e
0x00e27813
0x00e27814
0x00e27815
0x00e27816
0x00e27817
0x00e27818
0x00e27819
0x00e2781a
0x00e2781b
0x00e2781c
0x00e2781d
0x00e2781e
0x00e2781f
0x00e27820
0x00e27823
0x00e27824
0x00e27827
0x00e27829
0x00e2782d
0x00e2782d
0x00e27830
0x00e27830
0x00e27837
0x00e2783f
0x00e27842
0x00e27845
0x00e2784a
0x00e2784f
0x00e27852
0x00e27859
0x00e27860
0x00e27863
0x00e27866
0x00e27866
0x00e27830
0x00e2786a
0x00e2786f
0x00e2787b
0x00e27498
0x00e27498
0x00e2749b
0x00e2749e
0x00e274b6
0x00e274b6
0x00e274b9
0x00e274bc
0x00e274c3
0x00e274c6
0x00e274cc
0x00e274d4
0x00e274db
0x00e274de
0x00e274e1
0x00e274e7
0x00e274ea
0x00e274ed
0x00e274f0
0x00e274f3
0x00e274f6
0x00e274fa
0x00e27500
0x00e27506
0x00e27508
0x00e2750d
0x00e27510
0x00e27513
0x00e27513
0x00e27518
0x00e2751b
0x00e2751d
0x00e27522
0x00e27525
0x00e27528
0x00e2752c
0x00e2752f
0x00e27532
0x00e27533
0x00e27538
0x00e27540
0x00e27543
0x00e27543
0x00e27549
0x00e2755a
0x00e27735
0x00e27738
0x00e27746
0x00e27750
0x00e27750
0x00e27492
0x00e2746d
0x00e27423
0x00e273fa
0x00000000

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00E27777
__CxxThrowException@8.LIBVCRUNTIME ref: 00E277D6
__CxxThrowException@8.LIBVCRUNTIME ref: 00E2780E

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: b3edd8023717878a6f66685659f46355988a5e9add5905aa836fb0a85c734fa8
Instruction ID: a629d0c0a2ce3ae80d682c3678635353958859e0bac749f0c29c47c1832e63b0
Opcode Fuzzy Hash: b3edd8023717878a6f66685659f46355988a5e9add5905aa836fb0a85c734fa8
Instruction Fuzzy Hash: A2F16071E041199FCF04DF68E941AEEBBF2BF88304F249219E445BB351E771AA51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E493BE, Relevance: 4.6, APIs: 3, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 76%

			E00E493BE(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr _t67;
				int _t68;
				intOrPtr _t69;
				signed int _t70;

				_t69 = __esi;
				_t67 = __edi;
				_t66 = __edx;
				_t61 = __ebx;
				_t40 =  *0xe7b068; // 0x1b9618b6
				_t41 = _t40 ^ _t70;
				_v8 = _t40 ^ _t70;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00E2CEBE(_t41);
					_pop(_t62);
				}
				E00E43C10(_t67,  &_v804, 0, 0x50);
				E00E43C10(_t67,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t62;
				_v556 = _t66;
				_v560 = _t61;
				_v564 = _t69;
				_v568 = _t67;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t68 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t68 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					E00E2CEBE(_t57);
				}
				return E00E2C067(_v8 ^ _t70);
			}

0x00e493be
0x00e493be
0x00e493be
0x00e493be
0x00e493c9
0x00e493ce
0x00e493d0
0x00e493d8
0x00e493da
0x00e493dd
0x00e493e2
0x00e493e2
0x00e493ee
0x00e49401
0x00e4940f
0x00e49415
0x00e4941b
0x00e49421
0x00e49427
0x00e4942d
0x00e49433
0x00e49439
0x00e4943f
0x00e49445
0x00e4944c
0x00e49453
0x00e4945a
0x00e49461
0x00e49468
0x00e4946f
0x00e49470
0x00e49479
0x00e4947f
0x00e49482
0x00e49488
0x00e49495
0x00e4949e
0x00e494a7
0x00e494b0
0x00e494be
0x00e494c0
0x00e494d5
0x00e494e1
0x00e494e4
0x00e494e9
0x00e494f8

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00E494B6
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00E494C0
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00E494CD

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8b16bea7e0ffcac8aedb2d6c639c615e1253ee11634aeda83d0b1e8986e5e6d2
Instruction ID: a19de3944a65da4388ba6abeee5d1ed99464a616ca1b1b64a6aaaaa90bda9fe7
Opcode Fuzzy Hash: 8b16bea7e0ffcac8aedb2d6c639c615e1253ee11634aeda83d0b1e8986e5e6d2
Instruction Fuzzy Hash: FE31D4749012289BCB21DF25E888B9DBBB8BF08310F5051DAE81CB7291E7709F858F54

Uniqueness

Uniqueness Score: -1.00%

Function 00E4BE9F, Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00E4BE9F(int _a4) {
				void* _t14;

				if(E00E54396(_t14) != 1 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E00E4BEE1(_t14, _a4);
				ExitProcess(_a4);
			}

0x00e4beac
0x00e4bec8
0x00e4bec8
0x00e4bed1
0x00e4beda

APIs

GetCurrentProcess.KERNEL32(00000003,?,00E4BE9E,00E79760,00E484A4,00000003,00E79760,00000003,00E4FC69), ref: 00E4BEC1
TerminateProcess.KERNEL32(00000000,?,00E4BE9E,00E79760,00E484A4,00000003,00E79760,00000003,00E4FC69), ref: 00E4BEC8
ExitProcess.KERNEL32 ref: 00E4BEDA

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 82c1de8ae4deead421cfda941938624c9b04ae204c4ed527e383c770f547d1c9
Instruction ID: 2da2ebfae22115126061987dd871cb32f67ec039d1da181a64269d1b201d21f2
Opcode Fuzzy Hash: 82c1de8ae4deead421cfda941938624c9b04ae204c4ed527e383c770f547d1c9
Instruction Fuzzy Hash: C2E0B631001108BFCF126F65ED4999A7B69EF80395F005815FA05A6531CB76EE96CA40

Uniqueness

Uniqueness Score: -1.00%

Function 00E4ADA0, Relevance: 3.5, APIs: 2, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e83586df9f5072003d20ad9c65a17824f5633ad0142f6714a62fc8a2a60ca87
Instruction ID: 56c9c7ab5704ee578421653fc66584266e9d485d01c01b9ea662987ed33c7778
Opcode Fuzzy Hash: 1e83586df9f5072003d20ad9c65a17824f5633ad0142f6714a62fc8a2a60ca87
Instruction Fuzzy Hash: 39023C71E012199BDF14CFA9D8906AEB7F1FF88324F158269E919B7340D731AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E51D2F, Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00E51D2A,?,?,00000008,?,?,00E5D020,00000000), ref: 00E51F5C

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 367628ff719573d04bd11fad0d700ad6b9744ecb806179fb9032ada2a26b790d
Instruction ID: c0134cf7b018f7aaecc4c5763f4a63677be5723338b3949deabc2ba5f2ff66b0
Opcode Fuzzy Hash: 367628ff719573d04bd11fad0d700ad6b9744ecb806179fb9032ada2a26b790d
Instruction Fuzzy Hash: 1AB17C35210608DFD715CF28C486BA47BE0FF4536AF258A98ED99DF2A1C735E985CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00E58E19, Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E4FBAD: GetLastError.KERNEL32(00E7BC08,ios_base::failbit set,?,00E484A4,00E79760,00000008,?,00000001), ref: 00E4FBB2
Part of subcall function 00E4FBAD: SetLastError.KERNEL32(00000000,00000002,000000FF,?,00E484A4,00E79760,00000008,?,00000001), ref: 00E4FC50

EnumSystemLocalesW.KERNEL32(00E58F3F,00000001,00000000,?,00E4D33B,?,00E59577,00000000,00000055,?,?), ref: 00E58E8B

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 1e8ef4112b03654aad9492a3bb3c04ed300405617df73ce02ff52a40c4d92527
Instruction ID: 340dc86117279cda4e454c0d4bb76a4da93939e4b1fbb2441ef99aa6cb6231e6
Opcode Fuzzy Hash: 1e8ef4112b03654aad9492a3bb3c04ed300405617df73ce02ff52a40c4d92527
Instruction Fuzzy Hash: D21155362003045FDB18AF38CD926BAB7A2FF84359B08482CE946A7A40DB71B906CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00E58EB4, Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E4FBAD: GetLastError.KERNEL32(00E7BC08,ios_base::failbit set,?,00E484A4,00E79760,00000008,?,00000001), ref: 00E4FBB2
Part of subcall function 00E4FBAD: SetLastError.KERNEL32(00000000,00000002,000000FF,?,00E484A4,00E79760,00000008,?,00000001), ref: 00E4FC50

EnumSystemLocalesW.KERNEL32(00E59194,00000001,00000000,?,00E4D33B,?,00E5953B,00E4D33B,00000055,?,?,?,?,00E4D33B,?,?), ref: 00E58EFE

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c07195633c1ec067d455bfd48e9a2cbad98901a2bfb0f32b819b05074db726a7
Instruction ID: a323ee36efcfa0fd67127538e2605e3fc646214c31e0a48292d707d4b0bfaf1d
Opcode Fuzzy Hash: c07195633c1ec067d455bfd48e9a2cbad98901a2bfb0f32b819b05074db726a7
Instruction Fuzzy Hash: 30F0C2363003095FDB245F35DD85A6A7BA1EF8576DB05482CF945ABA80DAB1AC06C650

Uniqueness

Uniqueness Score: -1.00%

Function 00E58DCE, Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E4FBAD: GetLastError.KERNEL32(00E7BC08,ios_base::failbit set,?,00E484A4,00E79760,00000008,?,00000001), ref: 00E4FBB2
Part of subcall function 00E4FBAD: SetLastError.KERNEL32(00000000,00000002,000000FF,?,00E484A4,00E79760,00000008,?,00000001), ref: 00E4FC50

EnumSystemLocalesW.KERNEL32(00E58D25,00000001,00000000,?,?,00E59599,00E4D33B,00000055,?,?,?,?,00E4D33B,?,?,?), ref: 00E58E05

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d7aec8a031edefe88214f0358c20a84912dd758608c6196cdcaa092508952b7c
Instruction ID: e4eb262acd6bf414c5962dd89fcc27042e258bd75180d1c38e7df1247c75e404
Opcode Fuzzy Hash: d7aec8a031edefe88214f0358c20a84912dd758608c6196cdcaa092508952b7c
Instruction Fuzzy Hash: 7DF0553630020857CB149F35E905A7ABFF4EFC2755B060058EE05AB280CE719846C750

Uniqueness

Uniqueness Score: -1.00%

Function 00E50AF1, Relevance: 1.5, APIs: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E4A10C: EnterCriticalSection.KERNEL32(?,?,00E4BB5F,00000000,00E79880,0000000C,00E4BB26,?,?,00E4E656,?,?,00E4FD4F,00000001,00000364,00000002), ref: 00E4A11B

EnumSystemLocalesW.KERNEL32(00E50AE4,00000001,00E79AA0,0000000C,00E50F47,00000000), ref: 00E50B29

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: c4e8c11215f4363b0aca8f4c5cd0c3bc2d434bcb558369f1a1e2bc9851fe91f1
Instruction ID: 53420a1c7c49ab5f2dc403de2cacacef3dcc250bbf78d7d8aa1d4a3525512c96
Opcode Fuzzy Hash: c4e8c11215f4363b0aca8f4c5cd0c3bc2d434bcb558369f1a1e2bc9851fe91f1
Instruction Fuzzy Hash: 1CF05E31A41310DFD700EF65E846B5D77F0EB09325F109599F828BB2A1CBB54A48CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00E5104D, Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,?,?,00E4D46A,?,20001004,?,00000002,00000000,?,?), ref: 00E51081

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 56b555d2827bee97f3567b24a46cef291aef351426dc2d099435a606b5ab39b2
Instruction ID: 9d471e230950c3e7130517d7fb3bb972130fe85ff132f5863184db1d9f1d03fc
Opcode Fuzzy Hash: 56b555d2827bee97f3567b24a46cef291aef351426dc2d099435a606b5ab39b2
Instruction Fuzzy Hash: FBE04F31540258BBCF222F61EC04FAE7F55EF44792F004850FD0676161CB718E24AAD0

Uniqueness

Uniqueness Score: -1.00%

Function 00E47A1D, Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

0, xrefs: 00E47B99

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f35d0a7b4258c2f4ee6c69097f360a605af80a97d45d80776af1cf6b3b957bca
Instruction ID: d55b16704865d67ec36d6f20eab74c75c5d6ebdad9af84505dfababb732d8bc4
Opcode Fuzzy Hash: f35d0a7b4258c2f4ee6c69097f360a605af80a97d45d80776af1cf6b3b957bca
Instruction Fuzzy Hash: 2551597060C6485ADB388928B9967BFA79BDB41308F187519D4C6F7381EB11DF49A3C2

Uniqueness

Uniqueness Score: -1.00%

Function 00E54350, Relevance: 1.3, Strings: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

Strings

$, xrefs: 00E54388

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1211140351
Opcode ID: 42aaa73689b918f2ec4ea3a5eb9ad4ad76e55aec3eb03fedebaee9f0b7098caa
Instruction ID: 6037ca58fa428f08c2a41742755a97695bc1d799d28e9505453023caa950efab
Opcode Fuzzy Hash: 42aaa73689b918f2ec4ea3a5eb9ad4ad76e55aec3eb03fedebaee9f0b7098caa
Instruction Fuzzy Hash: 19F0A032A122249FCB26DA4CC405A98B3ECEB09B66F1514A6F804FB250C770ED44C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00E1B1B0, Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d626059e86efd521f8785081e72d3729e849dd546ae57f9adee7bb5f4b7537
Instruction ID: 54a5140dff69694d49af9d07fc0656579658657a41bb9acd68cd62e20d9b6746
Opcode Fuzzy Hash: 99d626059e86efd521f8785081e72d3729e849dd546ae57f9adee7bb5f4b7537
Instruction Fuzzy Hash: C9F16E71A04606DFCB19DF68C490AEEB7F2FF58304F249159E855A7752D730E894CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E14380, Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: _strcspn
String ID:
API String ID: 3709121408-0
Opcode ID: afe8ab009e7d1759ab9bfa361ae035b700aa7ec38e454089ef2d998905377fa5
Instruction ID: e1c6a2e04ddb3bf20cef0f7c1ba5e96a8f3c630f39562c23c4804729b2094dc3
Opcode Fuzzy Hash: afe8ab009e7d1759ab9bfa361ae035b700aa7ec38e454089ef2d998905377fa5
Instruction Fuzzy Hash: 34C1B072E00109ABDB19DFA8DC41EEEBBB5FF48314F104529F815B7291D735A991CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E1ABA0, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e115a3ec581b02b4ff3869ca3381861690ab32eac88afe56552eab5d02213deb
Instruction ID: c0ea634d5de0ff63e480a18b28cc13b49374308129125c5cdb7dcab8a29d9643
Opcode Fuzzy Hash: e115a3ec581b02b4ff3869ca3381861690ab32eac88afe56552eab5d02213deb
Instruction Fuzzy Hash: 87517EB1B0121A8BCB15CFACD8C05FEB7B1EB88344B596239E502FB244D670A994DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00E24700, Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27398a6bd04e7b042c2df0dd4eefd57469496f7df0cf8f294bdbd0d9e34c2454
Instruction ID: 3e2c495ca260b46e9d3679a3349276ea440c307a290cae084fc11f81001ba5f2
Opcode Fuzzy Hash: 27398a6bd04e7b042c2df0dd4eefd57469496f7df0cf8f294bdbd0d9e34c2454
Instruction Fuzzy Hash: 1E41C3727215128BD708CF3DD881BA5F7E1FB98314F1587A9E42ACB2C1DB35E9108B84

Uniqueness

Uniqueness Score: -1.00%

Function 00E5CC70, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43fbcb5ed2ee75850897859f2d5c530ddb9e9c960170b52378f5791ab3c85e87
Instruction ID: ba4ab29ab66d76aeb78aae5a87720471ecc3700bfa3adb0a29dd3e27c6275fc4
Opcode Fuzzy Hash: 43fbcb5ed2ee75850897859f2d5c530ddb9e9c960170b52378f5791ab3c85e87
Instruction Fuzzy Hash: E521B673F205384B770CC47E8C5227DB6E1C78C541745827AF8A6EA3C1E968D917E2E4

Uniqueness

Uniqueness Score: -1.00%

Function 00E5CB4C, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d1405bc9a430d6807acc8cd9fdd932089790e6184d3ce49d2d4a128180778db
Instruction ID: 3c9048051308588faaaf3f7608506e14ae27712b7b2d37a87908443e789c8516
Opcode Fuzzy Hash: 4d1405bc9a430d6807acc8cd9fdd932089790e6184d3ce49d2d4a128180778db
Instruction Fuzzy Hash: 2F11A723F30C295B675C816D8C172BAA2D2DBD825071F537ADC2AE7384E894DE23D290

Uniqueness

Uniqueness Score: -1.00%

Function 00E44D30, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: f4ab33970675e4f61581ebc199310a4c90abbcac8603a54a81c06c7ade50614c
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: E7112BF7F4009143D7148A3DF8B4BB6A399EFC5329B2D637AD052AB7D8D222E9459500

Uniqueness

Uniqueness Score: -1.00%

Function 00E54396, Relevance: .0, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19af5d985eccc93d57de684b90c7abc6b963c7846d56c53071b22cebcaccc51c
Instruction ID: fe6ded7e737233a487bb833073bfb4854bca046fd27c3fae543e6a90919288c5
Opcode Fuzzy Hash: 19af5d985eccc93d57de684b90c7abc6b963c7846d56c53071b22cebcaccc51c
Instruction Fuzzy Hash: 66E04F72911128EBC714DAC89504D59F3FCEB05B15B115596F904E3110C2709E44C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00E4A726, Relevance: 22.8, APIs: 15, Instructions: 343
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00E4A726(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				void* _v44;
				intOrPtr* _v48;
				char* _v52;
				intOrPtr* _v56;
				signed int _v60;
				intOrPtr _v64;
				signed int _v68;
				signed int* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				char _v92;
				signed int _t118;
				intOrPtr _t120;
				char _t140;
				signed short _t143;
				signed int _t144;
				void* _t147;
				void* _t150;
				void* _t153;
				void* _t154;
				void* _t157;
				signed int _t159;
				intOrPtr* _t160;
				signed char _t177;
				signed int* _t180;
				char* _t183;
				signed char _t184;
				void* _t191;
				char _t193;
				void* _t195;
				signed int* _t197;
				intOrPtr _t198;
				intOrPtr _t202;
				short* _t206;
				intOrPtr _t207;
				signed int _t208;
				signed char _t215;
				char _t216;
				intOrPtr _t217;
				void* _t221;
				signed int _t222;
				signed char* _t224;
				int* _t226;
				signed char* _t238;
				short* _t239;
				intOrPtr* _t241;
				char* _t242;
				char* _t243;
				intOrPtr* _t247;
				signed int _t248;
				short* _t249;
				void* _t251;
				signed int _t252;
				signed int _t253;
				void* _t254;
				void* _t255;

				_t118 =  *0xe7b068; // 0x1b9618b6
				_v8 = _t118 ^ _t253;
				_t241 = _a4;
				_t193 = 0;
				_v56 = _t241;
				_v32 = 0;
				_v36 = 0;
				_t120 =  *((intOrPtr*)(_t241 + 0xa8));
				_v40 = 0;
				_v44 = 0;
				_v92 = _t241;
				_v88 = 0;
				if(_t120 == 0) {
					__eflags =  *((intOrPtr*)(_t241 + 0x8c));
					if( *((intOrPtr*)(_t241 + 0x8c)) != 0) {
						asm("lock dec dword [eax]");
					}
					 *((intOrPtr*)(_t241 + 0x8c)) = _t193;
					__eflags = 0;
					 *((intOrPtr*)(_t241 + 0x90)) = _t193;
					 *_t241 = 0xe68598;
					 *((intOrPtr*)(_t241 + 0x94)) = 0xe68818;
					 *((intOrPtr*)(_t241 + 0x98)) = 0xe68998;
					 *((intOrPtr*)(_t241 + 4)) = 1;
					L48:
					return E00E2C067(_v8 ^ _t253);
				}
				_push(__edi);
				_t226 = _t241 + 8;
				_v48 = 0;
				if( *_t226 != 0) {
					L3:
					_v48 = E00E4E623(1, 4);
					E00E4F1E8(_t193);
					_v32 = E00E4E623(0x180, 2);
					E00E4F1E8(_t193);
					_v36 = E00E4E623(0x180, 1);
					E00E4F1E8(_t193);
					_v40 = E00E4E623(0x180, 1);
					E00E4F1E8(_t193);
					_v44 = E00E4E623(0x101, 1);
					E00E4F1E8(_t193);
					_t255 = _t254 + 0x3c;
					if(_v48 == _t193 || _v32 == _t193) {
						L43:
						E00E4F1E8(_v48);
						E00E4F1E8(_v32);
						E00E4F1E8(_v36);
						E00E4F1E8(_v40);
						_t193 = 1;
						__eflags = 1;
						goto L44;
					} else {
						_t202 = _v44;
						if(_t202 == 0 || _v36 == _t193 || _v40 == _t193) {
							goto L43;
						} else {
							_t140 = _t193;
							do {
								 *((char*)(_t140 + _t202)) = _t140;
								_t140 = _t140 + 1;
							} while (_t140 < 0x100);
							if(GetCPInfo( *_t226,  &_v28) == 0) {
								goto L43;
							}
							_t143 = _v28;
							if(_t143 > 5) {
								goto L43;
							}
							_t144 = _t143 & 0x0000ffff;
							_v60 = _t144;
							if(_t144 <= 1) {
								L22:
								_v52 = _v44 + 1;
								_t147 = E00E5400A(_t193, _t226, _t241, _t273, _t193,  *((intOrPtr*)(_t241 + 0xa8)), 0x100, _v44 + 1, 0xff, _v36 + 0x81, 0xff,  *_t226, _t193);
								_t255 = _t255 + 0x24;
								_t274 = _t147;
								if(_t147 == 0) {
									goto L43;
								}
								_t150 = E00E5400A(_t193, _t226, _t241, _t274, _t193,  *((intOrPtr*)(_t241 + 0xa8)), 0x200, _v52, 0xff, _v40 + 0x81, 0xff,  *_t226, _t193);
								_t255 = _t255 + 0x24;
								_t275 = _t150;
								if(_t150 == 0) {
									goto L43;
								}
								_v76 = _v32 + 0x100;
								_t153 = E00E53D19(_t193, _t226, _t241, _t275, _t193, 1, _v44, 0x100, _v32 + 0x100,  *_t226, _t193);
								_t255 = _t255 + 0x1c;
								if(_t153 == 0) {
									goto L43;
								}
								_t154 = _v32;
								_t206 = _t154 + 0xfe;
								 *_t206 = 0;
								_t221 = _v40;
								_v80 = _t206;
								_t207 = _v36;
								_t242 = _t207 + 0x80;
								 *((char*)(_t207 + 0x7f)) = _t193;
								 *((char*)(_t221 + 0x7f)) = _t193;
								 *_t242 = _t193;
								_v84 = _t242;
								_t243 = _t221 + 0x80;
								_v52 = _t243;
								 *_t243 = _t193;
								if(_v60 <= 1) {
									L39:
									_t208 = 0x3f;
									_push(0x1f);
									_t157 = memcpy(_v32, _v32 + 0x200, _t208 << 2);
									_push(0x1f);
									asm("movsw");
									memcpy(_t157, _t157 + 0x100, 0 << 2);
									asm("movsw");
									asm("movsb");
									_t159 = memcpy(_t221, _t221 + 0x100, 0 << 2);
									asm("movsw");
									asm("movsb");
									_t247 = _v56;
									if( *((intOrPtr*)(_t247 + 0x8c)) != 0) {
										asm("lock xadd [ecx], eax");
										if((_t159 | 0xffffffff) == 0) {
											E00E4F1E8( *((intOrPtr*)(_t247 + 0x90)) - 0xfe);
											E00E4F1E8( *((intOrPtr*)(_t247 + 0x94)) - 0x80);
											E00E4F1E8( *((intOrPtr*)(_t247 + 0x98)) - 0x80);
											E00E4F1E8( *((intOrPtr*)(_t247 + 0x8c)));
										}
									}
									_t160 = _v48;
									 *_t160 = 1;
									 *((intOrPtr*)(_t247 + 0x8c)) = _t160;
									 *_t247 = _v76;
									 *((intOrPtr*)(_t247 + 0x90)) = _v80;
									 *((intOrPtr*)(_t247 + 0x94)) = _v84;
									 *((intOrPtr*)(_t247 + 0x98)) = _v52;
									 *(_t247 + 4) = _v60;
									L44:
									E00E4F1E8(_v44);
									goto L48;
								}
								if( *_t226 != 0xfde9) {
									_t238 =  &_v22;
									__eflags = _v22 - _t193;
									if(_v22 == _t193) {
										goto L39;
									}
									_t195 = _v32;
									while(1) {
										_t177 = _t238[1];
										__eflags = _t177;
										if(_t177 == 0) {
											break;
										}
										_t248 =  *_t238 & 0x000000ff;
										_v68 = _t248;
										__eflags = _t248 - (_t177 & 0x000000ff);
										if(_t248 > (_t177 & 0x000000ff)) {
											L37:
											_t238 =  &(_t238[2]);
											__eflags =  *_t238;
											if( *_t238 != 0) {
												continue;
											}
											break;
										}
										_v64 = _t207;
										_t180 = _t221 + 0x80 + _t248;
										_t215 = _t207 - _t221;
										__eflags = _t215;
										_t222 = _v68;
										_t249 = _t195 - 0xffffff00 + _t248 * 2;
										_v72 = _t180;
										_t197 = _t180;
										do {
											 *_t249 = 0x8000;
											_t249 = _t249 + 2;
											 *(_t197 + _t215) = _t222;
											 *_t197 = _t222;
											_t222 = _t222 + 1;
											_t197 =  &(_t197[0]);
											__eflags = _t222 - (_t238[1] & 0x000000ff);
										} while (_t222 <= (_t238[1] & 0x000000ff));
										_t221 = _v40;
										_t207 = _v36;
										_t195 = _v32;
										goto L37;
									}
									L38:
									_t193 = 0;
									goto L39;
								}
								_t198 = _v52;
								_t239 = _t154 + 0x284;
								_t216 = 0xc2;
								_t251 = _t207 - _t221;
								do {
									_t183 = _t198 + _t216;
									 *_t239 = 0x8000;
									 *((char*)(_t251 + _t183)) = _t216;
									_t239 = _t239 + 2;
									 *_t183 = _t216;
									_t216 = _t216 + 1;
								} while (_t216 < 0xf5);
								_t221 = _v40;
								goto L38;
							}
							_t273 =  *_t226 - 0xfde9;
							if( *_t226 != 0xfde9) {
								_t224 =  &_v22;
								__eflags = _v22 - _t193;
								if(__eflags == 0) {
									goto L22;
								}
								_t217 = _v44;
								while(1) {
									_t184 = _t224[1];
									__eflags = _t184;
									if(__eflags == 0) {
										break;
									}
									_t252 =  *_t224 & 0x000000ff;
									__eflags = _t252 - (_t184 & 0x000000ff);
									if(_t252 > (_t184 & 0x000000ff)) {
										L20:
										_t224 =  &(_t224[2]);
										__eflags =  *_t224 - _t193;
										if(__eflags != 0) {
											continue;
										}
										break;
									} else {
										goto L19;
									}
									do {
										L19:
										 *((char*)(_t252 + _t217)) = 0x20;
										_t252 = _t252 + 1;
										__eflags = _t252 - (_t224[1] & 0x000000ff);
									} while (_t252 <= (_t224[1] & 0x000000ff));
									goto L20;
								}
								_t241 = _v56;
								goto L22;
							}
							E00E43C10(_t226, _v44 - 0xffffff80, 0x20, 0x80);
							_t255 = _t255 + 0xc;
							goto L22;
						}
					}
				}
				_push(_t226);
				_push(0x1004);
				_push(_t120);
				_push(0);
				_push( &_v92);
				_t191 = E00E53B67(0, __edx, _t226, _t241);
				_t255 = _t254 + 0x14;
				if(_t191 != 0) {
					goto L43;
				}
				goto L3;
			}

0x00e4a72e
0x00e4a735
0x00e4a73a
0x00e4a73d
0x00e4a73f
0x00e4a742
0x00e4a745
0x00e4a748
0x00e4a74e
0x00e4a751
0x00e4a754
0x00e4a757
0x00e4a75c
0x00e4ab1d
0x00e4ab1f
0x00e4ab21
0x00e4ab21
0x00e4ab24
0x00e4ab2a
0x00e4ab2c
0x00e4ab32
0x00e4ab38
0x00e4ab42
0x00e4ab4c
0x00e4ab53
0x00e4ab62
0x00e4ab62
0x00e4a762
0x00e4a763
0x00e4a766
0x00e4a76b
0x00e4a789
0x00e4a793
0x00e4a796
0x00e4a7a8
0x00e4a7ab
0x00e4a7bd
0x00e4a7c0
0x00e4a7d2
0x00e4a7d5
0x00e4a7e7
0x00e4a7ea
0x00e4a7ef
0x00e4a7f5
0x00e4aae3
0x00e4aae6
0x00e4aaee
0x00e4aaf6
0x00e4aafe
0x00e4ab08
0x00e4ab08
0x00000000
0x00e4a804
0x00e4a804
0x00e4a809
0x00000000
0x00e4a821
0x00e4a821
0x00e4a823
0x00e4a823
0x00e4a826
0x00e4a827
0x00e4a83c
0x00000000
0x00000000
0x00e4a842
0x00e4a848
0x00000000
0x00000000
0x00e4a84e
0x00e4a851
0x00e4a857
0x00e4a8ac
0x00e4a8cf
0x00e4a8d3
0x00e4a8d8
0x00e4a8db
0x00e4a8dd
0x00000000
0x00000000
0x00e4a905
0x00e4a90a
0x00e4a90d
0x00e4a90f
0x00000000
0x00000000
0x00e4a929
0x00e4a92f
0x00e4a934
0x00e4a939
0x00000000
0x00000000
0x00e4a93f
0x00e4a948
0x00e4a94e
0x00e4a951
0x00e4a954
0x00e4a957
0x00e4a95a
0x00e4a960
0x00e4a963
0x00e4a966
0x00e4a968
0x00e4a96b
0x00e4a971
0x00e4a974
0x00e4a976
0x00e4aa21
0x00e4aa28
0x00e4aa29
0x00e4aa34
0x00e4aa37
0x00e4aa39
0x00e4aa43
0x00e4aa46
0x00e4aa48
0x00e4aa51
0x00e4aa53
0x00e4aa55
0x00e4aa56
0x00e4aa61
0x00e4aa66
0x00e4aa6a
0x00e4aa78
0x00e4aa8b
0x00e4aa99
0x00e4aaa4
0x00e4aaa9
0x00e4aa6a
0x00e4aaac
0x00e4aaaf
0x00e4aab5
0x00e4aabe
0x00e4aac3
0x00e4aacc
0x00e4aad5
0x00e4aade
0x00e4ab09
0x00e4ab0c
0x00000000
0x00e4ab14
0x00e4a982
0x00e4a9b7
0x00e4a9ba
0x00e4a9bd
0x00000000
0x00000000
0x00e4a9bf
0x00e4a9c2
0x00e4a9c2
0x00e4a9c5
0x00e4a9c7
0x00000000
0x00000000
0x00e4a9c9
0x00e4a9cf
0x00e4a9d2
0x00e4a9d4
0x00e4aa17
0x00e4aa17
0x00e4aa1a
0x00e4aa1d
0x00000000
0x00000000
0x00000000
0x00e4aa1d
0x00e4a9dc
0x00e4a9e5
0x00e4a9e7
0x00e4a9e7
0x00e4a9e9
0x00e4a9ec
0x00e4a9ef
0x00e4a9f2
0x00e4a9f4
0x00e4a9f9
0x00e4a9fc
0x00e4a9ff
0x00e4aa02
0x00e4aa04
0x00e4aa09
0x00e4aa0a
0x00e4aa0a
0x00e4aa0e
0x00e4aa11
0x00e4aa14
0x00000000
0x00e4aa14
0x00e4aa1f
0x00e4aa1f
0x00000000
0x00e4aa1f
0x00e4a984
0x00e4a987
0x00e4a98f
0x00e4a994
0x00e4a99b
0x00e4a99b
0x00e4a99e
0x00e4a9a1
0x00e4a9a4
0x00e4a9a7
0x00e4a9a9
0x00e4a9aa
0x00e4a9b2
0x00000000
0x00e4a9b2
0x00e4a859
0x00e4a85f
0x00e4a879
0x00e4a87c
0x00e4a87f
0x00000000
0x00000000
0x00e4a881
0x00e4a884
0x00e4a884
0x00e4a887
0x00e4a889
0x00000000
0x00000000
0x00e4a88b
0x00e4a891
0x00e4a893
0x00e4a8a2
0x00e4a8a2
0x00e4a8a5
0x00e4a8a7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00e4a895
0x00e4a895
0x00e4a895
0x00e4a899
0x00e4a89e
0x00e4a89e
0x00000000
0x00e4a895
0x00e4a8a9
0x00000000
0x00e4a8a9
0x00e4a86f
0x00e4a874
0x00000000
0x00e4a874
0x00e4a809
0x00e4a7f5
0x00e4a76d
0x00e4a76e
0x00e4a773
0x00e4a777
0x00e4a778
0x00e4a779
0x00e4a77e
0x00e4a783
0x00000000
0x00000000
0x00000000

APIs

_free.LIBCMT ref: 00E4A796
_free.LIBCMT ref: 00E4A7AB
_free.LIBCMT ref: 00E4A7C0
_free.LIBCMT ref: 00E4A7D5
_free.LIBCMT ref: 00E4A7EA
GetCPInfo.KERNEL32(?,?), ref: 00E4A834

Part of subcall function 00E53B67: _free.LIBCMT ref: 00E53BD2

_free.LIBCMT ref: 00E4AA78
_free.LIBCMT ref: 00E4AA8B
_free.LIBCMT ref: 00E4AA99
_free.LIBCMT ref: 00E4AAA4
_free.LIBCMT ref: 00E4AAE6
_free.LIBCMT ref: 00E4AAEE
_free.LIBCMT ref: 00E4AAF6
_free.LIBCMT ref: 00E4AAFE
_free.LIBCMT ref: 00E4AB0C

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 1d03cdf5967e4169f7edf5c199bb24170e24e8a6aee137c5c300e7a4976613d3
Instruction ID: ffb985dbb1f09ae261262d13c01a9f811458fcd6f337a2c740600ddfa60a7b51
Opcode Fuzzy Hash: 1d03cdf5967e4169f7edf5c199bb24170e24e8a6aee137c5c300e7a4976613d3
Instruction Fuzzy Hash: 33D19A71D402059FDB20DFA8D881BEEBBF5FF08310F195069E988BB282D771A945DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00E58109, Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00E58109(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0xe7b218) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E00E4F1E8(_t46);
							E00E5749D( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E00E4F1E8(_t47);
							E00E57954( *((intOrPtr*)(_t74 + 0x88)));
						}
						E00E4F1E8( *((intOrPtr*)(_t74 + 0x7c)));
						E00E4F1E8( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E00E4F1E8( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E00E4F1E8( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E00E4F1E8( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E00E4F1E8( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E00E5827C( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0xe7b3b0) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E00E4F1E8(_t31);
							E00E4F1E8( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E00E4F1E8(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E00E4F1E8(_t74);
			}

0x00e58111
0x00e58115
0x00e5811d
0x00e58126
0x00e5812b
0x00e58132
0x00e5813a
0x00e58142
0x00e5814d
0x00e58153
0x00e58154
0x00e5815c
0x00e58164
0x00e5816f
0x00e58175
0x00e58179
0x00e58184
0x00e5818a
0x00e5812b
0x00e5818b
0x00e58193
0x00e581a6
0x00e581b9
0x00e581c7
0x00e581d2
0x00e581d7
0x00e581e0
0x00e581e8
0x00e581e9
0x00e581ef
0x00e581f2
0x00e581f5
0x00e581fc
0x00e581fe
0x00e58202
0x00e5820a
0x00e58211
0x00e58217
0x00e58218
0x00e58218
0x00e5821f
0x00e58221
0x00e58226
0x00e5822e
0x00e58233
0x00e58234
0x00e58234
0x00e58237
0x00e5823a
0x00e5823d
0x00e58240
0x00e58240
0x00e58252

APIs

___free_lconv_mon.LIBCMT ref: 00E5814D

Part of subcall function 00E5749D: _free.LIBCMT ref: 00E574BA
Part of subcall function 00E5749D: _free.LIBCMT ref: 00E574CC
Part of subcall function 00E5749D: _free.LIBCMT ref: 00E574DE
Part of subcall function 00E5749D: _free.LIBCMT ref: 00E574F0
Part of subcall function 00E5749D: _free.LIBCMT ref: 00E57502
Part of subcall function 00E5749D: _free.LIBCMT ref: 00E57514
Part of subcall function 00E5749D: _free.LIBCMT ref: 00E57526
Part of subcall function 00E5749D: _free.LIBCMT ref: 00E57538
Part of subcall function 00E5749D: _free.LIBCMT ref: 00E5754A
Part of subcall function 00E5749D: _free.LIBCMT ref: 00E5755C
Part of subcall function 00E5749D: _free.LIBCMT ref: 00E5756E
Part of subcall function 00E5749D: _free.LIBCMT ref: 00E57580
Part of subcall function 00E5749D: _free.LIBCMT ref: 00E57592

_free.LIBCMT ref: 00E58142

Part of subcall function 00E4F1E8: HeapFree.KERNEL32(00000000,00000000,?,00E57BF8,?,00000000,?,?,?,00E57E9D,?,00000007,?,?,00E582A2,?), ref: 00E4F1FE
Part of subcall function 00E4F1E8: GetLastError.KERNEL32(?,?,00E57BF8,?,00000000,?,?,?,00E57E9D,?,00000007,?,?,00E582A2,?,?), ref: 00E4F210

_free.LIBCMT ref: 00E58164
_free.LIBCMT ref: 00E58179
_free.LIBCMT ref: 00E58184
_free.LIBCMT ref: 00E581A6
_free.LIBCMT ref: 00E581B9
_free.LIBCMT ref: 00E581C7
_free.LIBCMT ref: 00E581D2
_free.LIBCMT ref: 00E5820A
_free.LIBCMT ref: 00E58211
_free.LIBCMT ref: 00E5822E
_free.LIBCMT ref: 00E58246

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 1ffad8d7a57a7522317b86dfc4d9abb711e09953c3842058552a561941c6808e
Instruction ID: c8c58fbdabed8c5cd541f9d9e74cd48eb8c71d2881537e57a3119084eb83093a
Opcode Fuzzy Hash: 1ffad8d7a57a7522317b86dfc4d9abb711e09953c3842058552a561941c6808e
Instruction Fuzzy Hash: 7131A731601B05DFEB209A78EA45B5A77E8EF00725F156869F848F7262DF30ED49CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00E25CE0, Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 150
threadnetworkCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00E25CE0(char* __edx, void* __eflags, intOrPtr* _a4, intOrPtr _a8) {
				intOrPtr* _v8;
				char _v16;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t29;
				long _t34;
				intOrPtr _t52;
				intOrPtr _t58;
				void* _t59;
				void* _t60;
				intOrPtr* _t63;
				char* _t64;
				char* _t66;
				char* _t67;
				char* _t69;
				char* _t70;
				intOrPtr* _t75;
				intOrPtr _t80;
				void* _t82;
				intOrPtr* _t83;
				intOrPtr* _t84;
				signed int _t86;
				void* _t87;
				char* _t88;
				void* _t89;
				char* _t90;
				char* _t91;
				void* _t92;
				char* _t93;
				char* _t97;

				_t77 = __edx;
				_push(0xffffffff);
				_push(0xe60d30);
				_t29 =  *0xe7b068; // 0x1b9618b6
				 *[fs:0x0] =  &_v16;
				_t83 = _t63;
				E00E20EA0(_t59, _t63, __edx, _t80);
				_t88 = _t87 - 0x18;
				_t64 = _t88;
				 *((intOrPtr*)(_t64 + 0x10)) = 0;
				 *((intOrPtr*)(_t64 + 0x14)) = 0xf;
				 *_t64 = 0;
				E00E14C40(_t59, _t64, __edx, "Socket::SendData", 0x10);
				_t34 = GetCurrentThreadId();
				_t65 = 0x11c;
				E00E12260(_t59, 0x11c, _t77, _t80, _t34, _t29 ^ _t86, _t80, _t82, _t59, _t63,  *[fs:0x0]);
				_t89 = _t88 + 0x1c;
				_t60 = 0;
				if(_a4 == 0) {
					L5:
					_t84 = _a4;
					L6:
					E00E20EA0(_t60, _t65, _t77, _t80);
					_t90 = _t89 - 0x18;
					_t66 = _t90;
					_a4 = _t90;
					 *((intOrPtr*)(_t66 + 0x10)) = 0;
					 *((intOrPtr*)(_t66 + 0x14)) = 0xf;
					 *_t66 = 0;
					E00E14C40(_t60, _t66, _t77, "-SendBuf: ", 0xa);
					_t91 = _t90 - 0x18;
					_v8 = 0;
					_t67 = _t91;
					 *((intOrPtr*)(_t67 + 0x10)) = 0;
					 *((intOrPtr*)(_t67 + 0x14)) = 0xf;
					 *_t67 = 0;
					E00E14C40(_t60, _t67, _t77, "Socket::SendData", 0x10);
					_push(GetCurrentThreadId());
					_t68 = 0x12c;
					_v8 = 0xffffffff;
					E00E12110(_t60, 0x12c, _t77, _t80);
					_t92 = _t91 + 0x34;
					if(_t84 == 0) {
						L10:
						E00E20EA0(_t60, _t68, _t77, _t80);
						_t93 = _t92 - 0x18;
						_t69 = _t93;
						_a4 = _t93;
						 *((intOrPtr*)(_t69 + 0x10)) = 0;
						 *((intOrPtr*)(_t69 + 0x14)) = 0xf;
						 *_t69 = 0;
						E00E14C40(_t60, _t69, _t77, "-Result: ", 9);
						_v8 = 1;
						_t70 = _t93 - 0x18;
						 *((intOrPtr*)(_t70 + 0x10)) = 0;
						 *((intOrPtr*)(_t70 + 0x14)) = 0xf;
						 *_t70 = 0;
						E00E14C40(_t60, _t70, _t77, "Socket::SendData", 0x10);
						_push(GetCurrentThreadId());
						_v8 = 0xffffffff;
						E00E12110(_t60, 0x130, _t77, _t80);
						E00E20EA0(_t60, 0x130, _t77, _t80);
						if( *0xe7ea10 != 0) {
							_t79 =  ==  ? "FALSE" : "TRUE";
							E00E167A0(_t60,  ==  ? "FALSE" : "TRUE", _t80, _t60, E00E164F0(0xe7d8f8,  ==  ? "FALSE" : "TRUE"));
						}
						 *[fs:0x0] = _v16;
						return _t60;
					}
					E00E20EA0(_t60, 0x12c, _t77, _t80);
					_t97 = _t92 - 0x18;
					_t75 = _t84;
					_t77 = _t97;
					_t17 = _t75 + 1; // 0x1
					_t80 = _t17;
					 *((intOrPtr*)(_t77 + 0x10)) = 0;
					 *((intOrPtr*)(_t77 + 0x14)) = 0xf;
					 *_t77 = 0;
					do {
						_t52 =  *_t75;
						_t75 = _t75 + 1;
					} while (_t52 != 0);
					_t68 = _t77;
					E00E14C40(_t60, _t77, _t77, _t84, _t75 - _t80);
					E00E12350(_t60, _t80);
					_t92 = _t97 + 0x18;
					goto L10;
				}
				_t80 = _a8;
				if(_t80 <= 0) {
					goto L5;
				}
				_t65 = _t83;
				if( *((intOrPtr*)( *((intOrPtr*)( *_t83 + 0xc))))() == 0) {
					goto L5;
				}
				_t58 =  *((intOrPtr*)(_t83 + 0xc));
				_t84 = _a4;
				if(_t58 != 0xffffffff) {
					__imp__#19(_t58, _t84, _t80, 0);
					_t65 = 1;
					_t60 =  >  ? 1 : 0;
				}
				goto L6;
			}

0x00e25ce0
0x00e25ce3
0x00e25ce5
0x00e25cf5
0x00e25d00
0x00e25d06
0x00e25d08
0x00e25d0d
0x00e25d10
0x00e25d14
0x00e25d1b
0x00e25d27
0x00e25d2a
0x00e25d2f
0x00e25d35
0x00e25d3a
0x00e25d3f
0x00e25d42
0x00e25d48
0x00e25d83
0x00e25d83
0x00e25d86
0x00e25d86
0x00e25d8b
0x00e25d8e
0x00e25d90
0x00e25d95
0x00e25d9c
0x00e25da8
0x00e25dab
0x00e25db0
0x00e25db3
0x00e25dba
0x00e25dbe
0x00e25dc5
0x00e25dd1
0x00e25dd4
0x00e25dde
0x00e25ddf
0x00e25de4
0x00e25deb
0x00e25df0
0x00e25df5
0x00e25e31
0x00e25e31
0x00e25e36
0x00e25e39
0x00e25e3b
0x00e25e40
0x00e25e47
0x00e25e53
0x00e25e56
0x00e25e5e
0x00e25e65
0x00e25e69
0x00e25e70
0x00e25e7c
0x00e25e7f
0x00e25e89
0x00e25e8f
0x00e25e96
0x00e25e9e
0x00e25eaa
0x00e25ebd
0x00e25ec6
0x00e25ecb
0x00e25ed3
0x00e25ee1
0x00e25ee1
0x00e25df7
0x00e25dfc
0x00e25dff
0x00e25e01
0x00e25e03
0x00e25e03
0x00e25e06
0x00e25e0d
0x00e25e14
0x00e25e17
0x00e25e17
0x00e25e19
0x00e25e1a
0x00e25e22
0x00e25e24
0x00e25e29
0x00e25e2e
0x00000000
0x00e25e2e
0x00e25d4a
0x00e25d4f
0x00000000
0x00000000
0x00e25d53
0x00e25d5c
0x00000000
0x00000000
0x00e25d5e
0x00e25d61
0x00e25d67
0x00e25d6e
0x00e25d79
0x00e25d7e
0x00e25d7e
0x00000000

APIs

Part of subcall function 00E20EA0: __Mtx_unlock.LIBCPMT ref: 00E20F3F

GetCurrentThreadId.KERNEL32 ref: 00E25D2F
send.WS2_32(?,00000000,?,00000000), ref: 00E25D6E
GetCurrentThreadId.KERNEL32 ref: 00E25DD9
GetCurrentThreadId.KERNEL32 ref: 00E25E84

Strings

-SendBuf: , xrefs: 00E25DA3
TRUE, xrefs: 00E25EB3
-Result: , xrefs: 00E25E4E
Socket::SendData, xrefs: 00E25D22, 00E25DCC, 00E25E77
FALSE, xrefs: 00E25EAC

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: CurrentThread$Mtx_unlocksend
String ID: -Result: $-SendBuf: $FALSE$Socket::SendData$TRUE
API String ID: 748144647-836181643
Opcode ID: 8e4567c8fcd5ed8f77036b6d09f47c1bc56c62715d4f51f1b3a1ad315587b7b9
Instruction ID: e40fc9360a6bf2775e62eef51953bc69b60ffeb2a4ea29611bceb9bed46e6cad
Opcode Fuzzy Hash: 8e4567c8fcd5ed8f77036b6d09f47c1bc56c62715d4f51f1b3a1ad315587b7b9
Instruction Fuzzy Hash: 355107B1600300ABEB18AF38D91679A7BE49F42318F18555CE9547F3C3C7B6894687E2

Uniqueness

Uniqueness Score: -1.00%

Function 00E17710, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00E17710(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, char _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed char** _v28;
				char _v72;
				intOrPtr* _v88;
				void* __ebp;
				signed int _t38;
				intOrPtr _t46;
				intOrPtr* _t53;
				char _t56;
				char _t58;
				signed int _t62;
				char _t63;
				intOrPtr _t65;
				void* _t69;
				void* _t72;
				void* _t74;
				signed char** _t75;
				void* _t81;
				void* _t82;
				intOrPtr _t83;
				intOrPtr _t84;
				intOrPtr _t85;
				intOrPtr* _t87;
				void* _t89;
				void* _t90;
				intOrPtr _t91;
				signed char** _t95;
				intOrPtr* _t96;
				intOrPtr* _t97;
				char* _t98;
				void* _t103;
				intOrPtr _t104;
				void* _t105;
				void* _t106;
				void* _t107;
				void* _t108;

				_push(0xffffffff);
				_push(0xe5fea0);
				_push( *[fs:0x0]);
				_t104 = _t103 - 0x38;
				_t38 =  *0xe7b068; // 0x1b9618b6
				_push(_t38 ^ _t101);
				 *[fs:0x0] =  &_v16;
				_v20 = _t104;
				_t65 = __ecx;
				_v24 = __ecx;
				_t95 = E00E48661(_t82);
				_v28 = _t95;
				E00E2A3A3(_t82, _t108,  &_v72);
				_t105 = _t104 + 4;
				 *((intOrPtr*)(_t65 + 8)) = 0;
				_t109 = _a8;
				 *((intOrPtr*)(_t65 + 0x10)) = 0;
				 *((intOrPtr*)(_t65 + 0x14)) = 0;
				_v8 = 0;
				if(_a8 == 0) {
					_t96 =  *((intOrPtr*)(_t95 + 8));
				} else {
					_t96 = 0xe71f6b;
				}
				E00E2A3A3(_t82, _t109,  &_v72);
				_t87 = _t96;
				_t106 = _t105 + 4;
				_t13 = _t87 + 1; // 0xe71f6c
				_t69 = _t13;
				do {
					_t46 =  *_t87;
					_t87 = _t87 + 1;
				} while (_t46 != 0);
				_t89 = _t87 - _t69 + 1;
				_push(1);
				_push(_t89);
				_t83 = E00E46B47();
				_t107 = _t106 + 8;
				if(_t83 == 0) {
					E00E29F8B(__eflags);
					goto L19;
				} else {
					if(_t89 != 0) {
						_t81 = _t83 - _t96;
						asm("o16 nop [eax+eax]");
						do {
							_t63 =  *_t96;
							_t14 = _t96 + 1; // 0x656e6567
							_t96 = _t14;
							 *((char*)(_t81 + _t96 - 1)) = _t63;
							_t89 = _t89 - 1;
						} while (_t89 != 0);
					}
					_t90 = 6;
					 *((intOrPtr*)(_t65 + 8)) = _t83;
					_push(1);
					_push(6);
					_t97 = "false";
					_t84 = E00E46B47();
					_t107 = _t107 + 8;
					if(_t84 == 0) {
						L19:
						E00E29F8B(__eflags);
						goto L20;
					} else {
						_t72 = _t84 - _t97;
						do {
							_t56 =  *_t97;
							_t97 = _t97 + 1;
							 *((char*)(_t72 + _t97 - 1)) = _t56;
							_t90 = _t90 - 1;
						} while (_t90 != 0);
						_t91 = 5;
						 *((intOrPtr*)(_t65 + 0x10)) = _t84;
						_push(1);
						_push(5);
						_t98 = "true";
						_t85 = E00E46B47();
						_t107 = _t107 + 8;
						if(_t85 == 0) {
							L20:
							E00E29F8B(__eflags);
							E00E160B0(_v28);
							E00E4309B(0, 0);
							asm("int3");
							asm("int3");
							asm("int3");
							_t53 = _v88;
							 *_t53 = 0xe6339c;
							 *((intOrPtr*)(_t53 + 4)) = 5;
							return 1;
						} else {
							_t74 = _t85 - _t98;
							do {
								_t58 =  *_t98;
								_t98 =  &(_t98[1]);
								 *((char*)(_t74 + _t98 - 1)) = _t58;
								_t91 = _t91 - 1;
							} while (_t91 != 0);
							 *((intOrPtr*)(_t65 + 0x14)) = _t85;
							if(_a8 == 0) {
								_t75 = _v28;
								 *((char*)(_t65 + 0xc)) =  *( *_t75) & 0x000000ff;
								_t62 =  *(_t75[1]) & 0x000000ff;
								 *(_t65 + 0xd) = _t62;
								 *[fs:0x0] = _v16;
								return _t62;
							} else {
								 *((short*)(_t65 + 0xc)) = 0x2c2e;
								 *[fs:0x0] = _v16;
								return _t58;
							}
						}
					}
				}
			}

0x00e17713
0x00e17715
0x00e17720
0x00e17721
0x00e17727
0x00e1772e
0x00e17732
0x00e17738
0x00e1773b
0x00e1773d
0x00e17745
0x00e1774b
0x00e1774e
0x00e17753
0x00e17756
0x00e1775d
0x00e17761
0x00e17768
0x00e1776f
0x00e17776
0x00e1777f
0x00e17778
0x00e17778
0x00e17778
0x00e17786
0x00e1778b
0x00e1778d
0x00e17790
0x00e17790
0x00e17793
0x00e17793
0x00e17795
0x00e17796
0x00e1779c
0x00e1779d
0x00e1779f
0x00e177a5
0x00e177a7
0x00e177ac
0x00e1787d
0x00000000
0x00e177b2
0x00e177b4
0x00e177b8
0x00e177ba
0x00e177c0
0x00e177c0
0x00e177c2
0x00e177c2
0x00e177c5
0x00e177c9
0x00e177c9
0x00e177c0
0x00e177ce
0x00e177d3
0x00e177d6
0x00e177d8
0x00e177d9
0x00e177e3
0x00e177e5
0x00e177ea
0x00e17882
0x00e17882
0x00000000
0x00e177f0
0x00e177f2
0x00e177f4
0x00e177f4
0x00e177f6
0x00e177f9
0x00e177fd
0x00e177fd
0x00e17802
0x00e17807
0x00e1780a
0x00e1780c
0x00e1780d
0x00e17817
0x00e17819
0x00e1781e
0x00e17887
0x00e17887
0x00e1788f
0x00e17898
0x00e1789d
0x00e1789e
0x00e1789f
0x00e178a3
0x00e178a6
0x00e178ac
0x00e178b9
0x00e17820
0x00e17822
0x00e17824
0x00e17824
0x00e17826
0x00e17829
0x00e1782d
0x00e1782d
0x00e17836
0x00e17839
0x00e17855
0x00e1785d
0x00e17863
0x00e17866
0x00e1786c
0x00e1787a
0x00e1783b
0x00e1783b
0x00e17844
0x00e17852
0x00e17852
0x00e17839
0x00e1781e
0x00e177ea

APIs

__Getcvt.LIBCPMT ref: 00E1774E
__Getcvt.LIBCPMT ref: 00E17786

Strings

false, xrefs: 00E177D9
true, xrefs: 00E1780D

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Getcvt
String ID: false$true
API String ID: 1921796781-2658103896
Opcode ID: d365885261035dde47a64c85ba20a4a1d7c0e3d6352a8914d20d86e1a277e3e3
Instruction ID: 7cd8f1b69d7f0cd92989e37895c3863808a854cefc42fd47bd2746db974b0802
Opcode Fuzzy Hash: d365885261035dde47a64c85ba20a4a1d7c0e3d6352a8914d20d86e1a277e3e3
Instruction Fuzzy Hash: 73518D35E082444FCB14DF68C4417AABBF1EF81714F1491AEEC847B382C776A905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E40F8F, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 104
threadCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00E40F8F(void* __ebx, void* __ecx, void* __edi, long _a4) {
				intOrPtr* _v12;
				char _v20;
				long _v24;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v56;
				intOrPtr _v92;
				long _t52;
				long _t69;
				long _t74;
				intOrPtr _t86;
				void* _t99;
				long _t100;
				intOrPtr _t105;
				char* _t108;
				intOrPtr* _t109;
				intOrPtr* _t114;
				intOrPtr* _t117;
				intOrPtr* _t120;
				signed int _t125;
				void* _t126;
				long _t130;
				void* _t133;
				intOrPtr _t135;
				intOrPtr* _t136;
				intOrPtr* _t137;
				long _t141;
				long _t142;
				void* _t147;
				void* _t148;
				void* _t150;
				void* _t151;
				void* _t152;

				_t126 = __edi;
				_t99 = __ebx;
				_t52 = _a4;
				_t151 = _t150 - 0xc;
				if(_t52 != 0) {
					_t124 =  *(__ecx + 0x10);
					if( *(__ecx + 0x10) != 0) {
						__eflags = _t52 - 2;
						if(_t52 == 2) {
							_t3 = __ecx + 0x10;
							 *_t3 =  *(__ecx + 0x10) & 0x00000000;
							__eflags =  *_t3;
						}
						return E00E40DD7(_t52, _t124, _t52);
					}
					if(_t52 == 1) {
						return E00E41277(__ecx);
					}
				}
				_t108 =  &_v20;
				E00E29D71(_t108, "switchState");
				E00E4309B( &_v20, 0xe77ff8);
				asm("int3");
				_t147 = _t151;
				_t152 = _t151 - 0x10;
				_push(_t99);
				_t100 = _v24;
				_v36 = _t108;
				_push(_t133);
				_push(_t126);
				__eflags = _t100;
				if(_t100 == 0) {
					_t109 =  &_v24;
					E00E29D71(_t109, "pContext");
					E00E4309B( &_v24, 0xe77ff8);
					asm("int3");
					_t148 = _t152;
					 *((intOrPtr*)(_t109 + 4)) = _v44;
					 *((intOrPtr*)(_t109 + 0x14)) = _v40;
					 *_t109 = 0xe67978;
					 *((intOrPtr*)(_t109 + 0x18)) = 0;
					 *((char*)(_t109 + 0x1c)) = 0;
					 *((intOrPtr*)(_t109 + 0x20)) = 1;
					 *((intOrPtr*)(_t109 + 0x24)) = 0;
					_v56 = _t109;
					 *0xe63210(_t126, _t133, _t100, _t147);
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t109 + 4)))) + 8))))();
					asm("lock xadd [0xe7b0b0], ebx");
					_t135 = _v56;
					_push(0);
					 *((intOrPtr*)(_t135 + 0x28)) = 2;
					 *(_t135 + 0xc) = E00E2EA8C(__eflags);
					_t69 = E00E2F025(_t124,  *((intOrPtr*)(_t109 + 4)), 0,  *(_t135 + 0x14) << 0xa, E00E41293, _t135, 0x10000, _t135 + 0x2c);
					 *(_t135 + 8) = _t69;
					__eflags = _t69;
					if(_t69 == 0) {
						CloseHandle( *(_t135 + 0xc));
						_t136 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t135 + 4)))) + 0xc));
						 *0xe63210();
						 *_t136();
						_t74 = GetLastError();
						__eflags = _t74;
						if(_t74 > 0) {
							__eflags = _t74;
						}
						_t114 =  &_v36;
						E00E36E63(_t114, _t74);
						E00E4309B( &_v36, 0xe79480);
						asm("int3");
						_push(_t148);
						_push(_t136);
						_t137 = _t114;
						E00E2E94B(_t114, _v92);
						 *_t137 = 0xe66fd4;
						return _t137;
					} else {
						return _t135;
					}
				} else {
					 *0xe63210();
					_t130 =  *((intOrPtr*)( *((intOrPtr*)( *_t100 + 8))))();
					__eflags = _t130;
					if(_t130 == 0) {
						 *0xe63210(_t100);
						_t130 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x10)) + 0x1c)))) + 0x1c))))();
					}
					_t105 = _v12;
					_t141 = _a4;
					_t125 =  *(_t105 + 0x10);
					_t117 = _t105 + 0x20;
					 *(_t105 + 0x10) =  *(_t105 + 0x10) & 0x00000000;
					_v12 = _t117;
					__eflags = _t141 - 1;
					if(_t141 != 1) {
						_v12 = _t117;
					} else {
						 *_t117 = 1;
					}
					E00E40BFF(_t125, _t130);
					_t142 = _t141;
					__eflags = _t142;
					if(_t142 == 0) {
						L17:
						_t86 = E00E4122A(_t130);
					} else {
						__eflags = _t142 != 1;
						if(_t142 != 1) {
							goto L17;
						} else {
							E00E2EE3D( *((intOrPtr*)(_t130 + 0xc)),  *((intOrPtr*)(_t105 + 0xc)), 0xffffffff, 1);
							_t120 = _v12;
							_t86 =  *_t120;
							 *_t120 = 0;
						}
					}
					return _t86;
				}
				goto L25;
			}

0x00e40f8f
0x00e40f8f
0x00e40f92
0x00e40f95
0x00e40f9a
0x00e40f9c
0x00e40fa1
0x00e40fb1
0x00e40fb4
0x00e40fb6
0x00e40fb6
0x00e40fb6
0x00e40fb6
0x00000000
0x00e40fbd
0x00e40fa6
0x00000000
0x00e40fa8
0x00e40fa6
0x00e40fc9
0x00e40fcc
0x00e40fda
0x00e40fdf
0x00e40fe1
0x00e40fe3
0x00e40fe6
0x00e40fe7
0x00e40fea
0x00e40fed
0x00e40fee
0x00e40fef
0x00e40ff1
0x00e4108d
0x00e41090
0x00e4109e
0x00e410a3
0x00e410a5
0x00e410ad
0x00e410b4
0x00e410bc
0x00e410c7
0x00e410ca
0x00e410cd
0x00e410d0
0x00e410d5
0x00e410dd
0x00e410e5
0x00e410e7
0x00e410f0
0x00e410f3
0x00e410f5
0x00e410fd
0x00e41118
0x00e41120
0x00e41123
0x00e41125
0x00e41133
0x00e4113e
0x00e41143
0x00e4114b
0x00e4114d
0x00e41153
0x00e41155
0x00e4115a
0x00e4115a
0x00e41160
0x00e41163
0x00e41171
0x00e41176
0x00e41177
0x00e4117a
0x00e4117e
0x00e41180
0x00e41185
0x00e4118f
0x00e41127
0x00e4112d
0x00e4112d
0x00e40ff7
0x00e40ffe
0x00e41008
0x00e4100a
0x00e4100c
0x00e4101f
0x00e41029
0x00e41029
0x00e4102b
0x00e4102e
0x00e41031
0x00e41034
0x00e41037
0x00e4103b
0x00e4103e
0x00e41041
0x00e4104a
0x00e41043
0x00e41046
0x00e41046
0x00e41050
0x00e41055
0x00e41055
0x00e41058
0x00e4107a
0x00e4107c
0x00e4105a
0x00e4105a
0x00e4105d
0x00000000
0x00e4105f
0x00e41069
0x00e4106e
0x00e41076
0x00e41076
0x00e41076
0x00e4105d
0x00e41085
0x00e41085
0x00000000

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00E40FA8

Part of subcall function 00E41277: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,00E40CDB), ref: 00E41287

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00E40FBD
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00E40FCC
__CxxThrowException@8.LIBVCRUNTIME ref: 00E40FDA
Concurrency::details::FreeVirtualProcessorRoot::Affinitize.LIBCONCRT ref: 00E41050
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00E41090
__CxxThrowException@8.LIBVCRUNTIME ref: 00E4109E

Strings

switchState, xrefs: 00E40FC4
pContext, xrefs: 00E41088

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Concurrency::details::$Exception@8FreeProcessorRoot::ThrowVirtualstd::invalid_argument::invalid_argument$AffinitizeExecutionIdleObjectProxy::ResetSingleSuspendThreadWait
String ID: pContext$switchState
API String ID: 3151764488-2660820399
Opcode ID: 82c7cb696c074e5002792d35cd5a07ba1c027561cba01983c5f8ed4b41ca7b18
Instruction ID: 8d285ad9bab12cec7919d31dbb7a77cd7cc63fe6bc4edd385a4bf34fd11aaec7
Opcode Fuzzy Hash: 82c7cb696c074e5002792d35cd5a07ba1c027561cba01983c5f8ed4b41ca7b18
Instruction Fuzzy Hash: A231C135A00314AFCF14EF64E885AAEB3B5BF44314F2055A9E915B7292DB70EE46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E35D98, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00E35D98(signed int __ebx, intOrPtr* __ecx, void* __edx, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v20;
				char _v24;
				void* __edi;
				void* __ebp;
				char* _t19;
				signed int _t27;
				void* _t29;
				intOrPtr* _t31;
				intOrPtr* _t37;
				intOrPtr* _t38;
				void* _t41;

				_t41 = __esi;
				_t31 = __ecx;
				_t27 = __ebx;
				_t37 = __ecx;
				if(_a4 == 0) {
					L9:
					_t31 =  &_v20;
					E00E29D71(_t31, "eventObject");
					_push(0xe77ff8);
					_t19 =  &_v20;
					goto L13;
				} else {
					__eflags = _a4 - 0xffffffff;
					if(_a4 == 0xffffffff) {
						goto L9;
					} else {
						__eax = 0;
						_v8 = 0;
						 &_v8 = GetCurrentProcess();
						__eax = GetCurrentProcess();
						__eflags = __eax;
						if(__eflags == 0) {
							__eax = GetLastError();
							__eflags = __eax;
							if(__eax > 0) {
								__ax & 0x0000ffff = __ax & 0x0000ffff | 0x80070000;
								__eflags = __ax & 0x0000ffff | 0x80070000;
							}
							__ecx =  &_v24;
							__eax = E00E36E46( &_v24, __eax);
							_push(0xe783a4);
							__eax =  &_v24;
							L13:
							_push(_t19);
							E00E4309B();
							asm("int3");
							_push(_t37);
							_t38 = _t31;
							if(( *(_t38 + 0x30) & 0x00000004) != 0) {
								__eflags = 0;
								return 0;
							} else {
								_push(_t27);
								asm("lock xadd [edi+0x14], ebx");
								_t29 = (_t27 | 0xffffffff) - 1;
								if(_t29 == 0) {
									 *0xe63210(_t41);
									 *((intOrPtr*)( *((intOrPtr*)( *_t38 + 0x1c))))();
									E00E362B5( *((intOrPtr*)(_t38 + 4)), _t38);
								}
								return _t29;
							}
						} else {
							__eax = E00E2C07D(__edx, __eflags);
							__ecx = 0xc;
							__ecx = _v8;
							 *((intOrPtr*)(__eax + 8)) = _v8;
							__ecx = __edi + 0xb8;
							__eax = E00E33DB9(__ebx, __edi + 0xb8, __edx, __edi, __esi);
							__edi = __eax;
							__esp = __ebp;
							_pop(__ebp);
							return __eax;
						}
					}
				}
			}

0x00e35d98
0x00e35d98
0x00e35d98
0x00e35da3
0x00e35da5
0x00e35df4
0x00e35df9
0x00e35dfc
0x00e35e01
0x00e35e06
0x00000000
0x00e35da7
0x00e35da7
0x00e35dab
0x00000000
0x00e35dad
0x00e35dad
0x00e35db3
0x00e35dba
0x00e35dc4
0x00e35dd1
0x00e35dd3
0x00e35e0b
0x00e35e11
0x00e35e13
0x00e35e18
0x00e35e18
0x00e35e18
0x00e35e1e
0x00e35e21
0x00e35e26
0x00e35e2b
0x00e35e2e
0x00e35e2e
0x00e35e2f
0x00e35e34
0x00e356e8
0x00e356e9
0x00e356ef
0x00e3571e
0x00e35721
0x00e356f1
0x00e356f1
0x00e356f5
0x00e356fa
0x00e356fb
0x00e35705
0x00e3570d
0x00e35713
0x00e35718
0x00e3571d
0x00e3571d
0x00e35dd5
0x00e35dd7
0x00e35ddc
0x00e35ddd
0x00e35de1
0x00e35de4
0x00e35dea
0x00e35def
0x00e35df0
0x00e35df0
0x00e35df1
0x00e35df1
0x00e35dd3
0x00e35dab

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00E35DBA
GetCurrentProcess.KERNEL32(000000FF,00000000), ref: 00E35DC4
DuplicateHandle.KERNEL32(00000000), ref: 00E35DCB
SafeRWList.LIBCONCRT ref: 00E35DEA

Part of subcall function 00E33DB9: __EH_prolog3.LIBCMT ref: 00E33DC0
Part of subcall function 00E33DB9: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00E33DCA
Part of subcall function 00E33DB9: List.LIBCMT ref: 00E33DD4

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00E35DFC
GetLastError.KERNEL32 ref: 00E35E0B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00E35E21
__CxxThrowException@8.LIBVCRUNTIME ref: 00E35E2F

Strings

eventObject, xrefs: 00E35DF4

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorException@8H_prolog3HandleLastLock::_ReaderSafeThrowWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 3870774015-1680012138
Opcode ID: 835b7e74cb75c50601b061a074441b5030caf7fec3238db519e5d37c918fae14
Instruction ID: af888f1a98d509c92e2944b0de2e28abc5ae9e16bd3ea4c34a187c6fadea3fef
Opcode Fuzzy Hash: 835b7e74cb75c50601b061a074441b5030caf7fec3238db519e5d37c918fae14
Instruction Fuzzy Hash: 7611C272500204FACB14EBB5ED4DEAF7BACAF00300F205525B115F2191DB708B08C660

Uniqueness

Uniqueness Score: -1.00%

Function 00E4FA93, Relevance: 15.1, APIs: 10, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00E4FA93(void* __esi, char _a4) {
				void* _v5;
				char _v12;
				char _v16;
				char _v20;
				void* __ebp;
				char _t55;
				char _t61;
				intOrPtr _t67;
				void* _t71;

				_t71 = __esi;
				_t36 = _a4;
				_t67 =  *_a4;
				_t75 = _t67 - 0xe69680;
				if(_t67 != 0xe69680) {
					E00E4F1E8(_t67);
					_t36 = _a4;
				}
				E00E4F1E8( *((intOrPtr*)(_t36 + 0x3c)));
				E00E4F1E8( *((intOrPtr*)(_a4 + 0x30)));
				E00E4F1E8( *((intOrPtr*)(_a4 + 0x34)));
				E00E4F1E8( *((intOrPtr*)(_a4 + 0x38)));
				E00E4F1E8( *((intOrPtr*)(_a4 + 0x28)));
				E00E4F1E8( *((intOrPtr*)(_a4 + 0x2c)));
				E00E4F1E8( *((intOrPtr*)(_a4 + 0x40)));
				E00E4F1E8( *((intOrPtr*)(_a4 + 0x44)));
				E00E4F1E8( *((intOrPtr*)(_a4 + 0x360)));
				_v16 =  &_a4;
				_t55 = 5;
				_v12 = _t55;
				_v20 = _t55;
				_push( &_v12);
				_push( &_v16);
				_push( &_v20);
				E00E4F8DB(_t75);
				_v16 =  &_a4;
				_t61 = 4;
				_v20 = _t61;
				_v12 = _t61;
				_push( &_v20);
				_push( &_v16);
				_push( &_v12);
				return E00E4F93C(_t71, _t75);
			}

0x00e4fa93
0x00e4fa98
0x00e4fa9e
0x00e4faa0
0x00e4faa6
0x00e4faa9
0x00e4faae
0x00e4fab1
0x00e4fab5
0x00e4fac0
0x00e4facb
0x00e4fad6
0x00e4fae1
0x00e4faec
0x00e4faf7
0x00e4fb02
0x00e4fb10
0x00e4fb1b
0x00e4fb23
0x00e4fb24
0x00e4fb27
0x00e4fb2d
0x00e4fb31
0x00e4fb35
0x00e4fb36
0x00e4fb40
0x00e4fb46
0x00e4fb47
0x00e4fb4a
0x00e4fb50
0x00e4fb54
0x00e4fb58
0x00e4fb61

APIs

_free.LIBCMT ref: 00E4FAA9

Part of subcall function 00E4F1E8: HeapFree.KERNEL32(00000000,00000000,?,00E57BF8,?,00000000,?,?,?,00E57E9D,?,00000007,?,?,00E582A2,?), ref: 00E4F1FE
Part of subcall function 00E4F1E8: GetLastError.KERNEL32(?,?,00E57BF8,?,00000000,?,?,?,00E57E9D,?,00000007,?,?,00E582A2,?,?), ref: 00E4F210

_free.LIBCMT ref: 00E4FAB5
_free.LIBCMT ref: 00E4FAC0
_free.LIBCMT ref: 00E4FACB
_free.LIBCMT ref: 00E4FAD6
_free.LIBCMT ref: 00E4FAE1
_free.LIBCMT ref: 00E4FAEC
_free.LIBCMT ref: 00E4FAF7
_free.LIBCMT ref: 00E4FB02
_free.LIBCMT ref: 00E4FB10

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 21ea2b9ba3feaea28ccad0e331119ebb0af73a148b60e8bff11a707ffe46c337
Instruction ID: 1e5c375fb3776671430fb1c7e6365a17e2baaa52d203d732c49b83b29da30bd8
Opcode Fuzzy Hash: 21ea2b9ba3feaea28ccad0e331119ebb0af73a148b60e8bff11a707ffe46c337
Instruction Fuzzy Hash: 2C21A576901109EFCB41EF94D891DDE7BF8AF08750B4151A6F619AB222EB31EB54CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00E52985, Relevance: 13.8, APIs: 9, Instructions: 302
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E00E52985(signed int _a4, void* _a8, unsigned int _a12) {
				char _v5;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				void* _v24;
				void* _v28;
				long _v32;
				char _v36;
				void* _v40;
				long _v44;
				signed int* _t137;
				signed int _t139;
				intOrPtr _t143;
				unsigned int _t154;
				intOrPtr _t158;
				signed int _t160;
				signed int _t163;
				long _t164;
				intOrPtr _t169;
				signed int _t170;
				intOrPtr _t172;
				signed int _t174;
				signed int _t178;
				void _t180;
				char _t185;
				char _t190;
				signed int _t198;
				signed int _t199;
				signed int _t200;
				signed int _t207;
				long _t210;
				unsigned int _t212;
				intOrPtr _t214;
				unsigned int _t217;
				signed int _t219;
				signed int _t220;
				signed int _t221;
				signed int _t222;
				signed char _t224;
				char _t226;
				signed int _t228;
				void* _t229;
				signed int _t230;
				char* _t231;
				char* _t232;
				signed int _t235;
				signed int _t236;
				void* _t240;
				void* _t242;
				void* _t243;

				_t198 = _a4;
				_t246 = _t198 - 0xfffffffe;
				if(_t198 != 0xfffffffe) {
					__eflags = _t198;
					if(__eflags < 0) {
						L59:
						_t137 = E00E4A05E(__eflags);
						 *_t137 =  *_t137 & 0x00000000;
						__eflags =  *_t137;
						 *((intOrPtr*)(E00E4A071( *_t137))) = 9;
						L60:
						_t139 = E00E4956C();
						goto L61;
					}
					__eflags = _t198 -  *0xe7e718; // 0x40
					if(__eflags >= 0) {
						goto L59;
					}
					_t207 = _t198 >> 6;
					_t235 = (_t198 & 0x0000003f) * 0x38;
					_v12 = _t207;
					_t143 =  *((intOrPtr*)(0xe7e518 + _t207 * 4));
					_v20 = _t235;
					_v36 = 1;
					_t224 =  *((intOrPtr*)(_t143 + _t235 + 0x28));
					__eflags = 1 & _t224;
					if(__eflags == 0) {
						goto L59;
					}
					_t210 = _a12;
					__eflags = _t210 - 0x7fffffff;
					if(__eflags <= 0) {
						__eflags = _t210;
						if(_t210 == 0) {
							L58:
							return 0;
						}
						__eflags = _t224 & 0x00000002;
						if((_t224 & 0x00000002) != 0) {
							goto L58;
						}
						__eflags = _a8;
						if(__eflags == 0) {
							goto L6;
						}
						_v28 =  *((intOrPtr*)(_t143 + _t235 + 0x18));
						_t226 =  *((intOrPtr*)(_t143 + _t235 + 0x29));
						_v5 = _t226;
						_t240 = 0;
						_t228 = _t226 - 1;
						__eflags = _t228;
						if(_t228 == 0) {
							__eflags =  !_t210 & 0x00000001;
							if(__eflags == 0) {
								L14:
								 *(E00E4A05E(__eflags)) =  *_t149 & _t240;
								 *((intOrPtr*)(E00E4A071(__eflags))) = 0x16;
								E00E4956C();
								goto L39;
							} else {
								_t154 = 4;
								_t212 = _t210 >> 1;
								_v16 = _t154;
								__eflags = _t212 - _t154;
								if(_t212 >= _t154) {
									_t154 = _t212;
									_v16 = _t212;
								}
								_t240 = E00E4F56D(_t154);
								E00E4F1E8(0);
								E00E4F1E8(0);
								_t243 = _t242 + 0xc;
								_v24 = _t240;
								__eflags = _t240;
								if(__eflags != 0) {
									_t158 = E00E52ED2(_t198, 0, 0, 1);
									_t242 = _t243 + 0x10;
									_t214 =  *((intOrPtr*)(0xe7e518 + _v12 * 4));
									 *((intOrPtr*)(_t235 + _t214 + 0x20)) = _t158;
									 *(_t235 + _t214 + 0x24) = _t228;
									_t229 = _t240;
									_t210 = _v16;
									_t143 =  *((intOrPtr*)(0xe7e518 + _v12 * 4));
									L22:
									_t199 = _v20;
									_t235 = 0;
									_v40 = _t229;
									__eflags =  *(_t199 + _t143 + 0x28) & 0x00000048;
									_t200 = _a4;
									if(( *(_t199 + _t143 + 0x28) & 0x00000048) != 0) {
										_t180 =  *((intOrPtr*)(_v20 + _t143 + 0x2a));
										_t200 = _a4;
										__eflags = _t180 - 0xa;
										if(_t180 != 0xa) {
											__eflags = _t210;
											if(_t210 != 0) {
												_t235 = 1;
												 *_t229 = _t180;
												_t231 = _t229 + 1;
												_t220 = _t210 - 1;
												__eflags = _v5;
												_v24 = _t231;
												_v16 = _t220;
												 *((char*)(_v20 +  *((intOrPtr*)(0xe7e518 + _v12 * 4)) + 0x2a)) = 0xa;
												_t200 = _a4;
												if(_v5 != 0) {
													_t185 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(0xe7e518 + _v12 * 4)) + 0x2b));
													_t200 = _a4;
													__eflags = _t185 - 0xa;
													if(_t185 != 0xa) {
														__eflags = _t220;
														if(_t220 != 0) {
															 *_t231 = _t185;
															_t232 = _t231 + 1;
															_t221 = _t220 - 1;
															__eflags = _v5 - 1;
															_v24 = _t232;
															_t235 = 2;
															_v16 = _t221;
															 *((char*)(_v20 +  *((intOrPtr*)(0xe7e518 + _v12 * 4)) + 0x2b)) = 0xa;
															_t200 = _a4;
															if(_v5 == 1) {
																_t190 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(0xe7e518 + _v12 * 4)) + 0x2c));
																_t200 = _a4;
																__eflags = _t190 - 0xa;
																if(_t190 != 0xa) {
																	__eflags = _t221;
																	if(_t221 != 0) {
																		 *_t232 = _t190;
																		_t222 = _t221 - 1;
																		__eflags = _t222;
																		_v16 = _t222;
																		_v24 = _t232 + 1;
																		_t235 = 3;
																		 *((char*)(_v20 +  *((intOrPtr*)(0xe7e518 + _v12 * 4)) + 0x2c)) = 0xa;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
									_t160 = E00E5A117(_t200);
									__eflags = _t160;
									if(_t160 == 0) {
										L42:
										_v36 = 0;
										L43:
										_t163 = ReadFile(_v28, _v24, _v16,  &_v32, 0);
										__eflags = _t163;
										if(_t163 == 0) {
											L54:
											_t164 = GetLastError();
											_t235 = 5;
											__eflags = _t164 - _t235;
											if(__eflags != 0) {
												__eflags = _t164 - 0x6d;
												if(_t164 != 0x6d) {
													L38:
													E00E4A03B(_t164);
													goto L39;
												}
												_t236 = 0;
												goto L40;
											}
											 *((intOrPtr*)(E00E4A071(__eflags))) = 9;
											 *(E00E4A05E(__eflags)) = _t235;
											goto L39;
										}
										_t217 = _a12;
										__eflags = _v32 - _t217;
										if(_v32 > _t217) {
											goto L54;
										}
										_t236 = _t235 + _v32;
										__eflags = _t236;
										L46:
										_t230 = _v20;
										_t169 =  *((intOrPtr*)(0xe7e518 + _v12 * 4));
										__eflags =  *((char*)(_t230 + _t169 + 0x28));
										if( *((char*)(_t230 + _t169 + 0x28)) < 0) {
											__eflags = _v5 - 2;
											if(_v5 == 2) {
												__eflags = _v36;
												_push(_t236 >> 1);
												_push(_v40);
												_push(_t200);
												if(_v36 == 0) {
													_t170 = E00E524E0();
												} else {
													_t170 = E00E52800();
												}
											} else {
												_t218 = _t217 >> 1;
												__eflags = _t217 >> 1;
												_t170 = E00E526A7(_t217 >> 1, _t217 >> 1, _t200, _v24, _t236, _a8, _t218);
											}
											_t236 = _t170;
										}
										goto L40;
									}
									_t219 = _v20;
									_t172 =  *((intOrPtr*)(0xe7e518 + _v12 * 4));
									__eflags =  *((char*)(_t219 + _t172 + 0x28));
									if( *((char*)(_t219 + _t172 + 0x28)) >= 0) {
										goto L42;
									}
									_t174 = GetConsoleMode(_v28,  &_v44);
									__eflags = _t174;
									if(_t174 == 0) {
										goto L42;
									}
									__eflags = _v5 - 2;
									if(_v5 != 2) {
										goto L43;
									}
									_t178 = ReadConsoleW(_v28, _v24, _v16 >> 1,  &_v32, 0);
									__eflags = _t178;
									if(_t178 != 0) {
										_t217 = _a12;
										_t236 = _t235 + _v32 * 2;
										goto L46;
									}
									_t164 = GetLastError();
									goto L38;
								} else {
									 *((intOrPtr*)(E00E4A071(__eflags))) = 0xc;
									 *(E00E4A05E(__eflags)) = 8;
									L39:
									_t236 = _t235 | 0xffffffff;
									__eflags = _t236;
									L40:
									E00E4F1E8(_t240);
									return _t236;
								}
							}
						}
						__eflags = _t228 == 1;
						if(_t228 == 1) {
							__eflags =  !_t210 & 0x00000001;
							if(__eflags != 0) {
								_t229 = _a8;
								_v16 = _t210;
								_v24 = _t229;
								_t143 =  *((intOrPtr*)(0xe7e518 + _v12 * 4));
								goto L22;
							}
							goto L14;
						} else {
							_t229 = _a8;
							_v16 = _t210;
							_v24 = _t229;
							goto L22;
						}
					}
					L6:
					 *(E00E4A05E(__eflags)) =  *_t145 & 0x00000000;
					 *((intOrPtr*)(E00E4A071(__eflags))) = 0x16;
					goto L60;
				} else {
					 *(E00E4A05E(_t246)) =  *_t197 & 0x00000000;
					_t139 = E00E4A071(_t246);
					 *_t139 = 9;
					L61:
					return _t139 | 0xffffffff;
				}
			}

0x00e5298e
0x00e52992
0x00e52995
0x00e529af
0x00e529b1
0x00e52d16
0x00e52d16
0x00e52d1b
0x00e52d1b
0x00e52d23
0x00e52d29
0x00e52d29
0x00000000
0x00e52d29
0x00e529b7
0x00e529bd
0x00000000
0x00000000
0x00e529c7
0x00e529cd
0x00e529d0
0x00e529d3
0x00e529dd
0x00e529e0
0x00e529e3
0x00e529e7
0x00e529e9
0x00000000
0x00000000
0x00e529ef
0x00e529f2
0x00e529f8
0x00e52a12
0x00e52a14
0x00e52d12
0x00000000
0x00e52d12
0x00e52a1a
0x00e52a1d
0x00000000
0x00000000
0x00e52a23
0x00e52a27
0x00000000
0x00000000
0x00e52a2d
0x00e52a30
0x00e52a34
0x00e52a3b
0x00e52a3d
0x00e52a3d
0x00e52a40
0x00e52a95
0x00e52a97
0x00e52a5d
0x00e52a62
0x00e52a69
0x00e52a6f
0x00000000
0x00e52a99
0x00e52a9b
0x00e52a9c
0x00e52a9e
0x00e52aa1
0x00e52aa3
0x00e52aa5
0x00e52aa7
0x00e52aa7
0x00e52ab2
0x00e52ab4
0x00e52abb
0x00e52ac0
0x00e52ac3
0x00e52ac6
0x00e52ac8
0x00e52aec
0x00e52af4
0x00e52af7
0x00e52afe
0x00e52b05
0x00e52b09
0x00e52b0b
0x00e52b0e
0x00e52b15
0x00e52b15
0x00e52b18
0x00e52b1a
0x00e52b1d
0x00e52b22
0x00e52b25
0x00e52b2e
0x00e52b32
0x00e52b35
0x00e52b37
0x00e52b3d
0x00e52b3f
0x00e52b48
0x00e52b49
0x00e52b4b
0x00e52b4f
0x00e52b50
0x00e52b54
0x00e52b57
0x00e52b61
0x00e52b66
0x00e52b69
0x00e52b78
0x00e52b7c
0x00e52b7f
0x00e52b81
0x00e52b83
0x00e52b85
0x00e52b8a
0x00e52b8c
0x00e52b90
0x00e52b91
0x00e52b97
0x00e52ba1
0x00e52ba2
0x00e52ba5
0x00e52baa
0x00e52bad
0x00e52bbc
0x00e52bc0
0x00e52bc3
0x00e52bc5
0x00e52bc7
0x00e52bc9
0x00e52bcb
0x00e52bd1
0x00e52bd1
0x00e52bd2
0x00e52be1
0x00e52be4
0x00e52be5
0x00e52be5
0x00e52bc9
0x00e52bc5
0x00e52bad
0x00e52b85
0x00e52b81
0x00e52b69
0x00e52b3f
0x00e52b37
0x00e52beb
0x00e52bf1
0x00e52bf3
0x00e52c66
0x00e52c66
0x00e52c6a
0x00e52c7a
0x00e52c80
0x00e52c82
0x00e52cde
0x00e52cde
0x00e52ce6
0x00e52ce7
0x00e52ce9
0x00e52d02
0x00e52d05
0x00e52c42
0x00e52c43
0x00000000
0x00e52c48
0x00e52d0b
0x00000000
0x00e52d0b
0x00e52cf0
0x00e52cfb
0x00000000
0x00e52cfb
0x00e52c84
0x00e52c87
0x00e52c8a
0x00000000
0x00000000
0x00e52c8c
0x00e52c8c
0x00e52c8f
0x00e52c92
0x00e52c95
0x00e52c9c
0x00e52ca1
0x00e52ca3
0x00e52ca7
0x00e52cc2
0x00e52cc6
0x00e52cc7
0x00e52cca
0x00e52ccb
0x00e52cd7
0x00e52ccd
0x00e52ccd
0x00e52ccd
0x00e52ca9
0x00e52ca9
0x00e52ca9
0x00e52cb4
0x00e52cb9
0x00e52cbc
0x00e52cbc
0x00000000
0x00e52ca1
0x00e52bf8
0x00e52bfb
0x00e52c02
0x00e52c07
0x00000000
0x00000000
0x00e52c10
0x00e52c16
0x00e52c18
0x00000000
0x00000000
0x00e52c1a
0x00e52c1e
0x00000000
0x00000000
0x00e52c32
0x00e52c38
0x00e52c3a
0x00e52c5e
0x00e52c61
0x00000000
0x00e52c61
0x00e52c3c
0x00000000
0x00e52aca
0x00e52acf
0x00e52ada
0x00e52c49
0x00e52c49
0x00e52c49
0x00e52c4c
0x00e52c4d
0x00000000
0x00e52c55
0x00e52ac8
0x00e52a97
0x00e52a42
0x00e52a45
0x00e52a59
0x00e52a5b
0x00e52a7c
0x00e52a7f
0x00e52a82
0x00e52a85
0x00000000
0x00e52a85
0x00000000
0x00e52a47
0x00e52a47
0x00e52a4a
0x00e52a4d
0x00000000
0x00e52a4d
0x00e52a45
0x00e529fa
0x00e529ff
0x00e52a07
0x00000000
0x00e52997
0x00e5299c
0x00e5299f
0x00e529a4
0x00e52d2e
0x00000000
0x00e52d2e

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ea4d55280f206db13f03aeb8e31e42cdae7013f5e7b9071feb42f464494523
Instruction ID: c07b2278cc648ed2a661adf99d2efa3a0f8682b21264a72800c22ab9da1eefa8
Opcode Fuzzy Hash: 72ea4d55280f206db13f03aeb8e31e42cdae7013f5e7b9071feb42f464494523
Instruction Fuzzy Hash: 27C12274A04209AFDF15DF98D880BAEBBB0BF4A315F14585CEE04BB392C7319949CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00E2AB92, Relevance: 13.6, APIs: 9, Instructions: 138
threadCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 59%

			E00E2AB92(void* __ebx, void* __edx, void* __edi, void* __esi, signed int* _a4, signed int _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _v28;
				signed int _t48;
				signed int _t52;
				long _t53;
				signed int _t54;
				signed int _t60;
				signed int _t63;
				signed int _t64;
				signed int _t67;
				long _t68;
				signed int _t73;
				long _t77;
				signed int* _t87;
				void* _t88;
				signed int _t89;
				signed int* _t92;
				intOrPtr _t97;
				signed int* _t101;
				void* _t106;
				signed int _t109;
				signed int _t114;

				_t106 = __edx;
				_t48 =  *0xe7b068; // 0x1b9618b6
				_v8 = _t48 ^ _t114;
				_t87 = _a4;
				_t109 = _a8;
				_v28 = _t109;
				if(( *_t87 & 0xfffffeff) != 1) {
					__eflags = _t109;
					if(_t109 != 0) {
						__eflags =  *(_t109 + 4);
						_t52 =  *_t109;
						if(__eflags < 0) {
							L22:
							_t53 = GetCurrentThreadId();
							__eflags = _t87[0xa] - _t53;
							if(_t87[0xa] == _t53) {
								L24:
								_t89 = _t87[0xb];
								_t54 = _t89 + 1;
								_t87[0xb] = _t54;
								__eflags = _t54 - 1;
								if(_t54 <= 1) {
									_t87[0xa] = GetCurrentThreadId();
									L34:
									L35:
									return E00E2C067(_v8 ^ _t114);
								}
								__eflags =  *_t87 & 0x00000100;
								if(( *_t87 & 0x00000100) != 0) {
									goto L34;
								}
								_t87[0xb] = _t89;
								L27:
								_t92 = _v28;
								__eflags = _t92;
								if(_t92 == 0) {
									L31:
									_push(3);
									L32:
									goto L35;
								}
								_t60 =  *_t92 | _t92[1];
								__eflags = _t60;
								if(_t60 != 0) {
									L30:
									_push(2);
									goto L32;
								}
								__eflags = _t92[2] - _t60;
								if(_t92[2] == _t60) {
									goto L31;
								}
								goto L30;
							}
							 *0xe63210();
							_t63 =  *((intOrPtr*)( *((intOrPtr*)(_t87[1] + 4))))();
							__eflags = _t63;
							if(_t63 == 0) {
								goto L27;
							}
							goto L24;
						}
						if(__eflags > 0) {
							L10:
							_t64 = _t52 |  *(_t109 + 4);
							__eflags = _t64;
							if(_t64 != 0) {
								L12:
								E00E2B162(_t88, _t106,  &_v24, 1);
								while(1) {
									_t67 =  *_t109;
									_t97 = _v20;
									__eflags = _t97 -  *(_t109 + 4);
									if(__eflags < 0) {
										goto L19;
									}
									if(__eflags > 0) {
										L16:
										__eflags = _v24 - _t67;
										if(_v24 != _t67) {
											goto L27;
										}
										__eflags = _t97 -  *(_t109 + 4);
										if(_t97 !=  *(_t109 + 4)) {
											goto L27;
										}
										__eflags = _v16 -  *((intOrPtr*)(_t109 + 8));
										if(_v16 >=  *((intOrPtr*)(_t109 + 8))) {
											goto L27;
										}
										goto L19;
									}
									__eflags = _v24 - _t67;
									if(_v24 < _t67) {
										goto L19;
									}
									goto L16;
									L19:
									_t68 = GetCurrentThreadId();
									__eflags = _t87[0xa] - _t68;
									if(_t87[0xa] == _t68) {
										goto L24;
									}
									 *0xe63210(E00E2B048(_v28,  &_v24));
									_t101 =  &(_t87[1]);
									_t73 =  *((intOrPtr*)( *((intOrPtr*)(_t87[1] + 8))))();
									__eflags = _t73;
									if(_t73 != 0) {
										goto L24;
									}
									E00E2B162(_t101, _t106,  &_v24, 1);
									_t109 = _v28;
								}
							}
							__eflags =  *((intOrPtr*)(_t109 + 8)) - _t64;
							if( *((intOrPtr*)(_t109 + 8)) <= _t64) {
								goto L22;
							}
							goto L12;
						}
						__eflags = _t52;
						if(_t52 < 0) {
							goto L22;
						}
						goto L10;
					}
					_t77 = GetCurrentThreadId();
					__eflags = _t87[0xa] - _t77;
					if(_t87[0xa] != _t77) {
						 *0xe63210();
						 *((intOrPtr*)( *(_t87[1])))();
					}
					goto L24;
				}
				if(_t87[0xa] != GetCurrentThreadId()) {
					 *0xe63210();
					 *((intOrPtr*)( *(_t87[1])))();
					_t87[0xa] = GetCurrentThreadId();
				}
				_t87[0xb] = _t87[0xb] + 1;
				goto L34;
			}

0x00e2ab92
0x00e2ab98
0x00e2ab9f
0x00e2aba3
0x00e2aba7
0x00e2abb2
0x00e2abb8
0x00e2abe8
0x00e2abea
0x00e2ac12
0x00e2ac16
0x00e2ac18
0x00e2acab
0x00e2acab
0x00e2acb1
0x00e2acb4
0x00e2accd
0x00e2accd
0x00e2acd0
0x00e2acd3
0x00e2acd6
0x00e2acd9
0x00e2ad08
0x00e2ad0b
0x00e2ad0d
0x00e2ad1b
0x00e2ad1b
0x00e2acdb
0x00e2ace1
0x00000000
0x00000000
0x00e2ace3
0x00e2ace6
0x00e2ace6
0x00e2ace9
0x00e2aceb
0x00e2acfd
0x00e2acfd
0x00e2acff
0x00000000
0x00e2acff
0x00e2acef
0x00e2acef
0x00e2acf2
0x00e2acf9
0x00e2acf9
0x00000000
0x00e2acf9
0x00e2acf4
0x00e2acf7
0x00000000
0x00000000
0x00000000
0x00e2acf7
0x00e2acbe
0x00e2acc7
0x00e2acc9
0x00e2accb
0x00000000
0x00000000
0x00000000
0x00e2accb
0x00e2ac1e
0x00e2ac28
0x00e2ac28
0x00e2ac28
0x00e2ac2b
0x00e2ac32
0x00e2ac38
0x00e2ac3d
0x00e2ac3d
0x00e2ac41
0x00e2ac44
0x00e2ac47
0x00000000
0x00000000
0x00e2ac49
0x00e2ac50
0x00e2ac50
0x00e2ac53
0x00000000
0x00000000
0x00e2ac59
0x00e2ac5c
0x00000000
0x00000000
0x00e2ac65
0x00e2ac68
0x00000000
0x00000000
0x00000000
0x00e2ac68
0x00e2ac4b
0x00e2ac4e
0x00000000
0x00000000
0x00000000
0x00e2ac6a
0x00e2ac6a
0x00e2ac70
0x00e2ac73
0x00000000
0x00000000
0x00e2ac8c
0x00e2ac92
0x00e2ac95
0x00e2ac97
0x00e2ac99
0x00000000
0x00000000
0x00e2aca1
0x00e2aca6
0x00e2aca6
0x00e2ac3d
0x00e2ac2d
0x00e2ac30
0x00000000
0x00000000
0x00000000
0x00e2ac30
0x00e2ac20
0x00e2ac22
0x00000000
0x00000000
0x00000000
0x00e2ac22
0x00e2abec
0x00e2abf2
0x00e2abf5
0x00e2ac02
0x00e2ac0b
0x00e2ac0b
0x00000000
0x00e2abf5
0x00e2abc3
0x00e2abcc
0x00e2abd5
0x00e2abdd
0x00e2abdd
0x00e2abe0
0x00000000

APIs

GetCurrentThreadId.KERNEL32 ref: 00E2ABBA
GetCurrentThreadId.KERNEL32 ref: 00E2ABD7
GetCurrentThreadId.KERNEL32 ref: 00E2ABEC
_xtime_get.LIBCPMT ref: 00E2AC38
GetCurrentThreadId.KERNEL32 ref: 00E2AC6A
__Xtime_diff_to_millis2.LIBCPMT ref: 00E2AC82
_xtime_get.LIBCPMT ref: 00E2ACA1
GetCurrentThreadId.KERNEL32 ref: 00E2ACAB
GetCurrentThreadId.KERNEL32 ref: 00E2AD02

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
String ID:
API String ID: 3943753294-0
Opcode ID: dac3a6224fc0b4382f4f914f344c7617785ab921bf97137c93bc480a6cfa1eb2
Instruction ID: 29441a99553e4762fa359e1b42cf3e401c4f011eeb63db0b4d4d84daa74f972b
Opcode Fuzzy Hash: dac3a6224fc0b4382f4f914f344c7617785ab921bf97137c93bc480a6cfa1eb2
Instruction Fuzzy Hash: 5C516F30500225CFCF11DF24EA869AAFBB5FF04314B28946AE906FB256D770ED45CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00E11EF0, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00E11EF0(void* __ebx, intOrPtr* __ecx, char _a4, char _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				intOrPtr _v24;
				char _v28;
				char _v44;
				signed int _v64;
				char _v92;
				char _v100;
				intOrPtr _v116;
				void* __edi;
				void* __ebp;
				signed int _t39;
				intOrPtr* _t42;
				intOrPtr _t44;
				intOrPtr _t49;
				signed int _t55;
				void* _t58;
				intOrPtr _t70;
				intOrPtr* _t73;
				intOrPtr _t79;
				signed char _t81;
				intOrPtr* _t82;
				intOrPtr _t84;
				void* _t85;
				intOrPtr _t87;
				intOrPtr* _t89;
				char* _t96;
				intOrPtr _t97;
				void* _t100;
				void* _t102;
				void* _t103;

				_push(0xffffffff);
				_push(0xe5f7d8);
				_push( *[fs:0x0]);
				_t103 = _t102 - 0x1c;
				_push(__ebx);
				_t39 =  *0xe7b068; // 0x1b9618b6
				_push(_t39 ^ _t99);
				_t1 =  &_v16; // 0xe12028
				 *[fs:0x0] = _t1;
				_t92 = __ecx;
				_v20 = __ecx;
				_t3 =  &_a8; // 0xe12028
				_t42 =  *_t3;
				_t83 = _a4;
				_t73 = _a4;
				_v20 = __ecx;
				_v28 = 0;
				_t87 =  *_t42;
				_t70 =  *((intOrPtr*)(_t42 + 4));
				_v24 = 0xf;
				_v44 = 0;
				_v20 = _t73 + 1;
				do {
					_t44 =  *_t73;
					_t73 = _t73 + 1;
					_t110 = _t44;
				} while (_t44 != 0);
				E00E14C40(_t70,  &_v44, _t83, _t83, _t73 - _v20);
				_v8 = 0;
				_push( &_v44);
				_push(_t70);
				E00E11690(_t70, __ecx, _t83, _t87, _t110, _t87);
				_t84 = _v24;
				if(_t84 < 0x10) {
					L6:
					 *_t92 = 0xe633b8;
					_t19 =  &_v16; // 0xe12028
					 *[fs:0x0] =  *_t19;
					return _t92;
				} else {
					_t79 = _v44;
					_t85 = _t84 + 1;
					_t49 = _t79;
					if(_t85 < 0x1000) {
						L5:
						_push(_t85);
						E00E2C347(_t79);
						goto L6;
					} else {
						_t79 =  *((intOrPtr*)(_t79 - 4));
						_t85 = _t85 + 0x23;
						if(_t49 - _t79 + 0xfffffffc > 0x1f) {
							E00E4957C(_t70, _t79, _t85, _t87, __eflags);
							asm("int3");
							asm("int3");
							_t100 = _t103;
							_t55 = _v64 & 0x00000017;
							 *(_t79 + 0xc) = _t55;
							_t22 = _t79 + 0x10; // 0x0
							_push(__ecx);
							_t81 =  *_t22 & _t55;
							__eflags = _t81;
							if(_t81 == 0) {
								return _t55;
							} else {
								__eflags = _a4;
								if(_a4 != 0) {
									E00E4309B(0, 0);
								}
								__eflags = _t81 & 0x00000004;
								if((_t81 & 0x00000004) == 0) {
									__eflags = _t81 & 0x00000002;
									_t96 =  ==  ? "ios_base::eofbit set" : "ios_base::failbit set";
								} else {
									_t96 = "ios_base::badbit set";
								}
								_t58 = E00E11650(_t70, _t85, _t87,  &_v100, 1);
								_t82 =  &_v92;
								_push(_t58);
								E00E11EF0(_t70, _t82, _t96);
								E00E4309B( &_v100, 0xe79ef4);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t100);
								_push(_t96);
								_t97 = _v116;
								asm("xorps xmm0, xmm0");
								_push(_t87);
								_t89 = _t82;
								 *_t89 = 0xe632f4;
								asm("movq [eax], xmm0");
								E00E42D62(_t97 + 4, _t89 + 4);
								 *_t89 = 0xe6330c;
								 *((intOrPtr*)(_t89 + 0xc)) =  *((intOrPtr*)(_t97 + 0xc));
								 *((intOrPtr*)(_t89 + 0x10)) =  *((intOrPtr*)(_t97 + 0x10));
								 *_t89 = 0xe633b8;
								return _t89;
							}
						} else {
							goto L5;
						}
					}
				}
			}

0x00e11ef3
0x00e11ef5
0x00e11f00
0x00e11f01
0x00e11f04
0x00e11f07
0x00e11f0e
0x00e11f0f
0x00e11f12
0x00e11f18
0x00e11f1a
0x00e11f1d
0x00e11f1d
0x00e11f20
0x00e11f23
0x00e11f25
0x00e11f28
0x00e11f2f
0x00e11f31
0x00e11f37
0x00e11f3e
0x00e11f42
0x00e11f45
0x00e11f45
0x00e11f47
0x00e11f48
0x00e11f48
0x00e11f54
0x00e11f5c
0x00e11f63
0x00e11f64
0x00e11f68
0x00e11f6d
0x00e11f73
0x00e11f9d
0x00e11f9d
0x00e11fa5
0x00e11fa8
0x00e11fb6
0x00e11f75
0x00e11f75
0x00e11f78
0x00e11f79
0x00e11f81
0x00e11f93
0x00e11f93
0x00e11f95
0x00000000
0x00e11f83
0x00e11f83
0x00e11f86
0x00e11f91
0x00e11fb9
0x00e11fbe
0x00e11fbf
0x00e11fc1
0x00e11fcc
0x00e11fcf
0x00e11fd2
0x00e11fd5
0x00e11fd6
0x00e11fd6
0x00e11fd8
0x00e11fe6
0x00e11fda
0x00e11fda
0x00e11fde
0x00e11fed
0x00e11fed
0x00e11ff2
0x00e11ff5
0x00e11ffe
0x00e1200b
0x00e11ff7
0x00e11ff7
0x00e11ff7
0x00e12015
0x00e1201d
0x00e12021
0x00e12023
0x00e12032
0x00e12037
0x00e12038
0x00e12039
0x00e1203a
0x00e1203b
0x00e1203c
0x00e1203d
0x00e1203e
0x00e1203f
0x00e12040
0x00e12043
0x00e12044
0x00e12047
0x00e1204a
0x00e1204b
0x00e12051
0x00e12057
0x00e1205f
0x00e12064
0x00e12070
0x00e12076
0x00e1207b
0x00e12084
0x00e12084
0x00000000
0x00000000
0x00000000
0x00e11f91
0x00e11f81

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00E11FED

Part of subcall function 00E4309B: RaiseException.KERNEL32(?,?,?,00E2CB67,?,?,?,?,?,?,?,?,00E2CB67,?,00E781E4), ref: 00E430FB

__CxxThrowException@8.LIBVCRUNTIME ref: 00E12032
___std_exception_copy.LIBVCRUNTIME ref: 00E1205F

Strings

ios_base::failbit set, xrefs: 00E11F05
( , xrefs: 00E11F1D
ios_base::badbit set, xrefs: 00E11FF7, 00E12022, 00E12043
( , xrefs: 00E11F0F, 00E11FA5

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise___std_exception_copy
String ID: ( $( $ios_base::badbit set$ios_base::failbit set
API String ID: 3941765731-1710869778
Opcode ID: dda7b7bee80482c9e8ac9036b9f98fd476da3c0e3064c3827349ff496759f938
Instruction ID: 6a6a3465514b6cbcbffae750a4c56d2f3fca0f7ff16203f2666f85778a13be01
Opcode Fuzzy Hash: dda7b7bee80482c9e8ac9036b9f98fd476da3c0e3064c3827349ff496759f938
Instruction Fuzzy Hash: 3541F4B1A00208AFC714DF68D845BEEB7F9EF49310F14965AF514B7781E770AA448BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E252F0, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 101
threadCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00E252F0(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v24;
				void* __ebp;
				signed int _t19;
				intOrPtr _t40;
				void* _t42;
				char* _t46;
				intOrPtr* _t48;
				char* _t49;
				char* _t50;
				intOrPtr* _t63;
				signed int _t65;
				void* _t66;
				char* _t68;
				void* _t69;
				char* _t70;

				_t61 = __edi;
				_t58 = __edx;
				_t19 =  *0xe7b068; // 0x1b9618b6
				_v20 = _t19 ^ _t65;
				 *[fs:0x0] =  &_v16;
				_t63 = __ecx;
				E00E20EA0(__ebx, __ecx, __edx, __edi);
				_t68 = _t66 - 0xfffffffffffffff4;
				_t46 = _t68;
				 *((intOrPtr*)(_t46 + 0x10)) = 0;
				 *((intOrPtr*)(_t46 + 0x14)) = 0xf;
				 *_t46 = 0;
				E00E14C40(__ebx, _t46, __edx, "Socket::SetSocketOption", 0x17);
				E00E12260(__ebx, 0x6d, _t58, __edi, GetCurrentThreadId(), _t19 ^ _t65, __esi, __ebx,  *[fs:0x0], 0xe60c28, 0xffffffff);
				_t69 = _t68 + 0x1c;
				_t48 = _t63;
				_t42 = 0;
				if( *((intOrPtr*)( *((intOrPtr*)( *_t63 + 0xc))))() != 0) {
					_t40 =  *((intOrPtr*)(_t63 + 8));
					if(_t40 != 0xffffffff) {
						_v24 = 1;
						__imp__#21(_t40, 0xffff, 4,  &_v24, 4);
						_t48 = 1;
						_t42 =  ==  ? 1 : 0;
					}
				}
				E00E20EA0(_t42, _t48, _t58, _t61);
				_t70 = _t69 - 0x18;
				_t49 = _t70;
				_v24 = _t70;
				 *((intOrPtr*)(_t49 + 0x10)) = 0;
				 *((intOrPtr*)(_t49 + 0x14)) = 0xf;
				 *_t49 = 0;
				E00E14C40(_t42, _t49, _t58, "-Result: ", 9);
				_v8 = 0;
				_t50 = _t70 - 0x18;
				 *((intOrPtr*)(_t50 + 0x10)) = 0;
				 *((intOrPtr*)(_t50 + 0x14)) = 0xf;
				 *_t50 = 0;
				E00E14C40(_t42, _t50, _t58, "Socket::SetSocketOption", 0x17);
				_push(GetCurrentThreadId());
				_v8 = 0xffffffff;
				E00E12110(_t42, 0x7c, _t58, _t61);
				E00E20EA0(_t42, 0x7c, _t58, _t61);
				if( *0xe7ea10 != 0) {
					_t60 =  ==  ? "FALSE" : "TRUE";
					E00E167A0(_t42,  ==  ? "FALSE" : "TRUE", _t61, _t42, E00E164F0(0xe7d8f8,  ==  ? "FALSE" : "TRUE"));
				}
				 *[fs:0x0] = _v16;
				return E00E2C067(_v20 ^ _t65);
			}

0x00e252f0
0x00e252f0
0x00e25304
0x00e2530b
0x00e25314
0x00e2531a
0x00e2531c
0x00e25321
0x00e25324
0x00e25328
0x00e2532f
0x00e2533b
0x00e2533e
0x00e2534e
0x00e25355
0x00e25358
0x00e2535a
0x00e25363
0x00e25365
0x00e2536b
0x00e25372
0x00e25382
0x00e2538d
0x00e25392
0x00e25392
0x00e2536b
0x00e25395
0x00e2539a
0x00e2539d
0x00e2539f
0x00e253a4
0x00e253ab
0x00e253b7
0x00e253ba
0x00e253c2
0x00e253c9
0x00e253cd
0x00e253d4
0x00e253e0
0x00e253e3
0x00e253ed
0x00e253f3
0x00e253fa
0x00e25402
0x00e2540e
0x00e25421
0x00e2542a
0x00e2542f
0x00e25437
0x00e2544e

APIs

Part of subcall function 00E20EA0: __Mtx_unlock.LIBCPMT ref: 00E20F3F

GetCurrentThreadId.KERNEL32 ref: 00E25343
setsockopt.WS2_32(?,0000FFFF,00000004,?,00000004), ref: 00E25382
GetCurrentThreadId.KERNEL32 ref: 00E253E8

Strings

Socket::SetSocketOption, xrefs: 00E25336, 00E253DB
TRUE, xrefs: 00E25417
-Result: , xrefs: 00E253B2
FALSE, xrefs: 00E25410

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: CurrentThread$Mtx_unlocksetsockopt
String ID: -Result: $FALSE$Socket::SetSocketOption$TRUE
API String ID: 3685440485-2008027822
Opcode ID: 222b7f75fabf1ca8bd57065d29ea5f840521b177fbc99b857be785519aa30c78
Instruction ID: fbec0e869de591045f56bdb1f43959a351edd1cfad80f2394b89c790faee0887
Opcode Fuzzy Hash: 222b7f75fabf1ca8bd57065d29ea5f840521b177fbc99b857be785519aa30c78
Instruction Fuzzy Hash: FC3139B1A443449BEB18EF78D806BA977E4AF01318F54156DE5147B3C2DBB68904C792

Uniqueness

Uniqueness Score: -1.00%

Function 00E25060, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 84
threadnetworkCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00E25060(void* __ecx, void* __edx, void* __edi, void* __eflags) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __ebp;
				signed int _t15;
				long _t20;
				void* _t32;
				void* _t33;
				char* _t37;
				char* _t39;
				char* _t40;
				void* _t49;
				void* _t50;
				signed int _t52;
				void* _t53;
				char* _t55;
				void* _t56;
				char* _t57;

				_t48 = __edi;
				_t45 = __edx;
				_t15 =  *0xe7b068; // 0x1b9618b6
				 *[fs:0x0] =  &_v16;
				_t50 = __ecx;
				E00E20EA0(_t32, __ecx, __edx, __edi);
				_t55 = _t53 - 0xfffffffffffffff0;
				_t37 = _t55;
				 *((intOrPtr*)(_t37 + 0x10)) = 0;
				 *((intOrPtr*)(_t37 + 0x14)) = 0xf;
				 *_t37 = 0;
				E00E14C40(_t32, _t37, __edx, "Socket::UnInitializeSocket", 0x1a);
				_t20 = GetCurrentThreadId();
				_t38 = 0x38;
				E00E12260(_t32, 0x38, _t45, __edi, _t20, _t15 ^ _t52, _t49, _t32,  *[fs:0x0], 0xe60bf8, 0xffffffff);
				_t56 = _t55 + 0x1c;
				_t33 = 1;
				if( *((char*)(_t50 + 4)) != 0) {
					__imp__#116();
					_t38 = 0;
					 *((char*)(_t50 + 4)) = 0;
					_t33 =  !=  ? 0 : 1;
				}
				E00E20EA0(_t33, _t38, _t45, _t48);
				_t57 = _t56 - 0x18;
				_t39 = _t57;
				_v20 = _t57;
				 *((intOrPtr*)(_t39 + 0x10)) = 0;
				 *((intOrPtr*)(_t39 + 0x14)) = 0xf;
				 *_t39 = 0;
				E00E14C40(_t33, _t39, _t45, "-Result: ", 9);
				_v8 = 0;
				_t40 = _t57 - 0x18;
				 *((intOrPtr*)(_t40 + 0x10)) = 0;
				 *((intOrPtr*)(_t40 + 0x14)) = 0xf;
				 *_t40 = 0;
				E00E14C40(_t33, _t40, _t45, "Socket::UnInitializeSocket", 0x1a);
				_push(GetCurrentThreadId());
				_v8 = 0xffffffff;
				E00E12110(_t33, 0x49, _t45, _t48);
				E00E20EA0(_t33, 0x49, _t45, _t48);
				if( *0xe7ea10 != 0) {
					_t47 =  ==  ? "FALSE" : "TRUE";
					_t67 =  ==  ? "FALSE" : "TRUE";
					E00E167A0(_t33,  ==  ? "FALSE" : "TRUE", _t48,  ==  ? "FALSE" : "TRUE", E00E164F0(0xe7d8f8,  ==  ? "FALSE" : "TRUE"));
				}
				 *[fs:0x0] = _v16;
				return _t33;
			}

0x00e25060
0x00e25060
0x00e25076
0x00e25081
0x00e25087
0x00e25089
0x00e2508e
0x00e25091
0x00e25095
0x00e2509c
0x00e250a8
0x00e250ab
0x00e250b0
0x00e250b6
0x00e250bb
0x00e250c0
0x00e250c3
0x00e250c9
0x00e250cb
0x00e250d1
0x00e250d8
0x00e250dc
0x00e250dc
0x00e250df
0x00e250e4
0x00e250e7
0x00e250e9
0x00e250ee
0x00e250f5
0x00e25101
0x00e25104
0x00e2510c
0x00e25113
0x00e25117
0x00e2511e
0x00e2512a
0x00e2512d
0x00e25137
0x00e2513d
0x00e25144
0x00e2514c
0x00e25158
0x00e2516b
0x00e2516b
0x00e25174
0x00e25179
0x00e25181
0x00e2518e

APIs

Part of subcall function 00E20EA0: __Mtx_unlock.LIBCPMT ref: 00E20F3F

GetCurrentThreadId.KERNEL32 ref: 00E250B0
WSACleanup.WS2_32 ref: 00E250CB
GetCurrentThreadId.KERNEL32 ref: 00E25132

Strings

Socket::UnInitializeSocket, xrefs: 00E250A3, 00E25125
TRUE, xrefs: 00E25161
-Result: , xrefs: 00E250FC
FALSE, xrefs: 00E2515A

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: CurrentThread$CleanupMtx_unlock
String ID: -Result: $FALSE$Socket::UnInitializeSocket$TRUE
API String ID: 2040956933-488997540
Opcode ID: 51348df867c4cc9cc374771a80a3f54c867a6a98e47dfa36ef2b4c3e94db1349
Instruction ID: a53f865db27a1e96da7438bdc1fad06d1b03164bdd9f29bb08fd1954f057f0dc
Opcode Fuzzy Hash: 51348df867c4cc9cc374771a80a3f54c867a6a98e47dfa36ef2b4c3e94db1349
Instruction Fuzzy Hash: CA314DB1A453409BE704AF78ED077993BD4DB06308F1455ADE4157B3C3C77A850583E2

Uniqueness

Uniqueness Score: -1.00%

Function 00E18990, Relevance: 10.7, APIs: 7, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00E18990(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				signed int _v16;
				signed int _v20;
				intOrPtr* _v24;
				char _v28;
				char _v32;
				void* _v36;
				intOrPtr* _v40;
				intOrPtr* _v44;
				intOrPtr* _v48;
				char _v64;
				intOrPtr _v80;
				char _v88;
				void* __ebp;
				signed int _t51;
				signed int _t52;
				intOrPtr _t55;
				intOrPtr _t56;
				void* _t58;
				void* _t65;
				signed int _t70;
				signed int _t72;
				void* _t77;
				signed int _t82;
				signed int _t83;
				void* _t85;
				intOrPtr _t89;
				char* _t96;
				signed int _t97;
				void* _t104;
				signed int _t107;
				intOrPtr* _t108;
				intOrPtr* _t111;
				signed int _t113;
				void* _t115;
				void* _t117;
				signed int _t119;
				void* _t121;

				_t104 = __edx;
				_push(0xffffffff);
				_push(0xe60056);
				_push( *[fs:0x0]);
				_t51 =  *0xe7b068; // 0x1b9618b6
				_t52 = _t51 ^ _t113;
				_v20 = _t52;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t52);
				 *[fs:0x0] =  &_v16;
				_v44 = __ecx;
				_v40 = __ecx;
				_v48 = __ecx;
				 *__ecx = 0;
				_t55 = __ecx + 4;
				_v40 = _t55;
				_t85 = _t55 + 8;
				_push(1);
				_v8 = 0;
				_t56 = E00E29AD6(_t85, __edi, __esi);
				_t117 = _t115 - 0x2c + 4;
				 *((intOrPtr*)(_t85 + 4)) = _t56;
				_v8 = 1;
				E00E297C6( &_v32, 0);
				_v8 = 2;
				_t58 =  *0xe7ea54; // 0x0
				_t107 =  *0xe7ea74; // 0x0
				_v24 = _t58;
				_v36 = _t58;
				if(_t107 == 0) {
					E00E297C6( &_v28, _t107);
					_t121 =  *0xe7ea74 - _t107; // 0x0
					if(_t121 == 0) {
						_t82 =  *0xe7d9a0; // 0x1
						_t83 = _t82 + 1;
						 *0xe7d9a0 = _t83;
						 *0xe7ea74 = _t83;
					}
					E00E2981E( &_v28);
					_t107 =  *0xe7ea74; // 0x0
				}
				_t89 =  *((intOrPtr*)(_t85 + 4));
				if(_t107 >=  *((intOrPtr*)(_t89 + 0xc))) {
					_t111 = 0;
					__eflags = 0;
					goto L8;
				} else {
					_t111 =  *((intOrPtr*)( *((intOrPtr*)(_t89 + 8)) + _t107 * 4));
					if(_t111 != 0) {
						L15:
						_t90 =  &_v32;
						_v8 = 1;
						E00E2981E( &_v32);
						_t108 = _v40;
						_push(_t85);
						 *_t108 = _t111;
						 *((intOrPtr*)(_t108 + 4)) = E00E16370(_t104, _t108, _t111);
						_v8 = 4;
						_push(_v48);
						E00E18F20(_t85, _v44, _t90, 0xe72104);
						 *[fs:0x0] = _v16;
						return E00E2C067(_v20 ^ _t113, _t90);
					} else {
						L8:
						if( *((char*)(_t89 + 0x14)) == 0) {
							L11:
							if(_t111 != 0) {
								goto L15;
							} else {
								goto L12;
							}
						} else {
							_t77 = E00E29AD0();
							if(_t107 >=  *((intOrPtr*)(_t77 + 0xc))) {
								L12:
								_t111 = _v24;
								if(_t111 != 0) {
									goto L15;
								} else {
									_push(_t85);
									_push( &_v36);
									_t65 = E00E19430(_t85, _t89, _t104);
									_t119 = _t117 + 8;
									_t129 = _t65 - 0xffffffff;
									if(_t65 == 0xffffffff) {
										_t96 =  &_v64;
										E00E11520(_t96);
										E00E4309B( &_v64, 0xe79ea0);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t113);
										_push(0xffffffff);
										_push(0xe5fa30);
										_push( *[fs:0x0]);
										_t70 =  *0xe7b068; // 0x1b9618b6
										_push(_t70 ^ _t119);
										_t72 =  &_v88;
										 *[fs:0x0] = _t72;
										_v80 = 0;
										_t97 =  *(_t96 + 0xc);
										__eflags = _t97;
										if(_t97 != 0) {
											_t72 =  *((intOrPtr*)( *_t97 + 8))();
											__eflags = _t72;
											if(_t72 != 0) {
												_t72 =  *((intOrPtr*)( *_t72))(1);
											}
										}
										 *[fs:0x0] = _v20;
										return _t72;
									} else {
										_t111 = _v36;
										_v24 = _t111;
										_v8 = 3;
										E00E29AA4(_t129, _t111);
										_t117 = _t119 + 4;
										 *((intOrPtr*)( *_t111 + 4))();
										 *0xe7ea54 = _t111;
										goto L15;
									}
								}
							} else {
								_t111 =  *((intOrPtr*)( *((intOrPtr*)(_t77 + 8)) + _t107 * 4));
								goto L11;
							}
						}
					}
				}
			}

0x00e18990
0x00e18993
0x00e18995
0x00e189a0
0x00e189a4
0x00e189a9
0x00e189ab
0x00e189ae
0x00e189af
0x00e189b0
0x00e189b1
0x00e189b5
0x00e189bd
0x00e189c0
0x00e189c3
0x00e189c6
0x00e189cc
0x00e189cf
0x00e189d2
0x00e189d5
0x00e189d7
0x00e189de
0x00e189e3
0x00e189e6
0x00e189ee
0x00e189f5
0x00e189fa
0x00e189fe
0x00e18a03
0x00e18a09
0x00e18a0c
0x00e18a11
0x00e18a17
0x00e18a1c
0x00e18a22
0x00e18a24
0x00e18a29
0x00e18a2a
0x00e18a2f
0x00e18a2f
0x00e18a37
0x00e18a3c
0x00e18a3c
0x00e18a42
0x00e18a48
0x00e18a56
0x00e18a56
0x00000000
0x00e18a4a
0x00e18a4d
0x00e18a52
0x00e18aab
0x00e18aab
0x00e18aae
0x00e18ab2
0x00e18ab7
0x00e18aba
0x00e18abb
0x00e18ac5
0x00e18ac8
0x00e18acf
0x00e18adc
0x00e18ae7
0x00e18aff
0x00e18a54
0x00e18a58
0x00e18a5c
0x00e18a6e
0x00e18a70
0x00000000
0x00000000
0x00000000
0x00000000
0x00e18a5e
0x00e18a5e
0x00e18a66
0x00e18a72
0x00e18a72
0x00e18a77
0x00000000
0x00e18a79
0x00e18a7c
0x00e18a7d
0x00e18a7e
0x00e18a83
0x00e18a86
0x00e18a89
0x00e18b02
0x00e18b05
0x00e18b13
0x00e18b18
0x00e18b19
0x00e18b1a
0x00e18b1b
0x00e18b1c
0x00e18b1d
0x00e18b1e
0x00e18b1f
0x00e18b20
0x00e18b23
0x00e18b25
0x00e18b30
0x00e18b31
0x00e18b38
0x00e18b39
0x00e18b3c
0x00e18b42
0x00e18b49
0x00e18b4c
0x00e18b4e
0x00e18b52
0x00e18b55
0x00e18b57
0x00e18b5f
0x00e18b5f
0x00e18b57
0x00e18b64
0x00e18b6f
0x00e18a8b
0x00e18a8b
0x00e18a8e
0x00e18a92
0x00e18a96
0x00e18a9d
0x00e18aa2
0x00e18aa5
0x00000000
0x00e18aa5
0x00e18a89
0x00e18a68
0x00e18a6b
0x00000000
0x00e18a6b
0x00e18a66
0x00e18a5c
0x00e18a52

APIs

std::locale::_Init.LIBCPMT ref: 00E189DE

Part of subcall function 00E29AD6: __EH_prolog3.LIBCMT ref: 00E29ADD
Part of subcall function 00E29AD6: std::_Lockit::_Lockit.LIBCPMT ref: 00E29AE8
Part of subcall function 00E29AD6: std::locale::_Setgloballocale.LIBCPMT ref: 00E29B03
Part of subcall function 00E29AD6: _Yarn.LIBCPMT ref: 00E29B19
Part of subcall function 00E29AD6: std::_Lockit::~_Lockit.LIBCPMT ref: 00E29B59

std::_Lockit::_Lockit.LIBCPMT ref: 00E189F5
std::_Lockit::_Lockit.LIBCPMT ref: 00E18A17
std::_Lockit::~_Lockit.LIBCPMT ref: 00E18A37
std::_Facet_Register.LIBCPMT ref: 00E18A96
std::_Lockit::~_Lockit.LIBCPMT ref: 00E18AB2
__CxxThrowException@8.LIBVCRUNTIME ref: 00E18B13

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$std::locale::_$Exception@8Facet_H_prolog3InitRegisterSetgloballocaleThrowYarn
String ID:
API String ID: 1052052190-0
Opcode ID: 1e91ff80d35b8112fb3493b4c27c44897fbbe03ee432e73ef391767d4efbd83f
Instruction ID: 0741faa8afee8201e74bbc1ec246ba4dfc1fe56f23d90ceefc25ff22b8bc30d8
Opcode Fuzzy Hash: 1e91ff80d35b8112fb3493b4c27c44897fbbe03ee432e73ef391767d4efbd83f
Instruction Fuzzy Hash: 49518CB1900218DFCB14DFA4D941B9EBBF4FF08714F14516AE809B7392EB31AA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E44E70, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00E44E70(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _t54;
				signed int _t61;
				intOrPtr _t62;
				void* _t63;
				intOrPtr* _t64;
				intOrPtr _t66;
				intOrPtr _t68;
				signed int _t69;
				signed int _t70;
				signed int _t73;
				intOrPtr _t77;
				intOrPtr _t79;
				signed int _t81;
				char _t83;
				intOrPtr _t87;
				intOrPtr* _t88;
				signed int _t95;
				signed int _t96;
				intOrPtr _t99;
				intOrPtr _t102;
				signed int _t104;
				void* _t107;
				void* _t108;
				void* _t115;

				_t77 = _a8;
				_push(__edi);
				_v5 = 0;
				_t102 = _t77 + 0x10;
				_push(_t102);
				_v16 = 1;
				_v20 = _t102;
				_v12 =  *(_t77 + 8) ^  *0xe7b068;
				E00E44E30(__edi, _t102,  *(_t77 + 8) ^  *0xe7b068);
				E00E4638C(_a12);
				_t54 = _a4;
				_t108 = _t107 + 0xc;
				_t99 =  *((intOrPtr*)(_t77 + 0xc));
				if(( *(_t54 + 4) & 0x00000066) != 0) {
					__eflags = _t99 - 0xfffffffe;
					if(_t99 != 0xfffffffe) {
						E00E46880(_t77, 0xfffffffe, _t102, 0xe7b068);
						goto L14;
					}
					goto L15;
				} else {
					_v32 = _t54;
					_v28 = _a12;
					 *((intOrPtr*)(_t77 - 4)) =  &_v32;
					if(_t99 == 0xfffffffe) {
						L15:
						return _v16;
					} else {
						do {
							_t81 = _v12;
							_t20 = _t99 + 2; // 0x3
							_t61 = _t99 + _t20 * 2;
							_t79 =  *((intOrPtr*)(_t81 + _t61 * 4));
							_t62 = _t81 + _t61 * 4;
							_t82 =  *((intOrPtr*)(_t62 + 4));
							_v24 = _t62;
							if( *((intOrPtr*)(_t62 + 4)) == 0) {
								_t83 = _v5;
								goto L8;
							} else {
								_t63 = E00E46830(_t82, _t102);
								_t83 = 1;
								_v5 = 1;
								_t115 = _t63;
								if(_t115 < 0) {
									_v16 = 0;
									L14:
									_push(_t102);
									E00E44E30(_t99, _t102, _v12);
									goto L15;
								} else {
									if(_t115 > 0) {
										_t64 = _a4;
										__eflags =  *_t64 - 0xe06d7363;
										if( *_t64 == 0xe06d7363) {
											__eflags =  *0xe679b8;
											if(__eflags != 0) {
												_t73 = E00E5F210(__eflags, 0xe679b8);
												_t108 = _t108 + 4;
												__eflags = _t73;
												if(_t73 != 0) {
													_t104 =  *0xe679b8; // 0xe42e15
													 *0xe63210(_a4, 1);
													 *_t104();
													_t102 = _v20;
													_t108 = _t108 + 8;
												}
												_t64 = _a4;
											}
										}
										E00E46864(_t64, _a8, _t64);
										_t66 = _a8;
										__eflags =  *((intOrPtr*)(_t66 + 0xc)) - _t99;
										if( *((intOrPtr*)(_t66 + 0xc)) != _t99) {
											E00E46880(_t66, _t99, _t102, 0xe7b068);
											_t66 = _a8;
										}
										_push(_t102);
										 *((intOrPtr*)(_t66 + 0xc)) = _t79;
										E00E44E30(_t99, _t102, _v12);
										E00E46848();
										asm("int3");
										_t68 = _v40;
										_t87 = _v36;
										__eflags = _t68 - _t87;
										if(_t68 != _t87) {
											_t88 = _t87 + 5;
											_t69 = _t68 + 5;
											__eflags = _t69;
											while(1) {
												_t95 =  *_t69;
												__eflags = _t95 -  *_t88;
												if(_t95 !=  *_t88) {
													break;
												}
												__eflags = _t95;
												if(_t95 == 0) {
													goto L25;
												} else {
													_t48 = _t69 + 1; // 0x53d
													_t96 =  *_t48;
													__eflags = _t96 -  *((intOrPtr*)(_t88 + 1));
													if(_t96 !=  *((intOrPtr*)(_t88 + 1))) {
														break;
													} else {
														_t69 = _t69 + 2;
														_t88 = _t88 + 2;
														__eflags = _t96;
														if(_t96 != 0) {
															continue;
														} else {
															goto L25;
														}
													}
												}
												goto L33;
											}
											asm("sbb eax, eax");
											_t70 = _t69 | 0x00000001;
											__eflags = _t70;
											return _t70;
										} else {
											L25:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L8;
									}
								}
							}
							goto L33;
							L8:
							_t99 = _t79;
						} while (_t79 != 0xfffffffe);
						if(_t83 != 0) {
							goto L14;
						}
						goto L15;
					}
				}
				L33:
			}

0x00e44e77
0x00e44e7b
0x00e44e7c
0x00e44e83
0x00e44e8c
0x00e44e8e
0x00e44e95
0x00e44e98
0x00e44e9b
0x00e44ea3
0x00e44ea8
0x00e44eab
0x00e44eae
0x00e44eb5
0x00e44f16
0x00e44f19
0x00e44f28
0x00000000
0x00e44f28
0x00000000
0x00e44eb7
0x00e44eb7
0x00e44ebd
0x00e44ec3
0x00e44ec9
0x00e44f39
0x00e44f42
0x00e44ecb
0x00e44ed0
0x00e44ed0
0x00e44ed3
0x00e44ed6
0x00e44ed9
0x00e44edc
0x00e44edf
0x00e44ee2
0x00e44ee7
0x00e44efd
0x00000000
0x00e44ee9
0x00e44eeb
0x00e44ef0
0x00e44ef2
0x00e44ef5
0x00e44ef7
0x00e44f0d
0x00e44f2d
0x00e44f2d
0x00e44f31
0x00000000
0x00e44ef9
0x00e44ef9
0x00e44f43
0x00e44f46
0x00e44f4c
0x00e44f4e
0x00e44f55
0x00e44f5c
0x00e44f61
0x00e44f64
0x00e44f66
0x00e44f68
0x00e44f75
0x00e44f7b
0x00e44f7d
0x00e44f80
0x00e44f80
0x00e44f83
0x00e44f83
0x00e44f55
0x00e44f8b
0x00e44f90
0x00e44f93
0x00e44f96
0x00e44fa2
0x00e44fa7
0x00e44fa7
0x00e44faa
0x00e44fae
0x00e44fb1
0x00e44fc1
0x00e44fc6
0x00e44fca
0x00e44fcd
0x00e44fd0
0x00e44fd2
0x00e44fd8
0x00e44fdb
0x00e44fdb
0x00e44fde
0x00e44fde
0x00e44fe0
0x00e44fe2
0x00000000
0x00000000
0x00e44fe4
0x00e44fe6
0x00000000
0x00e44fe8
0x00e44fe8
0x00e44fe8
0x00e44feb
0x00e44fee
0x00000000
0x00e44ff0
0x00e44ff0
0x00e44ff3
0x00e44ff6
0x00e44ff8
0x00000000
0x00e44ffa
0x00000000
0x00e44ffa
0x00e44ff8
0x00e44fee
0x00000000
0x00e44fe6
0x00e44ffc
0x00e44ffe
0x00e44ffe
0x00e45002
0x00e44fd4
0x00e44fd4
0x00e44fd4
0x00e44fd7
0x00e44fd7
0x00e44efb
0x00000000
0x00e44efb
0x00e44ef9
0x00e44ef7
0x00000000
0x00e44f00
0x00e44f00
0x00e44f02
0x00e44f09
0x00000000
0x00e44f0b
0x00000000
0x00e44f09
0x00e44ec9
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 00E44E9B
___except_validate_context_record.LIBVCRUNTIME ref: 00E44EA3
_ValidateLocalCookies.LIBCMT ref: 00E44F31
__IsNonwritableInCurrentImage.LIBCMT ref: 00E44F5C
_ValidateLocalCookies.LIBCMT ref: 00E44FB1

Strings

csm, xrefs: 00E44F46

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 38414bcb7c65906d1887986d4e01243bd6930d30905326449c720d7549d9c337
Instruction ID: b30b2145ff2e1854a14961c31e414bf352490ce14091600cea5592acd4f870d9
Opcode Fuzzy Hash: 38414bcb7c65906d1887986d4e01243bd6930d30905326449c720d7549d9c337
Instruction Fuzzy Hash: CE41D2B4F00209ABCF14DF68E844B9EBBE5BF45328F14A155E8147B2D2D731DA19CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E16B30, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00E16B30(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr* _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				void* _v24;
				intOrPtr* _v28;
				char _v32;
				char _v84;
				signed int _t35;
				signed int _t36;
				intOrPtr _t43;
				void* _t48;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				intOrPtr _t59;
				intOrPtr _t66;
				void* _t72;
				signed int _t75;
				intOrPtr* _t78;
				intOrPtr* _t79;
				signed int _t81;
				void* _t87;

				_t72 = __edx;
				_push(0xffffffff);
				_push(0xe5fdcf);
				_push( *[fs:0x0]);
				_t35 =  *0xe7b068; // 0x1b9618b6
				_t36 = _t35 ^ _t81;
				_v20 = _t36;
				_push(_t36);
				 *[fs:0x0] =  &_v16;
				_t78 = _a4;
				_v28 = _t78;
				E00E297C6( &_v32, 0);
				_v8 = 0;
				_t75 =  *0xe7ea68; // 0x0
				_t56 =  *0xe7ea40; // 0x0
				if(_t75 == 0) {
					_t7 =  &_v24; // 0xe17bee
					E00E297C6(_t7, _t75);
					_t87 =  *0xe7ea68 - _t75; // 0x0
					if(_t87 == 0) {
						_t53 =  *0xe7d9a0; // 0x1
						_t54 = _t53 + 1;
						 *0xe7d9a0 = _t54;
						 *0xe7ea68 = _t54;
					}
					_t8 =  &_v24; // 0xe17bee
					E00E2981E(_t8);
					_t75 =  *0xe7ea68; // 0x0
				}
				_t59 =  *((intOrPtr*)(_t78 + 4));
				if(_t75 >=  *((intOrPtr*)(_t59 + 0xc))) {
					_t79 = 0;
					__eflags = 0;
					L8:
					if( *((char*)(_t59 + 0x14)) == 0) {
						L11:
						if(_t79 != 0) {
							L19:
							E00E2981E( &_v32);
							 *[fs:0x0] = _v16;
							return E00E2C067(_v20 ^ _t81);
						}
						L12:
						if(_t56 == 0) {
							_push(8);
							_t79 = E00E2C07D(_t72, __eflags);
							_v24 = _t79;
							_v8 = 1;
							_t66 =  *((intOrPtr*)(_v28 + 4));
							__eflags = _t66;
							if(_t66 != 0) {
								_t43 =  *((intOrPtr*)(_t66 + 0x18));
								__eflags = _t43;
								if(_t43 == 0) {
									_t24 = _t66 + 0x1c; // 0x1c
									_t43 = _t24;
								}
							} else {
								_t43 = 0xe71f6b;
							}
							E00E11AD0( &_v84, _t43);
							 *((intOrPtr*)(_t79 + 4)) = 0;
							 *_t79 = 0xe64a64;
							E00E11B90( &_v84);
							_v28 = _t79;
							_v8 = 2;
							E00E29AA4(__eflags, _t79);
							 *((intOrPtr*)( *_t79 + 4))();
							 *0xe7ea40 = _t79;
						} else {
							_t79 = _t56;
						}
						goto L19;
					}
					_t48 = E00E29AD0();
					if(_t75 >=  *((intOrPtr*)(_t48 + 0xc))) {
						goto L12;
					}
					_t79 =  *((intOrPtr*)( *((intOrPtr*)(_t48 + 8)) + _t75 * 4));
					goto L11;
				}
				_t79 =  *((intOrPtr*)( *((intOrPtr*)(_t59 + 8)) + _t75 * 4));
				if(_t79 != 0) {
					goto L19;
				}
				goto L8;
			}

0x00e16b30
0x00e16b33
0x00e16b35
0x00e16b40
0x00e16b44
0x00e16b49
0x00e16b4b
0x00e16b51
0x00e16b55
0x00e16b5b
0x00e16b63
0x00e16b66
0x00e16b6b
0x00e16b72
0x00e16b78
0x00e16b80
0x00e16b83
0x00e16b86
0x00e16b8b
0x00e16b91
0x00e16b93
0x00e16b98
0x00e16b99
0x00e16b9e
0x00e16b9e
0x00e16ba3
0x00e16ba6
0x00e16bab
0x00e16bab
0x00e16bb1
0x00e16bb7
0x00e16bc9
0x00e16bc9
0x00e16bcb
0x00e16bcf
0x00e16be1
0x00e16be3
0x00e16c56
0x00e16c59
0x00e16c63
0x00e16c7b
0x00e16c7b
0x00e16be5
0x00e16be7
0x00e16bed
0x00e16bf4
0x00e16bf9
0x00e16bfc
0x00e16c03
0x00e16c06
0x00e16c08
0x00e16c11
0x00e16c14
0x00e16c16
0x00e16c18
0x00e16c18
0x00e16c18
0x00e16c0a
0x00e16c0a
0x00e16c0a
0x00e16c1f
0x00e16c27
0x00e16c2e
0x00e16c34
0x00e16c39
0x00e16c3d
0x00e16c41
0x00e16c4d
0x00e16c50
0x00e16be9
0x00e16be9
0x00e16be9
0x00000000
0x00e16be7
0x00e16bd1
0x00e16bd9
0x00000000
0x00000000
0x00e16bde
0x00000000
0x00e16bde
0x00e16bbc
0x00e16bc1
0x00000000
0x00000000
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E16B66
std::_Lockit::_Lockit.LIBCPMT ref: 00E16B86
std::_Lockit::~_Lockit.LIBCPMT ref: 00E16BA6
std::_Facet_Register.LIBCPMT ref: 00E16C41
std::_Lockit::~_Lockit.LIBCPMT ref: 00E16C59

Strings

{, xrefs: 00E16B83, 00E16BA3

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: {
API String ID: 459529453-2739055043
Opcode ID: 297066a57142fd8f02c6d30ec0771b9d1e36491623aa8f31b74b1e64a2425b86
Instruction ID: 97326b1d9264c314e0f05935ae11fdc722850cd9a193edb51035c1d75a15e34d
Opcode Fuzzy Hash: 297066a57142fd8f02c6d30ec0771b9d1e36491623aa8f31b74b1e64a2425b86
Instruction Fuzzy Hash: F841AEB1A04224CFDB14DF55D881BAEB7B4FF44714F145069E80ABB342DB71AE85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00E50CB0, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00E50CB0(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int* _v8;
				void** _t12;
				void* _t16;
				void* _t18;
				signed int _t22;
				WCHAR* _t23;
				void** _t26;
				signed int* _t29;
				void* _t32;
				void* _t34;

				_t29 = _a4;
				while(_t29 != _a8) {
					_t22 =  *_t29;
					_t12 = 0xe7e738 + _t22 * 4;
					_t32 =  *_t12;
					_v8 = _t12;
					if(_t32 == 0) {
						_t23 =  *(0xe69e60 + _t22 * 4);
						_t32 = LoadLibraryExW(_t23, 0, 0x800);
						if(_t32 != 0) {
							L12:
							_t26 = _v8;
							 *_t26 = _t32;
							if( *_t26 != 0) {
								FreeLibrary(_t32);
							}
							L14:
							if(_t32 != 0) {
								_t16 = _t32;
								L18:
								return _t16;
							}
							L15:
							_t29 =  &(_t29[1]);
							continue;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L9:
							_t32 = 0;
							L10:
							if(_t32 != 0) {
								goto L12;
							}
							 *_v8 = _t18 | 0xffffffff;
							goto L15;
						}
						_t18 = E00E4E161(_t23, L"api-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = E00E4E161(_t23, L"ext-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = LoadLibraryExW(_t23, _t32, _t32);
						_t32 = _t18;
						goto L10;
					}
					if(_t32 == 0xffffffff) {
						goto L15;
					}
					goto L14;
				}
				_t16 = 0;
				goto L18;
			}

0x00e50cb9
0x00e50d63
0x00e50cc1
0x00e50cc3
0x00e50cca
0x00e50ccc
0x00e50cd2
0x00e50cdf
0x00e50cf4
0x00e50cf8
0x00e50d4a
0x00e50d4a
0x00e50d4f
0x00e50d53
0x00e50d56
0x00e50d56
0x00e50d5c
0x00e50d5e
0x00e50d75
0x00e50d6e
0x00e50d74
0x00e50d74
0x00e50d60
0x00e50d60
0x00000000
0x00e50d60
0x00e50cfa
0x00e50d03
0x00e50d3a
0x00e50d3a
0x00e50d3c
0x00e50d3e
0x00000000
0x00000000
0x00e50d46
0x00000000
0x00e50d46
0x00e50d0d
0x00e50d12
0x00e50d17
0x00000000
0x00000000
0x00e50d21
0x00e50d26
0x00e50d2b
0x00000000
0x00000000
0x00e50d30
0x00e50d36
0x00000000
0x00e50d36
0x00e50cd7
0x00000000
0x00000000
0x00000000
0x00e50cdd
0x00e50d6c
0x00000000

Strings

ext-ms-, xrefs: 00E50D1B
api-ms-, xrefs: 00E50D07

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 9daf5e7f367b210f1bea3904b67bce50a94cfc0b1b01432f6a7353ca7a8f5d2f
Instruction ID: c79d0e57a065afc7f10716ee6565e16a6a4d409f374b5bf8e198e58de11cc769
Opcode Fuzzy Hash: 9daf5e7f367b210f1bea3904b67bce50a94cfc0b1b01432f6a7353ca7a8f5d2f
Instruction Fuzzy Hash: 0821EB31B41214BFC7318AB5AC41A5B7778AB127A6F152A10FD09B7391D670FD08C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00E11FC0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00E11FC0(void* __ebx, void* __ecx, signed int _a4, char _a8) {
				char _v24;
				char _v32;
				intOrPtr _v48;
				void* __edi;
				void* __ebp;
				signed int _t20;
				void* _t23;
				void* _t34;
				void* _t35;
				signed char _t37;
				intOrPtr* _t38;
				void* _t39;
				void* _t40;
				intOrPtr* _t41;
				char* _t46;
				intOrPtr _t47;

				_t35 = __ecx;
				_t34 = __ebx;
				_t20 = _a4 & 0x00000017;
				 *(__ecx + 0xc) = _t20;
				_t3 = _t35 + 0x10; // 0x0
				_t37 =  *_t3 & _t20;
				if(_t37 == 0) {
					return _t20;
				} else {
					if(_a8 != 0) {
						E00E4309B(0, 0);
					}
					if((_t37 & 0x00000004) == 0) {
						_t46 =  ==  ? "ios_base::eofbit set" : "ios_base::failbit set";
					} else {
						_t46 = "ios_base::badbit set";
					}
					_t23 = E00E11650(_t34, _t39, _t40,  &_v32, 1);
					_t38 =  &_v24;
					_push(_t23);
					E00E11EF0(_t34, _t38, _t46);
					E00E4309B( &_v32, 0xe79ef4);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t46);
					_t47 = _v48;
					asm("xorps xmm0, xmm0");
					_push(_t40);
					_t41 = _t38;
					 *_t41 = 0xe632f4;
					asm("movq [eax], xmm0");
					E00E42D62(_t47 + 4, _t41 + 4);
					 *_t41 = 0xe6330c;
					 *((intOrPtr*)(_t41 + 0xc)) =  *((intOrPtr*)(_t47 + 0xc));
					 *((intOrPtr*)(_t41 + 0x10)) =  *((intOrPtr*)(_t47 + 0x10));
					 *_t41 = 0xe633b8;
					return _t41;
				}
			}

0x00e11fc0
0x00e11fc0
0x00e11fcc
0x00e11fcf
0x00e11fd2
0x00e11fd6
0x00e11fd8
0x00e11fe6
0x00e11fda
0x00e11fde
0x00e11fed
0x00e11fed
0x00e11ff5
0x00e1200b
0x00e11ff7
0x00e11ff7
0x00e11ff7
0x00e12015
0x00e1201d
0x00e12021
0x00e12023
0x00e12032
0x00e12037
0x00e12038
0x00e12039
0x00e1203a
0x00e1203b
0x00e1203c
0x00e1203d
0x00e1203e
0x00e1203f
0x00e12043
0x00e12044
0x00e12047
0x00e1204a
0x00e1204b
0x00e12051
0x00e12057
0x00e1205f
0x00e12064
0x00e12070
0x00e12076
0x00e1207b
0x00e12084
0x00e12084

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00E11FED

Part of subcall function 00E4309B: RaiseException.KERNEL32(?,?,?,00E2CB67,?,?,?,?,?,?,?,?,00E2CB67,?,00E781E4), ref: 00E430FB

__CxxThrowException@8.LIBVCRUNTIME ref: 00E12032
___std_exception_copy.LIBVCRUNTIME ref: 00E1205F

Strings

ios_base::failbit set, xrefs: 00E11F05, 00E12001
ios_base::badbit set, xrefs: 00E11FF7, 00E12022, 00E12043
ios_base::eofbit set, xrefs: 00E12006

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3941765731-1866435925
Opcode ID: 3cba4d2555f18d7797707691150d44ecfd8a00fd819edbe7170be230af8085a0
Instruction ID: 32d1b257ccc6e44996f588e563da03974c10d5184b33fccd8243ef9ab857d097
Opcode Fuzzy Hash: 3cba4d2555f18d7797707691150d44ecfd8a00fd819edbe7170be230af8085a0
Instruction Fuzzy Hash: 611127B2A003056BC710DE68D802FC6B3D8AF54350F04966AFA58FB241F770E944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E57E84, Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00E57E84(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E00E57BCE(_t45, 7);
					E00E57BCE(_t45 + 0x1c, 7);
					E00E57BCE(_t45 + 0x38, 0xc);
					E00E57BCE(_t45 + 0x68, 0xc);
					E00E57BCE(_t45 + 0x98, 2);
					E00E4F1E8( *((intOrPtr*)(_t45 + 0xa0)));
					E00E4F1E8( *((intOrPtr*)(_t45 + 0xa4)));
					E00E4F1E8( *((intOrPtr*)(_t45 + 0xa8)));
					E00E57BCE(_t45 + 0xb4, 7);
					E00E57BCE(_t45 + 0xd0, 7);
					E00E57BCE(_t45 + 0xec, 0xc);
					E00E57BCE(_t45 + 0x11c, 0xc);
					E00E57BCE(_t45 + 0x14c, 2);
					E00E4F1E8( *((intOrPtr*)(_t45 + 0x154)));
					E00E4F1E8( *((intOrPtr*)(_t45 + 0x158)));
					E00E4F1E8( *((intOrPtr*)(_t45 + 0x15c)));
					return E00E4F1E8( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x00e57e8a
0x00e57e8f
0x00e57e98
0x00e57ea3
0x00e57eae
0x00e57eb9
0x00e57ec7
0x00e57ed2
0x00e57edd
0x00e57ee8
0x00e57ef6
0x00e57f04
0x00e57f15
0x00e57f23
0x00e57f31
0x00e57f3c
0x00e57f47
0x00e57f52
0x00000000
0x00e57f62
0x00e57f67

APIs

Part of subcall function 00E57BCE: _free.LIBCMT ref: 00E57BF3

_free.LIBCMT ref: 00E57ED2

Part of subcall function 00E4F1E8: HeapFree.KERNEL32(00000000,00000000,?,00E57BF8,?,00000000,?,?,?,00E57E9D,?,00000007,?,?,00E582A2,?), ref: 00E4F1FE
Part of subcall function 00E4F1E8: GetLastError.KERNEL32(?,?,00E57BF8,?,00000000,?,?,?,00E57E9D,?,00000007,?,?,00E582A2,?,?), ref: 00E4F210

_free.LIBCMT ref: 00E57EDD
_free.LIBCMT ref: 00E57EE8
_free.LIBCMT ref: 00E57F3C
_free.LIBCMT ref: 00E57F47
_free.LIBCMT ref: 00E57F52
_free.LIBCMT ref: 00E57F5D

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6820508e25db95c98653c6b87ea63b6b879027fb144ea53f642f15769260df2e
Instruction ID: 802e081772c8e65fdc0302d43b5454d347f95435c4a8484cce2b5b313f158ec5
Opcode Fuzzy Hash: 6820508e25db95c98653c6b87ea63b6b879027fb144ea53f642f15769260df2e
Instruction Fuzzy Hash: 01115171585B04EAD560BBB0EC07FCB7BDD9F00701F409C25B7DA76153DA6AB5188750

Uniqueness

Uniqueness Score: -1.00%

Function 00E2EB68, Relevance: 10.6, APIs: 7, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,00000000,?,?), ref: 00E2EB76
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,00000000,?,?), ref: 00E2EB7C
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,00000000,?,?), ref: 00E2EBA9
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,00000000,?,?), ref: 00E2EBB3
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,00000000,?,?), ref: 00E2EBC5
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00E2EBDB
__CxxThrowException@8.LIBVCRUNTIME ref: 00E2EBE9

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID:
API String ID: 4227777306-0
Opcode ID: 4ad4929ffe07cf930b26916f557179628e60ab9f8fa2e702003925634a037c31
Instruction ID: 9dff6228a05792f5e69232a5d955536c6d38347bd921a1f1b81b43bbca24d597
Opcode Fuzzy Hash: 4ad4929ffe07cf930b26916f557179628e60ab9f8fa2e702003925634a037c31
Instruction Fuzzy Hash: 5F01A235604135ABCB20AB76FC4EEEF3BBDAF41795B502425F506F2291EB60DA088760

Uniqueness

Uniqueness Score: -1.00%

Function 00E4E797, Relevance: 9.3, APIs: 6, Instructions: 319
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 64%

			E00E4E797(void* __ebx, void* __edi, void* __esi, void* __eflags, void* _a4, signed int _a8, long _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				char _v23;
				char _v24;
				void _v32;
				signed int _v33;
				long _v40;
				long _v44;
				char _v47;
				void _v48;
				intOrPtr _v52;
				long _v56;
				char _v60;
				intOrPtr _v68;
				char _v72;
				struct _OVERLAPPED* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				signed int _v92;
				long _v96;
				long _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				long _v112;
				void* _v116;
				char _v120;
				int _v124;
				intOrPtr _v128;
				struct _OVERLAPPED* _v132;
				struct _OVERLAPPED* _v136;
				struct _OVERLAPPED* _v140;
				struct _OVERLAPPED* _v144;
				signed int _t172;
				signed int _t174;
				intOrPtr _t176;
				int _t178;
				intOrPtr _t183;
				intOrPtr _t186;
				void* _t188;
				void* _t190;
				long _t193;
				void _t198;
				long _t202;
				void* _t206;
				intOrPtr _t212;
				signed char* _t213;
				char _t216;
				signed int _t219;
				char* _t220;
				void* _t222;
				long _t228;
				intOrPtr _t229;
				char _t231;
				long _t235;
				struct _OVERLAPPED* _t243;
				signed int _t246;
				intOrPtr _t249;
				signed int _t252;
				signed int _t253;
				signed int _t255;
				struct _OVERLAPPED* _t256;
				intOrPtr _t258;
				void* _t262;
				long _t263;
				signed char _t264;
				signed int _t265;
				void* _t266;
				void* _t268;
				struct _OVERLAPPED* _t269;
				long _t270;
				signed int _t271;
				long _t275;
				signed int _t278;
				long _t279;
				struct _OVERLAPPED* _t280;
				signed int _t282;
				intOrPtr _t284;
				signed int _t286;
				signed int _t289;
				long _t290;
				long _t291;
				signed int _t292;
				intOrPtr _t293;
				signed int _t294;
				void* _t295;
				void* _t296;

				_t172 =  *0xe7b068; // 0x1b9618b6
				_v8 = _t172 ^ _t294;
				_t174 = _a8;
				_t263 = _a12;
				_t282 = (_t174 & 0x0000003f) * 0x38;
				_t246 = _t174 >> 6;
				_v112 = _t263;
				_v84 = _t246;
				_t176 =  *((intOrPtr*)(0xe7e518 + _t246 * 4));
				_v80 = _t282;
				_t10 = _t176 + 0x18; // 0x8458b01
				_t284 = _a16 + _t263;
				_v116 =  *((intOrPtr*)(_t282 + _t10));
				_v104 = _t284;
				_t178 = GetConsoleCP();
				_t243 = 0;
				_v124 = _t178;
				E00E47456( &_v72, _t263, 0);
				asm("stosd");
				_t249 =  *((intOrPtr*)(_v68 + 8));
				_v128 = _t249;
				asm("stosd");
				asm("stosd");
				_t275 = _v112;
				_v40 = _t275;
				if(_t275 >= _t284) {
					L52:
					__eflags = _v60 - _t243;
				} else {
					_t286 = _v92;
					while(1) {
						_v47 =  *_t275;
						_v76 = _t243;
						_v44 = 1;
						_t186 =  *((intOrPtr*)(0xe7e518 + _v84 * 4));
						_v52 = _t186;
						if(_t249 != 0xfde9) {
							goto L23;
						}
						_t265 = _v80;
						_t212 = _t186 + 0x2e + _t265;
						_t256 = _t243;
						_v108 = _t212;
						while( *((intOrPtr*)(_t212 + _t256)) != _t243) {
							_t256 =  &(_t256->Internal);
							if(_t256 < 5) {
								continue;
							}
							break;
						}
						_t213 = _v40;
						_t278 = _v104 - _t213;
						_v44 = _t256;
						if(_t256 <= 0) {
							_t258 =  *((char*)(( *_t213 & 0x000000ff) + 0xe7b3b8)) + 1;
							_v52 = _t258;
							__eflags = _t258 - _t278;
							if(_t258 > _t278) {
								__eflags = _t278;
								if(_t278 <= 0) {
									goto L44;
								} else {
									_t290 = _v40;
									do {
										_t266 = _t265 + _t243;
										_t216 =  *((intOrPtr*)(_t243 + _t290));
										_t243 =  &(_t243->Internal);
										 *((char*)(_t266 +  *((intOrPtr*)(0xe7e518 + _v84 * 4)) + 0x2e)) = _t216;
										_t265 = _v80;
										__eflags = _t243 - _t278;
									} while (_t243 < _t278);
									goto L43;
								}
							} else {
								_t279 = _v40;
								__eflags = _t258 - 4;
								_v144 = _t243;
								_t260 =  &_v144;
								_v140 = _t243;
								_v56 = _t279;
								_t219 = (0 | _t258 == 0x00000004) + 1;
								__eflags = _t219;
								_push( &_v144);
								_v44 = _t219;
								_push(_t219);
								_t220 =  &_v56;
								goto L21;
							}
						} else {
							_t228 =  *((char*)(( *(_t265 + _v52 + 0x2e) & 0x000000ff) + 0xe7b3b8)) + 1;
							_v56 = _t228;
							_t229 = _t228 - _t256;
							_v52 = _t229;
							if(_t229 > _t278) {
								__eflags = _t278;
								if(_t278 > 0) {
									_t291 = _v40;
									do {
										_t268 = _t265 + _t243 + _t256;
										_t231 =  *((intOrPtr*)(_t243 + _t291));
										_t243 =  &(_t243->Internal);
										 *((char*)(_t268 +  *((intOrPtr*)(0xe7e518 + _v84 * 4)) + 0x2e)) = _t231;
										_t256 = _v44;
										_t265 = _v80;
										__eflags = _t243 - _t278;
									} while (_t243 < _t278);
									L43:
									_t286 = _v92;
								}
								L44:
								_t289 = _t286 + _t278;
								__eflags = _t289;
								L45:
								__eflags = _v60;
								_v92 = _t289;
							} else {
								_t269 = _t243;
								if(_t256 > 0) {
									_t293 = _v108;
									do {
										 *((char*)(_t294 + _t269 - 0xc)) =  *((intOrPtr*)(_t293 + _t269));
										_t269 =  &(_t269->Internal);
									} while (_t269 < _t256);
									_t229 = _v52;
								}
								_t279 = _v40;
								if(_t229 > 0) {
									E00E43110( &_v16 + _t256, _t279, _v52);
									_t256 = _v44;
									_t295 = _t295 + 0xc;
								}
								if(_t256 > 0) {
									_t270 = _v44;
									_t280 = _t243;
									_t292 = _v80;
									do {
										_t262 = _t292 + _t280;
										_t280 =  &(_t280->Internal);
										 *(_t262 +  *((intOrPtr*)(0xe7e518 + _v84 * 4)) + 0x2e) = _t243;
									} while (_t280 < _t270);
									_t279 = _v40;
								}
								_v136 = _t243;
								_v120 =  &_v16;
								_t260 =  &_v136;
								_v132 = _t243;
								_push( &_v136);
								_t235 = (0 | _v56 == 0x00000004) + 1;
								_v44 = _t235;
								_push(_t235);
								_t220 =  &_v120;
								L21:
								_push(_t220);
								_push( &_v76);
								_t222 = E00E5A1DB(_t260);
								_t296 = _t295 + 0x10;
								if(_t222 == 0xffffffff) {
									goto L52;
								} else {
									_t275 = _t279 + _v52 - 1;
									L31:
									_t275 = _t275 + 1;
									_v40 = _t275;
									_t193 = E00E5580D(_v124, _t243,  &_v76, _v44,  &_v32, 5, _t243, _t243);
									_t295 = _t296 + 0x20;
									_v56 = _t193;
									if(_t193 == 0) {
										goto L52;
									} else {
										if(WriteFile(_v116,  &_v32, _t193,  &_v100, _t243) == 0) {
											L51:
											_v96 = GetLastError();
											goto L52;
										} else {
											_t286 = _v88 - _v112 + _t275;
											_v92 = _t286;
											if(_v100 < _v56) {
												goto L52;
											} else {
												if(_v47 != 0xa) {
													L38:
													if(_t275 >= _v104) {
														goto L52;
													} else {
														_t249 = _v128;
														continue;
													}
												} else {
													_t198 = 0xd;
													_v48 = _t198;
													if(WriteFile(_v116,  &_v48, 1,  &_v100, _t243) == 0) {
														goto L51;
													} else {
														if(_v100 < 1) {
															goto L52;
														} else {
															_v88 = _v88 + 1;
															_t286 = _t286 + 1;
															_v92 = _t286;
															goto L38;
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L53;
						L23:
						_t252 = _v80;
						_t264 =  *((intOrPtr*)(_t252 + _t186 + 0x2d));
						__eflags = _t264 & 0x00000004;
						if((_t264 & 0x00000004) == 0) {
							_v33 =  *_t275;
							_t188 = E00E4A4C8(_t264);
							_t253 = _v33 & 0x000000ff;
							__eflags =  *((intOrPtr*)(_t188 + _t253 * 2)) - _t243;
							if( *((intOrPtr*)(_t188 + _t253 * 2)) >= _t243) {
								_push(1);
								_push(_t275);
								goto L30;
							} else {
								_t202 = _t275 + 1;
								_v56 = _t202;
								__eflags = _t202 - _v104;
								if(_t202 >= _v104) {
									_t271 = _v84;
									_t255 = _v80;
									 *((char*)(_t255 +  *((intOrPtr*)(0xe7e518 + _t271 * 4)) + 0x2e)) = _v33;
									 *(_t255 +  *((intOrPtr*)(0xe7e518 + _t271 * 4)) + 0x2d) =  *(_t255 +  *((intOrPtr*)(0xe7e518 + _t271 * 4)) + 0x2d) | 0x00000004;
									_t289 = _t286 + 1;
									goto L45;
								} else {
									_t206 = E00E4F6FF( &_v76, _t275, 2);
									_t296 = _t295 + 0xc;
									__eflags = _t206 - 0xffffffff;
									if(_t206 == 0xffffffff) {
										goto L52;
									} else {
										_t275 = _v56;
										goto L31;
									}
								}
							}
						} else {
							_v24 =  *((intOrPtr*)(_t252 + _t186 + 0x2e));
							_v23 =  *_t275;
							_push(2);
							 *(_t252 + _v52 + 0x2d) = _t264 & 0x000000fb;
							_push( &_v24);
							L30:
							_push( &_v76);
							_t190 = E00E4F6FF();
							_t296 = _t295 + 0xc;
							__eflags = _t190 - 0xffffffff;
							if(_t190 == 0xffffffff) {
								goto L52;
							} else {
								goto L31;
							}
						}
						goto L53;
					}
				}
				L53:
				if(__eflags != 0) {
					_t183 = _v72;
					_t167 = _t183 + 0x350;
					 *_t167 =  *(_t183 + 0x350) & 0xfffffffd;
					__eflags =  *_t167;
				}
				__eflags = _v8 ^ _t294;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E00E2C067(_v8 ^ _t294);
			}

0x00e4e7a2
0x00e4e7a9
0x00e4e7ac
0x00e4e7b1
0x00e4e7b9
0x00e4e7bc
0x00e4e7c0
0x00e4e7c3
0x00e4e7c6
0x00e4e7cd
0x00e4e7d0
0x00e4e7d7
0x00e4e7d9
0x00e4e7dc
0x00e4e7df
0x00e4e7e5
0x00e4e7e7
0x00e4e7ee
0x00e4e7fb
0x00e4e7fc
0x00e4e7ff
0x00e4e802
0x00e4e803
0x00e4e804
0x00e4e807
0x00e4e80c
0x00e4eb18
0x00e4eb18
0x00e4e812
0x00e4e812
0x00e4e815
0x00e4e817
0x00e4e81d
0x00e4e820
0x00e4e827
0x00e4e82e
0x00e4e837
0x00000000
0x00000000
0x00e4e83d
0x00e4e843
0x00e4e845
0x00e4e847
0x00e4e84a
0x00e4e84f
0x00e4e853
0x00000000
0x00000000
0x00000000
0x00e4e853
0x00e4e858
0x00e4e85b
0x00e4e85d
0x00e4e862
0x00e4e914
0x00e4e915
0x00e4e918
0x00e4e91a
0x00e4eac8
0x00e4eaca
0x00000000
0x00e4eacc
0x00e4eacc
0x00e4eacf
0x00e4ead2
0x00e4eadb
0x00e4eade
0x00e4eadf
0x00e4eae3
0x00e4eae6
0x00e4eae6
0x00000000
0x00e4eaea
0x00e4e920
0x00e4e920
0x00e4e925
0x00e4e928
0x00e4e92e
0x00e4e934
0x00e4e93d
0x00e4e940
0x00e4e940
0x00e4e941
0x00e4e942
0x00e4e945
0x00e4e946
0x00000000
0x00e4e946
0x00e4e868
0x00e4e877
0x00e4e878
0x00e4e87b
0x00e4e87d
0x00e4e882
0x00e4ea93
0x00e4ea95
0x00e4ea97
0x00e4ea9a
0x00e4ea9f
0x00e4eaa8
0x00e4eaab
0x00e4eaac
0x00e4eab0
0x00e4eab3
0x00e4eab6
0x00e4eab6
0x00e4eaba
0x00e4eaba
0x00e4eaba
0x00e4eabd
0x00e4eabd
0x00e4eabd
0x00e4eabf
0x00e4eabf
0x00e4eac3
0x00e4e888
0x00e4e888
0x00e4e88c
0x00e4e88e
0x00e4e891
0x00e4e894
0x00e4e898
0x00e4e899
0x00e4e89d
0x00e4e89d
0x00e4e8a0
0x00e4e8a5
0x00e4e8b1
0x00e4e8b6
0x00e4e8b9
0x00e4e8b9
0x00e4e8be
0x00e4e8c0
0x00e4e8c3
0x00e4e8c5
0x00e4e8c8
0x00e4e8cb
0x00e4e8ce
0x00e4e8d6
0x00e4e8da
0x00e4e8de
0x00e4e8de
0x00e4e8e4
0x00e4e8ea
0x00e4e8ed
0x00e4e8f5
0x00e4e8fc
0x00e4e900
0x00e4e901
0x00e4e904
0x00e4e905
0x00e4e949
0x00e4e949
0x00e4e94d
0x00e4e94e
0x00e4e953
0x00e4e959
0x00000000
0x00e4e95f
0x00e4e963
0x00e4e9ec
0x00e4e9f3
0x00e4e9fb
0x00e4ea03
0x00e4ea08
0x00e4ea0b
0x00e4ea10
0x00000000
0x00e4ea16
0x00e4ea2b
0x00e4eb0f
0x00e4eb15
0x00000000
0x00e4ea31
0x00e4ea3a
0x00e4ea3c
0x00e4ea42
0x00000000
0x00e4ea48
0x00e4ea4c
0x00e4ea82
0x00e4ea85
0x00000000
0x00e4ea8b
0x00e4ea8b
0x00000000
0x00e4ea8b
0x00e4ea4e
0x00e4ea50
0x00e4ea52
0x00e4ea6b
0x00000000
0x00e4ea71
0x00e4ea75
0x00000000
0x00e4ea7b
0x00e4ea7b
0x00e4ea7e
0x00e4ea7f
0x00000000
0x00e4ea7f
0x00e4ea75
0x00e4ea6b
0x00e4ea4c
0x00e4ea42
0x00e4ea2b
0x00e4ea10
0x00e4e959
0x00e4e882
0x00000000
0x00e4e96a
0x00e4e96a
0x00e4e96d
0x00e4e971
0x00e4e974
0x00e4e996
0x00e4e999
0x00e4e99e
0x00e4e9a2
0x00e4e9a6
0x00e4e9d4
0x00e4e9d6
0x00000000
0x00e4e9a8
0x00e4e9a8
0x00e4e9ab
0x00e4e9ae
0x00e4e9b1
0x00e4eaec
0x00e4eaef
0x00e4eafc
0x00e4eb07
0x00e4eb0c
0x00000000
0x00e4e9b7
0x00e4e9be
0x00e4e9c3
0x00e4e9c6
0x00e4e9c9
0x00000000
0x00e4e9cf
0x00e4e9cf
0x00000000
0x00e4e9cf
0x00e4e9c9
0x00e4e9b1
0x00e4e976
0x00e4e97d
0x00e4e982
0x00e4e988
0x00e4e98a
0x00e4e991
0x00e4e9d7
0x00e4e9da
0x00e4e9db
0x00e4e9e0
0x00e4e9e3
0x00e4e9e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00e4e9e6
0x00000000
0x00e4e974
0x00e4e815
0x00e4eb1b
0x00e4eb1b
0x00e4eb1d
0x00e4eb20
0x00e4eb20
0x00e4eb20
0x00e4eb20
0x00e4eb32
0x00e4eb34
0x00e4eb35
0x00e4eb36
0x00e4eb42

APIs

GetConsoleCP.KERNEL32(8304488B,00E49317,00000000), ref: 00E4E7DF
__fassign.LIBCMT ref: 00E4E9BE
__fassign.LIBCMT ref: 00E4E9DB
WriteFile.KERNEL32(?,00000010,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00E4EA23
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00E4EA63
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00E4EB0F

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: a6e35401122362aa699017f338fad7faaf21ba17a192673b5ecfe51ec538fe0a
Instruction ID: 9ae161ff3d19f198b4d0a676b473fb05389317659b6187c48218c118fa4c68f6
Opcode Fuzzy Hash: a6e35401122362aa699017f338fad7faaf21ba17a192673b5ecfe51ec538fe0a
Instruction Fuzzy Hash: 9CD18C71D002589FDF15CFA8E8809EDBBB5FF49314F2851AAE855BB342D630AE46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00E4DAC6, Relevance: 9.3, APIs: 6, Instructions: 265
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 73%

			E00E4DAC6(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				signed int _v8;
				short _v270;
				short _v272;
				char _v528;
				char _v700;
				signed int _v704;
				short _v706;
				signed int* _v708;
				signed int _v712;
				signed int _v716;
				signed int _v720;
				signed int* _v724;
				intOrPtr _v728;
				signed int _v732;
				signed int _v736;
				signed int _v740;
				signed int _v744;
				signed int _t146;
				void* _t153;
				signed int _t156;
				signed int _t157;
				intOrPtr _t158;
				signed int _t161;
				signed int _t163;
				signed int _t164;
				intOrPtr _t166;
				signed int _t169;
				signed int _t170;
				signed int _t172;
				signed int _t192;
				signed int _t194;
				signed int _t196;
				signed int _t201;
				signed int _t204;
				intOrPtr* _t212;
				intOrPtr* _t213;
				signed int _t222;
				intOrPtr _t225;
				intOrPtr* _t226;
				signed int _t228;
				signed int* _t232;
				signed int _t233;
				void* _t240;
				signed int _t241;
				intOrPtr _t243;
				signed int _t249;
				signed int _t251;
				signed int _t254;
				signed int* _t255;
				intOrPtr* _t256;
				short _t257;
				signed int _t259;
				signed int _t261;
				void* _t263;
				void* _t265;

				_t259 = _t261;
				_t146 =  *0xe7b068; // 0x1b9618b6
				_v8 = _t146 ^ _t259;
				_push(__ebx);
				_t204 = _a8;
				_push(__esi);
				_push(__edi);
				_t243 = _a4;
				_v736 = _t204;
				_v724 = E00E4FBAD(__ecx, __edx) + 0x278;
				_t153 = E00E4D199(_t204, __ecx, __edx, _t243, _a12, _a12,  &_v272, 0x83,  &_v700, 0x55,  &_v712);
				_t263 = _t261 - 0x2e4 + 0x18;
				if(_t153 == 0) {
					L39:
					__eflags = 0;
					goto L40;
				} else {
					_t10 = _t204 + 2; // 0x6
					_t249 = _t10 << 4;
					_t156 =  &_v272;
					_v716 = _t249;
					_t212 =  *((intOrPtr*)(_t249 + _t243));
					while(1) {
						_v704 = _v704 & 0x00000000;
						_t251 = _v716;
						if( *_t156 !=  *_t212) {
							break;
						}
						if( *_t156 == 0) {
							L6:
							_t157 = _v704;
						} else {
							_t257 =  *((intOrPtr*)(_t156 + 2));
							_v706 = _t257;
							_t251 = _v716;
							if(_t257 !=  *((intOrPtr*)(_t212 + 2))) {
								break;
							} else {
								_t156 = _t156 + 4;
								_t212 = _t212 + 4;
								if(_v706 != 0) {
									continue;
								} else {
									goto L6;
								}
							}
						}
						L8:
						if(_t157 != 0) {
							_t213 =  &_v272;
							_t240 = _t213 + 2;
							do {
								_t158 =  *_t213;
								_t213 = _t213 + 2;
								__eflags = _t158 - _v704;
							} while (_t158 != _v704);
							_v720 = (_t213 - _t240 >> 1) + 1;
							_t161 = E00E4F56D(4 + ((_t213 - _t240 >> 1) + 1) * 2);
							_v732 = _t161;
							__eflags = _t161;
							if(_t161 == 0) {
								goto L39;
							} else {
								_v728 =  *((intOrPtr*)(_t251 + _t243));
								_v740 =  *(_t243 + 0xa0 + _t204 * 4);
								_v744 =  *(_t243 + 8);
								_v708 = _t161 + 4;
								_t163 = E00E4B7D6(_t161 + 4, _v720,  &_v272);
								_t265 = _t263 + 0xc;
								__eflags = _t163;
								if(_t163 != 0) {
									_t164 = _v704;
									_push(_t164);
									_push(_t164);
									_push(_t164);
									_push(_t164);
									_push(_t164);
									E00E49599();
									asm("int3");
									_t166 =  *0xe7e50c; // 0x0
									return _t166;
								} else {
									__eflags = _v272 - 0x43;
									 *((intOrPtr*)(_t251 + _t243)) = _v708;
									if(_v272 != 0x43) {
										L17:
										_t169 = E00E4CEA6(_t204, _t243,  &_v700);
										_t222 = _v704;
									} else {
										__eflags = _v270;
										if(_v270 != 0) {
											goto L17;
										} else {
											_t222 = _v704;
											_t169 = _t222;
										}
									}
									 *(_t243 + 0xa0 + _t204 * 4) = _t169;
									__eflags = _t204 - 2;
									if(_t204 != 2) {
										__eflags = _t204 - 1;
										if(_t204 != 1) {
											__eflags = _t204 - 5;
											if(_t204 == 5) {
												 *((intOrPtr*)(_t243 + 0x14)) = _v712;
											}
										} else {
											 *((intOrPtr*)(_t243 + 0x10)) = _v712;
										}
									} else {
										_t255 = _v724;
										_t241 = _t222;
										_t232 = _t255;
										 *(_t243 + 8) = _v712;
										_v708 = _t255;
										_v720 = _t255[8];
										_v712 = _t255[9];
										while(1) {
											__eflags =  *(_t243 + 8) -  *_t232;
											if( *(_t243 + 8) ==  *_t232) {
												break;
											}
											_t256 = _v708;
											_t241 = _t241 + 1;
											_t201 =  *_t232;
											 *_t256 = _v720;
											_v712 = _t232[1];
											_t232 = _t256 + 8;
											 *((intOrPtr*)(_t256 + 4)) = _v712;
											_t204 = _v736;
											_t255 = _v724;
											_v720 = _t201;
											_v708 = _t232;
											__eflags = _t241 - 5;
											if(_t241 < 5) {
												continue;
											} else {
											}
											L25:
											__eflags = _t241 - 5;
											if(__eflags == 0) {
												_t192 = E00E53D19(_t204, _t243, _t255, __eflags, _v704, 1, 0xe697c8, 0x7f,  &_v528,  *(_t243 + 8), 1);
												_t265 = _t265 + 0x1c;
												__eflags = _t192;
												if(_t192 == 0) {
													_t233 = _v704;
												} else {
													_t194 = _v704;
													do {
														 *(_t259 + _t194 * 2 - 0x20c) =  *(_t259 + _t194 * 2 - 0x20c) & 0x000001ff;
														_t194 = _t194 + 1;
														__eflags = _t194 - 0x7f;
													} while (_t194 < 0x7f);
													_t196 = E00E43D7E( &_v528,  *0xe7b2a0, 0xfe);
													_t265 = _t265 + 0xc;
													__eflags = _t196;
													_t233 = 0 | _t196 == 0x00000000;
												}
												_t255[1] = _t233;
												 *_t255 =  *(_t243 + 8);
											}
											 *(_t243 + 0x18) = _t255[1];
											goto L37;
										}
										__eflags = _t241;
										if(_t241 != 0) {
											 *_t255 =  *(_t255 + _t241 * 8);
											_t255[1] =  *(_t255 + 4 + _t241 * 8);
											 *(_t255 + _t241 * 8) = _v720;
											 *(_t255 + 4 + _t241 * 8) = _v712;
										}
										goto L25;
									}
									L37:
									_t170 = _t204 * 0xc;
									_t106 = _t170 + 0xe69850; // 0xe13c60
									 *0xe63210(_t243);
									_t172 =  *((intOrPtr*)( *_t106))();
									_t225 = _v728;
									__eflags = _t172;
									if(_t172 == 0) {
										__eflags = _t225 - 0xe7b3b0;
										if(_t225 != 0xe7b3b0) {
											_t254 = _t204 + _t204;
											__eflags = _t254;
											asm("lock xadd [eax], ecx");
											if(_t254 != 0) {
												goto L44;
											} else {
												E00E4F1E8( *((intOrPtr*)(_t243 + 0x28 + _t254 * 8)));
												E00E4F1E8( *((intOrPtr*)(_t243 + 0x24 + _t254 * 8)));
												E00E4F1E8( *(_t243 + 0xa0 + _t204 * 4));
												_t228 = _v704;
												 *(_v716 + _t243) = _t228;
												 *(_t243 + 0xa0 + _t204 * 4) = _t228;
											}
										}
										_t226 = _v732;
										 *_t226 = 1;
										 *((intOrPtr*)(_t243 + 0x28 + (_t204 + _t204) * 8)) = _t226;
									} else {
										 *((intOrPtr*)(_v716 + _t243)) = _t225;
										E00E4F1E8( *(_t243 + 0xa0 + _t204 * 4));
										 *(_t243 + 0xa0 + _t204 * 4) = _v740;
										E00E4F1E8(_v732);
										 *(_t243 + 8) = _v744;
										goto L39;
									}
									goto L40;
								}
							}
						} else {
							L40:
							return E00E2C067(_v8 ^ _t259);
						}
						goto L48;
					}
					asm("sbb eax, eax");
					_t157 = _t156 | 0x00000001;
					__eflags = _t157;
					goto L8;
				}
				L48:
			}

0x00e4dac9
0x00e4dad1
0x00e4dad8
0x00e4dadb
0x00e4dadc
0x00e4dadf
0x00e4dae3
0x00e4dae4
0x00e4dae7
0x00e4daf7
0x00e4db1a
0x00e4db1f
0x00e4db24
0x00e4ddfc
0x00e4ddfc
0x00000000
0x00e4db2a
0x00e4db2a
0x00e4db2d
0x00e4db30
0x00e4db36
0x00e4db3f
0x00e4db41
0x00e4db44
0x00e4db4e
0x00e4db54
0x00000000
0x00000000
0x00e4db5a
0x00e4db83
0x00e4db83
0x00e4db5c
0x00e4db5c
0x00e4db64
0x00e4db6b
0x00e4db71
0x00000000
0x00e4db73
0x00e4db73
0x00e4db76
0x00e4db81
0x00000000
0x00000000
0x00000000
0x00000000
0x00e4db81
0x00e4db71
0x00e4db90
0x00e4db92
0x00e4db9b
0x00e4dba1
0x00e4dba4
0x00e4dba4
0x00e4dba7
0x00e4dbaa
0x00e4dbaa
0x00e4dbba
0x00e4dbc8
0x00e4dbcd
0x00e4dbd4
0x00e4dbd6
0x00000000
0x00e4dbdc
0x00e4dbe2
0x00e4dbef
0x00e4dbf8
0x00e4dc0b
0x00e4dc12
0x00e4dc17
0x00e4dc1a
0x00e4dc1c
0x00e4de7e
0x00e4de84
0x00e4de85
0x00e4de86
0x00e4de87
0x00e4de88
0x00e4de89
0x00e4de8e
0x00e4de8f
0x00e4de95
0x00e4dc22
0x00e4dc22
0x00e4dc30
0x00e4dc33
0x00e4dc49
0x00e4dc50
0x00e4dc56
0x00e4dc35
0x00e4dc35
0x00e4dc3d
0x00000000
0x00e4dc3f
0x00e4dc3f
0x00e4dc45
0x00e4dc45
0x00e4dc3d
0x00e4dc5c
0x00e4dc63
0x00e4dc66
0x00e4dd86
0x00e4dd89
0x00e4dd96
0x00e4dd99
0x00e4dda1
0x00e4dda1
0x00e4dd8b
0x00e4dd91
0x00e4dd91
0x00e4dc6c
0x00e4dc6c
0x00e4dc72
0x00e4dc7a
0x00e4dc7c
0x00e4dc7f
0x00e4dc88
0x00e4dc91
0x00e4dc97
0x00e4dc9a
0x00e4dc9c
0x00000000
0x00000000
0x00e4dc9e
0x00e4dca4
0x00e4dca5
0x00e4dcb0
0x00e4dcb8
0x00e4dcc0
0x00e4dcc3
0x00e4dcc6
0x00e4dccc
0x00e4dcd2
0x00e4dcd8
0x00e4dcde
0x00e4dce1
0x00000000
0x00000000
0x00e4dce3
0x00e4dd08
0x00e4dd08
0x00e4dd0b
0x00e4dd28
0x00e4dd2d
0x00e4dd30
0x00e4dd32
0x00e4dd70
0x00e4dd34
0x00e4dd34
0x00e4dd3a
0x00e4dd3f
0x00e4dd47
0x00e4dd48
0x00e4dd48
0x00e4dd5f
0x00e4dd66
0x00e4dd69
0x00e4dd6b
0x00e4dd6b
0x00e4dd76
0x00e4dd7c
0x00e4dd7c
0x00e4dd81
0x00000000
0x00e4dd81
0x00e4dce5
0x00e4dce7
0x00e4dcec
0x00e4dcf2
0x00e4dcfb
0x00e4dd04
0x00e4dd04
0x00000000
0x00e4dce7
0x00e4dda4
0x00e4dda4
0x00e4dda8
0x00e4ddb0
0x00e4ddb6
0x00e4ddb9
0x00e4ddbf
0x00e4ddc1
0x00e4de0f
0x00e4de15
0x00e4de1c
0x00e4de1c
0x00e4de22
0x00e4de26
0x00000000
0x00e4de28
0x00e4de2c
0x00e4de35
0x00e4de41
0x00e4de4f
0x00e4de55
0x00e4de58
0x00e4de58
0x00e4de26
0x00e4de67
0x00e4de6f
0x00e4de78
0x00e4ddc3
0x00e4ddc9
0x00e4ddd3
0x00e4dde5
0x00e4ddec
0x00e4ddf9
0x00000000
0x00e4ddf9
0x00000000
0x00e4ddc1
0x00e4dc1c
0x00e4db94
0x00e4ddfe
0x00e4de0e
0x00e4de0e
0x00000000
0x00e4db92
0x00e4db8b
0x00e4db8d
0x00e4db8d
0x00000000
0x00e4db8d
0x00000000

APIs

Part of subcall function 00E4FBAD: GetLastError.KERNEL32(00E7BC08,ios_base::failbit set,?,00E484A4,00E79760,00000008,?,00000001), ref: 00E4FBB2
Part of subcall function 00E4FBAD: SetLastError.KERNEL32(00000000,00000002,000000FF,?,00E484A4,00E79760,00000008,?,00000001), ref: 00E4FC50

_memcmp.LIBVCRUNTIME ref: 00E4DD5F
_free.LIBCMT ref: 00E4DDD3
_free.LIBCMT ref: 00E4DDEC
_free.LIBCMT ref: 00E4DE2C
_free.LIBCMT ref: 00E4DE35
_free.LIBCMT ref: 00E4DE41

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: _free$ErrorLast$_memcmp
String ID:
API String ID: 4275183328-0
Opcode ID: 893faeaa874c1e365e2152844d0f7bddbea894d12b4b7571b14da04546095056
Instruction ID: 16da8ee13c4542c19ca1711bffbdb31e79372e56e3920139d29f34c03036ab59
Opcode Fuzzy Hash: 893faeaa874c1e365e2152844d0f7bddbea894d12b4b7571b14da04546095056
Instruction Fuzzy Hash: 2AB14775A052299FDB24DF18DC88AADB7B4FF48314F1045EAE809A7350D771AE90CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00E45532, Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E00E45532(void* __ecx) {
				void* _t4;
				void* _t11;
				long _t25;
				void* _t28;

				if( *0xe7b150 != 0xffffffff) {
					_t25 = GetLastError();
					_t11 = E00E46608(__eflags,  *0xe7b150);
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E00E46643(__eflags,  *0xe7b150, 0xffffffff);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_push(1);
								_t28 = E00E46B47();
								__eflags = _t28;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E00E46643(__eflags,  *0xe7b150, 0);
								} else {
									__eflags = E00E46643(__eflags,  *0xe7b150, _t28);
									if(__eflags != 0) {
										_t11 = _t28;
										_t28 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E00E48B06(_t28);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t25);
					return _t11;
				} else {
					return 0;
				}
			}

0x00e45539
0x00e4554c
0x00e45553
0x00e45556
0x00e45559
0x00e45572
0x00e45572
0x00e4555b
0x00e4555b
0x00e4555d
0x00e45567
0x00e4556e
0x00e45570
0x00e45577
0x00e45579
0x00e45580
0x00e45584
0x00e45586
0x00e4559a
0x00e4559a
0x00e455a3
0x00e45588
0x00e45596
0x00e45598
0x00e455ac
0x00e455ae
0x00e455ae
0x00000000
0x00000000
0x00000000
0x00e45598
0x00e455b1
0x00000000
0x00000000
0x00000000
0x00e45570
0x00e4555d
0x00e455b9
0x00e455c3
0x00e4553b
0x00e4553d
0x00e4553d

APIs

GetLastError.KERNEL32(?,?,00E45529,00E42F57,00E5EC78,00000008,00E5EF8D,?,?,?,?,00E4018D,?,?,1B9618B6), ref: 00E45540
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00E4554E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E45567
SetLastError.KERNEL32(00000000,?,00E45529,00E42F57,00E5EC78,00000008,00E5EF8D,?,?,?,?,00E4018D,?,?,1B9618B6), ref: 00E455B9

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7cab05c00eb548101b90e1e31fb557e93acf7ab9754ec65cfd68cfa51339673d
Instruction ID: ceb47f30ebb20c8e077fa5c72018a751e42f088b247c6f13e4c31d2a8d39c9e3
Opcode Fuzzy Hash: 7cab05c00eb548101b90e1e31fb557e93acf7ab9754ec65cfd68cfa51339673d
Instruction Fuzzy Hash: 6701FC3310A7115FA72467B77C4D57B2785EF023797202229F524701E2FF554D48A184

Uniqueness

Uniqueness Score: -1.00%

Function 00E5617F, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00E5617F(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t36;
				intOrPtr* _t38;
				intOrPtr _t39;

				_t38 = _a4;
				if(_t38 != 0) {
					__eflags =  *_t38;
					if( *_t38 != 0) {
						_t14 = E00E5580D(_a16, 0, _t38, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t14;
						if(__eflags != 0) {
							_t36 = _a8;
							__eflags = _t14 -  *((intOrPtr*)(_t36 + 0xc));
							if(_t14 <=  *((intOrPtr*)(_t36 + 0xc))) {
								L10:
								_t15 = E00E5580D(_a16, 0, _t38, 0xffffffff,  *((intOrPtr*)(_t36 + 8)),  *((intOrPtr*)(_t36 + 0xc)), 0, 0);
								__eflags = _t15;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t36 + 0x10)) = _t15 - 1;
									_t17 = 0;
									__eflags = 0;
								} else {
									E00E4A03B(GetLastError());
									_t17 =  *((intOrPtr*)(E00E4A071(__eflags)));
								}
								L13:
								L14:
								return _t17;
							}
							_t17 = E00E4B590(_t36, _t14);
							__eflags = _t17;
							if(_t17 != 0) {
								goto L13;
							}
							goto L10;
						}
						E00E4A03B(GetLastError());
						_t17 =  *((intOrPtr*)(E00E4A071(__eflags)));
						goto L14;
					}
					_t39 = _a8;
					__eflags =  *((intOrPtr*)(_t39 + 0xc));
					if( *((intOrPtr*)(_t39 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t39 + 8)))) = 0;
						_t17 = 0;
						 *((intOrPtr*)(_t39 + 0x10)) = 0;
						goto L14;
					}
					_t17 = E00E4B590(_t39, 1);
					__eflags = _t17;
					if(_t17 != 0) {
						goto L14;
					}
					goto L5;
				}
				E00E4B615(_a8);
				return 0;
			}

0x00e56185
0x00e5618a
0x00e5619e
0x00e561a1
0x00e561d3
0x00e561db
0x00e561dd
0x00e561f6
0x00e561f9
0x00e561fc
0x00e5620a
0x00e56219
0x00e56221
0x00e56223
0x00e5623c
0x00e5623f
0x00e5623f
0x00e56225
0x00e5622c
0x00e56237
0x00e56237
0x00e56241
0x00e56242
0x00000000
0x00e56242
0x00e56201
0x00e56206
0x00e56208
0x00000000
0x00000000
0x00000000
0x00e56208
0x00e561e6
0x00e561f1
0x00000000
0x00e561f1
0x00e561a3
0x00e561a6
0x00e561a9
0x00e561bc
0x00e561bf
0x00e561c1
0x00e561c3
0x00000000
0x00e561c3
0x00e561af
0x00e561b4
0x00e561b6
0x00000000
0x00000000
0x00000000
0x00e561b6
0x00e5618f
0x00000000

Strings

C:\Users\user\Desktop\HttpToUsbBridge.exe, xrefs: 00E56184

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\HttpToUsbBridge.exe
API String ID: 0-917528041
Opcode ID: 0b7055ee0b4a85acd9d998c7b953f223ed3c6bc65dc203692d68b2cf871803b7
Instruction ID: b469f0822a8c874406ce1e3550717a0a9e8abb1b40883427f96e100c7ef2de77
Opcode Fuzzy Hash: 0b7055ee0b4a85acd9d998c7b953f223ed3c6bc65dc203692d68b2cf871803b7
Instruction Fuzzy Hash: 0521D475601605BFDB20AF71DC8087B779DAF003BAB505924FD19B7161EB30EC488760

Uniqueness

Uniqueness Score: -1.00%

Function 00E4FBAD, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 79%

			E00E4FBAD(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				long _t3;
				intOrPtr _t5;
				long _t6;
				intOrPtr _t9;
				long _t10;
				signed int _t39;
				signed int _t40;
				void* _t43;
				void* _t49;
				signed int _t51;
				signed int _t53;
				signed int _t54;
				long _t56;
				long _t60;
				long _t61;
				void* _t65;

				_t49 = __edx;
				_t43 = __ecx;
				_t60 = GetLastError();
				_t2 =  *0xe7b2e8; // 0x2
				_t67 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E00E5100B(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t51 = E00E4E623(1, 0x364);
						_pop(_t43);
						__eflags = _t51;
						if(__eflags != 0) {
							__eflags = E00E5100B(__eflags,  *0xe7b2e8, _t51);
							if(__eflags != 0) {
								E00E4F9D7(_t60, _t51, 0xe7e730);
								E00E4F1E8(0);
								_t65 = _t65 + 0xc;
								goto L13;
							} else {
								_t39 = 0;
								E00E5100B(__eflags,  *0xe7b2e8, 0);
								_push(_t51);
								goto L9;
							}
						} else {
							_t39 = 0;
							__eflags = 0;
							E00E5100B(0,  *0xe7b2e8, 0);
							_push(0);
							L9:
							E00E4F1E8();
							_pop(_t43);
							goto L4;
						}
					}
				} else {
					_t51 = E00E50FCC(_t67, _t2);
					if(_t51 == 0) {
						_t2 =  *0xe7b2e8; // 0x2
						goto L6;
					} else {
						if(_t51 != 0xffffffff) {
							L13:
							_t39 = _t51;
						} else {
							L3:
							_t39 = 0;
							L4:
							_t51 = _t39;
						}
					}
				}
				SetLastError(_t60);
				asm("sbb edi, edi");
				_t53 =  ~_t51 & _t39;
				if(_t53 == 0) {
					E00E4AB63(_t39, _t43, _t49, _t53, _t60);
					asm("int3");
					_t5 =  *0xe7b2e8; // 0x2
					_push(_t60);
					__eflags = _t5 - 0xffffffff;
					if(__eflags == 0) {
						L22:
						_t6 = E00E5100B(__eflags, _t5, 0xffffffff);
						__eflags = _t6;
						if(_t6 == 0) {
							goto L31;
						} else {
							_t60 = E00E4E623(1, 0x364);
							_pop(_t43);
							__eflags = _t60;
							if(__eflags != 0) {
								__eflags = E00E5100B(__eflags,  *0xe7b2e8, _t60);
								if(__eflags != 0) {
									E00E4F9D7(_t60, _t60, 0xe7e730);
									E00E4F1E8(0);
									_t65 = _t65 + 0xc;
									goto L29;
								} else {
									E00E5100B(__eflags,  *0xe7b2e8, _t21);
									_push(_t60);
									goto L25;
								}
							} else {
								E00E5100B(__eflags,  *0xe7b2e8, _t20);
								_push(_t60);
								L25:
								E00E4F1E8();
								_pop(_t43);
								goto L31;
							}
						}
					} else {
						_t60 = E00E50FCC(__eflags, _t5);
						__eflags = _t60;
						if(__eflags == 0) {
							_t5 =  *0xe7b2e8; // 0x2
							goto L22;
						} else {
							__eflags = _t60 - 0xffffffff;
							if(_t60 == 0xffffffff) {
								L31:
								E00E4AB63(_t39, _t43, _t49, _t53, _t60);
								asm("int3");
								_push(_t39);
								_push(_t60);
								_push(_t53);
								_t61 = GetLastError();
								_t9 =  *0xe7b2e8; // 0x2
								__eflags = _t9 - 0xffffffff;
								if(__eflags == 0) {
									L38:
									_t10 = E00E5100B(__eflags, _t9, 0xffffffff);
									__eflags = _t10;
									if(_t10 == 0) {
										goto L35;
									} else {
										_t54 = E00E4E623(1, 0x364);
										__eflags = _t54;
										if(__eflags != 0) {
											__eflags = E00E5100B(__eflags,  *0xe7b2e8, _t54);
											if(__eflags != 0) {
												E00E4F9D7(_t61, _t54, 0xe7e730);
												E00E4F1E8(0);
												goto L45;
											} else {
												_t40 = 0;
												E00E5100B(__eflags,  *0xe7b2e8, 0);
												_push(_t54);
												goto L41;
											}
										} else {
											_t40 = 0;
											__eflags = 0;
											E00E5100B(0,  *0xe7b2e8, 0);
											_push(0);
											L41:
											E00E4F1E8();
											goto L36;
										}
									}
								} else {
									_t54 = E00E50FCC(__eflags, _t9);
									__eflags = _t54;
									if(__eflags == 0) {
										_t9 =  *0xe7b2e8; // 0x2
										goto L38;
									} else {
										__eflags = _t54 - 0xffffffff;
										if(_t54 != 0xffffffff) {
											L45:
											_t40 = _t54;
										} else {
											L35:
											_t40 = 0;
											__eflags = 0;
											L36:
											_t54 = _t40;
										}
									}
								}
								SetLastError(_t61);
								asm("sbb edi, edi");
								_t56 =  ~_t54 & _t40;
								__eflags = _t56;
								return _t56;
							} else {
								L29:
								__eflags = _t60;
								if(_t60 == 0) {
									goto L31;
								} else {
									return _t60;
								}
							}
						}
					}
				} else {
					return _t53;
				}
			}

0x00e4fbad
0x00e4fbad
0x00e4fbb8
0x00e4fbba
0x00e4fbbf
0x00e4fbc2
0x00e4fbe0
0x00e4fbe3
0x00e4fbe8
0x00e4fbea
0x00000000
0x00e4fbec
0x00e4fbf8
0x00e4fbfb
0x00e4fbfc
0x00e4fbfe
0x00e4fc23
0x00e4fc25
0x00e4fc3e
0x00e4fc45
0x00e4fc4a
0x00000000
0x00e4fc27
0x00e4fc27
0x00e4fc30
0x00e4fc35
0x00000000
0x00e4fc35
0x00e4fc00
0x00e4fc00
0x00e4fc00
0x00e4fc09
0x00e4fc0e
0x00e4fc0f
0x00e4fc0f
0x00e4fc14
0x00000000
0x00e4fc14
0x00e4fbfe
0x00e4fbc4
0x00e4fbca
0x00e4fbce
0x00e4fbdb
0x00000000
0x00e4fbd0
0x00e4fbd3
0x00e4fc4d
0x00e4fc4d
0x00e4fbd5
0x00e4fbd5
0x00e4fbd5
0x00e4fbd7
0x00e4fbd7
0x00e4fbd7
0x00e4fbd3
0x00e4fbce
0x00e4fc50
0x00e4fc58
0x00e4fc5a
0x00e4fc5c
0x00e4fc64
0x00e4fc69
0x00e4fc6a
0x00e4fc6f
0x00e4fc70
0x00e4fc73
0x00e4fc8d
0x00e4fc90
0x00e4fc95
0x00e4fc97
0x00000000
0x00e4fc99
0x00e4fca5
0x00e4fca8
0x00e4fca9
0x00e4fcab
0x00e4fcce
0x00e4fcd0
0x00e4fce7
0x00e4fcee
0x00e4fcf3
0x00000000
0x00e4fcd2
0x00e4fcd9
0x00e4fcde
0x00000000
0x00e4fcde
0x00e4fcad
0x00e4fcb4
0x00e4fcb9
0x00e4fcba
0x00e4fcba
0x00e4fcbf
0x00000000
0x00e4fcbf
0x00e4fcab
0x00e4fc75
0x00e4fc7b
0x00e4fc7d
0x00e4fc7f
0x00e4fc88
0x00000000
0x00e4fc81
0x00e4fc81
0x00e4fc84
0x00e4fcfe
0x00e4fcfe
0x00e4fd03
0x00e4fd06
0x00e4fd07
0x00e4fd08
0x00e4fd0f
0x00e4fd11
0x00e4fd16
0x00e4fd19
0x00e4fd37
0x00e4fd3a
0x00e4fd3f
0x00e4fd41
0x00000000
0x00e4fd43
0x00e4fd4f
0x00e4fd53
0x00e4fd55
0x00e4fd7a
0x00e4fd7c
0x00e4fd95
0x00e4fd9c
0x00000000
0x00e4fd7e
0x00e4fd7e
0x00e4fd87
0x00e4fd8c
0x00000000
0x00e4fd8c
0x00e4fd57
0x00e4fd57
0x00e4fd57
0x00e4fd60
0x00e4fd65
0x00e4fd66
0x00e4fd66
0x00000000
0x00e4fd6b
0x00e4fd55
0x00e4fd1b
0x00e4fd21
0x00e4fd23
0x00e4fd25
0x00e4fd32
0x00000000
0x00e4fd27
0x00e4fd27
0x00e4fd2a
0x00e4fda4
0x00e4fda4
0x00e4fd2c
0x00e4fd2c
0x00e4fd2c
0x00e4fd2c
0x00e4fd2e
0x00e4fd2e
0x00e4fd2e
0x00e4fd2a
0x00e4fd25
0x00e4fda7
0x00e4fdaf
0x00e4fdb1
0x00e4fdb1
0x00e4fdb8
0x00e4fc86
0x00e4fcf6
0x00e4fcf6
0x00e4fcf8
0x00000000
0x00e4fcfa
0x00e4fcfd
0x00e4fcfd
0x00e4fcf8
0x00e4fc84
0x00e4fc7f
0x00e4fc5e
0x00e4fc63
0x00e4fc63

APIs

GetLastError.KERNEL32(00E7BC08,ios_base::failbit set,?,00E484A4,00E79760,00000008,?,00000001), ref: 00E4FBB2
_free.LIBCMT ref: 00E4FC0F
_free.LIBCMT ref: 00E4FC45
SetLastError.KERNEL32(00000000,00000002,000000FF,?,00E484A4,00E79760,00000008,?,00000001), ref: 00E4FC50

Strings

ios_base::failbit set, xrefs: 00E4FBB0

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: ErrorLast_free
String ID: ios_base::failbit set
API String ID: 2283115069-3924258884
Opcode ID: 42036c0cbebbda1268d6778037c4deb1852c72a9fd249d20cdf4018b0fda7895
Instruction ID: 69656d5872362706fc961ecc1ed18d76d2e66df076e76bb1e97bc76198a02d3e
Opcode Fuzzy Hash: 42036c0cbebbda1268d6778037c4deb1852c72a9fd249d20cdf4018b0fda7895
Instruction Fuzzy Hash: B9112C322052856EDA117376BCC9F6B219ADBC1B75B252B34F914F71F2DF218C898125

Uniqueness

Uniqueness Score: -1.00%

Function 00E3954E, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35
threadCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00E3954E(void* __ebx, void* __ecx, void* __edx, void* __edi, intOrPtr _a4) {
				char _v16;
				void* __esi;
				void* _t20;
				char* _t26;
				intOrPtr _t34;
				char* _t38;

				_push(__edi);
				_t34 = _a4;
				_t37 = __ecx;
				if(_t34 == 0) {
					_t26 =  &_v16;
					E00E29D71(_t26, "pScheduler");
					_push(0xe77ff8);
					goto L6;
				} else {
					if(E00E3A5BA( *((intOrPtr*)(__ecx + 0x14))) == __ecx) {
						_t30 =  *((intOrPtr*)(__ecx + 0x14));
						if( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x14)) + 8)) != _t34) {
							goto L2;
						} else {
							_push(__ecx);
							return E00E3264A(__ebx,  *((intOrPtr*)(_t30 + 0xc)), __edx, _t34, __ecx);
						}
					} else {
						L2:
						_t26 =  &_v16;
						E00E2F400(_t26);
						_push(0xe78674);
						L6:
						_push( &_v16);
						E00E4309B();
						asm("int3");
						_t38 = _t26;
						_push( *(_t38 + 0x20));
						_t20 = E00E2EEC1( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t38 + 0x14)) + 0xc)) + 0x70)));
						 *(_t38 + 0x20) =  *(_t38 + 0x20) & 0x00000000;
						return _t20;
					}
				}
			}

0x00e39555
0x00e39556
0x00e39559
0x00e3955d
0x00e39596
0x00e39599
0x00e3959e
0x00000000
0x00e3955f
0x00e39569
0x00e3957a
0x00e39580
0x00000000
0x00e39582
0x00e39585
0x00e3958e
0x00e3958e
0x00e3956b
0x00e3956b
0x00e3956b
0x00e3956e
0x00e39573
0x00e395a3
0x00e395a6
0x00e395a7
0x00e395ac
0x00e395ae
0x00e395b3
0x00e395bc
0x00e395c1
0x00e395c8
0x00e395c8
0x00e39569

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00E39562
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 00E39586
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00E39599
__CxxThrowException@8.LIBVCRUNTIME ref: 00E395A7

Strings

pScheduler, xrefs: 00E39591

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentException@8Manager::Proxy::RemoveSchedulerThreadThrowstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 3657713681-923244539
Opcode ID: 3d08f82f8d295ccbfe92384707abae3786cd061412ac0e5cbac33b2d2437305d
Instruction ID: 66a732fad88e00e60bf230ce395554b38786bfbc845bc3c12f3770db4bf781f8
Opcode Fuzzy Hash: 3d08f82f8d295ccbfe92384707abae3786cd061412ac0e5cbac33b2d2437305d
Instruction Fuzzy Hash: A1F05935A00604B7C725F650E84A89EBBB99E90B14F20A139E44633082DBF1EE42C2A1

Uniqueness

Uniqueness Score: -1.00%

Function 00E4BEE1, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E00E4BEE1(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t14;

				_v8 = _v8 & 0x00000000;
				_t8 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t8, __ecx);
				if(_t8 != 0) {
					_t8 = GetProcAddress(_v8, "CorExitProcess");
					_t14 = _t8;
					if(_t14 != 0) {
						 *0xe63210(_a4);
						_t8 =  *_t14();
					}
				}
				if(_v8 != 0) {
					return FreeLibrary(_v8);
				}
				return _t8;
			}

0x00e4bee7
0x00e4beeb
0x00e4bef6
0x00e4befe
0x00e4bf09
0x00e4bf0f
0x00e4bf13
0x00e4bf1a
0x00e4bf20
0x00e4bf20
0x00e4bf22
0x00e4bf27
0x00000000
0x00e4bf2c
0x00e4bf35

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00E4BED6,00000003,?,00E4BE9E,00E79760,00E484A4,00000003), ref: 00E4BEF6
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00E4BF09
FreeLibrary.KERNEL32(00000000,?,?,00E4BED6,00000003,?,00E4BE9E,00E79760,00E484A4,00000003), ref: 00E4BF2C

Strings

mscoree.dll, xrefs: 00E4BEEF
CorExitProcess, xrefs: 00E4BF01

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9fbd75839afd6d58ab8586f3170ba15f7bb902ca1d231e40c692aa8e18d97664
Instruction ID: a9554301367a68723c835d69f4c2264e9965167fa0f8856a19f579e0f8c8948b
Opcode Fuzzy Hash: 9fbd75839afd6d58ab8586f3170ba15f7bb902ca1d231e40c692aa8e18d97664
Instruction Fuzzy Hash: AEF05431A55218FFCB119B91FD09B9EBA68EB04795F141054E804B1160CB718F18DA90

Uniqueness

Uniqueness Score: -1.00%

Function 00E4C619, Relevance: 7.6, APIs: 5, Instructions: 120
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E00E4C619(signed int* __ecx, signed int __edx) {
				signed int _v8;
				intOrPtr* _v12;
				signed int _v16;
				signed int _t27;
				signed int _t29;
				intOrPtr _t33;
				signed int _t38;
				signed int _t41;
				void* _t46;
				signed int _t50;
				intOrPtr* _t51;
				signed int _t61;
				signed int _t62;
				signed int _t63;
				signed int _t65;
				signed int _t67;
				signed int _t68;
				signed int _t69;
				signed int* _t70;
				signed int _t74;
				void* _t75;

				_t63 = __edx;
				_v12 = __ecx;
				_t27 =  *__ecx;
				_t70 =  *_t27;
				if(_t70 == 0) {
					L14:
					return _t27 | 0xffffffff;
				}
				_t29 =  *0xe7b068; // 0x1b9618b6
				_t50 =  *_t70 ^ _t29;
				_t67 = _t70[1] ^ _t29;
				_t72 = _t70[2] ^ _t29;
				asm("ror edi, cl");
				asm("ror esi, cl");
				asm("ror ebx, cl");
				if(_t67 != _t72) {
					L13:
					 *_t67 = E00E4BD37( *((intOrPtr*)( *((intOrPtr*)(_v12 + 4)))));
					_t33 = E00E2C0AD(_t50);
					_t51 = _v12;
					 *((intOrPtr*)( *((intOrPtr*)( *_t51)))) = _t33;
					_t23 = _t67 + 4; // 0x4
					 *((intOrPtr*)( *((intOrPtr*)( *_t51)) + 4)) = E00E2C0AD(_t23);
					 *((intOrPtr*)( *((intOrPtr*)( *_t51)) + 8)) = E00E2C0AD(_t72);
					return 0;
				}
				_t38 = 0x200;
				_t74 = _t72 - _t50 >> 2;
				if(_t74 <= 0x200) {
					_t38 = _t74;
				}
				_t68 = _t38 + _t74;
				if(_t68 == 0) {
					_t68 = 0x20;
				}
				if(_t68 < _t74) {
					L8:
					_t68 = _t74 + 4;
					_v8 = E00E56EE3(_t50, _t68, 4);
					_t27 = E00E4F1E8(0);
					_t61 = _v8;
					_t75 = _t75 + 0x10;
					if(_t61 == 0) {
						goto L14;
					}
					goto L9;
				} else {
					_v8 = E00E56EE3(_t50, _t68, 4);
					E00E4F1E8(0);
					_t61 = _v8;
					_t75 = _t75 + 0x10;
					if(_t61 != 0) {
						L9:
						_t50 = _t61;
						_v8 = _t61 + _t74 * 4;
						_t72 = _t61 + _t68 * 4;
						_t41 =  *0xe7b068; // 0x1b9618b6
						_t67 = _v8;
						_t62 = _t67;
						_v16 = _t41;
						asm("sbb edx, edx");
						_t65 =  !_t63 & _t61 + _t68 * 0x00000004 - _t67 + 0x00000003 >> 0x00000002;
						if(_t65 == 0) {
							goto L13;
						}
						_t69 = _v16;
						_t46 = 0;
						do {
							_t46 = _t46 + 1;
							 *_t62 = _t69;
							_t62 = _t62 + 4;
						} while (_t46 != _t65);
						_t67 = _v8;
						goto L13;
					}
					goto L8;
				}
			}

0x00e4c619
0x00e4c623
0x00e4c628
0x00e4c62b
0x00e4c62f
0x00e4c73a
0x00000000
0x00e4c73a
0x00e4c635
0x00e4c644
0x00e4c649
0x00e4c64b
0x00e4c64d
0x00e4c64f
0x00e4c651
0x00e4c655
0x00e4c6f8
0x00e4c706
0x00e4c708
0x00e4c70d
0x00e4c714
0x00e4c716
0x00e4c724
0x00e4c733
0x00000000
0x00e4c736
0x00e4c65d
0x00e4c662
0x00e4c667
0x00e4c669
0x00e4c669
0x00e4c66b
0x00e4c670
0x00e4c674
0x00e4c674
0x00e4c677
0x00e4c696
0x00e4c698
0x00e4c6a4
0x00e4c6a7
0x00e4c6ac
0x00e4c6af
0x00e4c6b4
0x00000000
0x00000000
0x00000000
0x00e4c679
0x00e4c684
0x00e4c687
0x00e4c68c
0x00e4c68f
0x00e4c694
0x00e4c6ba
0x00e4c6bd
0x00e4c6bf
0x00e4c6c2
0x00e4c6c5
0x00e4c6ca
0x00e4c6cd
0x00e4c6cf
0x00e4c6de
0x00e4c6e2
0x00e4c6e4
0x00000000
0x00000000
0x00e4c6e6
0x00e4c6e9
0x00e4c6eb
0x00e4c6eb
0x00e4c6ec
0x00e4c6ee
0x00e4c6f1
0x00e4c6f5
0x00000000
0x00e4c6f5
0x00000000
0x00e4c694

APIs

_free.LIBCMT ref: 00E4C687
_free.LIBCMT ref: 00E4C6A7
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00E4C708
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00E4C71A
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00E4C727

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: __crt_fast_encode_pointer$_free
String ID:
API String ID: 366466260-0
Opcode ID: b61e2b69e3d67cc094fa8ea3d7ecba926fe48fdc0ad85ad359bede05eecd87a8
Instruction ID: f9dac985efaacdc17c5535aa86c4ba93b7da0ccc158793395b8678be0c4fd81b
Opcode Fuzzy Hash: b61e2b69e3d67cc094fa8ea3d7ecba926fe48fdc0ad85ad359bede05eecd87a8
Instruction Fuzzy Hash: 5241A036A012109BCB10DF78D881A5EB3E6EF89718B2695A9E515FB351DB31AD02CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00E16C80, Relevance: 7.6, APIs: 5, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00E16C80(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr* _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				void* _v24;
				intOrPtr* _v28;
				char _v32;
				char _v36;
				char _v88;
				signed int _t41;
				signed int _t42;
				intOrPtr _t45;
				intOrPtr _t49;
				intOrPtr _t51;
				void* _t52;
				void* _t57;
				signed int _t62;
				signed int _t63;
				void* _t64;
				intOrPtr _t66;
				intOrPtr _t73;
				void* _t80;
				signed int _t83;
				intOrPtr* _t86;
				intOrPtr* _t87;
				signed int _t89;
				void* _t95;

				_t80 = __edx;
				_t64 = __ebx;
				_push(0xffffffff);
				_push(0xe5fe40);
				_push( *[fs:0x0]);
				_t41 =  *0xe7b068; // 0x1b9618b6
				_t42 = _t41 ^ _t89;
				_v20 = _t42;
				_push(_t42);
				 *[fs:0x0] =  &_v16;
				_t86 = _a4;
				_v28 = _t86;
				_v36 = 0;
				E00E297C6( &_v32, 0);
				_v8 = 0;
				_t83 =  *0xe7ea70; // 0x0
				_t45 =  *0xe7ea3c; // 0x0
				_v36 = _t45;
				if(_t83 == 0) {
					E00E297C6( &_v24, _t83);
					_t95 =  *0xe7ea70 - _t83; // 0x0
					if(_t95 == 0) {
						_t62 =  *0xe7d9a0; // 0x1
						_t63 = _t62 + 1;
						 *0xe7d9a0 = _t63;
						 *0xe7ea70 = _t63;
					}
					E00E2981E( &_v24);
					_t83 =  *0xe7ea70; // 0x0
				}
				_t66 =  *((intOrPtr*)(_t86 + 4));
				if(_t83 >=  *((intOrPtr*)(_t66 + 0xc))) {
					_t87 = 0;
					__eflags = 0;
					L8:
					if( *((char*)(_t66 + 0x14)) == 0) {
						L11:
						if(_t87 != 0) {
							L19:
							E00E2981E( &_v32);
							 *[fs:0x0] = _v16;
							return E00E2C067(_v20 ^ _t89);
						}
						L12:
						_t49 = _v36;
						if(_t49 == 0) {
							_push(0x18);
							_t87 = E00E2C07D(_t80, __eflags);
							_v24 = _t87;
							_v8 = 1;
							asm("xorps xmm0, xmm0");
							asm("movups [esi], xmm0");
							asm("movq [esi+0x10], xmm0");
							_t73 =  *((intOrPtr*)(_v28 + 4));
							__eflags = _t73;
							if(_t73 != 0) {
								_t51 =  *((intOrPtr*)(_t73 + 0x18));
								__eflags = _t51;
								if(_t51 == 0) {
									_t51 = _t73 + 0x1c;
								}
							} else {
								_t51 = 0xe71f6b;
							}
							_t52 = E00E11AD0( &_v88, _t51);
							_v36 = 1;
							 *((intOrPtr*)(_t87 + 4)) = 0;
							_v8 = 3;
							 *_t87 = 0xe64a94;
							E00E17710(_t64, _t87, _t83, _t87);
							_v8 = 0;
							E00E11B90( &_v88);
							_v28 = _t87;
							_v8 = 5;
							E00E29AA4(__eflags, _t87);
							 *((intOrPtr*)( *_t87 + 4))(_t52, 1);
							 *0xe7ea3c = _t87;
						} else {
							_t87 = _t49;
						}
						goto L19;
					}
					_t57 = E00E29AD0();
					if(_t83 >=  *((intOrPtr*)(_t57 + 0xc))) {
						goto L12;
					}
					_t87 =  *((intOrPtr*)( *((intOrPtr*)(_t57 + 8)) + _t83 * 4));
					goto L11;
				}
				_t87 =  *((intOrPtr*)( *((intOrPtr*)(_t66 + 8)) + _t83 * 4));
				if(_t87 != 0) {
					goto L19;
				}
				goto L8;
			}

0x00e16c80
0x00e16c80
0x00e16c83
0x00e16c85
0x00e16c90
0x00e16c94
0x00e16c99
0x00e16c9b
0x00e16ca0
0x00e16ca4
0x00e16caa
0x00e16cb2
0x00e16cb5
0x00e16cbc
0x00e16cc1
0x00e16cc8
0x00e16cce
0x00e16cd3
0x00e16cd8
0x00e16cde
0x00e16ce3
0x00e16ce9
0x00e16ceb
0x00e16cf0
0x00e16cf1
0x00e16cf6
0x00e16cf6
0x00e16cfe
0x00e16d03
0x00e16d03
0x00e16d09
0x00e16d0f
0x00e16d21
0x00e16d21
0x00e16d23
0x00e16d27
0x00e16d39
0x00e16d3b
0x00e16de2
0x00e16de5
0x00e16def
0x00e16e06
0x00e16e06
0x00e16d41
0x00e16d41
0x00e16d46
0x00e16d4f
0x00e16d56
0x00e16d5b
0x00e16d5e
0x00e16d62
0x00e16d68
0x00e16d6b
0x00e16d70
0x00e16d73
0x00e16d75
0x00e16d7e
0x00e16d81
0x00e16d83
0x00e16d85
0x00e16d85
0x00e16d77
0x00e16d77
0x00e16d77
0x00e16d8c
0x00e16d91
0x00e16d98
0x00e16da1
0x00e16dab
0x00e16db1
0x00e16db9
0x00e16dc0
0x00e16dc5
0x00e16dc9
0x00e16dcd
0x00e16dd9
0x00e16ddc
0x00e16d48
0x00e16d48
0x00e16d48
0x00000000
0x00e16d46
0x00e16d29
0x00e16d31
0x00000000
0x00000000
0x00e16d36
0x00000000
0x00e16d36
0x00e16d14
0x00e16d19
0x00000000
0x00000000
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E16CBC
std::_Lockit::_Lockit.LIBCPMT ref: 00E16CDE
std::_Lockit::~_Lockit.LIBCPMT ref: 00E16CFE
std::_Facet_Register.LIBCPMT ref: 00E16DCD
std::_Lockit::~_Lockit.LIBCPMT ref: 00E16DE5

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 5817a0217b8f68f6372efd4e51abb6b919baea17ebfba0ac974edb0a46537d4a
Instruction ID: 20409726840548385e899dc68d42feca172625fdd2a26283f77c683792d980dc
Opcode Fuzzy Hash: 5817a0217b8f68f6372efd4e51abb6b919baea17ebfba0ac974edb0a46537d4a
Instruction Fuzzy Hash: B0416B71A002158FCB15EF64E841BEEB7F4FF44714F24955DE80ABB281EB70AA85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E169E0, Relevance: 7.6, APIs: 5, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00E169E0(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr* _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				void* _v24;
				intOrPtr* _v28;
				char _v32;
				char _v84;
				signed int _t35;
				signed int _t36;
				intOrPtr _t43;
				void* _t48;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				intOrPtr _t59;
				intOrPtr _t66;
				void* _t72;
				signed int _t75;
				intOrPtr* _t78;
				intOrPtr* _t79;
				signed int _t81;
				void* _t87;

				_t72 = __edx;
				_push(0xffffffff);
				_push(0xe5fdcf);
				_push( *[fs:0x0]);
				_t35 =  *0xe7b068; // 0x1b9618b6
				_t36 = _t35 ^ _t81;
				_v20 = _t36;
				_push(_t36);
				 *[fs:0x0] =  &_v16;
				_t78 = _a4;
				_v28 = _t78;
				E00E297C6( &_v32, 0);
				_v8 = 0;
				_t75 =  *0xe7ea6c; // 0x0
				_t56 =  *0xe7ea48; // 0x0
				if(_t75 == 0) {
					E00E297C6( &_v24, _t75);
					_t87 =  *0xe7ea6c - _t75; // 0x0
					if(_t87 == 0) {
						_t53 =  *0xe7d9a0; // 0x1
						_t54 = _t53 + 1;
						 *0xe7d9a0 = _t54;
						 *0xe7ea6c = _t54;
					}
					E00E2981E( &_v24);
					_t75 =  *0xe7ea6c; // 0x0
				}
				_t59 =  *((intOrPtr*)(_t78 + 4));
				if(_t75 >=  *((intOrPtr*)(_t59 + 0xc))) {
					_t79 = 0;
					__eflags = 0;
					L8:
					if( *((char*)(_t59 + 0x14)) == 0) {
						L11:
						if(_t79 != 0) {
							L19:
							E00E2981E( &_v32);
							 *[fs:0x0] = _v16;
							return E00E2C067(_v20 ^ _t81);
						}
						L12:
						if(_t56 == 0) {
							_push(8);
							_t79 = E00E2C07D(_t72, __eflags);
							_v24 = _t79;
							_v8 = 1;
							_t66 =  *((intOrPtr*)(_v28 + 4));
							__eflags = _t66;
							if(_t66 != 0) {
								_t43 =  *((intOrPtr*)(_t66 + 0x18));
								__eflags = _t43;
								if(_t43 == 0) {
									_t24 = _t66 + 0x1c; // 0x1c
									_t43 = _t24;
								}
							} else {
								_t43 = 0xe71f6b;
							}
							E00E11AD0( &_v84, _t43);
							 *((intOrPtr*)(_t79 + 4)) = 0;
							 *_t79 = 0xe6345c;
							E00E11B90( &_v84);
							_v28 = _t79;
							_v8 = 2;
							E00E29AA4(__eflags, _t79);
							 *((intOrPtr*)( *_t79 + 4))();
							 *0xe7ea48 = _t79;
						} else {
							_t79 = _t56;
						}
						goto L19;
					}
					_t48 = E00E29AD0();
					if(_t75 >=  *((intOrPtr*)(_t48 + 0xc))) {
						goto L12;
					}
					_t79 =  *((intOrPtr*)( *((intOrPtr*)(_t48 + 8)) + _t75 * 4));
					goto L11;
				}
				_t79 =  *((intOrPtr*)( *((intOrPtr*)(_t59 + 8)) + _t75 * 4));
				if(_t79 != 0) {
					goto L19;
				}
				goto L8;
			}

0x00e169e0
0x00e169e3
0x00e169e5
0x00e169f0
0x00e169f4
0x00e169f9
0x00e169fb
0x00e16a01
0x00e16a05
0x00e16a0b
0x00e16a13
0x00e16a16
0x00e16a1b
0x00e16a22
0x00e16a28
0x00e16a30
0x00e16a36
0x00e16a3b
0x00e16a41
0x00e16a43
0x00e16a48
0x00e16a49
0x00e16a4e
0x00e16a4e
0x00e16a56
0x00e16a5b
0x00e16a5b
0x00e16a61
0x00e16a67
0x00e16a79
0x00e16a79
0x00e16a7b
0x00e16a7f
0x00e16a91
0x00e16a93
0x00e16b06
0x00e16b09
0x00e16b13
0x00e16b2b
0x00e16b2b
0x00e16a95
0x00e16a97
0x00e16a9d
0x00e16aa4
0x00e16aa9
0x00e16aac
0x00e16ab3
0x00e16ab6
0x00e16ab8
0x00e16ac1
0x00e16ac4
0x00e16ac6
0x00e16ac8
0x00e16ac8
0x00e16ac8
0x00e16aba
0x00e16aba
0x00e16aba
0x00e16acf
0x00e16ad7
0x00e16ade
0x00e16ae4
0x00e16ae9
0x00e16aed
0x00e16af1
0x00e16afd
0x00e16b00
0x00e16a99
0x00e16a99
0x00e16a99
0x00000000
0x00e16a97
0x00e16a81
0x00e16a89
0x00000000
0x00000000
0x00e16a8e
0x00000000
0x00e16a8e
0x00e16a6c
0x00e16a71
0x00000000
0x00000000
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E16A16
std::_Lockit::_Lockit.LIBCPMT ref: 00E16A36
std::_Lockit::~_Lockit.LIBCPMT ref: 00E16A56
std::_Facet_Register.LIBCPMT ref: 00E16AF1
std::_Lockit::~_Lockit.LIBCPMT ref: 00E16B09

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 2a10ec2c522c1a4250f99241efafba3656640f23da02802fc45983818309fe11
Instruction ID: 1ca8a2ca1c6216ffa2b37dd62d5ba08b5c634c27a2b4033c236f4cd5225a6e3f
Opcode Fuzzy Hash: 2a10ec2c522c1a4250f99241efafba3656640f23da02802fc45983818309fe11
Instruction Fuzzy Hash: 45419172900225CFCB24DF55D881BAEBBB4EF44714F24915DE80ABB342DB31AE85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E33F72, Relevance: 7.5, APIs: 5, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 64%

			E00E33F72(void* __ebx, void* __ecx, void* __edx, intOrPtr _a4) {
				char _v9;
				char _v16;
				char _v29;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t18;
				signed int _t28;
				signed int _t29;
				void* _t31;
				signed int _t39;
				intOrPtr* _t46;
				signed int* _t54;
				void* _t63;
				void* _t66;
				intOrPtr* _t67;
				void* _t70;
				void* _t74;
				void* _t79;
				void* _t83;

				_t59 = __edx;
				_t38 = __ebx;
				_t79 = _t83;
				_t70 = __ecx;
				_t63 = E00E2EEB3( *0xe7e0d8);
				if(_t63 == 0) {
					L5:
					E00E35D79(_t70);
					_push(_a4);
					_t18 = E00E34BC5(_t38, _t70, _t59, _t63, _t70);
					E00E37A26(_t63);
					return _t18;
				} else {
					if( *((intOrPtr*)(_t63 + 0x1c)) == __ecx) {
						_t46 =  &_v16;
						E00E36DAA(_t46);
						E00E4309B( &_v16, 0xe7896c);
						asm("int3");
						asm("lock cmpxchg [edx], esi");
						__eflags = 0x80000000 - 0x80000000;
						_t66 = _t63;
						_t74 = _t70;
						if(0x80000000 == 0x80000000) {
							_push(_t79);
							_push(_t46);
							_push(__ebx);
							_push(_t66);
							_t67 = _t46;
							_t39 = E00E2EEB3( *0xe7e0d8);
							_v29 = 1;
							__eflags = _t39;
							if(_t39 != 0) {
								__eflags =  *((char*)(_t39 + 0x4c));
								if( *((char*)(_t39 + 0x4c)) == 0) {
									_v9 = 0;
									E00E13C60();
								}
							}
							 *0xe63210(_t74);
							_t28 =  *((intOrPtr*)( *((intOrPtr*)( *_t67 + 0x48))))();
							__eflags = _t28;
							if(_t28 != 0) {
								__eflags = _t28 - 2;
								if(_t28 == 2) {
									_t54 = _t67 + 0x198;
									__eflags =  *_t54;
									if( *_t54 == 0) {
										__eflags = 1;
										 *_t54 = 1;
									}
								}
								_t29 =  *(_t67 + 0x194);
								do {
									asm("lock cmpxchg [esi], ecx");
									__eflags = _t29 - _t29;
								} while (_t29 != _t29);
								__eflags = _t29 & 0x1fffffff;
								_t31 = E00E35FB7(_t67, _t29 & 0x1fffffff);
							} else {
								_t31 = E00E35B82(_t67);
							}
							__eflags = _v9;
							if(_v9 == 0) {
								_t31 = E00E13C60();
							}
							return _t31;
						} else {
							return 0x80000000;
						}
					} else {
						_t89 =  *((char*)(_t63 + 0x4c));
						if( *((char*)(_t63 + 0x4c)) == 0) {
							_t3 = _t63 - 4; // -4
							E00E3D6F5(_t3, __edx, _t89);
						}
						E00E3756F(_t63);
						goto L5;
					}
				}
			}

0x00e33f72
0x00e33f72
0x00e33f73
0x00e33f80
0x00e33f87
0x00e33f8c
0x00e33fa8
0x00e33faa
0x00e33faf
0x00e33fb4
0x00e33fbe
0x00e33fc8
0x00e33f8e
0x00e33f91
0x00e33fcb
0x00e33fce
0x00e33fdc
0x00e33fe1
0x00e33ff6
0x00e33ffa
0x00e33ffc
0x00e33ffd
0x00e33ffe
0x00e367c8
0x00e367cb
0x00e367cc
0x00e367cd
0x00e367d4
0x00e367db
0x00e367dd
0x00e367e2
0x00e367e4
0x00e367e6
0x00e367ea
0x00e367ee
0x00e367f2
0x00e367f2
0x00e367ea
0x00e367ff
0x00e36807
0x00e36809
0x00e3680b
0x00e36816
0x00e36819
0x00e3681b
0x00e36821
0x00e36824
0x00e36828
0x00e36829
0x00e36829
0x00e36824
0x00e36831
0x00e36833
0x00e3683d
0x00e36841
0x00e36841
0x00e36845
0x00e3684d
0x00e3680d
0x00e3680f
0x00e3680f
0x00e36852
0x00e36857
0x00e3685b
0x00e3685b
0x00e36863
0x00e34004
0x00e34004
0x00e34004
0x00e33f93
0x00e33f93
0x00e33f97
0x00e33f99
0x00e33f9c
0x00e33f9c
0x00e33fa3
0x00000000
0x00e33fa3
0x00e33f91

APIs

Part of subcall function 00E2EEB3: TlsGetValue.KERNEL32(?,?,00E2E45A,00E2E273,?,?), ref: 00E2EEB9

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 00E33F9C

Part of subcall function 00E3D6F5: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00E3D71C
Part of subcall function 00E3D6F5: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00E3D735
Part of subcall function 00E3D6F5: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00E3D7AB
Part of subcall function 00E3D6F5: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00E3D7B3

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 00E33FAA
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00E33FB4
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 00E33FBE
__CxxThrowException@8.LIBVCRUNTIME ref: 00E33FDC

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredException@8ExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceThrowValueVirtualWork
String ID:
API String ID: 4266703842-0
Opcode ID: 68ae0b2e60e590ef1875b33783d3c56c07004c2f1337c369e90a23d532917182
Instruction ID: 91d86dce9a9b201a3711bbb92e924856e2f06ecb0595723c4d49ed38441e8f08
Opcode Fuzzy Hash: 68ae0b2e60e590ef1875b33783d3c56c07004c2f1337c369e90a23d532917182
Instruction Fuzzy Hash: B2F0C235B045246ACB25B635D81A9ADBEA99F90724F44212AF40172281DFA09E05CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00E57954, Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00E57954(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0xe7b218; // 0xe7b26c
					if(_t23 != 0) {
						E00E4F1E8(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0xe7b21c; // 0xe7e240
					if(_t24 != 0) {
						E00E4F1E8(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0xe7b220; // 0xe7e240
					if(_t25 != 0) {
						E00E4F1E8(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0xe7b248; // 0xe7b270
					if(_t26 != 0) {
						E00E4F1E8(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0xe7b24c; // 0xe7e244
					if(_t27 != 0) {
						return E00E4F1E8(_t6);
					}
				}
				return _t6;
			}

0x00e5795a
0x00e5795f
0x00e57963
0x00e57969
0x00e5796c
0x00e57971
0x00e57975
0x00e5797b
0x00e5797e
0x00e57983
0x00e57987
0x00e5798d
0x00e57990
0x00e57995
0x00e57999
0x00e5799f
0x00e579a2
0x00e579a7
0x00e579a8
0x00e579ab
0x00e579b1
0x00000000
0x00e579b9
0x00e579b1
0x00e579bc

APIs

_free.LIBCMT ref: 00E5796C

Part of subcall function 00E4F1E8: HeapFree.KERNEL32(00000000,00000000,?,00E57BF8,?,00000000,?,?,?,00E57E9D,?,00000007,?,?,00E582A2,?), ref: 00E4F1FE
Part of subcall function 00E4F1E8: GetLastError.KERNEL32(?,?,00E57BF8,?,00000000,?,?,?,00E57E9D,?,00000007,?,?,00E582A2,?,?), ref: 00E4F210

_free.LIBCMT ref: 00E5797E
_free.LIBCMT ref: 00E57990
_free.LIBCMT ref: 00E579A2
_free.LIBCMT ref: 00E579B4

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a4f09737b92aae0865037ff966f59e70b01ea57400439f56cabb758cd4f65724
Instruction ID: 4b8e974524b6acf1997978bd88ba42993d507734f68774a3a5bd334f329024b3
Opcode Fuzzy Hash: a4f09737b92aae0865037ff966f59e70b01ea57400439f56cabb758cd4f65724
Instruction Fuzzy Hash: 51F0623244A244EB8620DB59F485C1A77EDEB407257962C05F48CFB622CB30FCC48670

Uniqueness

Uniqueness Score: -1.00%

Function 00E2AD44, Relevance: 7.5, APIs: 5, Instructions: 39
timeCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00E2AD44(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v20;
				intOrPtr _t8;
				signed int _t16;
				void* _t18;
				void* _t26;
				signed int _t28;

				_t24 = __edx;
				_t18 = __ecx + 4;
				E00E2C6ED(0xe61347, __ebx, __edi, __esi, 4);
				_t26 = _t18;
				_push(0x18);
				_t8 = E00E2C07D(__edx, __eflags);
				_v20 = _t8;
				_t16 = 0;
				_v8 = 0;
				if(_t8 == 0) {
					_t28 = 0;
				} else {
					_t28 = E00E2E24C(0, _t8, __edx, _t26, _a4);
				}
				_v8 = _v8 | 0xffffffff;
				if(E00E2E663(_t16, _t26, _t24, _t26, _t28, _t28, _t16) != 0) {
					E00E2E75A(_t26, _t28);
					_t16 = 1;
				}
				E00E2E460(_t28);
				return E00E2C6C7(_t16);
			}

0x00e2ad44
0x00e2ad47
0x00e2e883
0x00e2e888
0x00e2e88a
0x00e2e88c
0x00e2e892
0x00e2e895
0x00e2e897
0x00e2e89c
0x00e2e8ac
0x00e2e89e
0x00e2e8a8
0x00e2e8a8
0x00e2e8ae
0x00e2e8bd
0x00e2e8c2
0x00e2e8c7
0x00e2e8c7
0x00e2e8cb
0x00e2e8d7

APIs

__EH_prolog3.LIBCMT ref: 00E2E883
Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 00E2E8A3

Part of subcall function 00E2E24C: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00E2E26E
Part of subcall function 00E2E24C: Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00E2E28F

Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00E2E8B6
Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 00E2E8C2
Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 00E2E8CB

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Concurrency::details::$LockQueue$Concurrency::critical_section::_NodeNode::Timer$Acquire_lockAsyncBase::ContextCurrentDerefH_prolog3LibraryLoadRegisterSchedulerSwitch_to_active
String ID:
API String ID: 1236927926-0
Opcode ID: 94d6001379ff97b53abffa20a61ad4cfd7cad0634e3cc71e24e949d4cbc25a33
Instruction ID: 1dbc90635e3579be495d0c3da44feb8044f283c25508480d9eff6e5da0548d10
Opcode Fuzzy Hash: 94d6001379ff97b53abffa20a61ad4cfd7cad0634e3cc71e24e949d4cbc25a33
Instruction Fuzzy Hash: CCF0B431640234A79B1C7A74B4539EE36D54B81310B1C3179B5627B3C1CE608D059294

Uniqueness

Uniqueness Score: -1.00%

Function 00E27940, Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 455
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00E27940(void* __ebx, signed char __ecx, void* __edi, void* __esi, char _a4, signed char _a20, intOrPtr _a24, struct HINSTANCE__** _a28, intOrPtr _a48, char _a52) {
				char _v8;
				signed char _v12;
				signed int _v16;
				signed int _v20;
				signed char _v24;
				signed char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed char _v40;
				intOrPtr _v44;
				signed char _v48;
				char _v64;
				char _v68;
				signed char _v72;
				char _v88;
				char _v120;
				void* __ebp;
				signed int _t129;
				signed int _t130;
				void* _t134;
				signed char _t137;
				void* _t139;
				signed char _t142;
				struct HINSTANCE__** _t145;
				signed int _t151;
				signed int _t153;
				intOrPtr _t155;
				intOrPtr _t160;
				intOrPtr _t165;
				void* _t172;
				struct HINSTANCE__* _t183;
				void* _t185;
				struct HINSTANCE__** _t186;
				intOrPtr _t187;
				intOrPtr _t194;
				intOrPtr _t199;
				struct HINSTANCE__* _t206;
				_Unknown_base(*)()* _t210;
				void* _t218;
				signed char* _t219;
				intOrPtr _t220;
				intOrPtr _t227;
				signed char _t234;
				struct HINSTANCE__** _t245;
				struct HINSTANCE__* _t246;
				intOrPtr _t249;
				intOrPtr _t250;
				intOrPtr _t251;
				struct HINSTANCE__* _t261;
				char _t262;
				char _t263;
				char _t264;
				signed char _t272;
				intOrPtr _t273;
				intOrPtr _t274;
				intOrPtr _t277;
				intOrPtr _t279;
				intOrPtr _t280;
				intOrPtr _t281;
				void* _t282;
				void* _t283;
				void* _t284;
				intOrPtr _t285;
				void* _t286;
				char _t288;
				intOrPtr _t289;
				intOrPtr _t291;
				void* _t292;
				void* _t293;
				void* _t294;
				intOrPtr _t296;
				void* _t297;
				void* _t299;
				void* _t301;
				intOrPtr _t304;
				intOrPtr _t305;
				struct HINSTANCE__* _t308;
				signed char _t311;
				signed int _t312;
				void* _t314;
				signed int _t316;
				intOrPtr _t318;
				signed char _t320;

				_push(0xffffffff);
				_push(0xe60fd0);
				_push( *[fs:0x0]);
				_t129 =  *0xe7b068; // 0x1b9618b6
				_t130 = _t129 ^ _t312;
				_v20 = _t130;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t130);
				 *[fs:0x0] =  &_v16;
				_t234 = __ecx;
				_v28 = 0;
				_v24 = 0;
				_v8 = 1;
				_t134 = E00E28180( &_v64,  &_a4,  &_a28);
				_t316 = _t314 - 0x48 + 4;
				_t9 = _t234 + 4; // 0x4
				_v32 = _t9;
				E00E282C0(_t9,  &_v40, _t134);
				_t137 = _v40;
				_t299 = 0;
				_t304 = _v36;
				_v24 = _t137;
				if(_t137 != _t304) {
					do {
						_t299 = _t299 + 1;
						E00E21050( &_v24);
					} while (_v24 != _t304);
				}
				_t277 = _v44;
				if(_t277 < 0x10) {
					L7:
					if(_t299 != 0) {
						L34:
						_t300 = _v32;
						goto L35;
					} else {
						_t328 = _a52;
						if(_a52 == 0) {
							__eflags =  *(_t234 + 0xc);
							if( *(_t234 + 0xc) != 0) {
								L20:
								E00E12D00(_t277,  &_a28);
								_v8 = 8;
								E00E12D00(_t277,  &_a4);
								_t318 = _t316 - 0x18;
								_v8 = 0xa;
								_v36 = _t318;
								E00E12D00(_t277,  &_v64);
								_v8 = 0xb;
								E00E12D00(_t277,  &_v88);
								_v8 = 0xa;
								_t183 =  *( *(_t234 + 0x10))();
								_v8 = 9;
								_t316 = _t318 - 0x18 + 0x30;
								_t288 = _v68;
								_t308 = _t183;
								__eflags = _t288 - 0x10;
								if(_t288 < 0x10) {
									L24:
									_v8 = 1;
									_t289 = _v44;
									_v72 = 0;
									_v68 = 0xf;
									_v88 = 0;
									__eflags = _t289 - 0x10;
									if(_t289 < 0x10) {
										L28:
										_t185 = E00E28180( &_v64,  &_a4,  &_a28);
										_t316 = _t316 + 4;
										_t75 = _t234 + 4; // 0x4
										_t300 = _t75;
										_v8 = 0xc;
										_t186 = E00E27F90(_t234, _t75, _t75, _t308, _t185);
										_t261 =  *_t186;
										 *_t186 = _t308;
										__eflags = _t261;
										if(_t261 != 0) {
											_v8 = 0xd;
											 *(_t261->i)(1);
										}
										_v8 = 1;
										_t291 = _v44;
										__eflags = _t291 - 0x10;
										if(_t291 < 0x10) {
											L35:
											_t234 = _v28;
											goto L36;
										} else {
											_t262 = _v64;
											_t292 = _t291 + 1;
											_t187 = _t262;
											__eflags = _t292 - 0x1000;
											if(_t292 < 0x1000) {
												L33:
												_push(_t292);
												E00E2C347(_t262);
												_t316 = _t316 + 8;
												goto L35;
											} else {
												_t245 =  *(_t262 - 4);
												_t282 = _t292 + 0x23;
												__eflags = _t187 - _t245 + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L65;
												} else {
													goto L33;
												}
											}
										}
									} else {
										_t263 = _v64;
										_t293 = _t289 + 1;
										_t194 = _t263;
										__eflags = _t293 - 0x1000;
										if(_t293 < 0x1000) {
											L27:
											_push(_t293);
											E00E2C347(_t263);
											_t316 = _t316 + 8;
											goto L28;
										} else {
											_t245 =  *(_t263 - 4);
											_t282 = _t293 + 0x23;
											__eflags = _t194 - _t245 + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												goto L64;
											} else {
												goto L27;
											}
										}
									}
								} else {
									_t264 = _v88;
									_t294 = _t288 + 1;
									_t199 = _t264;
									__eflags = _t294 - 0x1000;
									if(_t294 < 0x1000) {
										L23:
										_push(_t294);
										E00E2C347(_t264);
										_t316 = _t316 + 8;
										goto L24;
									} else {
										_t245 =  *(_t264 - 4);
										_t282 = _t294 + 0x23;
										__eflags = _t199 - _t245 + 0xfffffffc - 0x1f;
										if(__eflags > 0) {
											goto L63;
										} else {
											goto L23;
										}
									}
								}
							} else {
								__eflags =  *0xe7bc7c - 0x10;
								_t205 =  >=  ? "HttpOverUsb.dll" : "HttpOverUsb.dll";
								_t206 = LoadLibraryA( >=  ? "HttpOverUsb.dll" : "HttpOverUsb.dll");
								 *(_t234 + 0xc) = _t206;
								__eflags = _t206;
								if(_t206 == 0) {
									goto L34;
								} else {
									__eflags =  *0xe7bc64 - 0x10;
									_t266 =  >=  ?  *0xe7bc50 : 0xe7bc50;
									 *(_t234 + 0x10) = GetProcAddress(_t206,  >=  ?  *0xe7bc50 : 0xe7bc50);
									__eflags =  *0xe7bc94 - 0x10;
									_t209 =  >=  ?  *0xe7bc80 : 0xe7bc80;
									_t210 = GetProcAddress( *(_t234 + 0xc),  >=  ?  *0xe7bc80 : 0xe7bc80);
									__eflags =  *(_t234 + 0x10);
									 *(_t234 + 0x14) = _t210;
									if( *(_t234 + 0x10) == 0) {
										goto L34;
									} else {
										__eflags = _t210;
										if(_t210 == 0) {
											goto L34;
										} else {
											goto L20;
										}
									}
								}
							}
						} else {
							_v24 = E00E2C07D(_t277, _t328);
							_t320 = _t316 - 0x14;
							_v8 = 2;
							_v28 = _t320;
							E00E12D00(_t277,  &_a28);
							_v8 = 3;
							E00E12D00(_t277,  &_a4);
							_v8 = 2;
							_t311 = E00E29010(_t234, _t211, _t277, _t299, _t328, 0x20);
							_t28 = _t299 + 2; // 0x2
							_t234 = _t28;
							_v24 = _t311;
							_v8 = 4;
							_t218 = E00E28180( &_v64,  &_a4,  &_a28);
							_t316 = _t320 - 0x18 + 4;
							_t300 = _v32;
							_v8 = 5;
							_t219 = E00E27F90(_t234, _v32, _v32, _t311, _t218);
							_v24 = 0;
							_t272 =  *_t219;
							 *_t219 = _t311;
							if(_t272 != 0) {
								_v8 = 6;
								 *((intOrPtr*)( *_t272))(1);
							}
							_v8 = 4;
							_t296 = _v44;
							if(_t296 < 0x10) {
								L15:
								_v8 = 1;
								L36:
								_t139 = E00E28180( &_v64,  &_a4,  &_a28);
								_t316 = _t316 + 4;
								_v8 = 0xe;
								E00E282C0(_t300,  &_v40, _t139);
								_t142 = _v40;
								_t301 = 0;
								_t305 = _v36;
								_v24 = _t142;
								if(_t142 == _t305) {
									L41:
									__eflags = 0;
								} else {
									do {
										_t301 = _t301 + 1;
										E00E21050( &_v24);
									} while (_v24 != _t305);
									if(_t301 == 0) {
										goto L41;
									} else {
										_t172 = E00E28180( &_v88,  &_a4,  &_a28);
										_t316 = _t316 + 4;
										_t234 = _t234 | 0x00000001;
										_v8 = 0xf;
										_v24 = _t234;
										E00E27EB0(_t234, _v32, _t301, _t305, _t172);
									}
								}
								if((_t234 & 0x00000001) == 0) {
									L48:
									_t279 = _v44;
									if(_t279 < 0x10) {
										L52:
										_t280 = _a24;
										_v48 = 0;
										_v44 = 0xf;
										_v64 = 0;
										if(_t280 < 0x10) {
											L56:
											_t281 = _a48;
											_a20 = 0;
											_a24 = 0xf;
											_a4 = 0;
											if(_t281 < 0x10) {
												L60:
												 *[fs:0x0] = _v16;
												return E00E2C067(_v20 ^ _t312);
											} else {
												_t245 = _a28;
												_t282 = _t281 + 1;
												_t145 = _t245;
												if(_t282 < 0x1000) {
													L59:
													_push(_t282);
													E00E2C347(_t245);
													goto L60;
												} else {
													_t245 =  *(_t245 - 4);
													_t282 = _t282 + 0x23;
													if(_t145 - _t245 + 0xfffffffc > 0x1f) {
														goto L69;
													} else {
														goto L59;
													}
												}
											}
										} else {
											_t249 = _a4;
											_t283 = _t280 + 1;
											_t155 = _t249;
											if(_t283 < 0x1000) {
												L55:
												_push(_t283);
												E00E2C347(_t249);
												_t316 = _t316 + 8;
												goto L56;
											} else {
												_t116 = _t249 - 4; // 0x80fb
												_t245 =  *_t116;
												_t282 = _t283 + 0x23;
												if(_t155 - _t245 + 0xfffffffc > 0x1f) {
													goto L68;
												} else {
													goto L55;
												}
											}
										}
									} else {
										_t250 = _v64;
										_t284 = _t279 + 1;
										_t160 = _t250;
										if(_t284 < 0x1000) {
											L51:
											_push(_t284);
											E00E2C347(_t250);
											_t316 = _t316 + 8;
											goto L52;
										} else {
											_t245 =  *(_t250 - 4);
											_t282 = _t284 + 0x23;
											if(_t160 - _t245 + 0xfffffffc > 0x1f) {
												goto L67;
											} else {
												goto L51;
											}
										}
									}
								} else {
									_t285 = _v68;
									if(_t285 < 0x10) {
										L47:
										_v72 = 0;
										_v68 = 0xf;
										_v88 = 0;
										goto L48;
									} else {
										_t251 = _v88;
										_t286 = _t285 + 1;
										_t165 = _t251;
										if(_t286 < 0x1000) {
											L46:
											_push(_t286);
											E00E2C347(_t251);
											_t316 = _t316 + 8;
											goto L47;
										} else {
											_t245 =  *(_t251 - 4);
											_t282 = _t286 + 0x23;
											if(_t165 - _t245 + 0xfffffffc > 0x1f) {
												goto L66;
											} else {
												goto L46;
											}
										}
									}
								}
							} else {
								_t273 = _v64;
								_t297 = _t296 + 1;
								_t220 = _t273;
								if(_t297 < 0x1000) {
									L14:
									_push(_t297);
									E00E2C347(_t273);
									_t316 = _t316 + 8;
									goto L15;
								} else {
									_t245 =  *(_t273 - 4);
									_t282 = _t297 + 0x23;
									if(_t220 - _t245 + 0xfffffffc > 0x1f) {
										goto L62;
									} else {
										goto L14;
									}
								}
							}
						}
					}
				} else {
					_t274 = _v64;
					_t277 = _t277 + 1;
					_t227 = _t274;
					if(_t277 < 0x1000) {
						L6:
						_push(_t277);
						E00E2C347(_t274);
						_t316 = _t316 + 8;
						goto L7;
					} else {
						_t245 =  *(_t274 - 4);
						_t282 = _t277 + 0x23;
						if(_t227 - _t245 + 0xfffffffc > 0x1f) {
							E00E4957C(_t234, _t245, _t282, _t299, __eflags);
							L62:
							E00E4957C(_t234, _t245, _t282, _t300, __eflags);
							L63:
							E00E4957C(_t234, _t245, _t282, _t299, __eflags);
							L64:
							E00E4957C(_t234, _t245, _t282, _t299, __eflags);
							L65:
							E00E4957C(_t234, _t245, _t282, _t300, __eflags);
							L66:
							E00E4957C(_t234, _t245, _t282, _t301, __eflags);
							L67:
							E00E4957C(_t234, _t245, _t282, _t301, __eflags);
							L68:
							E00E4957C(_t234, _t245, _t282, _t301, __eflags);
							L69:
							E00E4957C(_t234, _t245, _t282, _t301, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t312);
							_push(0xffffffff);
							_push(0xe5fa30);
							_push( *[fs:0x0]);
							_t151 =  *0xe7b068; // 0x1b9618b6
							_push(_t151 ^ _t316);
							_t153 =  &_v120;
							 *[fs:0x0] = _t153;
							_t246 =  *_t245;
							__eflags = _t246;
							if(_t246 != 0) {
								_v12 = 0;
								_t153 =  *(_t246->i)(1);
							}
							 *[fs:0x0] = _v20;
							return _t153;
						} else {
							goto L6;
						}
					}
				}
			}

0x00e27943
0x00e27945
0x00e27950
0x00e27954
0x00e27959
0x00e2795b
0x00e2795e
0x00e2795f
0x00e27960
0x00e27961
0x00e27965
0x00e2796b
0x00e2796f
0x00e27972
0x00e27978
0x00e27986
0x00e2798b
0x00e2798e
0x00e27991
0x00e27999
0x00e2799e
0x00e279a1
0x00e279a3
0x00e279a6
0x00e279ab
0x00e279b0
0x00e279b3
0x00e279b4
0x00e279b9
0x00e279b0
0x00e279be
0x00e279c4
0x00e279f2
0x00e279f4
0x00e27c82
0x00e27c82
0x00000000
0x00e279fa
0x00e279fa
0x00e279fe
0x00e27ac9
0x00e27acd
0x00e27b42
0x00e27b49
0x00e27b51
0x00e27b59
0x00e27b5e
0x00e27b61
0x00e27b68
0x00e27b6e
0x00e27b76
0x00e27b80
0x00e27b85
0x00e27b8c
0x00e27b8e
0x00e27b92
0x00e27b95
0x00e27b98
0x00e27b9a
0x00e27b9d
0x00e27bcb
0x00e27bcb
0x00e27bcf
0x00e27bd2
0x00e27bd9
0x00e27be0
0x00e27be4
0x00e27be7
0x00e27c15
0x00e27c1f
0x00e27c24
0x00e27c27
0x00e27c27
0x00e27c2a
0x00e27c31
0x00e27c36
0x00e27c38
0x00e27c3a
0x00e27c3c
0x00e27c3e
0x00e27c46
0x00e27c46
0x00e27c48
0x00e27c4c
0x00e27c4f
0x00e27c52
0x00e27c85
0x00e27c85
0x00000000
0x00e27c54
0x00e27c54
0x00e27c57
0x00e27c58
0x00e27c5a
0x00e27c60
0x00e27c76
0x00e27c76
0x00e27c78
0x00e27c7d
0x00000000
0x00e27c62
0x00e27c62
0x00e27c65
0x00e27c6d
0x00e27c70
0x00000000
0x00000000
0x00000000
0x00000000
0x00e27c70
0x00e27c60
0x00e27be9
0x00e27be9
0x00e27bec
0x00e27bed
0x00e27bef
0x00e27bf5
0x00e27c0b
0x00e27c0b
0x00e27c0d
0x00e27c12
0x00000000
0x00e27bf7
0x00e27bf7
0x00e27bfa
0x00e27c02
0x00e27c05
0x00000000
0x00000000
0x00000000
0x00000000
0x00e27c05
0x00e27bf5
0x00e27b9f
0x00e27b9f
0x00e27ba2
0x00e27ba3
0x00e27ba5
0x00e27bab
0x00e27bc1
0x00e27bc1
0x00e27bc3
0x00e27bc8
0x00000000
0x00e27bad
0x00e27bad
0x00e27bb0
0x00e27bb8
0x00e27bbb
0x00000000
0x00000000
0x00000000
0x00000000
0x00e27bbb
0x00e27bab
0x00e27acf
0x00e27acf
0x00e27adb
0x00e27ae3
0x00e27ae9
0x00e27aec
0x00e27aee
0x00000000
0x00e27af4
0x00e27af4
0x00e27b06
0x00e27b11
0x00e27b19
0x00e27b20
0x00e27b2b
0x00e27b2d
0x00e27b31
0x00e27b34
0x00000000
0x00e27b3a
0x00e27b3a
0x00e27b3c
0x00000000
0x00000000
0x00000000
0x00000000
0x00e27b3c
0x00e27b34
0x00e27aee
0x00e27a04
0x00e27a0d
0x00e27a10
0x00e27a13
0x00e27a1a
0x00e27a20
0x00e27a28
0x00e27a32
0x00e27a39
0x00e27a42
0x00e27a44
0x00e27a44
0x00e27a47
0x00e27a4d
0x00e27a58
0x00e27a5d
0x00e27a60
0x00e27a66
0x00e27a6a
0x00e27a6f
0x00e27a76
0x00e27a78
0x00e27a7c
0x00e27a7e
0x00e27a86
0x00e27a86
0x00e27a88
0x00e27a8c
0x00e27a92
0x00e27ac0
0x00e27ac0
0x00e27c88
0x00e27c92
0x00e27c97
0x00e27c9e
0x00e27ca5
0x00e27caa
0x00e27cad
0x00e27caf
0x00e27cb2
0x00e27cb7
0x00e27cfb
0x00e27cfb
0x00e27cc0
0x00e27cc0
0x00e27cc3
0x00e27cc4
0x00e27cc9
0x00e27cd0
0x00000000
0x00e27cd2
0x00e27cdc
0x00e27ce1
0x00e27ce7
0x00e27cea
0x00e27cef
0x00e27cf2
0x00e27cf7
0x00e27cd0
0x00e27d00
0x00e27d48
0x00e27d48
0x00e27d4e
0x00e27d7c
0x00e27d7c
0x00e27d7f
0x00e27d86
0x00e27d8d
0x00e27d94
0x00e27dc2
0x00e27dc2
0x00e27dc5
0x00e27dcc
0x00e27dd3
0x00e27dda
0x00e27e04
0x00e27e09
0x00e27e21
0x00e27ddc
0x00e27ddc
0x00e27ddf
0x00e27de0
0x00e27de8
0x00e27dfa
0x00e27dfa
0x00e27dfc
0x00000000
0x00e27dea
0x00e27dea
0x00e27ded
0x00e27df8
0x00000000
0x00000000
0x00000000
0x00000000
0x00e27df8
0x00e27de8
0x00e27d96
0x00e27d96
0x00e27d99
0x00e27d9a
0x00e27da2
0x00e27db8
0x00e27db8
0x00e27dba
0x00e27dbf
0x00000000
0x00e27da4
0x00e27da4
0x00e27da4
0x00e27da7
0x00e27db2
0x00000000
0x00000000
0x00000000
0x00000000
0x00e27db2
0x00e27da2
0x00e27d50
0x00e27d50
0x00e27d53
0x00e27d54
0x00e27d5c
0x00e27d72
0x00e27d72
0x00e27d74
0x00e27d79
0x00000000
0x00e27d5e
0x00e27d5e
0x00e27d61
0x00e27d6c
0x00000000
0x00000000
0x00000000
0x00000000
0x00e27d6c
0x00e27d5c
0x00e27d02
0x00e27d02
0x00e27d08
0x00e27d36
0x00e27d36
0x00e27d3d
0x00e27d44
0x00000000
0x00e27d0a
0x00e27d0a
0x00e27d0d
0x00e27d0e
0x00e27d16
0x00e27d2c
0x00e27d2c
0x00e27d2e
0x00e27d33
0x00000000
0x00e27d18
0x00e27d18
0x00e27d1b
0x00e27d26
0x00000000
0x00000000
0x00000000
0x00000000
0x00e27d26
0x00e27d16
0x00e27d08
0x00e27a94
0x00e27a94
0x00e27a97
0x00e27a98
0x00e27aa0
0x00e27ab6
0x00e27ab6
0x00e27ab8
0x00e27abd
0x00000000
0x00e27aa2
0x00e27aa2
0x00e27aa5
0x00e27ab0
0x00000000
0x00000000
0x00000000
0x00000000
0x00e27ab0
0x00e27aa0
0x00e27a92
0x00e279fe
0x00e279c6
0x00e279c6
0x00e279c9
0x00e279ca
0x00e279d2
0x00e279e8
0x00e279e8
0x00e279ea
0x00e279ef
0x00000000
0x00e279d4
0x00e279d4
0x00e279d7
0x00e279e2
0x00e27e24
0x00e27e29
0x00e27e29
0x00e27e2e
0x00e27e2e
0x00e27e33
0x00e27e33
0x00e27e38
0x00e27e38
0x00e27e3d
0x00e27e3d
0x00e27e42
0x00e27e42
0x00e27e47
0x00e27e47
0x00e27e4c
0x00e27e4c
0x00e27e51
0x00e27e52
0x00e27e53
0x00e27e54
0x00e27e55
0x00e27e56
0x00e27e57
0x00e27e58
0x00e27e59
0x00e27e5a
0x00e27e5b
0x00e27e5c
0x00e27e5d
0x00e27e5e
0x00e27e5f
0x00e27e60
0x00e27e63
0x00e27e65
0x00e27e70
0x00e27e71
0x00e27e78
0x00e27e79
0x00e27e7c
0x00e27e82
0x00e27e84
0x00e27e86
0x00e27e88
0x00e27e93
0x00e27e93
0x00e27e98
0x00e27ea3
0x00000000
0x00000000
0x00000000
0x00e279e2
0x00e279d2

APIs

LoadLibraryA.KERNEL32(HttpOverUsb.dll,?,00000000,?), ref: 00E27AE3
GetProcAddress.KERNEL32(00000000,00E7BC50), ref: 00E27B0F
GetProcAddress.KERNEL32(?,00E7BC80), ref: 00E27B2B

Strings

HttpOverUsb.dll, xrefs: 00E27AD6, 00E27AE2

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpOverUsb.dll
API String ID: 2238633743-2765453870
Opcode ID: 3715564077df5ad99f5062107301eefb9d69ccf743fad01a977bb348035cd8ee
Instruction ID: af1158e7e6af7209f08c328edef7c220172cb6d5b9a186200374d7dcfc82b199
Opcode Fuzzy Hash: 3715564077df5ad99f5062107301eefb9d69ccf743fad01a977bb348035cd8ee
Instruction Fuzzy Hash: 13F10471900158DFDF09CF68E985BAEBBB5EF49304F248198E445BB291DB349E84CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E156F0, Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 413
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00E156F0(void* __ebx, void* __edi, intOrPtr* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr* _a28, intOrPtr _a32) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				char _v48;
				intOrPtr _v52;
				char _v56;
				char _v72;
				signed short _v76;
				intOrPtr* _v80;
				char _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v100;
				char _v104;
				signed int _v108;
				signed char _v128;
				char* _v136;
				void* __esi;
				void* __ebp;
				signed int _t183;
				signed int _t184;
				intOrPtr _t189;
				signed short _t202;
				signed short _t218;
				intOrPtr _t219;
				signed int _t221;
				intOrPtr* _t225;
				intOrPtr* _t230;
				intOrPtr _t235;
				signed int _t240;
				signed int _t241;
				intOrPtr _t247;
				signed short _t280;
				intOrPtr _t291;
				intOrPtr _t293;
				intOrPtr _t296;
				intOrPtr _t299;
				intOrPtr* _t300;
				intOrPtr* _t301;
				char _t303;
				intOrPtr* _t306;
				signed short _t307;
				signed int _t316;
				signed int _t318;
				intOrPtr _t326;
				intOrPtr* _t327;
				intOrPtr* _t328;
				signed char _t331;
				intOrPtr* _t335;
				intOrPtr* _t336;
				void* _t337;
				intOrPtr* _t340;
				intOrPtr _t343;
				intOrPtr _t344;
				intOrPtr _t345;
				signed char _t347;
				void* _t348;
				intOrPtr* _t350;
				void* _t351;
				void* _t352;
				intOrPtr _t353;
				signed int _t354;
				void* _t357;
				char* _t359;
				char* _t367;
				signed int _t368;
				void* _t370;
				void* _t371;
				void* _t373;
				void* _t374;
				void* _t375;
				intOrPtr _t398;

				_push(0xffffffff);
				_push(0xe5fb60);
				_push( *[fs:0x0]);
				_t371 = _t370 - 0x5c;
				_t183 =  *0xe7b068; // 0x1b9618b6
				_t184 = _t183 ^ _t368;
				_v20 = _t184;
				_push(__ebx);
				_push(__edi);
				_push(_t184);
				 *[fs:0x0] =  &_v16;
				_t293 = _a32;
				_t299 = _a20;
				_t350 = _a28;
				_v108 = _a8;
				_v88 = _t299;
				_v100 = _t350;
				if(_t293 == 0) {
					L4:
					_t357 = 0;
					__eflags = 0;
				} else {
					_t291 =  *_t350;
					if(_t291 == 0x2b || _t291 == 0x2d) {
						_t357 = 1;
					} else {
						goto L4;
					}
				}
				_v92 = _t357;
				if(( *(_t299 + 0x14) & 0x00003000) == 0x3000) {
					_t12 = _t357 + 2; // 0x2
					_t189 = _t12;
					_t337 = "pP";
					__eflags = _t189 - _t293;
					if(_t189 <= _t293) {
						__eflags =  *((char*)(_t350 + _t357)) - 0x30;
						if( *((char*)(_t350 + _t357)) == 0x30) {
							_t299 =  *((intOrPtr*)(_t350 + _t357 + 1));
							__eflags = _t299 - 0x78;
							if(_t299 == 0x78) {
								L11:
								_t357 = _t189;
								_v92 = _t357;
							} else {
								__eflags = _t299 - 0x58;
								if(_t299 == 0x58) {
									goto L11;
								}
							}
						}
					}
				} else {
					_t337 = "eE";
				}
				_v96 = E00E46F80(_t299, _t350, _t337);
				_v24 = 0x2e;
				_v24 =  *((intOrPtr*)( *((intOrPtr*)(E00E48661(_t337)))));
				_t351 = E00E46F80(_t299, _t350,  &_v24);
				_v8 = 0;
				_t300 =  *((intOrPtr*)( *((intOrPtr*)(_v88 + 0x30)) + 4));
				_v80 = _t300;
				 *((intOrPtr*)( *_t300 + 4))();
				_v8 = 1;
				_push( &_v84);
				_t202 = E00E16370(_t337, _t351, _t357);
				_t373 = _t371 + 0x14;
				_v76 = _t202;
				_v8 = 2;
				_t301 = _v80;
				if(_t301 != 0) {
					_t336 =  *((intOrPtr*)( *_t301 + 8))();
					if(_t336 != 0) {
						 *((intOrPtr*)( *_t336))(1);
					}
				}
				_v8 = 0xffffffff;
				_v32 = 0;
				_v28 = 0xf;
				_v48 = 0;
				E00E14B00(_t293,  &_v48, _t337, _t293);
				_v8 = 3;
				_t303 = _v100;
				_t205 =  >=  ? _v48 :  &_v48;
				 *((intOrPtr*)( *_v76 + 0x1c))(_t303, _t303 + _t293,  >=  ? _v48 :  &_v48, 0);
				_v8 = 4;
				_t306 =  *((intOrPtr*)( *((intOrPtr*)(_v88 + 0x30)) + 4));
				_v80 = _t306;
				 *((intOrPtr*)( *_t306 + 4))();
				_v8 = 5;
				_t307 = E00E16C80(_t293,  *_v76, _t351, _t357,  &_v84);
				_t374 = _t373 + 4;
				_v76 = _t307;
				_v8 = 6;
				_t340 = _v80;
				if(_t340 != 0) {
					_t335 =  *((intOrPtr*)( *_t340 + 8))();
					if(_t335 != 0) {
						 *((intOrPtr*)( *_t335))(1);
					}
					_t307 = _v76;
				}
				_v8 = 3;
				 *((intOrPtr*)( *_t307 + 0x14))( &_v72);
				_t308 = _v76;
				_v8 = 7;
				_v100 =  *((intOrPtr*)( *((intOrPtr*)( *_v76 + 0x10))))();
				if(_t351 != _t293) {
					_t280 =  *((intOrPtr*)( *((intOrPtr*)( *_v76 + 0xc))))();
					_t308 = _t280;
					_t282 =  >=  ? _v48 :  &_v48;
					 *(( >=  ? _v48 :  &_v48) + _t351) = _t280;
				}
				_t352 =  ==  ? _v96 : _t351;
				_t295 =  >=  ? _v72 :  &_v72;
				_t218 =  *_t295;
				if(_t218 == 0x7f) {
					L30:
					_t219 = _v88;
					_t296 = _v32;
					_t398 =  *((intOrPtr*)(_t219 + 0x24));
					_t353 =  *((intOrPtr*)(_t219 + 0x20));
					if(_t398 < 0 || _t398 <= 0 && _t353 == 0 || _t353 <= _t296) {
						_t354 = 0;
						__eflags = 0;
					} else {
						_t354 = _t353 - _t296;
					}
					_t221 =  *(_t219 + 0x14) & 0x000001c0;
					if(_t221 == 0x40) {
						__eflags = _v28 - 0x10;
						_t223 =  >=  ? _v48 :  &_v48;
						_t225 = E00E151C0(_a4,  &_v84, _a12, _a16,  >=  ? _v48 :  &_v48, _t357);
						_t375 = _t374 + 0x18;
					} else {
						if(_t221 == 0x100) {
							__eflags = _v28 - 0x10;
							_t253 =  >=  ? _v48 :  &_v48;
							_t327 = E00E151C0(_a4,  &_v84, _a12, _a16,  >=  ? _v48 :  &_v48, _t357);
							_a12 =  *_t327;
							_a16 =  *((intOrPtr*)(_t327 + 4));
							_t225 = E00E15140(_t327, _a4,  &_v84,  *_t327,  *((intOrPtr*)(_t327 + 4)), _a24, _t354);
							_t375 = _t374 + 0x30;
							_t354 = 0;
						} else {
							_t328 = E00E15140(_t308, _a4,  &_v84, _a12, _a16, _a24, _t354);
							_t354 = 0;
							_a12 =  *_t328;
							_a16 =  *((intOrPtr*)(_t328 + 4));
							_t264 =  >=  ? _v48 :  &_v48;
							_t225 = E00E151C0(_a4,  &_v84,  *_t328,  *((intOrPtr*)(_t328 + 4)),  >=  ? _v48 :  &_v48, _t357);
							_t375 = _t374 + 0x30;
						}
					}
					_a12 =  *_t225;
					_t227 =  >=  ? _v48 :  &_v48;
					_t295 = _a4;
					_t228 = ( >=  ? _v48 :  &_v48) + _t357;
					_a16 =  *((intOrPtr*)(_t225 + 4));
					_t230 = E00E151C0(_a4,  &_v104,  *_t225,  *((intOrPtr*)(_t225 + 4)), ( >=  ? _v48 :  &_v48) + _t357, _t296 - _t357);
					_t343 = _v88;
					_t357 = _v108;
					_a12 =  *_t230;
					_a16 =  *((intOrPtr*)(_t230 + 4));
					 *((intOrPtr*)(_t343 + 0x20)) = 0;
					 *((intOrPtr*)(_t343 + 0x24)) = 0;
					E00E15140( *_t230, _a4, _t357,  *_t230,  *((intOrPtr*)(_t230 + 4)), _a24, _t354);
					_t344 = _v52;
					_t374 = _t375 + 0x30;
					if(_t344 < 0x10) {
						L45:
						_t345 = _v28;
						_v56 = 0;
						_v52 = 0xf;
						_v72 = 0;
						if(_t345 < 0x10) {
							L49:
							 *[fs:0x0] = _v16;
							return E00E2C067(_v20 ^ _t368);
						} else {
							_t315 = _v48;
							_t346 = _t345 + 1;
							_t235 = _t315;
							if(_t346 < 0x1000) {
								L48:
								_push(_t346);
								E00E2C347(_t315);
								goto L49;
							} else {
								_t315 =  *((intOrPtr*)(_t315 - 4));
								_t346 = _t346 + 0x23;
								if(_t235 - _t315 + 0xfffffffc > 0x1f) {
									goto L52;
								} else {
									goto L48;
								}
							}
						}
					} else {
						_t326 = _v72;
						_t348 = _t344 + 1;
						_t247 = _t326;
						if(_t348 < 0x1000) {
							L44:
							_push(_t348);
							E00E2C347(_t326);
							_t374 = _t374 + 8;
							goto L45;
						} else {
							_t315 =  *((intOrPtr*)(_t326 - 4));
							_t346 = _t348 + 0x23;
							if(_t247 -  *((intOrPtr*)(_t326 - 4)) + 0xfffffffc > 0x1f) {
								goto L51;
							} else {
								goto L44;
							}
						}
					}
				} else {
					while(_t218 > 0) {
						_t308 = _t218;
						if(_t308 >= _t352 - _t357) {
							goto L30;
						} else {
							_t354 = _t352 - _t308;
							_t315 = _v32;
							if(_t315 < _t354) {
								E00E160D0(_t295, _t315);
								L51:
								E00E4957C(_t295, _t315, _t346, _t354, __eflags);
								L52:
								E00E4957C(_t295, _t315, _t346, _t354, __eflags);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t368);
								_t347 = _v128;
								_push(_t357);
								_t359 = _v136;
								 *_t359 = 0x25;
								_t161 = _t359 + 1; // 0x4d
								_t240 = _t161;
								__eflags = _t347 & 0x00000020;
								if((_t347 & 0x00000020) != 0) {
									 *_t240 = 0x2b;
									_t240 = _t240 + 1;
									__eflags = _t240;
								}
								__eflags = _t347 & 0x00000010;
								if((_t347 & 0x00000010) != 0) {
									 *_t240 = 0x23;
									_t240 = _t240 + 1;
									__eflags = _t240;
								}
								_t316 = _a8;
								 *_t240 = 0x2a2e;
								_t241 = _t240 + 2;
								__eflags = _t316;
								if(_t316 != 0) {
									 *_t241 = _t316;
									_t241 = _t241 + 1;
									__eflags = _t241;
								}
								_t318 = _t347 & 0x00003000;
								__eflags = _t347 & 0x00000004;
								if((_t347 & 0x00000004) == 0) {
									__eflags = _t318 - 0x2000;
									if(_t318 != 0x2000) {
										__eflags = _t318 - 0x3000;
										if(_t318 != 0x3000) {
											__eflags = _t318 - 0x1000;
											_t178 = _t318 != 0x1000;
											__eflags = _t178;
											 *_t241 = 0x65 + (_t318 & 0xffffff00 | _t178) * 2;
											 *(_t241 + 1) = 0;
											return _t359;
										} else {
											 *_t241 = 0x61;
											 *(_t241 + 1) = 0;
											return _t359;
										}
									} else {
										goto L65;
									}
								} else {
									__eflags = _t318 - 0x2000;
									if(_t318 == 0x2000) {
										L65:
										 *_t241 = 0x66;
										 *(_t241 + 1) = 0;
										return _t359;
									} else {
										__eflags = _t318 - 0x3000;
										if(_t318 != 0x3000) {
											__eflags = _t318 - 0x1000;
											_t171 = _t318 != 0x1000;
											__eflags = _t171;
											 *_t241 = 0x45 + (_t318 & 0xffffff00 | _t171) * 2;
											 *(_t241 + 1) = 0;
											return _t359;
										} else {
											 *_t241 = 0x41;
											 *(_t241 + 1) = 0;
											return _t359;
										}
									}
								}
							} else {
								_t346 = _v28;
								if(_v28 - _t315 < 1) {
									_push(_v100);
									_v96 = 0;
									_t308 =  &_v48;
									E00E17210(_t295,  &_v48, _t354, 1, _v96, _t354, 1);
								} else {
									_t79 = _t315 + 1; // 0x1
									_v32 = _t79;
									_t366 =  >=  ? _v48 :  &_v48;
									_t367 = ( >=  ? _v48 :  &_v48) + _t354;
									_t83 = _t367 + 1; // 0x1
									E00E43690(_t83, _t367, _t315 - _t354 + 1);
									_t331 = _v100;
									_t374 = _t374 + 0xc;
									_t308 = _t331 << 0x00000008 | _t331 & 0x000000ff;
									 *_t367 = _t331 << 0x00000008 | _t331 & 0x000000ff;
									_t357 = _v92;
								}
								_t273 =  <=  ? _t295 : _t295 + 1;
								_t295 =  <=  ? _t295 : _t295 + 1;
								_t218 =  *_t295;
								if(_t218 != 0x7f) {
									continue;
								} else {
									goto L30;
								}
							}
						}
						goto L69;
					}
					goto L30;
				}
				L69:
			}

0x00e156f3
0x00e156f5
0x00e15700
0x00e15701
0x00e15704
0x00e15709
0x00e1570b
0x00e1570e
0x00e15710
0x00e15711
0x00e15715
0x00e1571b
0x00e15721
0x00e15724
0x00e15727
0x00e1572a
0x00e1572d
0x00e15732
0x00e15745
0x00e15745
0x00e15745
0x00e15734
0x00e15734
0x00e15738
0x00e1573e
0x00000000
0x00000000
0x00000000
0x00e15738
0x00e1574f
0x00e15757
0x00e15760
0x00e15760
0x00e15763
0x00e15768
0x00e1576a
0x00e1576c
0x00e15770
0x00e15772
0x00e15776
0x00e15779
0x00e15780
0x00e15780
0x00e15782
0x00e1577b
0x00e1577b
0x00e1577e
0x00000000
0x00000000
0x00e1577e
0x00e15779
0x00e15770
0x00e15759
0x00e15759
0x00e15759
0x00e1578c
0x00e15794
0x00e157a1
0x00e157ae
0x00e157b9
0x00e157c0
0x00e157c3
0x00e157c8
0x00e157ce
0x00e157d5
0x00e157d6
0x00e157db
0x00e157de
0x00e157e1
0x00e157e8
0x00e157ed
0x00e157f4
0x00e157f8
0x00e157fe
0x00e157fe
0x00e157f8
0x00e15800
0x00e1580d
0x00e15814
0x00e1581b
0x00e1581f
0x00e1582a
0x00e15835
0x00e15838
0x00e15847
0x00e15850
0x00e15854
0x00e15857
0x00e1585c
0x00e15862
0x00e1586c
0x00e1586e
0x00e15871
0x00e15874
0x00e15878
0x00e1587d
0x00e15886
0x00e1588a
0x00e15890
0x00e15890
0x00e15892
0x00e15892
0x00e15895
0x00e1589f
0x00e158a2
0x00e158a5
0x00e158b0
0x00e158b5
0x00e158bf
0x00e158c5
0x00e158ca
0x00e158d0
0x00e158d0
0x00e158d3
0x00e158de
0x00e158e2
0x00e158e6
0x00e15981
0x00e15981
0x00e15984
0x00e15987
0x00e1598b
0x00e1598e
0x00e1599e
0x00e1599e
0x00e1599a
0x00e1599a
0x00e1599a
0x00e159a3
0x00e159ab
0x00e15a48
0x00e15a50
0x00e15a62
0x00e15a67
0x00e159b1
0x00e159b6
0x00e15a00
0x00e15a08
0x00e15a1f
0x00e15a27
0x00e15a2d
0x00e15a3c
0x00e15a41
0x00e15a44
0x00e159b8
0x00e159ce
0x00e159d0
0x00e159d9
0x00e159df
0x00e159e5
0x00e159f6
0x00e159fb
0x00e159fb
0x00e159b6
0x00e15a70
0x00e15a79
0x00e15a80
0x00e15a83
0x00e15a8b
0x00e15a90
0x00e15a95
0x00e15a98
0x00e15aa1
0x00e15aab
0x00e15aae
0x00e15ab5
0x00e15abc
0x00e15ac1
0x00e15ac4
0x00e15aca
0x00e15af4
0x00e15af4
0x00e15af7
0x00e15afe
0x00e15b05
0x00e15b0c
0x00e15b36
0x00e15b3b
0x00e15b53
0x00e15b0e
0x00e15b0e
0x00e15b11
0x00e15b12
0x00e15b1a
0x00e15b2c
0x00e15b2c
0x00e15b2e
0x00000000
0x00e15b1c
0x00e15b1c
0x00e15b1f
0x00e15b2a
0x00000000
0x00000000
0x00000000
0x00000000
0x00e15b2a
0x00e15b1a
0x00e15acc
0x00e15acc
0x00e15acf
0x00e15ad0
0x00e15ad8
0x00e15aea
0x00e15aea
0x00e15aec
0x00e15af1
0x00000000
0x00e15ada
0x00e15ada
0x00e15add
0x00e15ae8
0x00000000
0x00000000
0x00000000
0x00000000
0x00e15ae8
0x00e15ad8
0x00e158f0
0x00e158f0
0x00e158f8
0x00e15901
0x00000000
0x00e15903
0x00e15903
0x00e15905
0x00e1590a
0x00e15b54
0x00e15b59
0x00e15b59
0x00e15b5e
0x00e15b5e
0x00e15b63
0x00e15b64
0x00e15b65
0x00e15b66
0x00e15b67
0x00e15b68
0x00e15b69
0x00e15b6a
0x00e15b6b
0x00e15b6c
0x00e15b6d
0x00e15b6e
0x00e15b6f
0x00e15b70
0x00e15b73
0x00e15b76
0x00e15b77
0x00e15b7a
0x00e15b7d
0x00e15b7d
0x00e15b80
0x00e15b83
0x00e15b85
0x00e15b88
0x00e15b88
0x00e15b88
0x00e15b89
0x00e15b8c
0x00e15b8e
0x00e15b91
0x00e15b91
0x00e15b91
0x00e15b92
0x00e15b95
0x00e15b9a
0x00e15b9d
0x00e15b9f
0x00e15ba1
0x00e15ba3
0x00e15ba3
0x00e15ba3
0x00e15ba6
0x00e15bac
0x00e15baf
0x00e15be9
0x00e15bef
0x00e15bfe
0x00e15c04
0x00e15c13
0x00e15c19
0x00e15c19
0x00e15c23
0x00e15c25
0x00e15c2d
0x00e15c06
0x00e15c08
0x00e15c0a
0x00e15c12
0x00e15c12
0x00000000
0x00000000
0x00000000
0x00e15bb1
0x00e15bb1
0x00e15bb7
0x00e15bf1
0x00e15bf3
0x00e15bf5
0x00e15bfd
0x00e15bb9
0x00e15bb9
0x00e15bbf
0x00e15bce
0x00e15bd4
0x00e15bd4
0x00e15bde
0x00e15be0
0x00e15be8
0x00e15bc1
0x00e15bc3
0x00e15bc5
0x00e15bcd
0x00e15bcd
0x00e15bbf
0x00e15bb7
0x00e15910
0x00e15910
0x00e1591a
0x00e15954
0x00e15957
0x00e1595b
0x00e15966
0x00e1591c
0x00e1591c
0x00e15925
0x00e15928
0x00e1592e
0x00e15933
0x00e15937
0x00e1593c
0x00e15940
0x00e1594a
0x00e1594d
0x00e1594f
0x00e1594f
0x00e15972
0x00e15975
0x00e15977
0x00e1597b
0x00000000
0x00000000
0x00000000
0x00000000
0x00e1597b
0x00e1590a
0x00000000
0x00e15901
0x00000000
0x00e158f0
0x00000000

APIs

_strcspn.LIBCMT ref: 00E15787
_strcspn.LIBCMT ref: 00E157A9

Strings

d , xrefs: 00E15763
` , xrefs: 00E15759

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: _strcspn
String ID: ` $d
API String ID: 3709121408-4219163421
Opcode ID: 9513038fb565126d62af2b963bcbd980c9f11676d72bbe53356b66f370660f95
Instruction ID: 0796fee6aa28f6b2324310029e9ae52586bd39741ce1a7df3fd6ad3702a8b420
Opcode Fuzzy Hash: 9513038fb565126d62af2b963bcbd980c9f11676d72bbe53356b66f370660f95
Instruction Fuzzy Hash: 71F18D72A00649DFDF05CFA8C884AEEBBF5FF89304F548069E815BB251D7319985CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E5EC62, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 80%

			E00E5EC62(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr* _t11;
				intOrPtr* _t13;
				intOrPtr* _t14;
				intOrPtr* _t16;
				void* _t22;
				void* _t27;

				_t22 = __ecx;
				E00E2C758(0xe61fd8, __ebx, __edi, __esi, 8);
				 *((intOrPtr*)(_t27 - 4)) = 0;
				_t10 = E00E42F52(__eflags);
				_t31 =  *_t10;
				if( *_t10 == 0) {
					L5:
					_t11 =  *((intOrPtr*)(_t27 + 8));
					 *_t11 = 0;
					 *((intOrPtr*)(_t11 + 4)) = 0;
				} else {
					_t13 = E00E42F5B(_t31);
					_t32 =  *_t13;
					if( *_t13 != 0) {
						goto L5;
					} else {
						_t14 = E00E42F52(_t32);
						_t33 =  *((intOrPtr*)( *_t14)) - 0xe0434f4d;
						if( *((intOrPtr*)( *_t14)) == 0xe0434f4d) {
							goto L5;
						} else {
							_t16 = E00E42F52(_t33);
							_t34 =  *((intOrPtr*)( *_t16)) - 0xe0434352;
							if( *((intOrPtr*)( *_t16)) == 0xe0434352) {
								goto L5;
							} else {
								 *((char*)(_t27 - 0x11)) = 1;
								_push(_t27 - 0x11);
								_push(E00E42F52(_t34));
								_push( *((intOrPtr*)(_t27 + 8)));
								E00E5E945(__ebx, _t22, __edx, __edi, 0, _t34);
								_t11 =  *((intOrPtr*)(_t27 + 8));
							}
						}
					}
				}
				return E00E2C6C7(_t11);
			}

0x00e5ec62
0x00e5ec69
0x00e5ec70
0x00e5ec73
0x00e5ec78
0x00e5ec7a
0x00e5ecdc
0x00e5ecdc
0x00e5ecdf
0x00e5ece1
0x00e5ec7c
0x00e5ec7c
0x00e5ec81
0x00e5ec83
0x00000000
0x00e5ec85
0x00e5ec85
0x00e5ec8c
0x00e5ec92
0x00000000
0x00e5ec94
0x00e5ec94
0x00e5ec9b
0x00e5eca1
0x00000000
0x00e5eca3
0x00e5eca6
0x00e5ecaa
0x00e5ecb0
0x00e5ecb1
0x00e5ecb4
0x00e5ecbc
0x00e5ecbc
0x00e5eca1
0x00e5ec92
0x00e5ec83
0x00e5ece9

APIs

__EH_prolog3_catch.LIBCMT ref: 00E5EC69
make_shared.LIBCPMT ref: 00E5ECB4

Part of subcall function 00E5E945: __EH_prolog3.LIBCMT ref: 00E5E94C

Strings

MOC, xrefs: 00E5EC8C
RCC, xrefs: 00E5EC9B

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: H_prolog3H_prolog3_catchmake_shared
String ID: MOC$RCC
API String ID: 1798871530-2084237596
Opcode ID: c09ca5b87a7535d1d1c59e8f1949ce58d3fac50385c20705b7290e65681bf640
Instruction ID: f113b66c8821732299f85eae78e7d9c25dbe1c5b6f7c6bcfad46dcb6f277bea6
Opcode Fuzzy Hash: c09ca5b87a7535d1d1c59e8f1949ce58d3fac50385c20705b7290e65681bf640
Instruction Fuzzy Hash: 45F04F70610294CFCB16ABA4D54195C7BB0BF41701B8561A5F9087B322CB799F8DCBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E40A09, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00E40A09(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v16;
				void* __ebp;
				signed int _t10;
				void* _t12;
				intOrPtr _t19;
				char* _t20;

				_push(__esi);
				_t19 = _a4;
				if(_t19 == 0) {
					_t20 =  &_v16;
					E00E29D71(_t20, "pScheduler");
					_push(0xe77ff8);
					goto L5;
				} else {
					if( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x1c)) + 8)) == _t19) {
						L6();
						_push(__ecx);
						return E00E3A513(__ebx,  *((intOrPtr*)(__ecx + 0x1c)), __edi, __ecx);
					} else {
						_t20 =  &_v16;
						E00E2F400(_t20);
						_push(0xe78674);
						L5:
						_push( &_v16);
						_t10 = E00E4309B();
						asm("int3");
						_push(_t20);
						asm("lock xadd [ecx+0x4c], eax");
						_t12 = (_t10 | 0xffffffff) - 1;
						if(_t12 == 0) {
							return E00E40A84(_t20);
						}
						return _t12;
					}
				}
			}

0x00e40a0f
0x00e40a12
0x00e40a17
0x00e40a4a
0x00e40a4d
0x00e40a52
0x00000000
0x00e40a19
0x00e40a1f
0x00e40a32
0x00e40a3a
0x00e40a42
0x00e40a21
0x00e40a21
0x00e40a24
0x00e40a29
0x00e40a57
0x00e40a5a
0x00e40a5b
0x00e40a60
0x00e40a64
0x00e40a68
0x00e40a6d
0x00e40a6e
0x00000000
0x00e40a70
0x00e40a76
0x00e40a76
0x00e40a1f

APIs

Concurrency::details::SchedulerProxy::DestroyVirtualProcessorRoot.LIBCONCRT ref: 00E40A3B
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00E40A4D
__CxxThrowException@8.LIBVCRUNTIME ref: 00E40A5B

Strings

pScheduler, xrefs: 00E40A45

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Concurrency::details::DestroyException@8ProcessorProxy::RootSchedulerThrowVirtualstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 1381464787-923244539
Opcode ID: 8b7dad0fa77729f0a61281eb9cb9e867d20d698ac70d8664ab28fdf136380a00
Instruction ID: 1144647260fd87f9b057d2f577a5eaf3c4e5d4d39b0d89c0d0e419f6eed72e92
Opcode Fuzzy Hash: 8b7dad0fa77729f0a61281eb9cb9e867d20d698ac70d8664ab28fdf136380a00
Instruction Fuzzy Hash: 8DF0A035A00314AB8B28FB64F85ACAEB3B85E50704B54A239B55673182DFB0AF05D685

Uniqueness

Uniqueness Score: -1.00%

Function 00E3AD5E, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28
threadCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00E3AD5E(void* __edi, intOrPtr* _a4) {
				char _v16;
				char _v28;
				intOrPtr _v56;
				struct HINSTANCE__* _t12;
				signed short _t13;
				intOrPtr* _t17;
				intOrPtr _t23;
				intOrPtr* _t44;
				WCHAR* _t47;
				void* _t51;
				void* _t53;
				intOrPtr* _t54;

				_t44 = _a4;
				if(_t44 == 0) {
					E00E29D71( &_v16, "pContext");
					E00E4309B( &_v16, 0xe77ff8);
					asm("int3");
					_t51 = _t53;
					_t54 = _t53 - 0x10;
					_t47 = L"combase.dll";
					_t12 = LoadLibraryExW(_t47, 0, 0x800);
					 *0xe7e110 = _t12;
					if(_t12 == 0) {
						_t13 = GetLastError();
						if(_t13 > 0) {
							goto L10;
						}
						goto L11;
					} else {
						if(GetProcAddress(GetModuleHandleW(_t47), "RoInitialize") != 0) {
							_t23 = E00E2EF66(_t22);
							 *_t54 = "RoUninitialize";
							 *0xe7e108 = _t23;
							if(GetProcAddress(GetModuleHandleW(_t47), ??) == 0) {
								goto L5;
							} else {
								 *0xe7e10c = E00E2EF66(_t25);
								 *0xe7e114 = 1;
								return  *0xe7e114;
							}
						} else {
							L5:
							_t13 = GetLastError();
							if(_t13 > 0) {
								L10:
								_t13 = _t13 & 0x0000ffff | 0x80070000;
							}
							L11:
							E00E36E46( &_v28, _t13);
							E00E4309B( &_v28, 0xe783a4);
							asm("int3");
							_t17 = E00E2EF66( *0xe7e108);
							 *0xe63210(_v56, _t47, _t51);
							return  *_t17();
						}
					}
				} else {
					 *0xe63210();
					return E00E40F71( *((intOrPtr*)( *((intOrPtr*)( *_t44 + 8))))());
				}
			}

0x00e3ad66
0x00e3ad6b
0x00e3ad93
0x00e3ada1
0x00e3ada6
0x00e3ada8
0x00e3adaa
0x00e3adb5
0x00e3adbb
0x00e3adc1
0x00e3adc8
0x00e3ae2a
0x00e3ae32
0x00000000
0x00000000
0x00000000
0x00e3adca
0x00e3addf
0x00e3adee
0x00e3adf3
0x00e3adfb
0x00e3ae0f
0x00000000
0x00e3ae11
0x00e3ae17
0x00e3ae25
0x00e3ae29
0x00e3ae29
0x00e3ade1
0x00e3ade1
0x00e3ade1
0x00e3ade9
0x00e3ae34
0x00e3ae37
0x00e3ae37
0x00e3ae3c
0x00e3ae40
0x00e3ae4e
0x00e3ae53
0x00e3ae5e
0x00e3ae6b
0x00e3ae75
0x00e3ae75
0x00e3addf
0x00e3ad6d
0x00e3ad74
0x00e3ad88
0x00e3ad88

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 00E3AD80
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00E3AD93
__CxxThrowException@8.LIBVCRUNTIME ref: 00E3ADA1

Strings

pContext, xrefs: 00E3AD8B

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Concurrency::details::Exception@8FreeIdleProxyProxy::ReturnThreadThrowstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1990795212-2046700901
Opcode ID: e1008e3782de57959bd83623d3b4e0edd2cc60071e9466850e525fa3d304511b
Instruction ID: 894ee4b3ec90f4e394b89eb8c0a0cf18d1a915e1de2c771c5afccd6c78baa22f
Opcode Fuzzy Hash: e1008e3782de57959bd83623d3b4e0edd2cc60071e9466850e525fa3d304511b
Instruction Fuzzy Hash: 08E0D839B0021467CB04F779F859CAEBBADAFC0B54B045135F512B3291DFB0AA06C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00E323DC, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00E323DC(signed int __ebx, void* __edx, void* __edi, void* __esi, void* __fp0, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v16;
				intOrPtr* _v20;
				void* _t27;
				void* _t30;
				void* _t38;
				char* _t39;
				char* _t54;

				_t55 = __esi;
				_t53 = __edi;
				_t35 = __ebx;
				if(_a4 == 0) {
					_push("pScheduler");
					goto L5;
				} else {
					if(_a8 == 0x10000) {
						_push(_a4);
						return E00E2FBC5(__ebx, _t38, __edx, __edi, __esi, __eflags, __fp0);
					} else {
						_push("version");
						L5:
						_t39 =  &_v16;
						E00E29D71(_t39);
						E00E4309B( &_v16, 0xe77ff8);
						asm("int3");
						E00E2C6ED(0xe614dc, _t35, _t53, _t55, 4);
						_t54 = _t39;
						asm("lock xadd [edi+0x4], ebx");
						_t37 = (_t35 | 0xffffffff) == 1;
						if((_t35 | 0xffffffff) == 1) {
							_v20 = 0xe7e104;
							E00E2F212(0xe7e104);
							_v8 = 0;
							_t27 = E00E2EF66( *0xe7e0a0);
							asm("sbb ecx, ecx");
							_v8 = _v8 | 0xffffffff;
							 *0xe7e0a0 =  *0xe7e0a0 &  ~(_t54 - _t27);
							 *0xe7e104 = 0;
							if( *((intOrPtr*)(_t54 + 0x4c)) != 0) {
								_t30 = E00E2E5FD(_t27, _t54 + 0x2c);
								 *((intOrPtr*)(_t54 + 0x28)) = 2;
								_v8 = 1;
								E00E2E743(_t30, _t54 + 0x2c);
								_v8 = _v8 | 0xffffffff;
								SetEvent( *(_t54 + 0x50));
								E00E2EF11( *((intOrPtr*)(_t54 + 0x4c)), 0xffffffff);
							}
							E00E2F439(_t54);
							_push(0x90);
							E00E2C347(_t54);
						}
						return E00E2C6C7(_t37);
					}
				}
			}

0x00e323dc
0x00e323dc
0x00e323dc
0x00e323e6
0x00e32404
0x00000000
0x00e323e8
0x00e323ef
0x00e323f8
0x00e32401
0x00e323f1
0x00e323f1
0x00e32409
0x00e32409
0x00e3240c
0x00e3241a
0x00e3241f
0x00e32427
0x00e3242c
0x00e32431
0x00e32436
0x00e32437
0x00e32442
0x00e32445
0x00e32452
0x00e32455
0x00e32461
0x00e32463
0x00e32467
0x00e3246d
0x00e32476
0x00e3247b
0x00e32480
0x00e3248a
0x00e32491
0x00e32499
0x00e3249d
0x00e324a8
0x00e324ae
0x00e324b1
0x00e324b6
0x00e324bc
0x00e324c2
0x00e324ca
0x00e324ca
0x00e323ef

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00E3240C
__CxxThrowException@8.LIBVCRUNTIME ref: 00E3241A

Strings

version, xrefs: 00E323F1
pScheduler, xrefs: 00E32404

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 1687795959-3154422776
Opcode ID: bce13a637565204930e6166671d8adfab53acbfb62b708dac1425ab2ea1d3db5
Instruction ID: ad33fc44430805d184c367d99272ef2859df5f89c1979a66d436c4cb82956ca3
Opcode Fuzzy Hash: bce13a637565204930e6166671d8adfab53acbfb62b708dac1425ab2ea1d3db5
Instruction Fuzzy Hash: F1E08634540308B6CB18FA64F80EACDBBA49B10745F00E175B56135091D7B49AD9D641

Uniqueness

Uniqueness Score: -1.00%

Function 00E4FEBB, Relevance: 6.3, APIs: 4, Instructions: 321
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00E4FEBB(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				unsigned int _v24;
				signed int _v32;
				signed int _v40;
				char _v48;
				intOrPtr _v56;
				char _v60;
				void* __ebx;
				void* __edi;
				signed char _t85;
				void* _t91;
				signed int _t95;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				signed int _t104;
				signed int _t105;
				void* _t106;
				signed int _t107;
				void* _t108;
				void* _t110;
				void* _t113;
				void* _t115;
				void* _t119;
				signed int* _t120;
				void* _t123;
				signed int _t125;
				signed int _t131;
				signed int* _t132;
				signed int* _t135;
				signed int _t136;
				signed int _t139;
				signed int _t141;
				signed int _t143;
				signed int _t148;
				signed int _t149;
				signed int _t153;
				signed int _t154;
				void* _t158;
				unsigned int _t159;
				signed int _t166;
				void* _t167;
				signed int _t168;
				signed int* _t169;
				signed int _t172;
				signed int _t180;
				signed int _t181;
				signed int _t182;
				signed int _t184;
				signed int _t185;
				signed int _t186;

				_t167 = __edx;
				_t180 = _a24;
				if(_t180 < 0) {
					_t180 = 0;
				}
				_t184 = _a8;
				 *_t184 = 0;
				E00E47456( &_v60, _t167, _a36);
				_t5 = _t180 + 0xb; // 0xb
				_t192 = _a12 - _t5;
				if(_a12 > _t5) {
					_t135 = _a4;
					_t141 = _t135[1];
					_t168 =  *_t135;
					__eflags = (_t141 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t141 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						__eflags = _t141;
						if(__eflags > 0) {
							L14:
							_t169 = _t184 + 1;
							_t85 = _a28 ^ 0x00000001;
							_v20 = 0x3ff;
							_v5 = _t85;
							_v40 = _t169;
							_v32 = ((_t85 & 0x000000ff) << 5) + 7;
							__eflags = _t141 & 0x7ff00000;
							_t91 = 0x30;
							if((_t141 & 0x7ff00000) != 0) {
								 *_t184 = 0x31;
								L19:
								_t143 = 0;
								__eflags = 0;
								L20:
								_t185 =  &(_t169[0]);
								_v16 = _t185;
								__eflags = _t180;
								if(_t180 != 0) {
									_t95 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v56 + 0x88))))));
								} else {
									_t95 = _t143;
								}
								 *_t169 = _t95;
								_t97 = _t135[1] & 0x000fffff;
								__eflags = _t97;
								_v24 = _t97;
								if(_t97 > 0) {
									L25:
									_t170 = _t143;
									_t144 = 0xf0000;
									_t98 = 0x30;
									_v12 = _t98;
									_v16 = _t143;
									_v24 = 0xf0000;
									do {
										__eflags = _t180;
										if(_t180 <= 0) {
											break;
										}
										_t123 = E00E5F330( *_t135 & _t170, _v12, _t135[1] & _t144 & 0x000fffff);
										_t158 = 0x30;
										_t125 = _t123 + _t158 & 0x0000ffff;
										__eflags = _t125 - 0x39;
										if(_t125 > 0x39) {
											_t125 = _t125 + _v32;
											__eflags = _t125;
										}
										_t159 = _v24;
										_t170 = (_t159 << 0x00000020 | _v16) >> 4;
										 *_t185 = _t125;
										_t185 = _t185 + 1;
										_t144 = _t159 >> 4;
										_t98 = _v12 - 4;
										_t180 = _t180 - 1;
										_v16 = (_t159 << 0x00000020 | _v16) >> 4;
										_v24 = _t159 >> 4;
										_v12 = _t98;
										__eflags = _t98;
									} while (_t98 >= 0);
									_v16 = _t185;
									__eflags = _t98;
									if(_t98 < 0) {
										goto L42;
									}
									_t119 = E00E5F330( *_t135 & _t170, _v12, _t135[1] & _t144 & 0x000fffff);
									__eflags = _t119 - 8;
									if(_t119 <= 8) {
										goto L42;
									}
									_t120 = _t185 - 1;
									_t139 = 0x30;
									while(1) {
										_t153 =  *_t120;
										__eflags = _t153 - 0x66;
										if(_t153 == 0x66) {
											goto L35;
										}
										__eflags = _t153 - 0x46;
										if(_t153 != 0x46) {
											_t135 = _a4;
											__eflags = _t120 - _v40;
											if(_t120 == _v40) {
												_t54 = _t120 - 1;
												 *_t54 =  *(_t120 - 1) + 1;
												__eflags =  *_t54;
											} else {
												__eflags = _t153 - 0x39;
												if(_t153 != 0x39) {
													_t154 = _t153 + 1;
													__eflags = _t154;
												} else {
													_t154 = _v32 + 0x3a;
												}
												 *_t120 = _t154;
											}
											goto L42;
										}
										L35:
										 *_t120 = _t139;
										_t120 = _t120 - 1;
									}
								} else {
									__eflags =  *_t135 - _t143;
									if( *_t135 <= _t143) {
										L42:
										__eflags = _t180;
										if(_t180 > 0) {
											_push(_t180);
											_t115 = 0x30;
											_push(_t115);
											_push(_t185);
											E00E43C10(_t180);
											_t185 = _t185 + _t180;
											__eflags = _t185;
											_v16 = _t185;
										}
										_t99 = _v40;
										__eflags =  *_t99;
										if( *_t99 == 0) {
											_t185 = _t99;
											_v16 = _t185;
										}
										 *_t185 = (_v5 << 5) + 0x50;
										_t104 = E00E5F330( *_t135, 0x34, _t135[1]);
										_t186 = 0;
										_t105 = _v16;
										_t148 = (_t104 & 0x000007ff) - _v20;
										__eflags = _t148;
										asm("sbb esi, esi");
										_t172 = _t105 + 2;
										_v40 = _t172;
										if(__eflags < 0) {
											L50:
											_t148 =  ~_t148;
											asm("adc esi, 0x0");
											_t186 =  ~_t186;
											_t136 = 0x2d;
											goto L51;
										} else {
											if(__eflags > 0) {
												L49:
												_t136 = 0x2b;
												L51:
												 *(_t105 + 1) = _t136;
												_t181 = _t172;
												_t106 = 0x30;
												 *_t172 = _t106;
												_t107 = 0;
												__eflags = _t186;
												if(__eflags < 0) {
													L55:
													__eflags = _t181 - _t172;
													if(_t181 != _t172) {
														L59:
														_push(_t136);
														_push(_t107);
														_push(0x64);
														_push(_t186);
														_t108 = E00E5F350();
														_t186 = _t136;
														_t136 = _t148;
														_v32 = _t172;
														_t172 = _v40;
														 *_t181 = _t108 + 0x30;
														_t181 = _t181 + 1;
														_t107 = 0;
														__eflags = 0;
														L60:
														__eflags = _t181 - _t172;
														if(_t181 != _t172) {
															L64:
															_push(_t136);
															_push(_t107);
															_push(0xa);
															_push(_t186);
															_push(_t148);
															_t110 = E00E5F350();
															_v40 = _t172;
															 *_t181 = _t110 + 0x30;
															_t181 = _t181 + 1;
															_t107 = 0;
															__eflags = 0;
															L65:
															_t149 = _t148 + 0x30;
															__eflags = _t149;
															 *_t181 = _t149;
															 *(_t181 + 1) = _t107;
															_t182 = _t107;
															L66:
															if(_v48 != 0) {
																 *(_v60 + 0x350) =  *(_v60 + 0x350) & 0xfffffffd;
															}
															return _t182;
														}
														__eflags = _t186 - _t107;
														if(__eflags < 0) {
															goto L65;
														}
														if(__eflags > 0) {
															goto L64;
														}
														__eflags = _t148 - 0xa;
														if(_t148 < 0xa) {
															goto L65;
														}
														goto L64;
													}
													__eflags = _t186 - _t107;
													if(__eflags < 0) {
														goto L60;
													}
													if(__eflags > 0) {
														goto L59;
													}
													__eflags = _t148 - 0x64;
													if(_t148 < 0x64) {
														goto L60;
													}
													goto L59;
												}
												_t136 = 0x3e8;
												if(__eflags > 0) {
													L54:
													_push(_t136);
													_push(_t107);
													_push(_t136);
													_push(_t186);
													_t113 = E00E5F350();
													_t186 = _t136;
													_t136 = _t148;
													_v32 = _t172;
													_t172 = _v40;
													 *_t172 = _t113 + 0x30;
													_t181 = _t172 + 1;
													_t107 = 0;
													__eflags = 0;
													goto L55;
												}
												__eflags = _t148 - 0x3e8;
												if(_t148 < 0x3e8) {
													goto L55;
												}
												goto L54;
											}
											__eflags = _t148;
											if(_t148 < 0) {
												goto L50;
											}
											goto L49;
										}
									}
									goto L25;
								}
							}
							 *_t184 = _t91;
							_t143 =  *_t135 | _t135[1] & 0x000fffff;
							__eflags = _t143;
							if(_t143 != 0) {
								_v20 = 0x3fe;
								goto L19;
							}
							_v20 = _t143;
							goto L20;
						}
						if(__eflags < 0) {
							L13:
							 *_t184 = 0x2d;
							_t184 = _t184 + 1;
							__eflags = _t184;
							_t141 = _t135[1];
							goto L14;
						}
						__eflags = _t168;
						if(_t168 >= 0) {
							goto L14;
						}
						goto L13;
					}
					_t182 = E00E501D6(_t135, _t141, _t135, _t184, _a12, _a16, _a20, _t180, 0, _a32, 0);
					__eflags = _t182;
					if(_t182 == 0) {
						_t131 = E00E5F4E0(_t184, 0x65);
						__eflags = _t131;
						if(_t131 != 0) {
							_t166 = ((_a28 ^ 0x00000001) << 5) + 0x50;
							__eflags = _t166;
							 *_t131 = _t166;
							 *((char*)(_t131 + 3)) = 0;
						}
						_t182 = 0;
					} else {
						 *_t184 = 0;
					}
					goto L66;
				}
				_t132 = E00E4A071(_t192);
				_t182 = 0x22;
				 *_t132 = _t182;
				E00E4956C();
				goto L66;
			}

0x00e4febb
0x00e4fec6
0x00e4fecb
0x00e4fecd
0x00e4fecd
0x00e4fed1
0x00e4feda
0x00e4fedc
0x00e4fee1
0x00e4fee4
0x00e4fee7
0x00e4fefd
0x00e4ff00
0x00e4ff05
0x00e4ff0f
0x00e4ff14
0x00e4ff68
0x00e4ff6a
0x00e4ff79
0x00e4ff7c
0x00e4ff7f
0x00e4ff81
0x00e4ff88
0x00e4ff9a
0x00e4ff9d
0x00e4ffa2
0x00e4ffa6
0x00e4ffa7
0x00e4ffc7
0x00e4ffca
0x00e4ffca
0x00e4ffca
0x00e4ffcc
0x00e4ffcc
0x00e4ffcf
0x00e4ffd2
0x00e4ffd4
0x00e4ffe5
0x00e4ffd6
0x00e4ffd6
0x00e4ffd6
0x00e4ffe7
0x00e4ffec
0x00e4ffec
0x00e4fff1
0x00e4fff4
0x00e4fffe
0x00e50000
0x00e50002
0x00e50007
0x00e50008
0x00e5000b
0x00e5000e
0x00e50011
0x00e50011
0x00e50013
0x00000000
0x00000000
0x00e5002a
0x00e50031
0x00e50035
0x00e50038
0x00e5003b
0x00e5003d
0x00e5003d
0x00e5003d
0x00e50043
0x00e50046
0x00e5004a
0x00e5004c
0x00e50050
0x00e50053
0x00e50056
0x00e50057
0x00e5005a
0x00e5005d
0x00e50060
0x00e50060
0x00e50065
0x00e50068
0x00e5006b
0x00000000
0x00000000
0x00e50082
0x00e50087
0x00e5008b
0x00000000
0x00000000
0x00e5008f
0x00e50092
0x00e50093
0x00e50093
0x00e50095
0x00e50098
0x00000000
0x00000000
0x00e5009a
0x00e5009d
0x00e500a4
0x00e500a7
0x00e500aa
0x00e500bf
0x00e500bf
0x00e500bf
0x00e500ac
0x00e500ac
0x00e500af
0x00e500b9
0x00e500b9
0x00e500b1
0x00e500b4
0x00e500b4
0x00e500bb
0x00e500bb
0x00000000
0x00e500aa
0x00e5009f
0x00e5009f
0x00e500a1
0x00e500a1
0x00e4fff6
0x00e4fff6
0x00e4fff8
0x00e500c2
0x00e500c2
0x00e500c4
0x00e500c6
0x00e500c9
0x00e500ca
0x00e500cb
0x00e500cc
0x00e500d4
0x00e500d4
0x00e500d6
0x00e500d6
0x00e500d9
0x00e500dc
0x00e500df
0x00e500e1
0x00e500e3
0x00e500e3
0x00e500f0
0x00e500f7
0x00e500fe
0x00e50100
0x00e50109
0x00e50109
0x00e5010c
0x00e5010e
0x00e50111
0x00e50114
0x00e50120
0x00e50120
0x00e50124
0x00e50127
0x00e50129
0x00000000
0x00e50116
0x00e50116
0x00e5011c
0x00e5011c
0x00e5012a
0x00e5012a
0x00e5012d
0x00e50131
0x00e50132
0x00e50134
0x00e50136
0x00e50138
0x00e50162
0x00e50162
0x00e50164
0x00e50171
0x00e50171
0x00e50172
0x00e50173
0x00e50175
0x00e50177
0x00e5017c
0x00e5017e
0x00e50182
0x00e50185
0x00e50188
0x00e5018a
0x00e5018b
0x00e5018b
0x00e5018d
0x00e5018d
0x00e5018f
0x00e5019c
0x00e5019c
0x00e5019d
0x00e5019e
0x00e501a0
0x00e501a1
0x00e501a2
0x00e501ab
0x00e501ae
0x00e501b0
0x00e501b1
0x00e501b1
0x00e501b3
0x00e501b3
0x00e501b3
0x00e501b6
0x00e501b8
0x00e501bb
0x00e501bd
0x00e501c3
0x00e501c8
0x00e501c8
0x00e501d5
0x00e501d5
0x00e50191
0x00e50193
0x00000000
0x00000000
0x00e50195
0x00000000
0x00000000
0x00e50197
0x00e5019a
0x00000000
0x00000000
0x00000000
0x00e5019a
0x00e50166
0x00e50168
0x00000000
0x00000000
0x00e5016a
0x00000000
0x00000000
0x00e5016c
0x00e5016f
0x00000000
0x00000000
0x00000000
0x00e5016f
0x00e5013a
0x00e5013f
0x00e50145
0x00e50145
0x00e50146
0x00e50147
0x00e50148
0x00e5014a
0x00e5014f
0x00e50151
0x00e50153
0x00e50158
0x00e5015b
0x00e5015d
0x00e50160
0x00e50160
0x00000000
0x00e50160
0x00e50141
0x00e50143
0x00000000
0x00000000
0x00000000
0x00e50143
0x00e50118
0x00e5011a
0x00000000
0x00000000
0x00000000
0x00e5011a
0x00e50114
0x00000000
0x00e4fff8
0x00e4fff4
0x00e4ffa9
0x00e4ffb5
0x00e4ffb5
0x00e4ffb7
0x00e4ffbe
0x00000000
0x00e4ffbe
0x00e4ffb9
0x00000000
0x00e4ffb9
0x00e4ff6c
0x00e4ff72
0x00e4ff72
0x00e4ff75
0x00e4ff75
0x00e4ff76
0x00000000
0x00e4ff76
0x00e4ff6e
0x00e4ff70
0x00000000
0x00000000
0x00000000
0x00e4ff70
0x00e4ff2e
0x00e4ff33
0x00e4ff35
0x00e4ff42
0x00e4ff49
0x00e4ff4b
0x00e4ff56
0x00e4ff56
0x00e4ff59
0x00e4ff5b
0x00e4ff5b
0x00e4ff5f
0x00e4ff37
0x00e4ff37
0x00e4ff37
0x00000000
0x00e4ff35
0x00e4fee9
0x00e4fef0
0x00e4fef1
0x00e4fef3
0x00000000

APIs

_strrchr.LIBCMT ref: 00E4FF42

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 66c456fdf5a4dfae377829ebdf4a615e87d5876ad469c89d9505d785f4827a0f
Instruction ID: 6e58d60876282fd2c6a5840dc903ef7ccc256596ef2b43b0c709be229ad80434
Opcode Fuzzy Hash: 66c456fdf5a4dfae377829ebdf4a615e87d5876ad469c89d9505d785f4827a0f
Instruction Fuzzy Hash: 5AB16432A016859FDB15CF28C8817EEBBE5EF45341F1499AAFC44FB282D6348D09CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00E21A70, Relevance: 6.2, APIs: 4, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00E21A70(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				intOrPtr _v44;
				char _v48;
				intOrPtr _v52;
				char _v56;
				intOrPtr _v60;
				intOrPtr* _v64;
				void* __ebp;
				signed int _t54;
				signed int _t55;
				void* _t66;
				void* _t69;
				void* _t71;
				void* _t73;
				void* _t74;
				void* _t82;
				intOrPtr* _t100;
				intOrPtr _t101;
				intOrPtr* _t104;
				intOrPtr _t105;
				signed int _t108;
				void* _t109;
				void* _t112;
				void* _t113;
				void* _t114;
				void* _t115;
				void* _t116;

				_t118 = __eflags;
				_t98 = __edx;
				_t88 = __ebx;
				_push(0xffffffff);
				_push(0xe60855);
				_push( *[fs:0x0]);
				_t54 =  *0xe7b068; // 0x1b9618b6
				_t55 = _t54 ^ _t108;
				_v20 = _t55;
				_push(_t55);
				 *[fs:0x0] =  &_v16;
				_v60 = __ecx;
				_t104 = _a4;
				_push(0x3c);
				_t100 = E00E2C07D(__edx, __eflags);
				_v64 = _t100;
				_v8 = 0;
				 *_t100 =  *_t104;
				 *((intOrPtr*)(_t100 + 4)) = 0;
				 *((intOrPtr*)(_t100 + 8)) = 0;
				 *((intOrPtr*)(_t100 + 4)) =  *((intOrPtr*)(_t104 + 4));
				 *((intOrPtr*)(_t100 + 8)) =  *((intOrPtr*)(_t104 + 8));
				_v44 = _t100;
				 *((intOrPtr*)(_t104 + 4)) = 0;
				 *((intOrPtr*)(_t104 + 8)) = 0;
				_v8 = 1;
				E00E12D00(__edx, _t104 + 0xc);
				_v8 = 2;
				E00E12D00(__edx, _t104 + 0x24);
				_v64 = _t100;
				_v8 = 3;
				asm("xorps xmm0, xmm0");
				_v24 = 0;
				asm("movups [ebp-0x24], xmm0");
				_t66 = E00E2A9A7(_t118,  &_v36);
				_t112 = _t109 - 0x30 + 8;
				_t119 = _t66;
				if(_t66 != 0) {
					E00E2AA76(__ebx, __edx, _t100, _t66);
					_t112 = _t112 + 4;
				}
				asm("xorps xmm0, xmm0");
				asm("movlpd [ebp-0x2c], xmm0");
				_v48 = 1;
				_v44 = _v36;
				_v8 = 4;
				_t69 = E00E2ADE5(_t119,  &_v32, 1);
				_t113 = _t112 + 8;
				if(_t69 != 0) {
					E00E2AA76(_t88, _t98, _t100, _t69);
					_t113 = _t113 + 4;
				}
				asm("xorps xmm0, xmm0");
				asm("movlpd [ebp-0x34], xmm0");
				_v56 = 1;
				_v52 = _v32;
				_v8 = 5;
				_v28 = 0;
				_t71 = E00E2AE38(_v32);
				_t114 = _t113 + 4;
				if(_t71 != 0) {
					E00E2AA76(_t88, _t98, _t100, _t71);
					_t114 = _t114 + 4;
				}
				_v40 = 0xe727b0;
				_v64 = 0;
				_v24 = _t100;
				_v8 = 6;
				_t73 = E00E2B01B(_v60, E00E1EBE0,  &_v40);
				_t115 = _t114 + 0xc;
				_t93 =  !=  ? _t73 : 1;
				if(1 != 0) {
					E00E2AA76(_t88, _t98, _t100, _t93);
					_t115 = _t115 + 4;
				}
				while(_v28 == 0) {
					_t82 = E00E2A9F9(_v36, _v32);
					_t115 = _t115 + 8;
					if(_t82 != 0) {
						E00E2AA76(_t88, _t98, _t100, _t82);
						_t115 = _t115 + 4;
					}
				}
				_t105 = _v24;
				if(_t105 != 0) {
					_t93 = _t105;
					E00E20000(_t88, _t105);
					_push(0x3c);
					E00E2C347(_t105);
					_t115 = _t115 + 8;
				}
				_v8 = 7;
				_t106 = _v32;
				_t101 = _v36;
				_t74 = E00E2AE5D(_v32);
				_t116 = _t115 + 4;
				if(_t74 != 0) {
					E00E2AA76(_t88, _t98, _t101, _t74);
					_t116 = _t116 + 4;
				}
				E00E2ADA1(_t93, _t106);
				E00E2A970(_t93, _t101);
				 *[fs:0x0] = _v16;
				return E00E2C067(_v20 ^ _t108);
			}

0x00e21a70
0x00e21a70
0x00e21a70
0x00e21a73
0x00e21a75
0x00e21a80
0x00e21a84
0x00e21a89
0x00e21a8b
0x00e21a90
0x00e21a94
0x00e21a9a
0x00e21a9d
0x00e21aa0
0x00e21aa7
0x00e21aac
0x00e21aaf
0x00e21ab8
0x00e21aba
0x00e21ac1
0x00e21acb
0x00e21ad1
0x00e21ad4
0x00e21ad7
0x00e21ade
0x00e21ae8
0x00e21af0
0x00e21af8
0x00e21b00
0x00e21b05
0x00e21b0b
0x00e21b12
0x00e21b15
0x00e21b1d
0x00e21b21
0x00e21b26
0x00e21b29
0x00e21b2b
0x00e21b2e
0x00e21b33
0x00e21b33
0x00e21b39
0x00e21b3c
0x00e21b41
0x00e21b45
0x00e21b4b
0x00e21b52
0x00e21b57
0x00e21b5c
0x00e21b5f
0x00e21b64
0x00e21b64
0x00e21b6a
0x00e21b6d
0x00e21b72
0x00e21b76
0x00e21b79
0x00e21b7e
0x00e21b82
0x00e21b87
0x00e21b8c
0x00e21b8f
0x00e21b94
0x00e21b94
0x00e21b97
0x00e21b9e
0x00e21ba5
0x00e21bab
0x00e21bb8
0x00e21bbd
0x00e21bc8
0x00e21bcd
0x00e21bd0
0x00e21bd5
0x00e21bd5
0x00e21bdc
0x00e21be6
0x00e21beb
0x00e21bf0
0x00e21bf3
0x00e21bf8
0x00e21bf8
0x00e21bfb
0x00e21c01
0x00e21c06
0x00e21c08
0x00e21c0a
0x00e21c0f
0x00e21c12
0x00e21c17
0x00e21c17
0x00e21c1a
0x00e21c1e
0x00e21c21
0x00e21c25
0x00e21c2a
0x00e21c2f
0x00e21c32
0x00e21c37
0x00e21c37
0x00e21c3b
0x00e21c41
0x00e21c4f
0x00e21c66

APIs

__Cnd_init.LIBCPMT ref: 00E21B21
__Mtx_init.LIBCPMT ref: 00E21B52
__Thrd_start.LIBCPMT ref: 00E21BB8
__Mtx_unlock.LIBCPMT ref: 00E21C25

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Cnd_initMtx_initMtx_unlockThrd_start
String ID:
API String ID: 2901745279-0
Opcode ID: 8caf987253b1c778e41c3fef42b5d806bfed737fbbaa0d6e0707032fdc34fdff
Instruction ID: 34b65da54cce659f2485220bd91b372b9d164f520112a91322179981a6b3041a
Opcode Fuzzy Hash: 8caf987253b1c778e41c3fef42b5d806bfed737fbbaa0d6e0707032fdc34fdff
Instruction Fuzzy Hash: 1A51B1B1C00258ABDF10DFA4ED41BDFBBF8AF15304F189169E805B3241E775AA44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00E4075A, Relevance: 6.1, APIs: 4, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E00E4075A(void* __ecx, signed int _a4) {
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t28;
				void* _t30;
				void* _t32;
				signed int _t34;
				intOrPtr _t35;
				void* _t39;
				signed int _t47;
				signed int _t49;
				signed int _t50;
				signed int _t52;
				intOrPtr _t56;
				void* _t58;

				if( *((intOrPtr*)(__ecx + 0xc)) != 0xe4081d) {
					_pop(_t60);
					_push(__ecx);
					_t47 = _a4;
					_t28 = _t47 - 4;
					asm("sbb edx, edx");
					_t49 =  ~_t47 & _t28;
					if( *((intOrPtr*)(_t49 + 0x34)) == 0) {
						_push(_t58);
						_t56 =  *((intOrPtr*)(__ecx + 8));
						_t39 = _t49 + 4;
						 *((intOrPtr*)(_t39 + 0x30)) = _t56;
						 *((intOrPtr*)(_t39 + 0x34)) = _t56;
						_v12 =  *((intOrPtr*)(_t56 + 0xc));
						if( *((char*)(__ecx + 0x11)) == 0) {
							_t30 = E00E2E635(_t56 + 0x20, _t49);
							 *((intOrPtr*)(_t56 + 0x30)) =  *((intOrPtr*)(_t56 + 0x30)) + 1;
							E00E2E74F(_t30, _t56 + 0x20);
							_t32 = E00E37298(_v12, _t39, 1);
						} else {
							 *((char*)(_t49 + 0x51)) = 0;
							_push(_t49 + 0x60);
							_t32 = E00E372F1(_t39, _t56 + 0x1c, _t49, _t56, _t58);
						}
						return _t32;
					}
					return _t28;
				} else {
					_pop(_t62);
					_t50 = _a4;
					_t34 = _t50 - 4;
					asm("sbb edx, edx");
					_t52 =  ~_t50 & _t34;
					if( *((intOrPtr*)(_t52 + 0x34)) == 0) {
						_t35 =  *((intOrPtr*)(__ecx + 8));
						 *((intOrPtr*)(_t52 + 0x34)) = _t35;
						 *((intOrPtr*)(_t52 + 0x38)) = _t35;
						asm("sbb edx, edx");
						return E00E37298( *((intOrPtr*)(_t35 + 0xc)),  ~_t52 & _t52 + 0x00000004, 0);
					}
					return _t34;
				}
			}

0x00e40764
0x00e4076c
0x00e407ab
0x00e407ac
0x00e407af
0x00e407b4
0x00e407b6
0x00e407bc
0x00e407bf
0x00e407c1
0x00e407c4
0x00e407ca
0x00e407cd
0x00e407d4
0x00e407d7
0x00e407ee
0x00e407f3
0x00e407f9
0x00e40804
0x00e407d9
0x00e407dc
0x00e407e0
0x00e407e4
0x00e407e4
0x00000000
0x00e4080b
0x00e4080d
0x00e40766
0x00e40766
0x00e40775
0x00e40778
0x00e4077d
0x00e4077f
0x00e40785
0x00e40787
0x00e4078f
0x00e40792
0x00e4079a
0x00000000
0x00e4079f
0x00e407a5
0x00e407a5

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00E407EE
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00E4079F

Part of subcall function 00E37298: SafeRWList.LIBCONCRT ref: 00E372A9

SafeRWList.LIBCONCRT ref: 00E407E4
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00E40804

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Base::Concurrency::details::ContextListSafeStealer$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 336577199-0
Opcode ID: 5d7777ef97c835590c8ba7f496daf67222cc6cd7f30d71285b3355081dac5b09
Instruction ID: 9ecc5e097f068362bda33ece4eade3e22e4f376a3b4ee130d5d840ad6dff3873
Opcode Fuzzy Hash: 5d7777ef97c835590c8ba7f496daf67222cc6cd7f30d71285b3355081dac5b09
Instruction Fuzzy Hash: 8321FF7120420A9FC704EF24D885FA6FBE9BF85318F54E2BAE5055B142D731E999CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 00E3FE31, Relevance: 6.1, APIs: 4, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E00E3FE31(void* __ecx) {
				char _v16;
				int* __ebx;
				int* __edi;
				int* __esi;
				void* __ebp;
				void* _t21;
				char* _t25;
				void* _t29;
				void* _t32;

				_t21 = __ecx;
				if(_t21 == E00E345D8()) {
					_t25 =  &_v16;
					E00E36D6D(_t25);
					_push(0xe79060);
					L9:
					E00E4309B();
					asm("int3");
					 *0xe63210(_t29, _t32, _t21,  &_v16);
					E00E37EA2(5, 4,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t25 + 0x1c)))) + 4))))(),  *((intOrPtr*)(_t25 + 8)));
					return SwitchToThread();
				}
				__edi = __ebx[7];
				__eax =  *__edi;
				__esi =  *( *__edi + 4);
				__ecx = __esi;
				__eax =  *0xe63210();
				__ecx = __edi;
				__eax =  *__esi();
				__ecx = __ebx;
				__eax = E00E37EA2(4, 4,  *__edi, __ebx[2]);
				__eax = __eax | 0xffffffff;
				asm("lock xadd [ebx+0x2c], eax");
				__eax = __eax - 1;
				__edi = __edi;
				__esi = __esi;
				if(__eax != 0) {
					__eax = __eax + 1;
					if(__eax > 1) {
						__ecx =  &_v16;
						__eax = E00E36D7E( &_v16);
						_push(0xe79028);
						goto L9;
					}
				} else {
					__eax = SetEvent(__ebx[0x2a]);
				}
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00e3fe38
0x00e3fe41
0x00e3fe8c
0x00e3fe8f
0x00e3fe94
0x00e3fea8
0x00e3feac
0x00e3feb1
0x00e3fec4
0x00e3fed5
0x00e2ee62
0x00e2ee62
0x00e3fe45
0x00e3fe4b
0x00e3fe4d
0x00e3fe50
0x00e3fe52
0x00e3fe58
0x00e3fe5a
0x00e3fe61
0x00e3fe63
0x00e3fe68
0x00e3fe6b
0x00e3fe70
0x00e3fe71
0x00e3fe72
0x00e3fe73
0x00e3fe84
0x00e3fe88
0x00e3fe9b
0x00e3fe9e
0x00e3fea3
0x00000000
0x00e3fea3
0x00e3fe75
0x00e3fe7b
0x00e3fe7b
0x00e3fe81
0x00e3fe82
0x00e3fe82
0x00e3fe83

APIs

SetEvent.KERNEL32(?,00000000), ref: 00E3FE7B
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00E3FE63

Part of subcall function 00E37EA2: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00E37EC3

__CxxThrowException@8.LIBVCRUNTIME ref: 00E3FEAC
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00E3FED5

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Context$Event$Base::Concurrency::details::$ThrowTrace$Exception@8
String ID:
API String ID: 2630251706-0
Opcode ID: 72086e4a00b454c7300a13f11f8608efd70cf917a67e7b68606c4217fa48a5e0
Instruction ID: 7ff33bcdd6d8383c2a97c54a9710c8fe69ce77cb048157319035bc83619ee659
Opcode Fuzzy Hash: 72086e4a00b454c7300a13f11f8608efd70cf917a67e7b68606c4217fa48a5e0
Instruction Fuzzy Hash: 7A110475B00200ABCB10BF769C8D96E7FA9EF88770F145065FA15B72A3CB709D11CA90

Uniqueness

Uniqueness Score: -1.00%

Function 00E4FD04, Relevance: 6.1, APIs: 4, Instructions: 69
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E00E4FD04(void* __ecx) {
				void* __esi;
				intOrPtr _t2;
				signed int _t3;
				signed int _t13;
				signed int _t18;
				long _t21;

				_t21 = GetLastError();
				_t2 =  *0xe7b2e8; // 0x2
				_t24 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E00E5100B(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t18 = E00E4E623(1, 0x364);
						__eflags = _t18;
						if(__eflags != 0) {
							__eflags = E00E5100B(__eflags,  *0xe7b2e8, _t18);
							if(__eflags != 0) {
								E00E4F9D7(_t21, _t18, 0xe7e730);
								E00E4F1E8(0);
								goto L13;
							} else {
								_t13 = 0;
								E00E5100B(__eflags,  *0xe7b2e8, 0);
								_push(_t18);
								goto L9;
							}
						} else {
							_t13 = 0;
							__eflags = 0;
							E00E5100B(0,  *0xe7b2e8, 0);
							_push(0);
							L9:
							E00E4F1E8();
							goto L4;
						}
					}
				} else {
					_t18 = E00E50FCC(_t24, _t2);
					if(_t18 == 0) {
						_t2 =  *0xe7b2e8; // 0x2
						goto L6;
					} else {
						if(_t18 != 0xffffffff) {
							L13:
							_t13 = _t18;
						} else {
							L3:
							_t13 = 0;
							L4:
							_t18 = _t13;
						}
					}
				}
				SetLastError(_t21);
				asm("sbb edi, edi");
				return  ~_t18 & _t13;
			}

0x00e4fd0f
0x00e4fd11
0x00e4fd16
0x00e4fd19
0x00e4fd37
0x00e4fd3a
0x00e4fd3f
0x00e4fd41
0x00000000
0x00e4fd43
0x00e4fd4f
0x00e4fd53
0x00e4fd55
0x00e4fd7a
0x00e4fd7c
0x00e4fd95
0x00e4fd9c
0x00000000
0x00e4fd7e
0x00e4fd7e
0x00e4fd87
0x00e4fd8c
0x00000000
0x00e4fd8c
0x00e4fd57
0x00e4fd57
0x00e4fd57
0x00e4fd60
0x00e4fd65
0x00e4fd66
0x00e4fd66
0x00000000
0x00e4fd6b
0x00e4fd55
0x00e4fd1b
0x00e4fd21
0x00e4fd25
0x00e4fd32
0x00000000
0x00e4fd27
0x00e4fd2a
0x00e4fda4
0x00e4fda4
0x00e4fd2c
0x00e4fd2c
0x00e4fd2c
0x00e4fd2e
0x00e4fd2e
0x00e4fd2e
0x00e4fd2a
0x00e4fd25
0x00e4fda7
0x00e4fdaf
0x00e4fdb8

APIs

GetLastError.KERNEL32(?,?,?,00E4A076,00E4F5B0,?,?,00E2C097,?,?,00E1108B,00000008), ref: 00E4FD09
_free.LIBCMT ref: 00E4FD66
_free.LIBCMT ref: 00E4FD9C
SetLastError.KERNEL32(00000000,00000002,000000FF,?,?,?,00E4A076,00E4F5B0,?,?,00E2C097,?,?,00E1108B,00000008), ref: 00E4FDA7

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 5d0a825623c4e5691f2ae0606ad5f6d40d46c87828d184ef767221adde796cd0
Instruction ID: fd9f4f8ae00248ae0448e14abdb520877bbcc1c79536dd2d5f4d3bac711dab37
Opcode Fuzzy Hash: 5d0a825623c4e5691f2ae0606ad5f6d40d46c87828d184ef767221adde796cd0
Instruction Fuzzy Hash: 21114C31A011412ED6217676BC89F2F259ADBC1B76B252734F518F61F2DF218C494124

Uniqueness

Uniqueness Score: -1.00%

Function 00E42870, Relevance: 6.0, APIs: 4, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 81%

			E00E42870(void* __ecx, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v8;
				char _v20;
				void* _t11;
				void* _t18;
				void* _t28;

				_t26 = _a8;
				_t18 = __ecx;
				_t11 = E00E34841(_a8, 0,  *((intOrPtr*)(_t26 + 0x78)),  &_v8);
				while(1) {
					_t28 = _t11;
					if(_t28 == 0) {
						break;
					}
					if(_t28 == _a12) {
						L3:
						_t11 = E00E34E4E(_t26,  &_v8, 0);
						continue;
					}
					E00E4277C(_t28,  *((intOrPtr*)(_t18 + 0x10)),  *((intOrPtr*)(_t18 + 0x14)));
					if(E00E428DF(_t28) != 0) {
						E00E413C9( &_v20, _t14);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						return 1;
					}
					goto L3;
				}
				return 0;
			}

0x00e42879
0x00e4287c
0x00e4288a
0x00e428bb
0x00e428bb
0x00e428bf
0x00000000
0x00000000
0x00e42894
0x00e428ae
0x00e428b6
0x00000000
0x00e428b6
0x00e4289e
0x00e428ac
0x00e428ce
0x00e428da
0x00e428db
0x00e428dc
0x00000000
0x00e428dc
0x00000000
0x00e428ac
0x00000000

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00E4288A
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00E4289E
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00E428B6
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00E428CE

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction ID: bcb686b59fb7378fdeb53b5555ad51f477622cd81ad6471913f46be661235e06
Opcode Fuzzy Hash: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction Fuzzy Hash: C201F932600114A7CF19EE59E845EEF7BDDAF98350F411069FE11BB282DA70ED10D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00E38618, Relevance: 6.0, APIs: 4, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00E38618(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20) {
				intOrPtr _t19;
				void* _t20;
				intOrPtr _t25;

				_t19 =  *((intOrPtr*)(0xe670a8 + (_a16 * 6 + _a20) * 4));
				_t25 = _t19;
				if(_t25 == 0) {
					_t20 = E00E388FB(_a4, _a8, _a12);
					goto L10;
				} else {
					if(_t25 <= 0) {
						L8:
						return 0;
					} else {
						if(_t19 <= 2) {
							_t20 = E00E388FB(_a4, _a8, _a12);
							goto L10;
						} else {
							if(_t19 == 3) {
								_t20 = E00E388FB(_a4, _a8, _a12);
								goto L10;
							} else {
								if(_t19 + 0xfffffffc > 1) {
									goto L8;
								} else {
									_t20 = E00E388FB(_a4, _a8, _a12);
									L10:
									return _t20;
								}
							}
						}
					}
				}
			}

0x00e38622
0x00e38629
0x00e3862b
0x00e3867e
0x00000000
0x00e3862d
0x00e3862d
0x00e38671
0x00e38674
0x00e3862f
0x00e38632
0x00e3866a
0x00000000
0x00e38634
0x00e38637
0x00e3865a
0x00000000
0x00e38639
0x00e3863f
0x00000000
0x00e38641
0x00e3864a
0x00e38683
0x00e38687
0x00e38687
0x00e3863f
0x00e38637
0x00e38632
0x00e3862d

APIs

std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00E3864A
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00E3865A
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00E3866A
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00E3867E

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Compare_exchange_acquire_4std::_
String ID:
API String ID: 3973403980-0
Opcode ID: 61f6f711efced6ebe2e3a989f9433902b6955eb8b54e56de0c7250eae215e2e8
Instruction ID: 1b861cc2cff33b434a01a60b137c2db95aecffefc8ba164b089c9a7832505dd5
Opcode Fuzzy Hash: 61f6f711efced6ebe2e3a989f9433902b6955eb8b54e56de0c7250eae215e2e8
Instruction Fuzzy Hash: 31011936000349BBCF129E54EE0A8AD3F66BF44354F58A415FD58A4071DB33CA70EB85

Uniqueness

Uniqueness Score: -1.00%

Function 00E2FB5E, Relevance: 6.0, APIs: 4, Instructions: 39
threadCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 71%

			E00E2FB5E(void* __ecx, void* __edx, void* __edi, void* __esi) {
				char _v20;
				intOrPtr _t5;
				signed short _t6;
				void* _t9;
				void* _t19;

				_t19 = __ecx;
				_t5 = E00E2F025(__edx, __edi, 0, 0x10000, E00E30964, __ecx, 0, 0);
				 *((intOrPtr*)(_t19 + 0x4c)) = _t5;
				if(_t5 == 0) {
					_t6 = GetLastError();
					if(_t6 > 0) {
						_t6 = _t6 & 0x0000ffff | 0x80070000;
					}
					E00E36E46( &_v20, _t6);
					_t9 = E00E4309B( &_v20, 0xe783a4);
					asm("int3");
					return _t9;
				} else {
					_push(0xf);
					return E00E2EDFB(_t5);
				}
			}

0x00e2fb69
0x00e2fb77
0x00e2fb7f
0x00e2fb85
0x00e2fb93
0x00e2fb9b
0x00e2fba0
0x00e2fba0
0x00e2fba9
0x00e2fbb7
0x00e2fbbc
0x00e2fbbd
0x00e2fb87
0x00e2fb87
0x00e2fb92
0x00e2fb92

APIs

Concurrency::details::LoadLibraryAndCreateThread.LIBCONCRT ref: 00E2FB77

Part of subcall function 00E2F025: ___crtGetTimeFormatEx.LIBCMT ref: 00E2F03B
Part of subcall function 00E2F025: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00E2F05A

GetLastError.KERNEL32 ref: 00E2FB93
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00E2FBA9
__CxxThrowException@8.LIBVCRUNTIME ref: 00E2FBB7

Part of subcall function 00E2EDFB: SetThreadPriority.KERNEL32(?,?), ref: 00E2EE07

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Concurrency::details::LibraryLoadThread$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorException@8FormatLastPriorityReferenceThrowTime___crt
String ID:
API String ID: 1674182817-0
Opcode ID: 3d67baf3c5c7d7ef6d7403a5aa186fb80c5bae7b0cf58a4d4db2e07eafbadf32
Instruction ID: 1d92a279d449f463971e470fbca84d4245fb73413bada9223a648c966774679b
Opcode Fuzzy Hash: 3d67baf3c5c7d7ef6d7403a5aa186fb80c5bae7b0cf58a4d4db2e07eafbadf32
Instruction Fuzzy Hash: B0F082719003357AE720B676AC0BFBB3AEC9F00754F401839B445F6182EDA4D90486B0

Uniqueness

Uniqueness Score: -1.00%

Function 00E5DBF7, Relevance: 6.0, APIs: 4, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00E5DBF7(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0xe7ba70, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E00E5DBE0();
					E00E5DBA2();
					_t13 = WriteConsoleW( *0xe7ba70, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x00e5dc14
0x00e5dc18
0x00e5dc25
0x00e5dc2a
0x00e5dc45
0x00e5dc45
0x00e5dc4b

APIs

WriteConsoleW.KERNEL32(00E49317,00E2A1E4,?,00000000,00E49317,?,00E5A2F6,00E49317,00000001,00E49317,00E49317,?,00E4EB6E,00000000,8304488B,00E49317), ref: 00E5DC0E
GetLastError.KERNEL32(?,00E5A2F6,00E49317,00000001,00E49317,00E49317,?,00E4EB6E,00000000,8304488B,00E49317,00000000,00E49317,?,00E4F0C2,00000010), ref: 00E5DC1A

Part of subcall function 00E5DBE0: CloseHandle.KERNEL32(FFFFFFFE,00E5DC2A,?,00E5A2F6,00E49317,00000001,00E49317,00E49317,?,00E4EB6E,00000000,8304488B,00E49317,00000000,00E49317), ref: 00E5DBF0

___initconout.LIBCMT ref: 00E5DC2A

Part of subcall function 00E5DBA2: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00E5DBD1,00E5A2E3,00E49317,?,00E4EB6E,00000000,8304488B,00E49317,00000000), ref: 00E5DBB5

WriteConsoleW.KERNEL32(00E49317,00E2A1E4,?,00000000,?,00E5A2F6,00E49317,00000001,00E49317,00E49317,?,00E4EB6E,00000000,8304488B,00E49317,00000000), ref: 00E5DC3F

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c0d44308a7aec9788710fec4c62f8b68b1da7cf1298f1081f0c3e60f63487821
Instruction ID: 37734dd3035268a876a38bb4c3e5aa4cfa98511bc530098c30d13b04a2d7ccd2
Opcode Fuzzy Hash: c0d44308a7aec9788710fec4c62f8b68b1da7cf1298f1081f0c3e60f63487821
Instruction Fuzzy Hash: 28F03036404118FFCF726FA2EC09A8A7F66FB483A2B015411FE09B5130D772C968DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E2ED67, Relevance: 6.0, APIs: 4, Instructions: 29
registryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 51%

			E00E2ED67(void* __ebx, void* __edi, void* __esi, long* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _v0;
				char _v8;
				char _v24;
				void* __ebp;
				char* _t12;
				signed short _t13;
				intOrPtr* _t22;
				void* _t27;
				void* _t31;
				void* _t32;

				_t32 = __esi;
				_t31 = __edi;
				_t27 = __ebx;
				_t12 =  &_v8;
				__imp__RegisterWaitForSingleObject(_t12, _a4, _a8, _a12, 0xffffffff, 0xc);
				if(_t12 == 0) {
					_t13 = GetLastError();
					if(_t13 > 0) {
						_t13 = _t13 & 0x0000ffff | 0x80070000;
					}
					E00E36E46( &_v24, _t13);
					E00E4309B( &_v24, 0xe783a4);
					asm("int3");
					if(E00E31290(_t27, _t31, _t32) < 4) {
						SetThreadAffinityMask(_v0,  *_a4);
					} else {
						_t22 = E00E2EF66( *0xe7e078);
						 *0xe63210(_v0, _a4, 0, _t32);
						 *_t22();
					}
					return 1;
				} else {
					return _v8;
				}
			}

0x00e2ed67
0x00e2ed67
0x00e2ed67
0x00e2ed6d
0x00e2ed7e
0x00e2ed86
0x00e2ed8d
0x00e2ed95
0x00e2ed9a
0x00e2ed9a
0x00e2eda3
0x00e2edb1
0x00e2edb6
0x00e2edc2
0x00e2edf0
0x00e2edc4
0x00e2edcb
0x00e2eddd
0x00e2ede3
0x00e2ede5
0x00e2edfa
0x00e2ed88
0x00e2ed8c
0x00e2ed8c

APIs

RegisterWaitForSingleObject.KERNEL32 ref: 00E2ED7E
GetLastError.KERNEL32(?,?,?,?,?,00E34C1B,?), ref: 00E2ED8D
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00E2EDA3
__CxxThrowException@8.LIBVCRUNTIME ref: 00E2EDB1

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastObjectRegisterSingleThrowWait
String ID:
API String ID: 3803302727-0
Opcode ID: ff53b20f95ecd5cf13bb771e43055b71fb073616de5b164cf5465b6e113d2e17
Instruction ID: 21ed6ab676a2d9d84b1738ced805bae37d5faa1f8fbdfdfccc19e2f3af63ba6e
Opcode Fuzzy Hash: ff53b20f95ecd5cf13bb771e43055b71fb073616de5b164cf5465b6e113d2e17
Instruction Fuzzy Hash: 73F08C3450021ABBCB00EFB5DD09EAB3BA96F00750F104610B521F10D0DA30D6089760

Uniqueness

Uniqueness Score: -1.00%

Function 00E2EA8C, Relevance: 6.0, APIs: 4, Instructions: 28
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 87%

			E00E2EA8C(void* __eflags, DWORD* _a4) {
				long _v0;
				void* _v4;
				_Unknown_base(*)()* _v8;
				long _v12;
				struct _SECURITY_ATTRIBUTES* _v16;
				char _v20;
				void* _t12;
				signed short _t13;

				_t12 = E00E2B5F6(0, 0, (_a4 & 0x000000ff) + (_a4 & 0x000000ff), 0x1f0002);
				if(_t12 == 0) {
					_t13 = GetLastError();
					if(_t13 > 0) {
						_t13 = _t13 & 0x0000ffff | 0x80070000;
					}
					E00E36E46( &_v20, _t13);
					E00E4309B( &_v20, 0xe783a4);
					asm("int3");
					return CreateThread(_v16, _v12, _v8, _v4, _v0, _a4);
				} else {
					return _t12;
				}
			}

0x00e2eaa2
0x00e2eaac
0x00e2eab0
0x00e2eab8
0x00e2eabd
0x00e2eabd
0x00e2eac6
0x00e2ead4
0x00e2ead9
0x00e2eaf6
0x00e2eaaf
0x00e2eaaf
0x00e2eaaf

APIs

___crtCreateEventExW.LIBCPMT ref: 00E2EAA2
GetLastError.KERNEL32(?,?,?,?,00000000,?,?), ref: 00E2EAB0
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00E2EAC6
__CxxThrowException@8.LIBVCRUNTIME ref: 00E2EAD4

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorEventException@8LastThrow___crt
String ID:
API String ID: 200240550-0
Opcode ID: b628a4af8e4d2cf8a43cd5c58e6de10b7843109c95974f218400a2097516c157
Instruction ID: d2ce978f805142846c46ac8012800b6c79fda76708c349096e618308bdb29fd8
Opcode Fuzzy Hash: b628a4af8e4d2cf8a43cd5c58e6de10b7843109c95974f218400a2097516c157
Instruction Fuzzy Hash: 03E0DFA1A402297AE710F6BAAC4BF7B3ADC6B00B84F442814B919F41C2FE64D6088171

Uniqueness

Uniqueness Score: -1.00%

Function 00E3591B, Relevance: 6.0, APIs: 4, Instructions: 26
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E00E3591B(void* __ecx, void* __eflags) {
				char _v20;
				long _t5;
				signed short _t6;
				int _t10;

				E00E2E72C();
				 *0xe7e0d8 = E00E2EE68();
				_t5 = TlsAlloc();
				 *0xe7e13c = _t5;
				if(_t5 == 0xffffffff) {
					_t6 = GetLastError();
					if(_t6 > 0) {
						_t6 = _t6 & 0x0000ffff | 0x80070000;
					}
					E00E36E46( &_v20, _t6);
					E00E4309B( &_v20, 0xe783a4);
					asm("int3");
					_t10 = TlsFree( *0xe7e13c);
					 *0xe7e13c =  *0xe7e13c & 0x00000000;
					return _t10;
				} else {
					return _t5;
				}
			}

0x00e3591b
0x00e35925
0x00e400c1
0x00e400c7
0x00e400cf
0x00e400d3
0x00e400db
0x00e400e0
0x00e400e0
0x00e400e9
0x00e400f7
0x00e400fc
0x00e40103
0x00e40109
0x00e40110
0x00e400d1
0x00e400d2
0x00e400d2

APIs

Part of subcall function 00E2EE68: TlsAlloc.KERNEL32(00000000,?,?), ref: 00E2EE6E

TlsAlloc.KERNEL32(00000000,?,?), ref: 00E400C1
GetLastError.KERNEL32 ref: 00E400D3
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00E400E9
__CxxThrowException@8.LIBVCRUNTIME ref: 00E400F7

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Alloc$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3735082963-0
Opcode ID: 57761946615e91223cb06f29c509f6da26878fa462e6f27d0b7e8097cd6f00dd
Instruction ID: 8167ce4103be8781aa28b4ea9151c6f530dec1194feb7338f66246b465a094a2
Opcode Fuzzy Hash: 57761946615e91223cb06f29c509f6da26878fa462e6f27d0b7e8097cd6f00dd
Instruction Fuzzy Hash: ADE09230400225AEC310FB76BC4E66F36E86F04394F502E25F125F12A1EA74910C8B61

Uniqueness

Uniqueness Score: -1.00%

Function 00E2ECA3, Relevance: 6.0, APIs: 4, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 47%

			E00E2ECA3(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v0;
				char _v8;
				long _v12;
				long _v16;
				char _v24;
				void* __ebp;
				char* _t12;
				signed short _t13;
				intOrPtr* _t26;
				void* _t31;
				char* _t32;
				intOrPtr* _t33;
				void* _t36;
				void* _t37;

				_t37 = __esi;
				_t36 = __edi;
				_t31 = __ebx;
				_t12 =  &_v8;
				__imp__GetNumaHighestNodeNumber(_t12);
				if(_t12 == 0) {
					_t13 = GetLastError();
					if(_t13 > 0) {
						_t13 = _t13 & 0x0000ffff | 0x80070000;
					}
					_t32 =  &_v24;
					E00E36E46(_t32, _t13);
					E00E4309B( &_v24, 0xe783a4);
					asm("int3");
					_push(_t32);
					_push(_t32);
					if(E00E31290(_t31, _t36, _t37) < 4) {
						GetProcessAffinityMask(GetCurrentProcess(),  &_v12,  &_v16);
						_t33 = _a4;
						 *((short*)(_t33 + 4)) = 0;
						 *_t33 = _v12;
					} else {
						_t26 = E00E2EF66( *0xe7e07c);
						 *0xe63210(_v0, _a4, _t37);
						 *_t26();
					}
					return 1;
				} else {
					return _v8;
				}
			}

0x00e2eca3
0x00e2eca3
0x00e2eca3
0x00e2eca9
0x00e2ecad
0x00e2ecb5
0x00e2ecbc
0x00e2ecc4
0x00e2ecc9
0x00e2ecc9
0x00e2eccf
0x00e2ecd2
0x00e2ece0
0x00e2ece5
0x00e2ece9
0x00e2ecea
0x00e2ecf3
0x00e2ed26
0x00e2ed2c
0x00e2ed31
0x00e2ed38
0x00e2ecf5
0x00e2ecfc
0x00e2ed0c
0x00e2ed12
0x00e2ed14
0x00e2ed3e
0x00e2ecb7
0x00e2ecbb
0x00e2ecbb

APIs

GetNumaHighestNodeNumber.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,00000000,?), ref: 00E2ECAD
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,00000000,?,?), ref: 00E2ECBC
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00E2ECD2
__CxxThrowException@8.LIBVCRUNTIME ref: 00E2ECE0

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8HighestLastNodeNumaNumberThrow
String ID:
API String ID: 3016159387-0
Opcode ID: db310c27e4164ebd61449c50195f915c0a3d0ca12598058f6505aa0cba828504
Instruction ID: 48570022f5e71b6633b1291ac51d0adc91c4b5e93041a8df2b3c283318ca173f
Opcode Fuzzy Hash: db310c27e4164ebd61449c50195f915c0a3d0ca12598058f6505aa0cba828504
Instruction Fuzzy Hash: E7E04874A00119ABC710EBB5EE4ADAF77EC5F00645F501454B005F1151EB64DB088761

Uniqueness

Uniqueness Score: -1.00%

Function 00E2EDFB, Relevance: 6.0, APIs: 4, Instructions: 23
threadCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 87%

			E00E2EDFB(void* _a4, int _a8) {
				int _v4;
				long _v8;
				void* _v12;
				void* _v16;
				char _v20;
				int _t9;
				signed short _t10;

				_t9 = SetThreadPriority(_a4, _a8);
				if(_t9 == 0) {
					_t10 = GetLastError();
					if(_t10 > 0) {
						_t10 = _t10 & 0x0000ffff | 0x80070000;
					}
					E00E36E46( &_v20, _t10);
					E00E4309B( &_v20, 0xe783a4);
					asm("int3");
					return SignalObjectAndWait(_v16, _v12, _v8, _v4);
				} else {
					return _t9;
				}
			}

0x00e2ee07
0x00e2ee0f
0x00e2ee13
0x00e2ee1b
0x00e2ee20
0x00e2ee20
0x00e2ee29
0x00e2ee37
0x00e2ee3c
0x00e2ee53
0x00e2ee12
0x00e2ee12
0x00e2ee12

APIs

SetThreadPriority.KERNEL32(?,?), ref: 00E2EE07
GetLastError.KERNEL32 ref: 00E2EE13
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00E2EE29
__CxxThrowException@8.LIBVCRUNTIME ref: 00E2EE37

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastPriorityThreadThrow
String ID:
API String ID: 4286982218-0
Opcode ID: bfce4e10d8791a39356e567ee04e55d7c411e7fa3c4186ed2db478d9bb989db3
Instruction ID: 5821eb6d43203271f071bc523b97df4be13d4c0a23b90c94953b8114f874a6d2
Opcode Fuzzy Hash: bfce4e10d8791a39356e567ee04e55d7c411e7fa3c4186ed2db478d9bb989db3
Instruction Fuzzy Hash: 38E08634500129BBCB11BF76ED09ABB3BAD7F00744F405414B415F41A1EF74D6188661

Uniqueness

Uniqueness Score: -1.00%

Function 00E2EEC1, Relevance: 6.0, APIs: 4, Instructions: 23
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 63%

			E00E2EEC1(long _a4, void* _a8) {
				intOrPtr _v16;
				char _v20;
				int _t6;
				signed short _t7;
				void* _t10;
				void* _t13;

				_t6 = TlsSetValue(_a4, _a8);
				if(_t6 == 0) {
					_t7 = GetLastError();
					if(_t7 > 0) {
						_t7 = _t7 & 0x0000ffff | 0x80070000;
					}
					E00E36E46( &_v20, _t7);
					_t10 = E00E4309B( &_v20, 0xe783a4);
					asm("int3");
					__imp__UnregisterWait(_v16, _t13);
					return _t10;
				} else {
					return _t6;
				}
			}

0x00e2eecd
0x00e2eed5
0x00e2eed9
0x00e2eee1
0x00e2eee6
0x00e2eee6
0x00e2eeef
0x00e2eefd
0x00e2ef02
0x00e2ef09
0x00e2ef10
0x00e2eed8
0x00e2eed8
0x00e2eed8

APIs

TlsSetValue.KERNEL32(?,00000000,00E33FC3,00000000,?,?,?,?), ref: 00E2EECD
GetLastError.KERNEL32 ref: 00E2EED9
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00E2EEEF
__CxxThrowException@8.LIBVCRUNTIME ref: 00E2EEFD

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrowValue
String ID:
API String ID: 1964976909-0
Opcode ID: 7229f412edc41f1b2233ef95869bf33e61a440ae272aaec77081be6e5a5320b0
Instruction ID: 6c89e5ba37976ff9189705b7915490620c8fb5b0cfff49dca6acd9258bbd5338
Opcode Fuzzy Hash: 7229f412edc41f1b2233ef95869bf33e61a440ae272aaec77081be6e5a5320b0
Instruction Fuzzy Hash: A6E08634500129BBCB11FF76EC49ABB3BAD6F00744F445414F415F00A1EB75D61C9650

Uniqueness

Uniqueness Score: -1.00%

Function 00E2EE68, Relevance: 6.0, APIs: 4, Instructions: 21
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 87%

			E00E2EE68() {
				long _v16;
				char _v20;
				long _t4;
				signed short _t5;

				_t4 = TlsAlloc();
				if(_t4 == 0xffffffff) {
					_t5 = GetLastError();
					if(_t5 > 0) {
						_t5 = _t5 & 0x0000ffff | 0x80070000;
					}
					E00E36E46( &_v20, _t5);
					E00E4309B( &_v20, 0xe783a4);
					asm("int3");
					return TlsFree(_v16);
				} else {
					return _t4;
				}
			}

0x00e2ee6e
0x00e2ee77
0x00e2ee7b
0x00e2ee83
0x00e2ee88
0x00e2ee88
0x00e2ee91
0x00e2ee9f
0x00e2eea4
0x00e2eeb2
0x00e2ee7a
0x00e2ee7a
0x00e2ee7a

APIs

TlsAlloc.KERNEL32(00000000,?,?), ref: 00E2EE6E
GetLastError.KERNEL32 ref: 00E2EE7B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00E2EE91
__CxxThrowException@8.LIBVCRUNTIME ref: 00E2EE9F

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3103352999-0
Opcode ID: 5e308c4bfe7cf9a5934bd6e63cf5f784352a7cacadfc59b2cf65bfa325b64186
Instruction ID: e669b9413b9cf10bdfe67b364af9b33cc9b845f7164d6c533ee8e1fff018eb49
Opcode Fuzzy Hash: 5e308c4bfe7cf9a5934bd6e63cf5f784352a7cacadfc59b2cf65bfa325b64186
Instruction Fuzzy Hash: 41E01234500129AAD710FB7AAD4EA7F36AE7F00755F901A14F035F11E1EB64D50D86A1

Uniqueness

Uniqueness Score: -1.00%

Function 00E20B60, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 169
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E00E20B60(void* __ebx, signed int __edx, void* __eflags, signed int* _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				char _v44;
				signed int _v48;
				char _v60;
				signed int* _v64;
				char _v92;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t39;
				signed int _t40;
				signed int _t42;
				signed int _t48;
				signed int _t50;
				intOrPtr _t62;
				intOrPtr _t65;
				char* _t75;
				void* _t85;
				signed int _t87;
				signed int _t88;
				signed int _t90;
				char _t92;
				signed int* _t95;
				signed int _t96;
				signed int _t99;
				void* _t101;
				signed int _t103;
				void* _t104;

				_t87 = __edx;
				_t74 = __ebx;
				_push(0xffffffff);
				_push(0xe606c1);
				_push( *[fs:0x0]);
				_t39 =  *0xe7b068; // 0x1b9618b6
				_t40 = _t39 ^ _t99;
				_v20 = _t40;
				_push(_t88);
				_push(_t40);
				 *[fs:0x0] =  &_v16;
				_t95 = _a4;
				asm("xorps xmm0, xmm0");
				_v8 = 0;
				_v64 = _t95;
				_v48 = 0;
				asm("movups [esi], xmm0");
				_push(0x7800);
				 *_t95 = 0;
				_t95[1] = 0;
				_t95[2] = 0;
				_t95[3] = 0;
				_t42 = E00E495D8();
				_t103 = _t101 - 0x30 + 4;
				 *_t95 = _t42;
				if(_t42 == 0) {
					_push("malloc failed.");
					goto L12;
				} else {
					E00E43C10(_t88, _t42, 0, 0x7800);
					_t104 = _t103 + 0xc;
					_t95[2] = 0x7800;
					_v8 = 0;
					_v48 = 1;
					E00E20750(__ebx, _t87,  &_v44, _a8, 0);
					_v8 = 1;
					_t88 = _v28;
					if(_t95[2] >= _t88) {
						L4:
						_t92 = _v44;
						_t57 =  >=  ? _t92 :  &_v44;
						E00E43110(_t95[1] +  *_t95,  >=  ? _t92 :  &_v44, _v28);
						_t103 = _t104 + 0xc;
						E00E17D10(_t74, _t95, _t92, _v28);
						_t62 = _v24;
						if(_t62 < 0x10) {
							L10:
							 *[fs:0x0] = _v16;
							return E00E2C067(_v20 ^ _t99);
						} else {
							_t28 = _t62 + 1; // 0x11
							_t85 = _t28;
							_t65 = _t92;
							if(_t85 < 0x1000) {
								L9:
								_push(_t85);
								E00E2C347(_t92);
								goto L10;
							} else {
								_t88 =  *(_t92 - 4);
								_t75 = _t85 + 0x23;
								if(_t65 - _t88 + 0xfffffffc > 0x1f) {
									goto L13;
								} else {
									goto L9;
								}
							}
						}
					} else {
						_push(_t88);
						_push( *_t95);
						_t87 = E00E495CD();
						_t103 = _t104 + 8;
						if(_t87 == 0) {
							_push("reaclloc failed.");
							L12:
							_t75 =  &_v60;
							E00E11560(_t75, _t95);
							E00E4309B( &_v60, 0xe79e34);
							L13:
							E00E4957C(_t74, _t75, _t87, _t88, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t99);
							_push(0xffffffff);
							_push(0xe606f0);
							_push( *[fs:0x0]);
							_push(_t95);
							_push(_t88);
							_t48 =  *0xe7b068; // 0x1b9618b6
							_push(_t48 ^ _t103);
							_t50 =  &_v92;
							 *[fs:0x0] = _t50;
							_t96 =  *(_t75 + 4);
							__eflags = _t96;
							if(_t96 != 0) {
								_t90 = _t88 | 0xffffffff;
								__eflags = _t90;
								_t50 = _t90;
								asm("lock xadd [esi+0x4], eax");
								if(_t90 == 0) {
									_t50 =  *((intOrPtr*)( *_t96))();
									asm("lock xadd [esi+0x8], edi");
									__eflags = _t90 == 1;
									if(_t90 == 1) {
										_t50 =  *((intOrPtr*)( *_t96 + 4))();
									}
								}
							}
							 *[fs:0x0] = _v20;
							return _t50;
						} else {
							 *_t95 = _t87;
							E00E43C10(_t88, _t95[1] + _t87, 0, _t88 - _t95[1]);
							_t104 = _t103 + 0xc;
							_t95[2] = _t88;
							goto L4;
						}
					}
				}
			}

0x00e20b60
0x00e20b60
0x00e20b63
0x00e20b65
0x00e20b70
0x00e20b74
0x00e20b79
0x00e20b7b
0x00e20b7f
0x00e20b80
0x00e20b84
0x00e20b8a
0x00e20b8d
0x00e20b90
0x00e20b97
0x00e20b9a
0x00e20ba1
0x00e20ba4
0x00e20ba9
0x00e20baf
0x00e20bb6
0x00e20bbd
0x00e20bc4
0x00e20bc9
0x00e20bcc
0x00e20bd0
0x00e20cc4
0x00000000
0x00e20bd6
0x00e20bde
0x00e20be3
0x00e20be6
0x00e20bf5
0x00e20bfd
0x00e20c04
0x00e20c09
0x00e20c10
0x00e20c16
0x00e20c44
0x00e20c4e
0x00e20c51
0x00e20c5b
0x00e20c60
0x00e20c68
0x00e20c6d
0x00e20c73
0x00e20ca5
0x00e20caa
0x00e20cc1
0x00e20c75
0x00e20c75
0x00e20c75
0x00e20c78
0x00e20c80
0x00e20c9b
0x00e20c9b
0x00e20c9d
0x00000000
0x00e20c82
0x00e20c82
0x00e20c85
0x00e20c90
0x00000000
0x00e20c92
0x00000000
0x00e20c92
0x00e20c90
0x00e20c80
0x00e20c18
0x00e20c18
0x00e20c19
0x00e20c20
0x00e20c22
0x00e20c27
0x00e20c94
0x00e20cc9
0x00e20cc9
0x00e20ccc
0x00e20cda
0x00e20cdf
0x00e20cdf
0x00e20ce4
0x00e20ce5
0x00e20ce6
0x00e20ce7
0x00e20ce8
0x00e20ce9
0x00e20cea
0x00e20ceb
0x00e20cec
0x00e20ced
0x00e20cee
0x00e20cef
0x00e20cf0
0x00e20cf3
0x00e20cf5
0x00e20d00
0x00e20d01
0x00e20d02
0x00e20d03
0x00e20d0a
0x00e20d0b
0x00e20d0e
0x00e20d14
0x00e20d17
0x00e20d19
0x00e20d1b
0x00e20d1b
0x00e20d1e
0x00e20d20
0x00e20d25
0x00e20d2b
0x00e20d2d
0x00e20d32
0x00e20d33
0x00e20d39
0x00e20d39
0x00e20d33
0x00e20d25
0x00e20d3f
0x00e20d4c
0x00e20c29
0x00e20c30
0x00e20c39
0x00e20c3e
0x00e20c41
0x00000000
0x00e20c41
0x00e20c27
0x00e20c16

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00E20CDA

Strings

malloc failed., xrefs: 00E20CC4
reaclloc failed., xrefs: 00E20C94

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Exception@8Throw
String ID: malloc failed.$reaclloc failed.
API String ID: 2005118841-654047535
Opcode ID: 7a35bcc5216a4715c61c7a90b0669f92977d51e9dce29085a9a5d4be4748a696
Instruction ID: 9699772b96689d9c262f0865ceee5346befb7b82c97a28fb2a05cc398ae89077
Opcode Fuzzy Hash: 7a35bcc5216a4715c61c7a90b0669f92977d51e9dce29085a9a5d4be4748a696
Instruction Fuzzy Hash: 6B51D271A002149BDB10DF58DC45B9EBBF8EF44724F248929F459B7381DB75A944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E4BFB5, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00E4BFB5(void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				char* _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				char* _t26;
				intOrPtr* _t36;
				signed int _t37;
				signed int _t40;
				char _t42;
				signed int _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr _t48;
				signed int _t49;
				signed int _t54;
				void* _t57;
				intOrPtr* _t58;
				void* _t59;
				signed int _t64;
				signed int _t66;

				_t57 = __edx;
				_t48 = _a4;
				if(_t48 != 0) {
					__eflags = _t48 - 2;
					if(_t48 == 2) {
						L5:
						_push(_t59);
						E00E567F9(_t48, _t57, _t59);
						E00E56246(_t57, 0, 0xe7e3b8, 0x104);
						_t26 =  *0xe7e500; // 0xc63330
						 *0xe7e4f0 = 0xe7e3b8;
						_v20 = _t26;
						__eflags = _t26;
						if(_t26 == 0) {
							L7:
							_t26 = 0xe7e3b8;
							_v20 = 0xe7e3b8;
							L8:
							_v8 = 0;
							_v16 = 0;
							_t64 = E00E4C266(E00E4C0ED( &_v8, _t26, 0, 0,  &_v8,  &_v16), _v8, _v16, 1);
							__eflags = _t64;
							if(__eflags != 0) {
								E00E4C0ED( &_v8, _v20, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
								__eflags = _t48 - 1;
								if(_t48 != 1) {
									_v12 = 0;
									_push( &_v12);
									_t49 = E00E56174(_t48, 0, _t64, _t64);
									__eflags = _t49;
									if(_t49 == 0) {
										_t58 = _v12;
										_t54 = 0;
										_t36 = _t58;
										__eflags =  *_t58;
										if( *_t58 == 0) {
											L17:
											_t37 = 0;
											 *0xe7e4f4 = _t54;
											_v12 = 0;
											_t49 = 0;
											 *0xe7e4f8 = _t58;
											L18:
											E00E4F1E8(_t37);
											_v12 = 0;
											L19:
											E00E4F1E8(_t64);
											_t40 = _t49;
											L20:
											return _t40;
										} else {
											goto L16;
										}
										do {
											L16:
											_t36 = _t36 + 4;
											_t54 = _t54 + 1;
											__eflags =  *_t36;
										} while ( *_t36 != 0);
										goto L17;
									}
									_t37 = _v12;
									goto L18;
								}
								_t42 = _v8 - 1;
								__eflags = _t42;
								 *0xe7e4f4 = _t42;
								_t43 = _t64;
								_t64 = 0;
								 *0xe7e4f8 = _t43;
								L12:
								_t49 = 0;
								goto L19;
							}
							_t44 = E00E4A071(__eflags);
							_push(0xc);
							_pop(0);
							 *_t44 = 0;
							goto L12;
						}
						__eflags =  *_t26;
						if( *_t26 != 0) {
							goto L8;
						}
						goto L7;
					}
					__eflags = _t48 - 1;
					if(__eflags == 0) {
						goto L5;
					}
					_t45 = E00E4A071(__eflags);
					_t66 = 0x16;
					 *_t45 = _t66;
					E00E4956C();
					_t40 = _t66;
					goto L20;
				}
				return 0;
			}

0x00e4bfb5
0x00e4bfbe
0x00e4bfc3
0x00e4bfcd
0x00e4bfd0
0x00e4bfed
0x00e4bfed
0x00e4bfee
0x00e4c001
0x00e4c006
0x00e4c00e
0x00e4c014
0x00e4c017
0x00e4c019
0x00e4c020
0x00e4c020
0x00e4c022
0x00e4c025
0x00e4c028
0x00e4c02f
0x00e4c048
0x00e4c04d
0x00e4c04f
0x00e4c070
0x00e4c078
0x00e4c07b
0x00e4c096
0x00e4c099
0x00e4c0a0
0x00e4c0a4
0x00e4c0a6
0x00e4c0ad
0x00e4c0b0
0x00e4c0b2
0x00e4c0b4
0x00e4c0b6
0x00e4c0c0
0x00e4c0c0
0x00e4c0c2
0x00e4c0c8
0x00e4c0cb
0x00e4c0cd
0x00e4c0d3
0x00e4c0d4
0x00e4c0da
0x00e4c0dd
0x00e4c0de
0x00e4c0e4
0x00e4c0e7
0x00000000
0x00000000
0x00000000
0x00000000
0x00e4c0b8
0x00e4c0b8
0x00e4c0b8
0x00e4c0bb
0x00e4c0bc
0x00e4c0bc
0x00000000
0x00e4c0b8
0x00e4c0a8
0x00000000
0x00e4c0a8
0x00e4c080
0x00e4c080
0x00e4c081
0x00e4c086
0x00e4c088
0x00e4c08a
0x00e4c08f
0x00e4c08f
0x00000000
0x00e4c08f
0x00e4c051
0x00e4c056
0x00e4c058
0x00e4c059
0x00000000
0x00e4c059
0x00e4c01b
0x00e4c01e
0x00000000
0x00000000
0x00000000
0x00e4c01e
0x00e4bfd2
0x00e4bfd5
0x00000000
0x00000000
0x00e4bfd7
0x00e4bfde
0x00e4bfdf
0x00e4bfe1
0x00e4bfe6
0x00000000
0x00e4bfe6
0x00000000

Strings

C:\Users\user\Desktop\HttpToUsbBridge.exe, xrefs: 00E4BFF8, 00E4BFFF, 00E4C035

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\HttpToUsbBridge.exe
API String ID: 0-917528041
Opcode ID: 0add4d402c1667ccb2093dec4d99ecac2d95a8af5fce782afcf749cd632469ac
Instruction ID: b4ae6267b04a86bba325b6149ee134ec65615837bf549394e34003a8acb16644
Opcode Fuzzy Hash: 0add4d402c1667ccb2093dec4d99ecac2d95a8af5fce782afcf749cd632469ac
Instruction Fuzzy Hash: F8418271A01218EFCB25DB99EC81DAEBBF8EB89714F2410A6F414F7351E7718A44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E3A14C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00E3A14C(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v60;
				intOrPtr _v68;
				intOrPtr _t41;
				void* _t51;
				intOrPtr _t56;
				intOrPtr _t58;
				intOrPtr _t59;
				char* _t62;
				intOrPtr _t66;
				intOrPtr _t74;
				intOrPtr _t75;
				intOrPtr* _t77;
				intOrPtr _t78;
				intOrPtr* _t79;
				intOrPtr _t83;

				_t77 = _a4;
				_t55 = __ecx;
				if(_t77 == 0) {
					_t62 =  &_v20;
					E00E29D71(_t62, "pContext");
					E00E4309B( &_v20, 0xe77ff8);
					asm("int3");
					_t41 = _t62;
					_t74 = 0;
					_v68 = _t41;
					_v60 = 0;
					if( *((intOrPtr*)(_t41 + 0xc0)) > 0) {
						_t56 = 0;
						_push(_t77);
						_v28 = 0;
						do {
							_t83 = 0;
							_t66 =  *((intOrPtr*)(_t41 + 0x10)) + _t56;
							_v20 = 0;
							_v16 = _t66;
							if( *((intOrPtr*)(_t66 + 4)) > 0) {
								_t75 = 0;
								_v12 = 0;
								do {
									_t58 =  *((intOrPtr*)( *((intOrPtr*)(_t66 + 0x30)) + _t75 + 0x10));
									if(_t58 == 0) {
										_t59 = 0;
									} else {
										_t59 =  *((intOrPtr*)(_t58 + 0x38));
									}
									if(_t59 != 0) {
										do {
											_t44 =  *((intOrPtr*)(_t66 + 0x30));
											_t78 = _t59;
											if(_t59 ==  *((intOrPtr*)( *((intOrPtr*)(_t66 + 0x30)) + _t75 + 0x10))) {
												_t59 = 0;
											} else {
												_t59 =  *((intOrPtr*)(_t59 + 0x38));
											}
											_t79 =  *((intOrPtr*)(_t78 + 0x1c));
											E00E40A61(_t44, _t79);
											 *0xe63210();
											 *((intOrPtr*)( *((intOrPtr*)( *_t79 + 0x24))))();
											_t66 = _v16;
											_t75 = _v12;
										} while (_t59 != 0);
										_t83 = _v20;
									}
									_t83 = _t83 + 1;
									_t75 = _t75 + 0x34;
									_v20 = _t83;
									_v12 = _t75;
								} while (_t83 <  *((intOrPtr*)(_t66 + 4)));
								_t41 = _v32;
								_t74 = _v24;
								_t56 = _v28;
							}
							_t74 = _t74 + 1;
							_t56 = _t56 + 0x34;
							_v24 = _t74;
							_v28 = _t56;
						} while (_t74 <  *((intOrPtr*)(_t41 + 0xc0)));
					}
					_push(0x838);
					return E00E2C347( *((intOrPtr*)(_t41 + 0x38)));
				} else {
					 *0xe63210();
					_t51 =  *((intOrPtr*)( *((intOrPtr*)( *_t77 + 8))))();
					if(_t51 == 0) {
						 *0xe63210(_t77);
						_t51 =  *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0x1c))))();
					}
					return _t51;
				}
			}

0x00e3a155
0x00e3a158
0x00e3a15c
0x00e3a191
0x00e3a194
0x00e3a1a2
0x00e3a1a7
0x00e3a1ae
0x00e3a1b0
0x00e3a1b2
0x00e3a1b5
0x00e3a1be
0x00e3a1c6
0x00e3a1c8
0x00e3a1c9
0x00e3a1cc
0x00e3a1cf
0x00e3a1d1
0x00e3a1d3
0x00e3a1d6
0x00e3a1dc
0x00e3a1de
0x00e3a1e0
0x00e3a1e3
0x00e3a1e6
0x00e3a1ec
0x00e3a1f3
0x00e3a1ee
0x00e3a1ee
0x00e3a1ee
0x00e3a1f7
0x00e3a1f9
0x00e3a1f9
0x00e3a1fc
0x00e3a202
0x00e3a209
0x00e3a204
0x00e3a204
0x00e3a204
0x00e3a20b
0x00e3a210
0x00e3a21c
0x00e3a224
0x00e3a226
0x00e3a229
0x00e3a22c
0x00e3a230
0x00e3a230
0x00e3a233
0x00e3a234
0x00e3a237
0x00e3a23a
0x00e3a23d
0x00e3a242
0x00e3a245
0x00e3a248
0x00e3a248
0x00e3a24b
0x00e3a24c
0x00e3a24f
0x00e3a252
0x00e3a255
0x00e3a263
0x00e3a264
0x00e3a274
0x00e3a15e
0x00e3a165
0x00e3a16d
0x00e3a171
0x00e3a17b
0x00e3a183
0x00e3a183
0x00e3a189
0x00e3a189

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00E3A194
__CxxThrowException@8.LIBVCRUNTIME ref: 00E3A1A2

Strings

pContext, xrefs: 00E3A18C

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1687795959-2046700901
Opcode ID: f8100dacf412a4309623b4f2bba26420347eb06c6e3a971111a2fc75049c7454
Instruction ID: 5f5ecf8d7b5662adf77e2170290315957d313a5e3ff0874cb21567773011f97d
Opcode Fuzzy Hash: f8100dacf412a4309623b4f2bba26420347eb06c6e3a971111a2fc75049c7454
Instruction Fuzzy Hash: 53418C75B012149FCB04DFA9D8C496EBBB5BF84314F1890B9E551B7312CB70AE82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E17D10, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E00E17D10(void* __ebx, intOrPtr* __ecx, void* __edi, intOrPtr _a4) {
				char _v16;
				signed char _v36;
				void* __esi;
				intOrPtr _t28;
				intOrPtr _t33;
				intOrPtr _t36;
				intOrPtr _t40;
				intOrPtr* _t41;
				intOrPtr _t45;
				intOrPtr _t47;
				intOrPtr* _t50;
				intOrPtr* _t51;
				void* _t56;
				void* _t61;

				_t50 = __ecx;
				_t47 = _a4;
				_t45 =  *((intOrPtr*)(__ecx + 0xc));
				if(_t45 < _t47) {
					 *((intOrPtr*)(__ecx + 0xc)) = _t47;
					_t45 = _t47;
				}
				_t40 =  *((intOrPtr*)(_t50 + 4));
				_t36 =  *((intOrPtr*)(_t50 + 8));
				if(_t40 + _t47 > _t36) {
					_push("invalid argument.");
					goto L9;
				} else {
					_t61 = _t36 - _t40 - _t47 - _t45;
					if(_t61 >= 0) {
						L6:
						_t28 = _t40 + _t47;
						 *((intOrPtr*)(_t50 + 4)) = _t28;
						return _t28;
					} else {
						_push( ~(0 | _t61 > 0x00000000) | _t36 + 0x00007800);
						_push( *_t50);
						_t33 = E00E495CD();
						_t56 = _t56 + 8;
						if(_t33 == 0) {
							_push("reaclloc failed.");
							L9:
							_t41 =  &_v16;
							E00E11560(_t41, _t50);
							E00E4309B( &_v16, 0xe79e34);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t50);
							_t51 = _t41;
							 *_t51 = 0xe723a4;
							if((_v36 & 0x00000001) != 0) {
								_push(0x14);
								E00E2C347(_t51);
							}
							return _t51;
						} else {
							 *_t50 = _t33;
							E00E43C10(_t47,  *((intOrPtr*)(_t50 + 4)) + _t33 + _t47, 0, 0x7800);
							_t40 =  *((intOrPtr*)(_t50 + 4));
							 *((intOrPtr*)(_t50 + 8)) =  *((intOrPtr*)(_t50 + 8)) + 0x7800;
							goto L6;
						}
					}
				}
			}

0x00e17d18
0x00e17d1b
0x00e17d1e
0x00e17d23
0x00e17d25
0x00e17d28
0x00e17d28
0x00e17d2a
0x00e17d2d
0x00e17d35
0x00e17d98
0x00000000
0x00e17d37
0x00e17d3d
0x00e17d3f
0x00e17d82
0x00e17d82
0x00e17d86
0x00e17d8e
0x00e17d41
0x00e17d50
0x00e17d51
0x00e17d53
0x00e17d58
0x00e17d5d
0x00e17d91
0x00e17d9d
0x00e17d9d
0x00e17da0
0x00e17dae
0x00e17db3
0x00e17db4
0x00e17db5
0x00e17db6
0x00e17db7
0x00e17db8
0x00e17db9
0x00e17dba
0x00e17dbb
0x00e17dbc
0x00e17dbd
0x00e17dbe
0x00e17dbf
0x00e17dc7
0x00e17dc8
0x00e17dca
0x00e17dd0
0x00e17dd2
0x00e17dd5
0x00e17dda
0x00e17de1
0x00e17d5f
0x00e17d69
0x00e17d70
0x00e17d75
0x00e17d7b
0x00000000
0x00e17d7b
0x00e17d5d
0x00e17d3f

APIs

Part of subcall function 00E11560: ___std_exception_copy.LIBVCRUNTIME ref: 00E11592

__CxxThrowException@8.LIBVCRUNTIME ref: 00E17DAE

Part of subcall function 00E4309B: RaiseException.KERNEL32(?,?,?,00E2CB67,?,?,?,?,?,?,?,?,00E2CB67,?,00E781E4), ref: 00E430FB

Strings

invalid argument., xrefs: 00E17D98
reaclloc failed., xrefs: 00E17D91

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow___std_exception_copy
String ID: invalid argument.$reaclloc failed.
API String ID: 640887848-1666685858
Opcode ID: 79c7bd51ffeb0c85f04b10526a5f665638f5b05dc19b4f7d78b57e1eb565b9c0
Instruction ID: fa0453c8cdbcd89168974128a0e88fec0b1f0d14bb3131b90ca79d7c8a8e6e57
Opcode Fuzzy Hash: 79c7bd51ffeb0c85f04b10526a5f665638f5b05dc19b4f7d78b57e1eb565b9c0
Instruction Fuzzy Hash: 892138717443096BC720DA64EC81EAAB3E9DF50714F24843DE989E3241E7B0FD84C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00E50862, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00E50862(void* __eflags, intOrPtr* _a4) {
				void* _t15;
				intOrPtr _t19;
				intOrPtr _t24;
				intOrPtr _t32;
				intOrPtr* _t33;
				intOrPtr* _t34;

				_t34 = _a4;
				if(E00E5A117(E00E4E19B(_t34)) == 0) {
					L11:
					return 0;
				}
				_t15 = E00E48597(1);
				_t24 = 2;
				if(_t34 != _t15) {
					if(_t34 != E00E48597(_t24)) {
						goto L11;
					}
					_t33 = 0xe7e72c;
					L5:
					 *0xe7e23c =  *0xe7e23c + 1;
					if(( *(_t34 + 0xc) & 0x000004c0) != 0) {
						goto L11;
					}
					asm("lock or [ecx], eax");
					_t19 =  *_t33;
					if(_t19 != 0) {
						L10:
						 *((intOrPtr*)(_t34 + 4)) = _t19;
						 *_t34 =  *_t33;
						 *((intOrPtr*)(_t34 + 8)) = 0x1000;
						 *((intOrPtr*)(_t34 + 0x18)) = 0x1000;
						L9:
						return 1;
					}
					 *_t33 = E00E4F56D(0x1000);
					E00E4F1E8(0);
					_t19 =  *_t33;
					if(_t19 != 0) {
						goto L10;
					}
					_t32 = _t34 + 0x14;
					 *((intOrPtr*)(_t34 + 8)) = _t24;
					 *((intOrPtr*)(_t34 + 4)) = _t32;
					 *_t34 = _t32;
					 *((intOrPtr*)(_t34 + 0x18)) = _t24;
					goto L9;
				}
				_t33 = 0xe7e728;
				goto L5;
			}

0x00e50869
0x00e5087d
0x00e5090e
0x00000000
0x00e5090e
0x00e50885
0x00e5088d
0x00e50890
0x00e508a2
0x00000000
0x00000000
0x00e508a4
0x00e508a9
0x00e508a9
0x00e508ba
0x00000000
0x00000000
0x00e508c1
0x00e508c4
0x00e508c8
0x00e508f7
0x00e508f7
0x00e508fc
0x00e508fe
0x00e50905
0x00e508f3
0x00000000
0x00e508f3
0x00e508d6
0x00e508d8
0x00e508dd
0x00e508e3
0x00000000
0x00000000
0x00e508e5
0x00e508e8
0x00e508eb
0x00e508ee
0x00e508f0
0x00000000
0x00e508f0
0x00e50892
0x00000000

APIs

_free.LIBCMT ref: 00E508D8

Strings

,, xrefs: 00E508A4
(, xrefs: 00E50892

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: _free
String ID: ($,
API String ID: 269201875-1242805649
Opcode ID: 3e5efbb34c2a6b51bce318a93df4cc99d9b1ce1563c4d1bec33d19ef687db582
Instruction ID: 334577246d269c6b1b3e0cb8345d2d8ee8930ac7c86e9a42e553218d0aac0641
Opcode Fuzzy Hash: 3e5efbb34c2a6b51bce318a93df4cc99d9b1ce1563c4d1bec33d19ef687db582
Instruction Fuzzy Hash: B711E6711013028FF3249F29E441B56B7E8EF88365F20682EF899E7342DB71E9848790

Uniqueness

Uniqueness Score: -1.00%

Function 00E2B79A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000D,?,ios_base::failbit set,?,00E298AB,00000001,?,00E1201A,00000000,?,00E11667,00E7EA04,00E178A0,00E7EA34,?,00E1201A), ref: 00E2B81E

Strings

ios_base::failbit set, xrefs: 00E2B79D

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: ErrorLast
String ID: ios_base::failbit set
API String ID: 1452528299-3924258884
Opcode ID: 6179656328c174dd6a0f95ae7d34fd7c9a795da6e3fee9d5953c5053f195df24
Instruction ID: 345d9881bc9ef3deecc932033fd38e2825bc6a7ea13c66f153a6338360ec21ba
Opcode Fuzzy Hash: 6179656328c174dd6a0f95ae7d34fd7c9a795da6e3fee9d5953c5053f195df24
Instruction Fuzzy Hash: 2C11C232200125AFDF129F62FC485AAB765BF48754F00803AFA19A6260DB7098149B90

Uniqueness

Uniqueness Score: -1.00%

Function 00E25EF0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29
threadCOMMON

Download Yara Rule

C-Code - Quality: 18%

			E00E25EF0(void* __ecx, void* __edi, void* __eflags) {
				void* __ebp;
				intOrPtr _t9;
				void* _t10;
				char* _t12;
				void* _t14;
				void* _t17;
				void* _t19;

				_push(__ecx);
				_t17 = __ecx;
				E00E20EA0(_t10, __ecx, _t14, __edi);
				_t12 = _t19 - 0x18;
				 *((intOrPtr*)(_t12 + 0x10)) = 0;
				 *((intOrPtr*)(_t12 + 0x14)) = 0xf;
				 *_t12 = 0;
				E00E14C40(_t10, _t12, _t14, "Socket::CloseListenSocket", 0x19);
				_push(GetCurrentThreadId());
				E00E12260(_t10, 0x138, _t14, __edi);
				_t9 =  *((intOrPtr*)(_t17 + 8));
				if(_t9 != 0xffffffff) {
					__imp__#3(_t9);
					 *((intOrPtr*)(_t17 + 8)) = 0xffffffff;
				}
				return _t9;
			}

0x00e25ef3
0x00e25ef5
0x00e25ef7
0x00e25eff
0x00e25f03
0x00e25f0a
0x00e25f16
0x00e25f19
0x00e25f23
0x00e25f29
0x00e25f2e
0x00e25f37
0x00e25f3a
0x00e25f40
0x00e25f40
0x00e25f4b

APIs

Part of subcall function 00E20EA0: __Mtx_unlock.LIBCPMT ref: 00E20F3F

GetCurrentThreadId.KERNEL32 ref: 00E25F1E
closesocket.WS2_32(?), ref: 00E25F3A

Strings

Socket::CloseListenSocket, xrefs: 00E25F11

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: CurrentMtx_unlockThreadclosesocket
String ID: Socket::CloseListenSocket
API String ID: 145399429-2896332649
Opcode ID: 2b4df23b5fd9a1c6f804208dcbfa85423de7def01d1ab6459c58c02404079109
Instruction ID: ff276dac7fb1df7b2e21fea6d2b0f3283de1b523bf4f07667c89c00862b2c109
Opcode Fuzzy Hash: 2b4df23b5fd9a1c6f804208dcbfa85423de7def01d1ab6459c58c02404079109
Instruction Fuzzy Hash: BBF0E5B01053045BD6247B7DEC067663AD89F42328F14178DF968AB3D3CEB6855143E2

Uniqueness

Uniqueness Score: -1.00%

Function 00E25F50, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29
threadCOMMON

Download Yara Rule

C-Code - Quality: 18%

			E00E25F50(void* __ecx, void* __edi, void* __eflags) {
				void* __ebp;
				intOrPtr _t9;
				void* _t10;
				char* _t12;
				void* _t14;
				void* _t17;
				void* _t19;

				_push(__ecx);
				_t17 = __ecx;
				E00E20EA0(_t10, __ecx, _t14, __edi);
				_t12 = _t19 - 0x18;
				 *((intOrPtr*)(_t12 + 0x10)) = 0;
				 *((intOrPtr*)(_t12 + 0x14)) = 0xf;
				 *_t12 = 0;
				E00E14C40(_t10, _t12, _t14, "Socket::CloseServerSocket", 0x19);
				_push(GetCurrentThreadId());
				E00E12260(_t10, 0x142, _t14, __edi);
				_t9 =  *((intOrPtr*)(_t17 + 0xc));
				if(_t9 != 0xffffffff) {
					__imp__#3(_t9);
					 *((intOrPtr*)(_t17 + 0xc)) = 0xffffffff;
				}
				return _t9;
			}

0x00e25f53
0x00e25f55
0x00e25f57
0x00e25f5f
0x00e25f63
0x00e25f6a
0x00e25f76
0x00e25f79
0x00e25f83
0x00e25f89
0x00e25f8e
0x00e25f97
0x00e25f9a
0x00e25fa0
0x00e25fa0
0x00e25fab

APIs

Part of subcall function 00E20EA0: __Mtx_unlock.LIBCPMT ref: 00E20F3F

GetCurrentThreadId.KERNEL32 ref: 00E25F7E
closesocket.WS2_32(?), ref: 00E25F9A

Strings

Socket::CloseServerSocket, xrefs: 00E25F71

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: CurrentMtx_unlockThreadclosesocket
String ID: Socket::CloseServerSocket
API String ID: 145399429-3112096289
Opcode ID: e9923093749deb76336a876165bece195cd7c36b64721fae4b2b64000b185fb4
Instruction ID: 080f8fd521070553c874f75885a49ff1f4fa9a110661cb59fb777d0135075059
Opcode Fuzzy Hash: e9923093749deb76336a876165bece195cd7c36b64721fae4b2b64000b185fb4
Instruction Fuzzy Hash: DDF0A0B01053045BD6247B7DEC06B6A3A989B02338F54578DF868AB3D3CABA956147E2

Uniqueness

Uniqueness Score: -1.00%

Function 00E3D9FE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00E3D9FE(void* __ecx, intOrPtr _a4) {
				intOrPtr _v12;
				signed int _v16;
				char _v24;
				intOrPtr _t11;
				void* _t14;
				signed int* _t16;
				signed int* _t19;

				_t11 = _a4;
				if(_t11 == 0) {
					_t16 =  &_v16;
					E00E29D71(_t16, "pThreadProxy");
					_t14 = E00E4309B( &_v16, 0xe77ff8);
					asm("int3");
					_t19 = _t16;
					if( *((intOrPtr*)(_t19 + 0x2c)) == 0) {
						_v16 = _v16 & 0x00000000;
						_v12 = 0xe2f24e;
						do {
							_t14 = E00E2D985( &_v24);
						} while ( *((intOrPtr*)(_t19 + 0x2c)) == 0);
					}
					return _t14;
				} else {
					 *((intOrPtr*)(__ecx + 0x9c)) = _t11;
					return _t11;
				}
			}

0x00e3da01
0x00e3da09
0x00e3da1a
0x00e3da1d
0x00e3da2b
0x00e3da30
0x00e3da38
0x00e3da3e
0x00e3da40
0x00e3da44
0x00e3da4b
0x00e3da4e
0x00e3da53
0x00e3da4b
0x00e3da5b
0x00e3da0b
0x00e3da0b
0x00e3da12
0x00e3da12

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00E3DA1D
__CxxThrowException@8.LIBVCRUNTIME ref: 00E3DA2B

Strings

pThreadProxy, xrefs: 00E3DA15

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pThreadProxy
API String ID: 1687795959-3651400591
Opcode ID: bcc27e224213a5ca5b0fd038b78de4587fb8267c0186957a70c0a39c4a0016c1
Instruction ID: ee15c8b80cd5a3101e68049760a559a743243e50f8a73d7c2a86bca4a093bdb1
Opcode Fuzzy Hash: bcc27e224213a5ca5b0fd038b78de4587fb8267c0186957a70c0a39c4a0016c1
Instruction Fuzzy Hash: 03D05E31A0430866CB00EBB5E94AD8E77E85B00748F40A575B915B6182EF70E609CA50

Uniqueness

Uniqueness Score: -1.00%

Function 00E2A025, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00E2A025(intOrPtr _a4) {
				char _v20;

				E00E29E43( &_v20, _a4);
				E00E4309B( &_v20, 0xe78100);
				asm("int3");
				return "bad function call";
			}

0x00e2a031
0x00e2a03f
0x00e2a044
0x00e2a04a

APIs

std::regex_error::regex_error.LIBCPMT ref: 00E2A031
__CxxThrowException@8.LIBVCRUNTIME ref: 00E2A03F

Part of subcall function 00E4309B: RaiseException.KERNEL32(?,?,?,00E2CB67,?,?,?,?,?,?,?,?,00E2CB67,?,00E781E4), ref: 00E430FB

Strings

bad function call, xrefs: 00E2A045

Memory Dump Source

Source File: 00000000.00000002.475778268.0000000000E11000.00000020.00020000.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.475765072.0000000000E10000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475910325.0000000000E63000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.475977870.0000000000E7B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.475998907.0000000000E7C000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.476008710.0000000000E7D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.476026303.0000000000E7F000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_HttpToUsbBridge.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::regex_error::regex_error
String ID: bad function call
API String ID: 1019185057-3612616537
Opcode ID: 05d1c36a919de689583889f00293894d79eeb60e6ea467a1a9e85119415dede1
Instruction ID: 1ca800770fc5983f5120ffefc45a4a16fb70619b66b7e2dab97b601a8bd88e71
Opcode Fuzzy Hash: 05d1c36a919de689583889f00293894d79eeb60e6ea467a1a9e85119415dede1
Instruction Fuzzy Hash: 8CC0123884021C678B05F6F4ED0B8AEB7ACAE40340FC43855752072142EF7097158690

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report HttpToUsbBridge.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Jbx Signature Overview

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Malware Analysis System Evasion:

Anti Debugging:

Language, Device and Operating System Detection:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: HttpToUsbBridge.exe PID: 6440 Parent PID: 1124

General

File Activities

File Opened

File Created

File Attributes Queried

Volume Information Queried

Device IO